live for the um
office hours of pwn college
specifically for the shell coding
module we have asu students
on zoom everyone else on twitch let me
get on twitch so that i can
um
so that i can
see questions and everything okay
perfect so um
what questions do we have so just to uh
you know get everyone on the same page
we're part way through the shell coding
module there are
14 awesome levels um of
shellcode challenges hopefully everyone
is
excited to shell code and is having fun
are you guys having fun on on zoom
going to take the deafening silence as a
yes
someone says depends on your idea of fun
sounds like 50 out of 50.
awesome um you might see it
i'm on baby duty right now because it's
labor day so uh
this might be a little bit of a chaotic
office hours
someone on zoom says this is sadistic
but it's very fun
all right 14 seems to be uh to be
hurting people
um okay
can we go over multi-stage shell coding
um we will do that awesome
all right let's start with that since
that's a concrete question
um as long as the baby kind of uh
lets us do it let's uh jump over to my
terminal oops get rid of these slides
that's from the lecturers recording um
we'll actually
where's the other
awesome now we have okay
so um we're gonna go to phone college
here
um some of these challenges for the
shell coding might require you to
do multi-stage shell code um
unless you are better at shell coding
than we are
multi-stage shell coding is a technique
uh hold on
all right back uh
someone says the baby doesn't like shout
coding the baby loves gel coding
all right um she's just uh said that
that i'm a noob at shell coding uh
multi-stage shell code um
let's say that we have a
uh shell code here
oh that's actually yeah okay so we have
a shell code here
uh we have our standard preamble that
let's let me just
copy it from here
all right so we have shell code some
shell code this
uh basically does exec bin sh uh example
from the slides
and we are somehow constrained
to the point where we cannot do this
shell code
um uh just execute the shell code off
the bat
right because for whatever reason either
um we have uh
too few bytes to actually make this work
something is filtered
etc etc right um
how do we get around this right one way
is we could do a multi-stage
shell code where one stage loads the
next stage and the next stage executes
right so let's um
getting a shell is pretty much
impossible since home ctf
is set to no su id i do not think that
is the case
i mean home ctf is set to no suid that
was a question on
zoom i just read out um getting a shell
is uh definitely possible um
it's not possible to get a shell from
executing
a set uid binary in-home ctf
um so
let's uh uh
get rolling all right so what we need to
do is is um
read in so we launch shell code that
will read in more shell code and execute
that uh next shell code right
um all right let me actually start a
list of
uh questions to go back to someone just
asked
why does asterisk drop permissions i'll
cover that
um okay
so uh
multi-state shell code so in order to do
to read in more shell code we have to
call the read
system call right this makes sense um we
can call the read system called pretty
easily
the read system call is a
system called zero
and the first argument is the file
descriptor
that we want to read from standard input
is file descriptor zero
second argument is where we want to read
into um and this is pretty
simple instead of having this kind of
bin sh string here we're going to
um have a where to read
label and this will just be some label
um i don't know
whatever just put let's put a bunch of
no ops
there
so the second argument will be a pointer
to our where to read
and then um we will uh the
third uh argument to read
and of course i'm going off memory but
you can look at the man page
file descriptor the buffer to read into
and the number of bytes you
and these number of bytes we can do
whatever right
let's say we read a kilobyte of shell
code so this is
stage one of our shell code let's save
it as stage one
that s and what is stage two stage two
is gonna be our old
ben sh shell code of course
as someone mentioned bin uh sh drops
privileges and so forth but
let's um uh
for the purposes of the demo let's have
this been a safe shell code so this will
be our stage
two shell code all right
let's compile um
our our shell code uh
stage one stage one dot s
uh dash no std lib
dash static and our stage two
okay and then um we do our opt copy
and same for stage one and stage two
okay so here's
our my stage one show shell code
and here's my stage two shell code
all right you can see stage one is
shorter than stage two because there's
no ben sh et cetera et cetera
um the uh
uh key thing is of course to
make your stage one shell code pass
whatever restrictions that you need to
pass
um this shell code still looks pretty
loose and probably won't pass
you know things with many restrictions
um but that's
a separate topic so now we have stage
