diff --git a/index.html b/index.html index 1705065..055e35c 100644 --- a/index.html +++ b/index.html @@ -291,12 +291,11 @@ template: inverse .right-column[ In hacking, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode. [1] -Here's a bit of shellcode to open `/bin/sh` on 32-bit x86 (48 bytes) [2]: +Here's a bit of shellcode to open `/bin/sh` on 32-bit x86 (37 bytes) [2]: ``` -\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01 -\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30 -\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1 -\x0c\xce\x81 +\x6a\x17\x58\x31\xdb\xcd\x80\x6a\x2e\x58\x53\xcd\x80\x31\xd2 +\x6a\x0b\x58\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89 +\xe3\x52\x53\x89\xe1\xcd\x80 ``` As strings in C are NULL terminated, shellcode should not have `\x00` in it. @@ -305,7 +304,7 @@ As strings in C are NULL terminated, shellcode should not have `\x00` in it. Sometimes swapping out some shellcode for some other shellcode is the trick. -.footnote[[1] Borrowed from [wikipedia](https://en.wikipedia.org/wiki/Shellcode)
[2] Shellcode from [shell-storm](http://shell-storm.org/shellcode/files/shellcode-491.php)] +.footnote[[1] Borrowed from [wikipedia](https://en.wikipedia.org/wiki/Shellcode)
[2] Shellcode from [shell-storm](http://shell-storm.org/shellcode/files/shellcode-251.php)] ] --- template: inverse @@ -380,8 +379,7 @@ template: inverse .right-column[ Now it's your turn. -Use google cloudshell https://console.cloud.google.com/cloudshell/ to run ssh to -log into `XX.XX.XX.XX` (not available now) with ssh using user `hulkX` password `smashX`. Binary and shellcode are in `/smash` +Log into the provided VM. Binary and shellcode are in `/smash` **Alternative** If you want to use your own system, Do this as preparation: - Install radare2: `$ sudo apt-get install -y radare2`
**OR**
`$ git clone https://github.com/radareorg/radare2.git && cd radare2 && sys/user.sh`
for a persistent installation. @@ -435,7 +433,7 @@ int main() .right-column[ Now, if you managed that: - Try to make it open a shell via shellcode. Especially fun if you make the binary SUID root:
`$ sudo chown root.root diy && sudo chmod u+s diy` -- Can be done both via shellcode in an environment variable (usually more reliable) and via shellcode in the buffer +- Can be done both via shellcode in an environment variable (usually more reliable **HINT**) and via shellcode in the buffer Tip: `gets()` behaves weirdly and will close your shell immediately. The trick is to do something like:
`$ (echo -e MYINPUT; cat)|./diy`
@@ -463,6 +461,24 @@ template: inverse - `S` step over - `?v HEX` build in calculator (e.g. `?v 0xdead0000+0xbeef`) - `?vi HEX` hex to integer (e.g. `?vi 0x400`) +] +--- +template: inverse +# Quick GDB reference +--- +.left-column[ +## Quick GDB reference +] +.right-column[ +- `gdb --args ` start gdb with a program with arguments +- `disas ` disassemble a function +- `b *
` set a breakpoint on an address +- `x/200x $esp` show the memory contents for 200 bytes starting at the address $esp points to +- `r` run +- `r < foo.txt` run with stdin filled from a file +- `c` continue +- `s` step into +- `info functions` list all functions ]