반응형

 

gray hat python의 마지막 부분인 pydbg를 이용한 danger_track.py을 실행하게 되면

어떻게 테스트 해야 할지 모르게 된다.

 

그래서 간단한 buffer_overflow.py를 이용하여, 찍히는 로그를 확인 할 수 있다.

 

# -*- coding: cp949 -*-

from ctypes import *
import os

msvcrt = cdll.msvcrt

print ('this is process : %d (0x%04x)' % (os.getpid(), os.getpid()) )
raw_input ('Once the dubber is attached, press any key.')

buffer = c_char_p("AAAAA")
overflow = "A" * 1000000

msvcrt.strcpy(buffer, overflow)

 

위의 내용을 기반으로 돌리게 되면, bof는 발생하나 EIP 부분이 바뀌지 않는 것을 확인 할 수 있다.

 

CONTEXT DUMP
  EIP: 1e0acf39 mov esi,[eax]
  EAX: 41414141 (1094795585) -> N/A
  EBX: 00000009 (         9) -> N/A
  ECX: 00bc6000 (  12345344) -> BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (heap)
  EDX: 41414141 (1094795585) -> N/A
  EDI: 0000004c (        76) -> N/A
  ESI: 1d1b0dca ( 488312266) -> N/A
  EBP: 1d1b0dc8 ( 488312264) -> N/A
  ESP: 0021fb1c (   2226972) -> 7>L747,!STx!,!8Tx!!p;p!P!`wp?@W$!P!=!! (stack)
  +00: 1d1b0dca ( 488312266) -> N/A
  +04: 00000000 (         0) -> N/A
  +08: 00000037 (        55) -> N/A
  +0c: 1e0b3e9e ( 504053406) -> N/A
  +10: 0000004c (        76) -> N/A
  +14: 1d1b0dca ( 488312266) -> N/A

 

EIP가 바뀌지 않으면 까다로운 작업이 되므로, 눈으로 쉽게 확인 할 수 있는 방법은 EIP가 덮이느냐, 덮히지 않느냐를 확인하는 것이 나에겐 무지 중요한 부분이다.

(이후에서는 crash만 나더라도 더 명확하게 되는건지 확인 할 수 있겠지만 현재로는 EIP를 기반으로 찾고 있다.)

 

그러던 중, war-ftpd v.1.65 프로그램을 구한 뒤 테스트를 진행 하였다.

war-ftpd는 다행히도 EIP가 덮어졌다.

CONTEXT DUMP
  EIP: 41414141 Unable to disassemble at 41414141
  EAX: 00000000 (         0) -> N/A
  EBX: 00000000 (         0) -> N/A
  ECX: 41414141 (1094795585) -> N/A
  EDX: 7c9332bc (2090021564) -> N/A
  EDI: 00000000 (         0) -> N/A
  ESI: 00000000 (         0) -> N/A
  EBP: 00aebf18 (  11452184) -> N/A
  ESP: 00aebef8 (  11452152) -> 2|2|z2|AAAA|AAAAkc~`LPD@;hL@;|x;x;j|AAAA (heap)
  +00: 7c9332a8 (2090021544) -> N/A
  +04: 00aebfe0 (  11452384) -> AAAAAAAA?@=&HZppppeH8x???;##2|AAAAAAAAF#@=&HZ (heap)
  +08: 00aefd94 (  11468180) -> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (stack)
  +0c: 00aebffc (  11452412) -> ?@=&HZppppeH8x???;##2|AAAAAAAAF#@=&HZpppp (heap)
  +10: 00aebfb4 (  11452340) -> j|AAAAAAAA?@=&HZppppeH8x???;##2|AAAA (heap)
  +14: 00aec2dc (  11453148) -> 2|z2|AAAA|AAAAj|AAAAAAAA? (stack)

 

아주 ESP까지 덕지 덕지 붙어져 있는 것을 확인 할 수 있다.

danger_track은 tracking을 하기 위한 모니터링 툴이다. 즉, 어디에서 크래쉬가 발생하였는지에 대한 메모리 참조를 하기 위한 도구이지 fuzzing 도구가 아닌다. (fuzzing 도구인지 알고 무쟈게 즐거워했는데..ㅡㅡ;;)

 

이 것으로 danger_track 테스트를 마무리 하겠다.

