From fc6e82f8f35bc178fc01c01f75bd3fc090d22a99 Mon Sep 17 00:00:00 2001 From: Navan Chauhan Date: Wed, 18 Oct 2023 20:00:35 -0600 Subject: add link to tags --- docs/posts/2023-10-05-attack-lab.html | 71 +++++++++++++++-------------------- 1 file changed, 30 insertions(+), 41 deletions(-) (limited to 'docs/posts/2023-10-05-attack-lab.html') diff --git a/docs/posts/2023-10-05-attack-lab.html b/docs/posts/2023-10-05-attack-lab.html index 82a02fe..d049a6b 100644 --- a/docs/posts/2023-10-05-attack-lab.html +++ b/docs/posts/2023-10-05-attack-lab.html @@ -49,7 +49,8 @@

Lab 3 for CSCI 2400 @ CU Boulder - Computer Systems

-

This assignment involves generating a total of five attacks on two programs having different security vulnerabilities. The directions for this lab are detailed but not difficult to follow.

+

This assignment involves generating a total of five attacks on two programs having different security vulnerabilities. The directions for this lab are detailed but not difficult to follow. + Attack Lab Handout

Again, I like using objdump to disassemble the code.

@@ -113,11 +114,10 @@ NICE JOB!

Phase 2

-

Phase 2 involves injecting a small amount of code as part of your exploit string.

-
- -
-

Within the file ctarget there is code for a function touch2 having the following C representation:

+

Phase 2 involves injecting a small amount of code as part of your exploit string. +

+ Within the file ctarget there is code for a function touch2 having the following C representation: + Attack Lab Handout

@@ -138,11 +138,10 @@ NICE JOB!

Your task is to get CTARGET to execute the code for touch2 rather than returning to test. In this case, - however, you must make it appear to touch2 as if you have passed your cookie as its argument.

-
- -
-

Recall that the first argument to a function is passed in register %rdi

+ however, you must make it appear to touch2 as if you have passed your cookie as its argument. +

+ Recall that the first argument to a function is passed in register %rdi + Attack Lab Handout

This hint tells us that we need to store the cookie in the rdi register

@@ -275,22 +274,17 @@ NICE JOB!

Phase 3

-

Phase 3 also involves a code injection attack, but passing a string as argument.

-
- -
-

You will need to include a string representation of your cookie in your exploit string. The string should - consist of the eight hexadecimal digits (ordered from most to least significant) without a leading “0x.”

-
- -
-

Your injected code should set register %rdi to the address of this string

-
- -
-

When functions hexmatch and strncmp are called, they push data onto the stack, overwriting +

Phase 3 also involves a code injection attack, but passing a string as argument. +

+ You will need to include a string representation of your cookie in your exploit string. The string should + consist of the eight hexadecimal digits (ordered from most to least significant) without a leading “0x.” +

+ Your injected code should set register %rdi to the address of this string +

+ When functions hexmatch and strncmp are called, they push data onto the stack, overwriting portions of memory that held the buffer used by getbuf. As a result, you will need to be careful - where you place the string representation of your cookie.

+ where you place the string representation of your cookie. + Attack Lab Handout

Because hexmatch and strncmp might overwrite the buffer allocated for getbuf we will try to store the data after the function touch3 itself.

@@ -390,21 +384,16 @@ NICE JOB! * movq * popq * ret - * nop

- - -
-

All the gadgets you need can be found in the region of the code for rtarget demarcated by the - functions startfarm and midfarm

-
- -
-

You can do this attack with just two gadgets

-
- -
-

When a gadget uses a popq instruction, it will pop data from the stack. As a result, your exploit - string will contain a combination of gadget addresses and data.

+ * nop +

+ All the gadgets you need can be found in the region of the code for rtarget demarcated by the + functions startfarm and midfarm +

+ You can do this attack with just two gadgets +

+ When a gadget uses a popq instruction, it will pop data from the stack. As a result, your exploit + string will contain a combination of gadget addresses and data. + Attack Lab Handout

Let us check if we can find popq %rdi between start_farm and end_farm

-- cgit v1.2.3