5 ms·

Shellcode Injection

132 points by piyush8311 11y ago

dmeeze 11y ago
I must be missing something. If you can create an executable which is suid you already have root...
- anewhnaccount 11y ago
  The scenario is someone else has set setuid on an executable which is vulnerable to buffer overflows.
Ecco 11y ago
Why "echo 0 | dd of=foo" and not simply "echo 0 > foo"?
- nautical 11y ago
  echo 0 > foo //wont work with sudo .. sudo echo 0 > foo //will fail ... sudo sh -c 'echo 0 > file' //If you want echo with sudo else what author has done is right
  - tomsthumb 11y ago
    piping to `sudo tee <fname>` is also a nice alternative
trampi 11y ago
The same author refers to another article of him, in which he explains the basics of buffer overflows quite nice. https://dhavalkapil.com/blogs/Buffer-Overflow-Exploit/ https://dhavalkapil.com/blogs/Buffer-Overflow-Exploit/
amenod 11y ago
> ... -fno-stack-protector -z execstack Does anyone know how common stack protector is in the wild?
- Liru 11y ago
  Depends on which distributions patch gcc to enable it by default. From what I'm aware, a lot of them do, though.
- nautical 11y ago
  Fedora 20 comes with fstack-protector-strong .. so does ubuntu arch openbsd/freebsd etc .
- pm24601 11y ago
  From the responses to this stackoverflow question: http://stackoverflow.com/questions/1629685/when-and-how-to-use-gccs-stack-protection-feature http://stackoverflow.com/questions/1629685/when-and-how-to-u... The protection only protects under some circumstances not all. So this demo still seems valid. Also the protection comes at a cost of extra code (and extra execution time). This means to me that any IoT device probably does not have stack protection.
  - 0x0539 11y ago
    Actually, this demo would be stopped if the stack protector was on. The demo relies upon overwriting the return pointer that controls where the function jumps to upon returning. The stack protector acts as a guard against overwriting that value without knowing a key that is stored elsewhere in memory. You'd need some memory disclosure issue to get the key or brute force the key.
cedricvg 11y ago
Almost every program nowadays is compiled with W^X (--no_execstack) by default which means the memory is not executable and writable at once (Windows equivalent is DEP). Still a good example of how a basic overflow can lead to arbitrary code execution. A follow-up post using ROP or return-to-libc would be interesting, with W^X enabled.
- vampire_dk 11y ago
  I'll try it next. Thanks for the suggestion :)
juanuys 11y ago
My favourite resource for these types of exploits used to be phiral.com (see Wayback Machine circa March 2007 [1], since it doesn't exist anymore), belonging to author Jon Erickson who wrote "Hacking: the Art of Exploitation" [2]. [1] https://web.archive.org/web/20070305111749/http://phiral.com/ https://web.archive.org/web/20070305111749/http://phiral.com... [2] https://en.wikipedia.org/wiki/Hacking:_The_Art_of_Exploitation https://en.wikipedia.org/wiki/Hacking:_The_Art_of_Exploitati...
- vampire_dk 11y ago
  This book is quite good. It was my first introduction in this area.
dimdimdim 11y ago
Here are 2 good courses on Assembly and Shellcoding on x86 and x86_64 if you are interested: http://www.pentesteracademy.com/topics?v=nhr http://www.pentesteracademy.com/topics?v=nhr

Shellcode Injection

132 points by piyush8311 11y ago

dmeeze 11y ago

I must be missing something. If you can create an executable which is suid you already have root...

anewhnaccount 11y ago
The scenario is someone else has set setuid on an executable which is vulnerable to buffer overflows.

Ecco 11y ago

Why "echo 0 | dd of=foo" and not simply "echo 0 > foo"?

nautical 11y ago
echo 0 > foo //wont work with sudo .. sudo echo 0 > foo //will fail ... sudo sh -c 'echo 0 > file' //If you want echo with sudo else what author has done is right
- tomsthumb 11y ago
  piping to `sudo tee <fname>` is also a nice alternative

trampi 11y ago

The same author refers to another article of him, in which he explains the basics of buffer overflows quite nice. https://dhavalkapil.com/blogs/Buffer-Overflow-Exploit/ https://dhavalkapil.com/blogs/Buffer-Overflow-Exploit/

amenod 11y ago

> ... -fno-stack-protector -z execstack Does anyone know how common stack protector is in the wild?

Liru 11y ago
Depends on which distributions patch gcc to enable it by default. From what I'm aware, a lot of them do, though.
nautical 11y ago
Fedora 20 comes with fstack-protector-strong .. so does ubuntu arch openbsd/freebsd etc .
pm24601 11y ago
From the responses to this stackoverflow question: http://stackoverflow.com/questions/1629685/when-and-how-to-use-gccs-stack-protection-feature http://stackoverflow.com/questions/1629685/when-and-how-to-u... The protection only protects under some circumstances not all. So this demo still seems valid. Also the protection comes at a cost of extra code (and extra execution time). This means to me that any IoT device probably does not have stack protection.
- 0x0539 11y ago
  Actually, this demo would be stopped if the stack protector was on. The demo relies upon overwriting the return pointer that controls where the function jumps to upon returning. The stack protector acts as a guard against overwriting that value without knowing a key that is stored elsewhere in memory. You'd need some memory disclosure issue to get the key or brute force the key.

cedricvg 11y ago

Almost every program nowadays is compiled with W^X (--no_execstack) by default which means the memory is not executable and writable at once (Windows equivalent is DEP). Still a good example of how a basic overflow can lead to arbitrary code execution. A follow-up post using ROP or return-to-libc would be interesting, with W^X enabled.

vampire_dk 11y ago
I'll try it next. Thanks for the suggestion :)

juanuys 11y ago

My favourite resource for these types of exploits used to be phiral.com (see Wayback Machine circa March 2007 [1], since it doesn't exist anymore), belonging to author Jon Erickson who wrote "Hacking: the Art of Exploitation" [2]. [1] https://web.archive.org/web/20070305111749/http://phiral.com/ https://web.archive.org/web/20070305111749/http://phiral.com... [2] https://en.wikipedia.org/wiki/Hacking:_The_Art_of_Exploitation https://en.wikipedia.org/wiki/Hacking:_The_Art_of_Exploitati...

vampire_dk 11y ago
This book is quite good. It was my first introduction in this area.

dimdimdim 11y ago

Here are 2 good courses on Assembly and Shellcoding on x86 and x86_64 if you are interested: http://www.pentesteracademy.com/topics?v=nhr http://www.pentesteracademy.com/topics?v=nhr