one and stage two
actually when we can test all of this
out
by compiling um this with
an executable stack
ah no it's a little trickier than that
uh i forgot
the arguments hold on let me go to how
do we compile it with an executable text
segment so we can
emulate the shell code i forgot the
exact arguments
um let me look up my own slides
um was dash
dash l dash n yeah i think it was dash l
comma n
let me yeah w l
comment um
yeah thank you ricky uh
uh someone on
um
on on twitch is asking does opt copy
need to be writable
opt copy i'm not parsing the question
um the text segment doesn't have to be
section doesn't have to be writable for
copies to work but anyways
this makes um tells the the linker to
make the uh text segment executable
oops all right and now
dashan and now we have our
stage one i can execute my stage one
and if i s trace it i see that it reads
in
something for my stage two and of course
i can actually
stage one sending my stage two shell
code
in
and something is wrong
so it reads into a buffer at ox90 that's
uh
that's not good
oops i did move instead of load
effective address so usually these live
sessions are in class and my students uh
catch me making mistake mistakes um
everyone on zoom feel free to holler if
you see me making a mistake so
right there what i did instead of
loading the address of
this look position that i want to um
read
uh something into i um
moved the value at that position into
the pointer right so instead of
rsi having the address of this location
it had the value at the location
that's bad news so let's do the load
effective address all right
now we have to of course rebuild the
shell code
and obj copy the shell code out
no sorry we don't have to do that
because that's just stage one all right
yes trace it
we rebuilt it right
load effective address rsi rip
where to read
yeah option copy i shouldn't have to opt
copy stage two someone on zoom says opt
copy stage two
stage two isn't doing this read stage
one is doing this read
uh okay let's just go back
first principle stage one that s
rex zero success
oh can you still hear me on zoom oh it
didn't save you're right it didn't say
why yeah okay people can still hear me
on zoom it seems
um okay
it didn't save that's weird that's
really weird i don't know why i didn't
save but now we're good
all right uh so you compiled it now we
can s-trace it
and you can see that
we exactly read 38 bytes that is
the size of my stage two shell code do
you
is a utility that um measures the size
of files
so 38 bytes is the stage of my um shell
code it read 38 bytes that's these bytes
and the next thing you did was exact
then sh let's run through it
in gdb all right so we're
running stage one in gdb we're gonna
break at start
and we're gonna run um with
stage two as our input
raw all right so we have we're broken
in start or we break
and start so here's move rex0 that's the
the move
right so we can step move our di0 that's
the
uh standard input so this was the
syscall number
standard input and i'm stepping single
stepping through my shell code and
seeing the effects i can see
inforag these are all of the the states
of um
of this the state of all the registers
right now so most things are
um actually start out at the beginning
of program execution as zero
um and the important one
that we're about to set is rsi that's
the pointer to my um
buffer so let's see where where are we
right now
so that's what we're about to to set by
the way if you
are tired of um doing this x-slash irip
every time you step in gdb
you can do disk i rip this will have it
always
every time it stops will display um
whatever
this is in that expression which
in this case is rfp all right so this is
about to load
the effective address um into rsi
of the instruction pointer
um plus ox9 the instruction pointer here
is this each uh well it's 402 in our
in our l file but of course um it is
only
14 bytes into our shell code um
let's see what is there right now so we
can
um let's say 10 bytes
uh or let's do 10 instructions
in rip plus ox 9
and here they are alright plus ox 9 is
that's right so this is rip plus ox9
this rip
it's a little tricky is actually
after this instruction and this
instruction is some amount of
bytes along this when this says ri prp
when instruction executes is always
pointing to the next instruction
to execute um layout regs
oh interesting um
the uh anyways uh rip
here means this address right here so
start plus 21
21 bytes into our shell code um plus
nine so 21 plus nine
um is uh uh
well e9 plus nine should be
pointing to right here let's uh take a
look x i
x square plus o x 9 or x 9 is equal to 9
of course
enter
oops i dereferenced it
there all right so this is me examining
the instruction or the memory location
that
this refers to again this is the
instruction pointer so the address of
the next instruction when this
instruction is executing
plus nine that's what i did in my
um runner oh she dropped her book
uh let me finish this and i'll get our
