Program hack for Linux Practice

Program hack for Linux Practice

This time the practice is file hack, let's start with the login executable file!

First we execute this executable program

① we want to be able to log in without knowing the password. And no matter what the password is, it is prompt "on your command,my master!" ".

The program is first disassembled.

We'll first find the entrance to the main function.

We can see the CMP statement, there is a jmp statement, if not equal to jump to "0x8048466", this is normal program execution process, we here want not equal time, Do not jump, so you can change the "0e" to "zero" tosay, do not jump. This is the equivalent of a jump statement that does not exist because, regardless of whether the comparison results are equal, the execution continues sequentially.

Let's see what the right landing is like.

First open the login file, results,

Enter ":%!xxd", result.

Search "0e", enter "/75 0e", results.

Modify the value to "max" and enter ":%!" xxd-r"Save the changes.

After returning to the binary file format, enter ":wq" to save.

Re-executes the executable, as a result.

② we want to skip the hint no matter what you enter. End directly.

Parses the disassembly of the main function.

We only need to jne the CMP comparison to the judgment statement, jump directly to leave place. The "xx" is revised to "1a", so that in the case of the wrong password will be directly ended, quit the program. Add the code to "8048472" and add thecode"jmp" toAdd "eb 0c". Summary: That is, the "page" ismodified to "1a eb 0c".

Let's try to be successful.

But it failed and was shown as a segment error.

This is what I want to re-assemble the executable file, and the result is

Because of my modification, the file is not available, I cannot revert back to the original version, so I have to restart the new code to try.

So I have to re-modify, I do not add new code, the "0e" directly modified to "1a".

The result of the modified execution is as follows.

Revise and disassemble again to see the results.

③ in-depth research to try to guess passwords.

From theMainin the code, we can see that the comparison is "0x1c(%esp) "and"%eax"The value, and the look of a step"%eax"is the value of"0x18(%esp", look up, I guess, here's the comparison."0x7fe"and"0x0"In this way, the result is never equal, so I try to modify it, and the following" XX"Change to"FE".

Save after modification.

After the change, enter any password, is successful login.

That's it, it's done!

Procedural cracking of Linux practice