Format String Vulnerability Ubuntu Lab Report-KSU .

Format String Vulnerability Lab Task1: The Vulnerable Program I launch 2 VM, one is SEEDUBUNTU and the other one is SEEDUBUTNTU CLONE. After I run “sudo ./server” on server side and run “nc -u 10.0.2.7 9090” on client side, I can type messages on client side and the server program prints the same content typed by me. Figure 1-1 Task2: Understanding the Layout of the Stack As shown in fig 2-3, I firstly type “aaaaaaa..%x…%x” to observe the output of this format string, then I find that there exists 6161616161… in server side, I also find the content includes numbers like 3, 10, addresses like 80….., b7… and bf….., because of the address of msg(begins with bf), I guess the address begins with bf…, then I construct format string to test the bf…. addresses. After many tests, I get the output shown in fig2-2, meaning that bffff0e0 is the buffer address, but there are two bffff0e0. However, the previous one is followed by 3, while the second one is followed by 80… which seems like an address, so I think the second one is the msg. The address of msg is 0xbffff0a0, so the return address of myprintf() is 0xbffff09c. There are 8 %.x between format string and msg, so the address of format string is 0xbffff0a0-32 = 0xbffff080, the address of buf is 0xbffff0e0. The distance between ➊ and ➌ is 96. Figure 2-1 Figure 2-2 Figure 2-3 Task 3: Crash the Program I type some %s on client side shown in fig 3-1, and then the server crushes shown in fig 3-2. Figure 3-1 Figure 3-2 Task4.a: Stack Data The figures blow is as same as figures used in task2, so I use 24 %x to get the first four bytes of my input. Figure 4-1 Task4.b: Heap Data I firstly build the format string as shown in fig4-4, I put the address of secret in stack, and then add the valist to find the address of secret, then I use %s to print the content. So as shown in fig4-3, I get the content of secret ”A secret message”. Figure 4-3 Figure 4-4 Task5.a: Change the value to a different value As shown in fig 5-2, I build the format string including the address of target, then the value of target is changed in fig 5-1. Figure 5-1 Figure 5-2 Task5.b: Change the value to 0x500 After calculating, I build the format string shown in fig 5-4, then the value of target is changed to 0x00000500. Figure 5-3 Figure 5-4 Task5.c: Chang the value to 0xFF990000 I divided 0xff990000 into two parts, one part is for 0xff99 and another part is for 0x0000. So I calculate the remaining %.Zx, z=65222, then I use %hn to modify the memory of address, then in 0x0904a042, the value is 0xff99, after that, I use %.65637x to get zero because of overflowing. So, as shown in fig 5-5, the target changes to 0xff990000. Figure 5-5 Figure 5-6 Task6: Inject Malicious Code into the Server Program As is shown in fig 6-3, I firstly make sure the address is right, so I use input_target that aims at modifying target to be the address of the malicious code(I set 0xbffff1c0 as the address of the malicious code), then I use the format string shown in fig 6-3 to launch my attack, I divide the address of malicious code into two parts to write into the return address of myprintf(). After that, I check the existence of myfile. It is clear that myfile is deleted because of my attack shown in fig 6-2. The reason I use x90: Use NOP can add the entry point of my injected code so that I can use the address which is not exact. NOP instruction does not do anything meaningful, other than advancing point of my code, as long as I can jump to one of the NOP instructions, I can finally reach the malicious code. Figure 6-1 Figure 6-2 Figure 6-3 Malicious code NOP NOP ..NOP 0XBFFFF1C0 Figure 6-4 the location of malicious code stored Task7: Getting a Reverse Shell I modified the format string from task6, as shown in fig 7-2, the ip address of client is 10.0.2.8 included in the format string. Then I launch the TCP server on client, and launch the attack to server. The attacking result is shown in fig7-2, it depicts that I get the reverse Shell. Figure 7-1 Figure 7-2 Task8: Fixing the Problem The warning aims at telling people that when using printf, the format string is better be a string literal and not a variable. In the server.c code, the printf(msg); causes the vulnerable of this program, so I modified the code to printf(“%s”, msg); As is shown in fig 8-1, it is clear that there is no gcc compiler warning. I launch the attack as doing in task7, as shown in fig 7-2, I don’t get the reverse shell so my attack fails. Figure 8-1 Figure 7-2