new book um
in our uh runner um
shell code why did my
ipad stop working sorry if i missed some
twitch questions my ipad stopped working
um
in in the runner uh in the runner elf
our shell code is loaded at whatever
base address we started out at
or the entry point is at this 40d4 by
the time we get
to this load the next instruction is 409
and this address is referring to this
where to read label
which is 40f2 awesome
all right point is there's nothing here
right now if i
uh well if i step over the instruction
now we're
going on to how much to read so now
we're
about to execute the syscall let me do
infor reg
here's what things are looking at rdi is
zero so that means standard input
rsi is pointing here this is
where we will write our
uh read in our shell code right now it's
basically just that no
no that we put in and then whatever used
to be there
before um
and then what else uh our dx is how much
we're gonna read that is
10 24 and binary and a decimal or x 400
in hexadecimal
and rax is zero meaning the read cisco
so let's um step
now we have executed that read and right
away
we see that this f2 where we step next
should have been a no op it was just an
olap but we just replaced it with
a some code
and we can disassemble again this
location
and now we see shellcode here
right so we uh move the um
uh syscall number of exact ve
reload this rfp plus 10 so it's it's
this
four uh plus hex 10 so plus 16. so
40100 which means it'll go to
here and this is where of course um bin
sh lives
i can actually show you that we can look
at it now
now there's been a sage in here we just
read all of this in and then here are
the other instructions we
just read in um that finished setting up
the exact vsys call
and trigger it so now we can step
step step step we're about to hit the
syscall
boom we have just launched uh
bin dash because that's where bin sh
links to
and um success
all right there are two um let's restart
this
program uh two
suggestions um on uh
uh zoom one is layout reg
it's a a whole like um
different layout for geb so you can go
through and it's it's
it's all nice and graphical showed you
what changed the other ones layout asm
just for the the assembly um my
recommendation if you're gonna start
tweaking gdb is to install something
like peta
phone debug um or phone gdb
they're um they're in my shell coding
slides
um it's basically a gdb
plugin for lack of a better uh
explanation
um that will allow you to do all sorts
of or that'll make it look really fancy
um and really nice okay
um so that was
multi-stage shell code of course you
have to also inject your first stage
normally
but i'll leave that as an exercise to
the reader and multi-stage shell code
requires either your first stage to make
some code writable
um which just so people don't go off on
the wrong
um tangent i don't think any of our
current challenges
require that or it requires um
you know they're already to be writable
executable pages that you can read into
and jump to all right
question on zoom what techniques in
general
do you use to make shell code smaller um
good question i'll give you two
right now well
yeah i'll give you a couple of a couple
of tricks um
one trick let's look at our
um stage one one trick is xor instead of
um uh
moving zero right so so here this is a
move zero let's just remove
actually um i have a utility that that
makes exploring this stuff much easier
um it's called
shell tools do i have it publicly
available somewhere
uh you you can do the same with palm
tools i'm just going to do it with shot
tools because
it gives me a little more analysis um
so let's say we're talking about move
rax0
right so here is my um
this this is a script i wrote that
assembles all of this
and then obj dumps it hex dumps it gives
it to me
and and uh an ability a form that i can
paste into a c script a python
two script a python three script a shell
script uh
let me see if i actually have it
available
did i public oh yeah it's public on
github okay
yeah so it's uh in
um renewing the shellcode challenges for
you guys i i
i kind of pulled together these
loose scripts into a git repo and push
them if you're interested
it's on um
uh here github.com
shell tools there's an assemble uh
program there that is um that'll
assemble your shell code and then also
like
s trace it to see what the shell code
does and so forth um
obviously this guy just moves our x0 and
crashes but we can see
if you move our ax 60 and syscall
see the s trace actually shows it down
through
um the exit zero okay
uh so making things smaller so here i
did
move rax ox uh
um 3c right and
this takes an enormous amount of bytes
this takes uh this whole shell code is
nine bytes in size
this thing takes uh uh seven of them
right and it has a null byte in it so
it's kind of really bad
um at the end rax
is 60 right so so our goal
is to do move rx 60
in the same uh i mean fewer bytes than
seven
with the same effect that that rdx ends
up with 60.
