All right.
So welcome back to Introduction to Exploit Development.
And this time we are going to do our final capstone for Hacker Summer Camp 2022.
And right now what I want you to do is before we do anything so this is actually your location for getting
the new Docker container.
There's going to be some changes in the course.
And I want to tell you that now that instead of using a new debugger or peda the Python exploit development
extension, it was not been updated since somewhere around December 2020 and I've been seeing a couple
of bugs.
So now we are going to be using the new debugger Jeff for Jeff pronounced Jeff.
But before we do that, we want to make sure that we disable our let's see, our
arsenal are from the from the Linux host because we are running Docker, right.
And Docker and inherits the protections of the Linux host.
So what I want to do, I'm sorry, I'm just going through my walkthroughs right now.
Let's see.
OC So pseudo echo two type process system kernel randomize virtual address space.
You might have to do this as route and I'll explain why we're going to do like a really, really easy
one because we want to prove
normally by default your system is basically set of two for randomizing.
Esler Normally it is, but in our previous exercise we did it as zero, but your default is two so that
we can make sure that our binaries are randomized.
Now, number two, I want you to do this.
I want you to copy and pull.
So the command is pseudo docker pull GitHub container repository IO slash 27, which is my GitHub repository
intro exploit def dash cobra this character latest.
So I already have it actually I'm just going to turn off my VPN if I have it because if I didn't mention
this earlier, if you leave your VPN on for some reason, GitHub doesn't like it when you want privacy
and it actually could prevent you from being able to pull your Docker containers.
So we're going to use four methods in establishing our root chain, but for right now, we're going
to start up our container.
So what we're going to do is we're going to run the command to allow us to pipe localhost port two,
2 to 2 to the container, which is listing on port 22.
So we're going to run.
Cito Docker Run double dash, dash it double dash privilege dash P 2 to 2, 2 to 22 GCR dash IO slash
taxi seven slash intro exploit dev dash cobra latest.
And for debugging purposes, we're going to execute the bash shell.
So this is your vulnerable binary.
And if I were to do this LSE route, that's your flag.
I don't want to reveal the flag, but you just run the command cat route flag.
But I want you to log in as a under-privileged user so that we can root this box and then we can work
on it in order to capture the flag.
This will be your quiz, and these are your four exercises.
So what I want you to do now is open a new terminal and we're going to do s h ctf at local host dash
p two, two, two, two.
Say Yes.
And your password is player.
And now we're going to open another Thomas session.
So Thomas new dash se workspace
and we are of our four old binaries.
So our first exercise before we do anything, we want to make sure that ASL is still enabled and the
quickest way to check is to run the linker command.
So LD
run again, run it again and notice how the memory address ranges are constantly being randomized,
which means outer space layout randomization is on.
So in our first exercise, we want to make sure that we're going to do something that's really, really,
really simple.
And it's basically we have a unused shell function within the first exercise, which is volume.
Before we go on to something more advanced like abusing system calls in a different function that was
in this binary to volume or replacing.
We will keep on going on with this.
So let's just start from the basics and then from the basics.
We'll start continually to build rope chains, to be able to push things like shell variables into the
data segment.
And then finally we will use the RET to plot attack, which is the return to linkage procedure or linkage
table, which is a which is basically a pointer to the global offset table over the got.
And that will be our final challenge for fall four vote.
So first let's do object up dash DX Bone.
And if you go up, we have something called a unused shell function, which has not been called in any
part of the program.
But we're going to abuse this with a drop chain to do a very, very straightforward SLR bypass and real
applications.
You might actually see like a new shell functions or shell functions that are not intended to be done.
In the second exercise, we will actually go for our
out.
Let me just open up the student code.
All right.
Well, that's my previous work.
But what I'm going to do is I want to start this from scratch.
No, I don't care.
Or bass just dropping into the container.
So we're going to use object dump dash dx phone grep unused and we're going to grab this memory address
of the unused shell function.
Now to do a simple rock chain.
I've been teaching about how to do manual rock chaining before.
We only need to do one more thing, which is use ROPPER.
So ROPPER is already preinstalled in debugger in this container.
So we're going to ROPPER.
And then we're to run file volume and then want to search for a def one return and we want this instruction.
So in our source code, let's write the following notes unused shell func equals this memory address
which we pulled from here.
Make sure to end it with a zero.
From the top.
From an import star.
I'm sorry.
People are annoying me on my phone and we get our return instruction.
Make sure to copy this.
Return equals this.
Let's see.
Let's just say I tap one pie.
If you have not noticed yet, we have switched to Python three due to the deprecation of Python two
and Python two is no longer supported and working on a very simple buffer buffer overflow to a rob chain
to exploit the shell function.
So the commands now or the code is buff equals bytes.
A remember in Python three, you have to specify it as bytes, so you have to append a little B right
here.
Let me open this up and make this bigger.
How do you zoom in on this?
Say, Oh my God, you are not a way you can zoom in o control plus oc buff.
We knew that if we write 208 bytes it would overwrite the base pointer.
So we can say overwrite base pointer.
And then we can do bytes.
Hex 42 times eight.
Overwrite the return stack pointer.
And finally, because now we overrode the stack pointer in our previous fuzzy exercises or that was
capitalized.
Sorry, we can now put in our return instruction from here.
So pack 64 reds.
Now, in case you're wondering, this is the equivalent of saying struct pack, little Indian rat.
That's basically the same exact thing.
So we're just using PO tools to make this much more convenient.
But now we're going to pop our onion shell function.
So we're going to use buff plus equals PAX 64, which is a function within the open tools library,
unused shell function.
And then we're going to use this dot standard out, that buffer dot right buff and then we're going
to copy of this into our container.
So let's control B shift double quote then attempt one py
copy and paste this and then we're going to run the command python 3x1 dot py semicolon cat semicolon
wrap this in parentheses pipe dot so we now sent the buffer into standard in press enter again and then
we're press ID on my route and less route flag dot text.
And at the very final video that I'm gonna make, I'll reveal the flag.
But at this point you could have just ran the command route flag text, but we're not going to do that.
We'll just escape that.
But this is your first walkthrough, and it's just a really, really basic thing to abuse a new shell
function.
And the next exercise, we're going to find a system call to using the bin date command to be able to
do our exploit.
So in our next section, just keep your container running.
We're going to walk through all of this again and we're going to go for our next exploit.
We're going to try to do this one baby step at a time.
Remember, Asla is still on so von and our next vulnerable binary to Von, as you can see, also has
a randomized space address.
So that's your first exercise.
And I will reveal the flag, which I will add as a quiz to the last exercise, which you need to complete
this course.