windowhan lab

 scp 명령어를 이용한 파일 복사 및 전송

  ssh에서 제공되는 scp 명령어를 통해 로컬서버↔원격서버 로의 파일을 간단하게 전송할 수 있다.

 1. 사용방법
    1) 원격 서버 → 로컬 서버로 파일 전송
        # scp [옵션] [계정명]@[원격지IP주소]:[원본 경로 및 파일] [전송받을 위치]

        예제1) IP 111.222.333.444 서버의 abc라는 계정으로 /home/abc/index.html 파일을 로컬서버 /home/me/ 디렉토리에 전송 받기

                    # scp abc@111.222.333.444:/home/abc/index.html /home/me/

    2) 로컬 서버 → 원격 서버로 파일 전송
        # scp [옵션] [원본 경로 및 파일] [계정명]@[원격지IP주소]:[전송할 경로]

        예제2) 로컬서버 /home/me/wow.html 파일을 IP 111.222.333.444 서버의 /home/abc/ 디렉토리에 전송 하기
                   # scp /home/me/wow.html abc@111.222.333.444:/home/abc/

    3) ssh포트를 기본 22번으로 사용하고 있지 않는 서버로의 전송

        예제3) 2222번인 SSH포트를 사용한다면 아래와 같이 –P 옵션과 포트번호를 넣어준다.
                  # scp –P 2222 abc@111.222.333.444:/home/abc/index.html /home/me/
                  # scp –P 2222 /home/me/wow.html abc@111.222.333.444:/home/abc/

        [주의사항]
        옵션중에 –P와 –p가 있으니 대/소문자 확인을 하여야 한다.
        -P : 포트번호를 지정함
        -p : 원본파일 수정/사용시간 및 권한을 유지함
        -r : 하위 디렉토리 및 파일 모두 복사함

procstat -v pid

set follow-fork-mode child

segmentation fault 뜰때, 원인을 분석할 수 있게 core파일을 생성시킬 수 있는 옵션이다.

 ulimit -c 10000

RTL이나 ROP할때 특히나 stdin같이 크기가 제한적인 부분에서는 쓰려는 함수 내에서 sub esp 로 인해서 esp가 권한이없는 부분을 가리키는것을 주의해야한다.

LOB 페도라 풀고있는데 system함수 쓰다가 암걸릴뻔했네요 ㅜ

서버가 아파치일 경우, 아파치 자체의 기능으로 같은 세션으로 같은 페이지를 부를 때, 한 페이지의 스크립트가 모두 끝나기 전까지는 다른 페이지가 실행되지 않는다.

set *(자료형*)포인터주소 = 값

예시)

(gdb) set *(long*)0xb7fcc104 = 0xb7fcc10c

(gdb) x/x 0xb7fcc104

0xb7fcc104: 0xb7fcc10c

(gdb) 

0xb7fcc108: 0x0804858e

(gdb) 

0xb7fcc10c: 0x00031337

(gdb) 

0xb7fcc110: 0x007db0e7

(gdb) 

FC3은 않그러지만 FC4부터 임시버퍼에 ASLR이 걸려있다고 들었다.

FC4는 숫자가 2개만 랜덤하게 되서 Brute Force하게 공격을하면 쓸 수 있을 것같다.

근데 희안한건 FC13에서는 임시버퍼에 ASLR이 제대로 걸려있지않다.

왜그런지는 잘 모르겠다.

풀려있으면 그냥 써야지.

데이터를 특정한 곳에 갔다놓을때는 뒤에 널문자가 붙는듯.

따라서 ret 다음에 바로 canary가 존재할 경우에는 canary를 침범할 수 있으니 조심해야한다.

(gdb) x/100x $esp

0xbffca220: 0x00000000 0x530e0443 0x00000000 0x530e14b1

0xbffca230: 0x00000000 0x61616161 0x61616161 0x61616161

0xbffca240: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca250: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca260: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca270: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca280: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca290: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca2a0: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca2b0: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca2c0: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca2d0: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca2e0: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca2f0: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca300: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca310: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca320: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca330: 0x61616161 0x62626262 0x63636363 0x0804000a

0xbffca340: 0x00031337 0xbffca368 0x008cb740 0x00000000

0xbffca350: 0x007a3828 0x00040000 0x00000000 0x007a3300

0xbffca360: 0x00000000 0x0079eb64 0x61616161 0x61616161

0xbffca370: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca380: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca390: 0x61616161 0x61616161 0x61616161 0x61616161

0xbffca3a0: 0x61616161 0x61616161 0x61616161 0x61616161

(gdb) she (python -c 'print "a"*260 + "bbbb" + "cccc"') > res

(gdb) r < res

The program being debugged has been started already.

Start it from the beginning? (y or n) y

warning: cannot close "shared object read from target memory": File in wrong format

Starting program: /home/cruel/tmp/enigma < res

Reading symbols from shared object read from target memory...(no debugging symbols found)...done.