um actually let me uh get
the baby a book i'll be right back
yes
what's up
all right back um okay
so uh
how can we do this one we can if this
was move rx0 which also takes 7 bytes
it'll be nice and simple right we can do
xor rax rax boom
we're down to 3 bytes
and we have the same effect
but has anyone
um done level three
where you can't have this uh
h right so so x or
x rex if you look at the hex dump here
it has the
h here in the principal h uh printable
uh representation of these bytes so this
ox48
what is this h this h is actually
um a the way that
amd built md64 basically
used to have instructions such as xor
eax eax let me actually for reference
bring up the um
shell coding is it in the shell coding
or in the fundamentals lecture
let's see i'm actually working on a new
fundamental series
i'm gonna pull up slides from that um
i'm hoping to record it
when i have time over the next few weeks
um
that will hopefully fill in even more
gaps it's just a lot of work to uh
call it the secret life of hello world
just a lot of work to
build it i'm at 100 slides but let's get
to the
assembly part of it these guys
all right so partial access on
um
on uh
amd 64 you can access parts of
a register and so when i did
let me show you this slide a little
better
okay when i did eax eax what i'm really
accessing is
the lowest 32 bits of
rax so half of rx right
um and xor eax ex if i assemble that
assembles to 3 1 c 0
right whereas x or r a x r x
assembles to 4 8 3 1 c 0. so you can
deduce
that um three one c zero means x or
e a x e a x and this four eight
turns it into x or r e x r x and you
would be correct in that
um let me figure out
where i have this
slide talking about that
um
oh right after that okay uh
what
okay slide 67
just a lot of slides all right um
so what happened when um amd built
uh amd64 is they realized that backwards
compatibility is very important
right and this has been the case
throughout the life cycle of x86
um from uh you know
a 386's ability to run 16-bit code all
the way through
your modern 64-bit processor being able
to run 32-bit or 16-bit code
still right um and the way that they do
this is that
uh most of your instructions on your
processor will still
with some exceptions that are very
important for the homework will operate
on 32-bit code
on 32-bit um data
such as the lowest 32 bits of
registers um
and uh i'm sorry i have to get her a new
toy because she dropped this one on the
floor
all right we're just gonna bring the
whole toy box
ah the baby is asking for new shell code
someone says okay
um uh uh where were we
so most instructions on um
64 on amd64 still operate
on 32 bits unless you provide a special
prefix
to the instruction that tells it hey
this is 64-bit uh land we are gonna
do 64-bit stuff and the way this looks
like
is the prefix rex
rex and uh you typically don't write
that in your assembly but your assembler
will write it when it
figures out what size um operand you're
working on
since we are doing 64-bit operands here
it says okay rex
move rax rx and that's this instruction
and rex assembles into
an ox-48 which happens to be
a
h okay so when level three says no h
what you're really saying is
you cannot have the prefix that turns
things into 64-bit mode
now not all instructions require that
prefix to work on 64-bit data
but that's the the challenge with with
uh with it so the point is
how did she drop this so fast we're
going to run out of
toys
okay sorry about that um
so looking on twitch to make sure i
didn't
flash butt crack okay we're good um
so uh
the rex bite yes
okay um
hacker's crack
um what were they saying oh yeah yeah so
we see a difference between xor rx rx
and xor eax eax
and it's that h-byte the interesting
thing
is the effects of these two instructions
are exactly the same
uh if we
um let's let's
drop into rappel as a reminder repel is
is a
a really cool tool where we can type uh
instructions and it'll execute them
um if we say okay
let's let's fill rax oops
sorry brained up let's fill our ax with
all f's
right um if we do
move all
x 42 we'll just replace
one byte of r x if we move
a h or x 43 we will just replace
one byte of rx so al is this byte ah
is this byte if we move into ax
one one two two three three four four
we'll just replace
oops you're right will just replace
these two bytes ax is the lower 16 bits
of rax
but if you move it to eax
one one two two three three four four
because
of a quirk of history a historical
decision that md64 made that simplified
thing
somewhere this acts differently this
zeros out
the half of our ax that uh
it won't touch right so any um
data that touches
eax ebx ecx edi
and so on the registers um
the 32-bit registers will actually zero
out
the top half of the 64-bit registers um
and zero out actually i if i remember
correctly it'll sign extend
nope it zeroes it out yeah so it zeroes
out the uh
the the top uh bits
what does this mean for us this means
that if we move
our ax negative one
so we have all uh ones in rex
if the x or r a x r x obviously this
will go all zero
okay but also we reset that and xor e a
x e a x
it'll also go all zero so
by doing xor instead of xor r a x r ax
by doing xor
e x e a x we can save a byte
to zero out um rax and
still zero out rx pretty cool
okay so
our original goal if you remember was
moving 16 to our x not zeroing it out
um and and zeroing out rx doesn't
necessarily
solve that but it gets us closer because
once we move
0 16 to our a or once we zero out our ax
by doing x or e x e x which is just two
