0

Hello guys, I explain my problem, i recently learn about socket programming and i want to do a simple "exploit" maybe the easiest shellcode exercise. In order to be precise i'll put below the source code of the vulnerable program running on the remote server, on a specific port.

#include <unistd.h>
#include <stdio.h>

typedef void (*func)(void);

int main(void)
{
    char input[4096];
    char* output = "My favorite shell is /bin/sh";

    puts(output);
    printf("[DEBUG] foobar: execve=%p input=%p output=%p\n",
        execve, input, output);

    read(0, input, 4096);
    ((func)&input)();

    return 0;
}

It's a school's ctf exercise the goal is to get a flag. As i'm new in that kind of exercise, first i tried to exploit the program locally. I succeeded with a techniques i just learned (port binding 1337). Here are the steps:

# ./shellcode.sh | ./program 
My favorite shell is /bin/sh
[DEBUG] foobar: execve=0x80483c0 input=0xff8aed4c output=0x80485d0

on a different shell i can then do:

# nc localhost 1337
id
uid=0(root) gid=0(root) groups=0(root)

I got a shell, yeah that's cool but there is no flag here ! Now i to get a shell on the server.

If i understood well the source code, the vulnerable program executed what you put as input. I disassembled the main:

(gdb) disas main
Dump of assembler code for function main:
   0x080484bc <+0>: push   %ebp
   0x080484bd <+1>: mov    %esp,%ebp
   0x080484bf <+3>: and    $0xfffffff0,%esp
   0x080484c2 <+6>: sub    $0x1020,%esp
   0x080484c8 <+12>:    movl   $0x80485d0,0x101c(%esp)
   0x080484d3 <+23>:    mov    0x101c(%esp),%eax
   0x080484da <+30>:    mov    %eax,(%esp)
   0x080484dd <+33>:    call   0x8048390 <puts@plt>
   0x080484e2 <+38>:    mov    0x101c(%esp),%eax
   0x080484e9 <+45>:    mov    %eax,0xc(%esp)
   0x080484ed <+49>:    lea    0x1c(%esp),%eax
   0x080484f1 <+53>:    mov    %eax,0x8(%esp)
   0x080484f5 <+57>:    movl   $0x80483c0,0x4(%esp)
   0x080484fd <+65>:    movl   $0x80485f0,(%esp)
   0x08048504 <+72>:    call   0x8048380 <printf@plt>
   0x08048509 <+77>:    movl   $0x1000,0x8(%esp)
   0x08048511 <+85>:    lea    0x1c(%esp),%eax
   0x08048515 <+89>:    mov    %eax,0x4(%esp)
   0x08048519 <+93>:    movl   $0x0,(%esp)
   0x08048520 <+100>:   call   0x8048370 <read@plt>
   0x08048525 <+105>:   lea    0x1c(%esp),%eax
   0x08048529 <+109>:   call   *%eax
   0x0804852b <+111>:   mov    $0x0,%eax
   0x08048530 <+116>:   leave  
   0x08048531 <+117>:   ret  

For the instruction call *%eax, eax points to the input. Am i right to guess if you just put a shellcode as input, it will execute it ?

But the port binding shellcode seems to not work with the remote server ( maybe it is secured ?)

Then i used simples shellcodes (execve(bin/sh)) already written by people that way:

# echo -ne "shellcode" | nc server port

No one worked that way so i thought that my whole logic is wrong. What is wrong in the process ? To get a shell on a remote server, what are the way ? If someone can help me i would be grateful. Thank you all.

  • I am struggling to understand what you're asking. – Qndel Aug 22 '15 at 2:19
  • 1
    this should be enough for you to understand the process adn if this is too much then you need to go back to basics. – Qndel Aug 22 '15 at 2:19
  • keep in mind , that cracking and malicious actions are widely disliked and merit little respect with them. Instead , learn to reverse engineer and do some malware analysis. Learn to code in assembly and understand how and why this may or might not work. – Qndel Aug 22 '15 at 2:27
  • Ok thank you. I understand your point but i do the exercise only in order to learn new things. Have a good day. – creuchmeuch Aug 22 '15 at 11:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.