Loaded system supplied DSO at 0x576000

(no debugging symbols found)

(no debugging symbols found)

enigma : The brothers will be glad to have you!

you : 

Breakpoint 3, 0x08048526 in vuln ()

(gdb) x/100x $esp

0xbf9d9180: 0x00000000 0x530e14b4 0x00000000 0x530e14c1

0xbf9d9190: 0x00000000 0x61616161 0x61616161 0x61616161

0xbf9d91a0: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d91b0: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d91c0: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d91d0: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d91e0: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d91f0: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d9200: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d9210: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d9220: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d9230: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d9240: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d9250: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d9260: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d9270: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d9280: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d9290: 0x61616161 0x61616161 0x62626262 0x63636363

0xbf9d92a0: 0x0003000a 0xbf9d92c8 0x008cb740 0x00000000

0xbf9d92b0: 0x007a3828 0x00040000 0x00000000 0x007a3300

0xbf9d92c0: 0x00000000 0x0079eb64 0x61616161 0x61616161

0xbf9d92d0: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d92e0: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d92f0: 0x61616161 0x61616161 0x61616161 0x61616161

0xbf9d9300: 0x61616161 0x61616161 0x61616161 0x61616161

데이터 + \x0a\x00을 추가하는듯.

guest@notroot-virtual-machine:~$ ulimit -s unlimited
guest@notroot-virtual-machine:~$ cat /proc/self/maps
08048000-08053000 r-xp 00000000 08:01 393239     /bin/cat
08053000-08054000 r--p 0000a000 08:01 393239     /bin/cat
08054000-08055000 rw-p 0000b000 08:01 393239     /bin/cat
0a01a000-0a03b000 rw-p 00000000 00:00 0          [heap]
40000000-40020000 r-xp 00000000 08:01 1704861    /lib/i386-linux-gnu/ld-2.17.so
40020000-40021000 r--p 0001f000 08:01 1704861    /lib/i386-linux-gnu/ld-2.17.so
40021000-40022000 rw-p 00020000 08:01 1704861    /lib/i386-linux-gnu/ld-2.17.so
40022000-40023000 r-xp 00000000 00:00 0          [vdso]
40023000-40025000 rw-p 00000000 00:00 0
40025000-40026000 r--p 00855000 08:01 2236817    /usr/lib/locale/locale-archive
40038000-401e6000 r-xp 00000000 08:01 1704885    /lib/i386-linux-gnu/libc-2.17.so
401e6000-401e8000 r--p 001ae000 08:01 1704885    /lib/i386-linux-gnu/libc-2.17.so
401e8000-401e9000 rw-p 001b0000 08:01 1704885    /lib/i386-linux-gnu/libc-2.17.so
401e9000-401ed000 rw-p 00000000 00:00 0
401ed000-403ed000 r--p 00000000 08:01 2236817    /usr/lib/locale/locale-archive
403ed000-4051f000 r--p 00858000 08:01 2236817    /usr/lib/locale/locale-archive
bfacf000-bfaf0000 rw-p 00000000 00:00 0          [stack]
guest@notroot-virtual-machine:~$ cat /proc/self/maps
08048000-08053000 r-xp 00000000 08:01 393239     /bin/cat
08053000-08054000 r--p 0000a000 08:01 393239     /bin/cat
08054000-08055000 rw-p 0000b000 08:01 393239     /bin/cat
0904d000-0906e000 rw-p 00000000 00:00 0          [heap]
40000000-40020000 r-xp 00000000 08:01 1704861    /lib/i386-linux-gnu/ld-2.17.so
40020000-40021000 r--p 0001f000 08:01 1704861    /lib/i386-linux-gnu/ld-2.17.so
40021000-40022000 rw-p 00020000 08:01 1704861    /lib/i386-linux-gnu/ld-2.17.so
40022000-40023000 r-xp 00000000 00:00 0          [vdso]
40023000-40025000 rw-p 00000000 00:00 0
40025000-40026000 r--p 00855000 08:01 2236817    /usr/lib/locale/locale-archive
40038000-401e6000 r-xp 00000000 08:01 1704885    /lib/i386-linux-gnu/libc-2.17.so
401e6000-401e8000 r--p 001ae000 08:01 1704885    /lib/i386-linux-gnu/libc-2.17.so
401e8000-401e9000 rw-p 001b0000 08:01 1704885    /lib/i386-linux-gnu/libc-2.17.so
401e9000-401ed000 rw-p 00000000 00:00 0
401ed000-403ed000 r--p 00000000 08:01 2236817    /usr/lib/locale/locale-archive
403ed000-4051f000 r--p 00858000 08:01 2236817    /usr/lib/locale/locale-archive
bfafc000-bfb1d000 rw-p 00000000 00:00 0          [stack]