bytes
now we can do something very cool
which is to move
um into a
l instead of r ax
why is my
terminal notch my slides not showing
what the hell
well hold on
that's weird one second
there we go okay
okay slides on the side there so you can
see and uh instead of
doing uh movie axe ex uh move
rax whatever number we can move al
whatever number
to just fill in the least significant
bits and that's all
that that we need because the value 60
fits into
eight bits into just that lowest bit of
al
and there we go x or exex move a l
o x 3 c you can try it in repel
x-ray ax ex zeroes out eax of course and
move
al60 now rax
is 3c and best of all
instead of 7 bytes all of this takes
four bytes
pretty cool um
all right
so what does this mean this means that
we can do
exit in six bytes instead of nine
pretty awesome all right
um
questions on that
let me add going over level one to the
list so assuming you do multi-stage
shell code for 14 i'm reading a question
on zoom
uh the minimum amount of bytes you would
need would still
exceed 16. or six i did not say that
uh i i i would
not agree with that question um
i guess the biggest hint i can give for
14 is
your shell code doesn't run in a vacuum
your shell code
hijacks execution of a program that was
running that had hopes and dreams
that was had goals and an accomplishment
that had done something in the past
right
what did it do in the past and how can
you use that to achieve your goals
that's the key thing to realize when
you're
uh shell coding in extremely constrained
conditions what can you
pick and choose from existing
program properties and so forth program
state
to achieve your goal okay
so this is um one way of
shrinking your shell code um another way
there are some some other interesting
tricks you can use
um based on interesting effects of
certain instructions
for example
for example the mole
instruction right
hold on let me check what's going on
um i will be right back i have to change
a diaper
um why don't everyone watch some
matrix to get in the hacker mood i'll be
right back
what
so
all right
all right i'm back um hopefully
that uh you know the matrix got
you all in a good hacker mood all right
um
let's talk about
instruction side effects so there are
instructions that are
um useful for shell coding in certain
contexts
i'm going to call out one
so often times in shellcode you have to
set
rax rdi rsi
and rdx right these four and then
trigger a
cis call um
so an instruction that can set
both uh to set two different registers
or
or multiple registers uh is great
x86 and 32-bit had an awesome set of
instructions push a
and pop a and and pop a would
read in all of um would pop all of the
registers off the stack
right that that saved a lot of space and
it was super awesome
um
but that no longer exists in 64 bit
um it's gone uh or at least in 64-bit
mode so
what uh but there are still instructions
that can um
help right one of these for example
let's say we had
values in uh rax and rdx
so in the syscall number and the third
argument to assist call
and we wanted to wipe them out right
uh we can do that all at once and if you
have zero in another
register right so we do xor um
esi esi so this is two bytes it'll zero
out
rsi that was already zero in this
example but that's fine
and then we use mole
esi mol is a very cool
uh instruction it will multiply whatever
is in rax
by whatever so that was negative one
by whatever you provided to the
instruction
it'll multiply whatever oops was in rex
or whatever you provided to the
instructions so by esi
right and then it will also
because a multiplication can overflow
very easily
it'll put the overflow into rdx in this
case
we're multiplying by zero so we are
wiping out
everything in rax and everything in rdx
with
one instruction with mole esi mol esi
is how many bytes two bytes
so in two bytes we zero out rax and rdx
as long as we have another register that
is already zero
um that's a very useful thing
um you can sometimes be even more clever
by
actually using it to set specific values
into these various um registers
but you know just the knowledge of
small uh multipl like the multiply
instruction can um help with shell
coding sometimes in in certain
situations
on to which we have someone says the
baby's cute yes she's very cute she's
very cute
and she's very cute
um usually we
have the baby schedule set up in a way
that
she's not teaching but
didn't work out for labor day huh yeah
okay um so
kyle c sorry uh question on zoom
when you have just one bite h one h byte
left to get rid of
um i'm gonna do give you one more hint
for
the age bytes
most things so you do xor rax
rax this has an age byte
so we we talked that xor eax e x doesn't
of course is the 32-bit version
there's one thing push
oops of course that's push rex
no h byte
pop rex no h bite
so when amd 64 um was uh
creating a or when amd was creating a
d64
in their infinite wisdom for whatever
reason i'm not sure
they made push and pop work on 64-bit
uh data by default without
the rex oh yeah and also someone
mentioned
on zoom notice they're also one byte
that's incredible they're a single bite
instruction
that uh does something actually pretty
pretty intense they will this a pop
will take the value that's at the top of
the stack
move it into reacts and then move the
stack that's pretty good
all right um
so uh other questions let's see let's
see let's see um s
trace permission so we're gonna move on
to my my list of questions
um that i've been taking notes on
