Hello and welcome to Nucu Labs agent!
We’ve been contracted by some external contractors to help them break…, I mean, assist them in making their life easier with their “competition”.
We obtained their competition’s software from a poorly configured AWS server.
Their competition, X, uses the software in order to setup a private communication channel to their servers, the software is simple, it fires up a server, listens on a port and waits for the right password, when the right password is entered, the server remembers the client and stops asking for passwords, simple.
Luckily the source code was also lying around otherwise we would had to reverse engineer the binary ourselves, trivial, I know.
Here’s the source code, take a look at yourself and take your time, don’t want to be missing something.
| |
#include #include #include #include #include #include #include #include
#define PORT 9090 #define BUFFER_LENGTH 500 #define MIN_PASSWORD_LENGTH 5
char *password; int security_flag = 0;
/* This function will initialize the program */ void initialize(void) { int i; password = malloc(sizeof(char) * 10); srand(time(0));
for (i = 0; i < 9; i++) {
double f = (double)rand() / RAND_MAX;
password[i] = 65 + f * (90 - 65);
}
password[9] = '\n';
password[10] = '\0';
printf("Server initialized!\n");
printf("Server password: %s", password);
fflush(stdout);
}
int main(void) { struct sockaddr_in server; struct sockaddr_in client; char buf[BUFFER_LENGTH]; char responseBuf[BUFFER_LENGTH]; int clientLen = sizeof(struct sockaddr_in);
initialize();
/* Setup server */
int sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
memset((char *) &server, 0, sizeof(server));
server.sin_family = AF_INET;
server.sin_addr.s_addr = htonl(INADDR_ANY);
server.sin_port = htons(PORT);
if (bind(sock, (struct sockaddr *) &server, sizeof(server)) < 0) {
perror("ERROR on binding");
}
/* Sync server, handle only one client, low budget */
for (;;) {
/* Set buffers to zero so no overlapping */
bzero(buf, BUFFER_LENGTH);
bzero(responseBuf, BUFFER_LENGTH);
int size = recvfrom(sock, &buf, BUFFER_LENGTH-1, 0, (struct sockaddr *) &client, &clientLen);
printf("size received: %d\n", size);
if (security_flag != 0 || (strcmp(buf, password) == 0 && size > MIN_PASSWORD_LENGTH)) {
// When password is correct, let vadim see secret orders from network and don't require password anymore..
sendto(sock, "secret unlocked\n", 17, 0, (struct sockaddr *) &client, clientLen);
security_flag = 1;
// [Imagine secret menu here]
} else if (size > MIN_PASSWORD_LENGTH) {
char logBuffer[BUFFER_LENGTH] = {'\0'};
int size = sprintf(logBuffer, buf);
logBuffer[size] = '\0';
// ECHO VADIM THE PASSWORD, SO HE KNOW HE IMBECILE!
sendto(sock, logBuffer, size+1, 0, (struct sockaddr *) &client, clientLen);
fflush(stdout);
}
}
close(sock);
return EXIT_SUCCESS;
}
| |
Have you read the source code? Okay good.
Remember, our goal is to exploit this software remotely, we will need to design an exploit.
Lab setup
It is recommended that you fire up a Linux 32 bit machine on your VirtualBox if you host isn’t Linux.
As you can see (assuming that you’ve read the code), we’re interested in either switching the security flag remotely or getting the program to spit out the password, both are possible, both are, but based on our lab testing we could only switch the security flag. If you figure out how to get the password then please tell us and you may even get a promotion and a free bottle of vodka.
These are the things I’m talking about. Go back and revisit the code if you’ve forgotten what they do already.
| |
When we compile the program we get this, bingo:
| |
We compiled the binary with the flag -fno-stack-protector because we want to extract the password, and when the stack is protected we can’t extract it! GCC inserts some extra code in the binary to abort the execution if the stack becomes corrupted.
| |
As you can see if we run objdump -t to get the symbols and filter them with egrep. What we care about is the addresses of the security_flag and password. But how will this help us? This will help us because printf uses the stack. Pick one of the following training material and read it then try to bypass the program and make it send you the secret menu. I’m sure you can do it and if not, then read on.
- SEED: Format string vulnerability lab.
- (scut / team teso) Exploiting Format String Vulnerabilities
- A simple Format String exploit example – bin 0x11
Switching the security_flag
Switching the security flag is easy, all we have to do is make the pop the stack until we’re at the beginning of our format string and then make the format string containing the 4 byte address that we want to write to.
In order to write to that address we will use %n and to pop the stack %.8x.
- %n – writes the total number of printed characters to a variable.
- %.8x – displays an address in a pretty way.
Let’s use python to simplify our exploit techniques by saving us lots of characters to type.
We fire two terminals, one for the program and one for our exploit.
| |
Now, let’s unlock the secret by not knowing the correct password and by only switching the security flag, as we seen earlier, it’s address is: 0804a088.
| |
To write to the security flag we will make the stack point to our string and we will replace the aaaa with the address of the security_flag which is: 0804a088.
| |
All we have to do now is go back one address and write to it:
| |
Getting the password
In theory getting the password should work in the same way as switching the secret_flag. Replace %n with %s and make sure that you’ve got address of the password in the beginning of the format buffer that you’re sending to the server.
That’s all! Thank you for reading and have a nice day!