20169217 "Linux kernel Fundamentals and analysis" 12th Week work

RETURN-TO-LIBC Attack experiment

Experiment Preparation:

Enter a command to install something that compiles a 32-bit C program:

sudo apt-get  updatesudo apt-get install lib32z1 libc6-dev-i386sudo apt-get Install Lib32readline-gplv2-dev

Enter the command "linux32" into the 32-bit Linux environment. Enter "/bin/bash" Using bash:

Experimental steps

Initial setup

In Ubuntu and some other Linux systems, the initial address of random heap (heap) and stack (stack) is randomized using address space, which makes it difficult to guess the exact memory address, and guessing the memory address is the key to the buffer overflow attack. So in this experiment, we use the following command to turn off this feature:

sudo sysctl-w kernel.randomize_va_space=0

In addition, in order to further protect against buffer overflow attacks and other attacks using shell programs, many shell programs automatically abandon their privileges when called. Therefore, even if you can trick a set-uid program into invoking a shell, you cannot maintain root privileges in the shell, which is implemented in/bin/bash.

In a Linux system,/bin/sh is actually a symbolic link to/bin/bash or/bin/dash. To reproduce the situation before this protective measure was implemented, we used another shell program (zsh) instead of/bin/bash. The following instructions describe how to set up the ZSH program:

/-s zsh shexit

To prevent a buffer overflow attack, the most recent version of the GCC compiler sets the program compilation to a stack that is not executable by default, and you can manually set whether the stack is not executable at compile time:

Gcc-z execstack-o test test.c    -z noexecstack-o test test.c  #栈不可执行

The purpose of this experiment is to show that the "stack unenforceable" protection is not entirely valid, so we use "-Z noexecstack", or use the compiler's default settings without manually specifying it.

Vulnerability procedures

Save the following code as a "RETLIB.C" file and save it to the/tmp directory. The code is as follows:

Compile the program, and set the Set-uid. The command is as follows:

We also need to use a program that reads the environment variables:

Attack program

Save the following code as a "exploit.c" file and save it to the/tmp directory. The code is as follows:

Get memory address
Get the Bin_sh address using the GETENVADDR program just now:

GDB obtains the system and exit addresses:

Modify the Exploit.c file and fill in the memory address you just found:

Attack

First run the attack program exploit, and then run the vulnerability program RETLIB, the success of the attack, gain the root authority:

This is the end of the experiment.

20169217 "Linux kernel Fundamentals and analysis" 12th Week work