um
uh so someone joined in a little late i
think and as asking about multi-state
shell code uh we went through that at
the beginning of the
um office hours um so
that'll be in the recording um or you
can probably go
even rewind to it now on twitch but
it'll be in the recording afterwards um
moving on to s trace permission so you
might have noticed that uh when you
stray something
the said uid bit does not take effect
right well that is absolutely correct um
there are actually
several um different scenarios in which
the set uid bit doesn't take effect if
you look at a program funny
and it's marked said uid the set uid bit
will not take effect because
you know it's a huge security risk um
the reason that uh s tracing a program
doesn't uh honor set uid is because
when you s trace it you launch it
with a debugger attached to it stress
works by attaching using the linux
debugging functionality which is called
the ptrace for process tracing
um and uh
with attached to a process with p trace
this is exactly what gdb uses as well
for debugging that's how gdp debugs
you can do anything to that process you
can read memory write memory read
registers write registers
obviously there's a huge security risk
so when you start a process with b-trace
the kernel will not honor the set uid
bit
so that process will start not set uid
now you might have a question well how
do i debug my freaking shell code then
right this is exactly why we gave you um
practice mode in pwn college like this
is literally exactly why
if we go to okay
if we go to
uh pwn college let me just launch up
um baby shell just to show this
oops uh
now let's do something where i don't
have to type a lot because i have this
baby
let's uh do baby suede so i'm going to
launch baby suede in practice mode
right what do you mean invalid path
i'm gonna have to follow up with connor
connor are you on this call
that's not the path sorry i'm a little
bit more distracted
than my usual self here's the bath
practice challenge
okay so that is uh launched up let's see
if the baby will be
satisfied sitting down again
okay um
ah connor's in twitch shot good anyways
all right that was my error
so i spun up uh baby cat okay
why can't you see what i was just doing
obs is having issues
that's what i was just doing i was
spinning up um
baby cat all right so let me ssh
oops
okay
all right so we are uh
everyone remembers baby sued oops
probably very lovingly bin cat is set
uid
if i launch bin cat slash flag
i get the flag if i s trace bin cat
slash flag there's no asteroids on here
um i won't get the flag
it won't work um why is this
like i said when you connect when you
launch a uh
process with a debugger it will not be
set uid because otherwise
you would have complete control right in
the exact same way you do x-rays you
could do gdb
um cat then and and uh mess around with
all the values of memory and get the
flag super easily so
this is why we gave you practice mode so
you can
sudo and become root and now you're
already rude
you can just you know whatever uh read
slash flag
directly um but now you can also do
asteroids
bin cat flag and the fstracer was
installed it would work
this is exactly why we have um practice
mode
you can do all of your debugging as root
um on your shell code s tracing gdbing
with the actual flag
everything should work then you can
log out rerun the challenge
in real mode instead of practice mode
and then when you log back in
now you don't have pseudo but um
bin cat or whatever the the flag is
is now the real flag again this is my
flag don't submit my flag but this is
for vin cat
or for uh baby swood okay
so that's uh why uh said uid
um drops or does not honor
estrace causes said uid to
not honor those permissions um
causes the colonel not to honor to set
you a deep bit that's what i was trying
to say
okay
someone had asked is it possible to do
multi-stage shell code
if there is uh uh
no write permissions on memory uh yes
but it gets very complicated and and we
didn't intend for you to do so in this
assignment um it's a good idea and
probably we should actually make um
a level 15 that requires it but um
typically what you would have to do is
execute the m protect syscall
to add write permissions to a page of
memory
and then write into that memory um but
we're not going to uh do that this year
but you might have just doomed
whoever has that might have doomed next
year's class
um okay
uh level one um
we have we're hitting the end of the
hour
um that was fast
have you really been streaming for an
hour
crazy am i still hearing people
on zoom someone say something
okay beautiful thank you i can still
hear it all right um
i feel like i'm getting a little better
at at catching the uh
chat uh questions from both twitch and
and uh zoom all right anyways on zoom
someone asked um
to demonstrate uh level one
um let's
do that real quick so actually i'm going
to solve
level one if i can um live
right now you can have it as a free flag
just for showing up
to office hours baby shell level one
i already solved it well anyways um
let's just run i'll get you the flag
someone said at what point could we
share our solutions for pawn college
after the semester is over please this
is a class
at asu um
okay
uh
so we are um ah
and then someone let me let me add a
note
oh hold on
uh quick break um we're gonna do another
diaper change um i'll be right back
one sec
have some hold on
have some matrix to get everyone in the
right mindset i'll be back
you
all right we're back um
cool cool cool um let's do this all
right so
we are uh
ssh into baby shell level one testing
and actually let me actually relaunch it
in practice mode
so that i can also show you how to debug
your shell code um
all right we're in testing mode in my
home directory let's just move
all this away and we're gonna
start up our shell code dot c
or that s what we need of course is
just this global start we need a start
label and we need our that intel syntax
to be uh no prefix
okay awesome now we can start our shell
code so first
let's start with an exit shell code of
course this won't solve
the the level but we can
we can start with it
okay um so we're gonna move
the exit uh syscall number into rx
i'll do a syscall and that's it that's
our entire shell code
right so this will exit cleanly with
some exit uh
value um of course
let's compile this um
no cdlib static
shellcode elf that elf
stay with the thing okay awesome and
then we'll opt copy it out
so uh let's s-trace it
let's s trace it so you saw we did a
clean exit that is very awesome
um and let's
um all right
so now we do opt copy dump
section um
we'll dump this section into our shell
code
raw from our shell code elf
okay here is our shell code raw
nice and and simple there's that h and
then
it's just the exit zero so now we can
run
baby shell and it says okay reading
uh memory for interstate stdn and we can
pass it in to scdn shellcode.raw
and boom and it executes our shell code
okay
we can ask trace this and we'll see what
it does it closes all the file
descriptors
and then it executes shellcode
um and this shellcode
uh does an exit and now we have a
different exit value why because the
value in rdi
was some crazy thing right and and the
exit
exits with the value in rti all right
awesome now um
uh let's make shell code that actually
does something um
we are going to move uh the
value uh the the the syscall exec ve
into our ax
we're gonna move into rsi a string
pointing to bin
sh and that's going to be here
i'm going to make a new label for it
string
that bin sh okay um
and we do again
like we did earlier load effective
address of that string
we're going to move into rdi so that's
uh sorry this should be our di moving to
rsi
0 and rdx so this is
um if we go ahead and do a man exactly
this is the path is the first argument
arc v is the second and then p is the
third we don't care about our green and
v
we just want the path
um and
uh this is shellcode
if we run this we'll call bin sh
that is awesome let me prove this to you
okay um and we can
s trace baby shell
give it the shellcode.raw
and what we see it close go close and
then it maps the shell code it says and
there's the memory map
then it reads it then it executes it and
then our shell code executes bin
sage then minish runs and of course
there is no more um
content and then it it closes so what we
can do
actually instead of doing this is
uh here let's make a file of commands
that we want to run
let's do echo high and we can cat
shellcode.raw
and then commands uh can we do this
no because of the way that it reads so
let's just do it a different thing way
catch shellcode.raw and then cat
and pipe all of that into baby shell
and now we execute the shell code and
here's our shell awesome problem is
it dropped privileges right we used to
be running with
uh effective id of zero and now
we are running with out effective id of
zero
which means uh we're screwed um
sh will drop privileges unless you run
it with sh-p
this is much harder um
but i will show you an
alternative um
actually why don't we just
just do that well no no let's not be
crazy okay
um
how should we approach this well there
are multiple ways one way
is we use something that doesn't drop
privileges um
there is a shell called ksh but it's not
installed ksh won't drop privileges
um uh
you can um write your own custom program
oh zsh
zsa is also not installed i don't know
if zsa will drop privileges you should
test
um
there's a lot of uh uh
different things you can do um one of
them is to write your own
program that you will execute instead of
being sh right benesage is just a
program it's not magic
and we're going to write a program
called cat flag i already wrote it in
fact
it's right here all this program does
is open the flag and send it out to me
right so i can
compile it okay
i can run it of course it doesn't
produce anything because
the flag is not readable by my user but
this is practice mode so i can use sudo
to test it out right so that's my
practice flag
okay um does python drop privileges no
python does not so we could
actually uh run python right user bin
python let's do that that's pretty cool
that's a neat idea
um so we
we look at so we'll do been
whatever
okay um so we do uh
um
user bin python this is an interesting
uh
thing um
and now we're gonna actually use it ben
python instead of been sh
let's compile
opt copy our shell code out let's do our
cat
okay
ah it doesn't seem to fly but it is
executing
something it's waiting for us
interesting
okay so there's a question on zoom about
send file let me
run this and then i will rewrite the
shell code to use send file
and we'll go through that so
um we're gonna uh execute
uh cat flag instead of sh and that is my
cat flag program in my home directory it
does not have set uid
and it's pointless the pro home
directory is mounted in a way
that does not allow set uid um
programs to to be honored um
and uh this cat flag if i run it with
through privileges
casts the flag and we're about to run it
oh
baby's getting upset we're about to run
it with um the privileges
of baby sued which is um effective user
id root
so let's run it so we do our cat
shell code uh hold on let me compile it
opt copy the shell code out we can catch
shellcode raw
boom and there we go right
so let's say that hadn't worked we could
s-trace it
and of course when we s-trace it
the open fails of my cat flag because s
trace does not honor the set uid
but if you want as trace it you can of
course pseudo estros
and that will also work
okay um so
uh that is how you solve level one
basically i did this i can also log out
and uh restart uh
level one with
without practice mode hold on
re-run it uh restarted without practice
mode
ssh back in
and literally hit up a couple of times
i didn't save my
history well of course my home directory
is all saved
i can just copy paste that same command
and there's the real flag for my
instance for my level one testing one
don't steal that flag
get your own level one testing one flag
cool okay um
oh interesting conor on twitch said uh
you can use ipython instead of python
okay
um is there any way to use symbolic
links to prevent
needing to put a long file name in your
program this was asked on on
zoom yes there it is absolutely
um in fact someone on zoom says just
name the file a single character
if you don't put the full path if you
just put a it'll look in the current
directory for a file named a
that's very useful um
someone says for 13 do we need to change
our dot c file i don't know what you
mean by your dot c file
um i didn't have a dot c file anywhere
in this
uh oh do you mean like cat flag dot c
whoever's asking that on zoom
uh cad flag.c uh
for 13 i don't think so connor is 13
special in a way that would require
changes to the
dots
um connor said he doesn't think so
oh okay yeah 13 is uh uh level 13 is
just 12 bytes
long
yeah i mean why why i don't think it's
special in any way that
changes what you have to execute you
just have to have
shell code that is less than 12 bytes um
there is a question about home ctf
with set uid uh permissions
uh so the nose suid
flag that is on home so if i do mount
i i can see on my home
directory
yes here no set uid for home ctf
this means that if i
um put a set uid uh
um in my home directory a file that is
set uid
let's say i launch up baby sued and i
make a chmod set uid and then i chmod
uh with a set uid bit my cat flag binary
that won't help me if i execute cat flag
it won't automatically get
root access now if i execute it by
exploiting a set uad binary that lives
outside
of my home directory it'll still run
with root access so hopefully that
answered the question of how to get
around the fact that
slash home is mounted as no set uid
um
someone said um on zoom
um that if we can't write
to slash which we cannot this is not a
writable
uh file system how can we
get around having to include a full path
well
let me show you this um
let's see if the baby will let's see if
the baby will let us do this
okay we might have to be very fast
let's uh let me edit my shell code here
i'm running
home cat home ctf cat flag i can just do
cat flag and it'll look in my current
directory so let me compile it
i'll copy it out if i am in slash
and i do that
it won't work right it crashed let me
show you why
we're gonna s-trace it it tries to
exactly
cat flag and there's no such follower
directory what it's going to do is look
in the current directory if there's no
slash it'll resolve it relative
to the current directory guys this is
going to be the last thing and then i
have to go
take care of this situation if i go back
to my home directory
where there is a cad flag file in the
current directory
and i run it
then it works it it doesn't work because
i s traced it but if i don't s trace it
what you can see is it executing cat
flag and that works um
and here's my flag uh one final thing
it's the same
for if there is no slash at the
beginning of a path it's a relative path
i can do dot dot slash dot or
cad flag right this will be important
for this next homework actually
if i'm in a directory where there's a
dot dot cat flag
and i run this
uh okay okay
uh you might be out of luck i don't have
time to debug this
oh it's still exact i didn't okay gcc
ops copy
run boom it works
all right so everything else please um
that that's it for officers today
that's it for office hours today um
sorry about the crying baby
um we are going to
uh have all-stars tomorrow uh connor
holds his office hours
at 2 p.m arizona time um
if you have other questions uh email me
if you email me
please uh cc connor that's
the number one problem uh with uh
emailing me is that when you don't see
connor and i'm
buried in some insanity uh i have uh
i don't i am not as responsive as i
would like to be
but um uh if you cc connor then
then the chance of getting a fast
response
increases a lot um also partially
because i don't like dumping
uh that load onto connor so that i i i
try to do it faster
but um but also conor is extremely
responsive um
cool otherwise uh see you on wednesday
please make sure to watch all of the set
uid
uh lectures um
two are the two up right now are ones
that you will absolutely need
for the the first a couple of levels of
the homework
and then um after that you are going to
i will put out um tonight two more
that you should also watch uh by
wednesday
cool thank you very much for tuning in
to phone college office hours and i will
see you on wednesday ciao