즐거운 하루 되시길....

 

Tip : 누구든 생각하겠죠? danger_track은 print로 출력 하고 있습니다. 그 부분을 파일로 떨구면 보기도 편하고

또한, 파일명으로 dump 파일을 생성하면 추후에 다양한 내용들을 dump 하더라도 섞일 염려가 없으니 참고하시길....

관련 코드는 아래와 같습니다.

 

proc_name = psutil.Process(pid)
targetFile_Name = proc_name.name + '_crash_dump.txt'
output_fw = file(targetFile_Name, 'w')
반응형
반응형

이늠의 pydbg는 언제쯤 내 맘대로 움직일까..ㅡ.ㅡ;;

일단 동작은 하는데 영 찜찜하게 끝났네....

 

우선, MEM_IMAGE를 snap 을 안 떠서 crash 계속 나고 원인 찾는다고

삽질의 삽질 한 끝에 좋은 사이트 하나 얻었고, 해당 내용을 적용하니 되긴 된다.

 

http://linkc.tistory.com/entry/Analysis-about-Pydbg-Snapshot

 

            # do not snapshot blocks of memory that match the following characteristics.
            # XXX - might want to drop the MEM_IMAGE check to accomodate for self modifying code.
            #if mbi.State != MEM_COMMIT or mbi.Type == MEM_IMAGE:
            if mbi.State != MEM_COMMIT:

- pydbg.py 수정 -

 

또한, pydbg에서 self._log()를 출력하는데 내용이 안나오는 이유는 상단에 아래와 같은 코드로 막아 놓았기 때문이다.

 

self._log = lambda msg: None #sys.stderr.write("PDBG_LOG> " + msg + "\n")

-> self._log = lambda msg: sys.stderr.write("PDBG_LOG> " + msg + "\n")

 

XP에서는 잘 되는데....Win 7에서는 안되는 이유...ㅡ.ㅡ

파라매터가 잘못 됐다????

 

GetLastError : 87 (0x57)

ERROR_INVALID_PARAMETER
 

 

 

위와 같은 에러가 발생하지만 정상적으로 동작은 된다.

 

적용은 되는데, 저 에러코드를 못 잡겠는데 누가 잡은 사람 있는 사람~~~

댓글 남겨주셈~~T-T

please. anybody is request me to solution picture T-T

have a good day.

반응형
반응형

These instructions are for Windows XP => Windows 7 using Python 2.7 (though other versions should work too)

Thanks to louppen for the great starting point!

  1. Download and install MinGW Compilier v20101030
    • Make sure to use pre-packaged repo catalogs and the old version! PyDasm barfs when compiling because MinGW32 removed support for -mno-cygwin! Bug Report
    • On the "Select Components" dialog check C++ Compiler and ObjC Compiler in addition to selected by default set
  2. Download and install Python 2.7 (x64)
  3. Download and install Git for windows
    • Make sure it adds git to your path variable!
  4. Update $PATH to include C:\Python27 and C:\MinGW\bin KB article
  5. Checkout pydbg

    C:\sulley_build>git clone https://Fitblip@github.com/Fitblip/pydbg.git
    Cloning into 'pydbg'...
    remote: Counting objects: 17, done.
    remote: Compressing objects: 100% (12/12), done.
    remote: Total 17 (delta 4), reused 17 (delta 4)
    Unpacking objects: 100% (17/17), done.
    
  6. Build pydbg

    C:\sulley_build\pydbg>python setup.py install
    running install
    running build
    running build_py
    creating build
    creating build\lib
    creating build\lib\pydbg
    ...snip...
    running install_egg_info
    Removing C:\python27\Lib\site-packages\pydbg-0.0.0-py2.7.egg-info
    Writing C:\python27\Lib\site-packages\pydbg-0.0.0-py2.7.egg-info
    
  7. Download and extract libdasm

  8. Build the extention and install it (beware of gcc version 4.7.x removed support for -mno-cygwin, seehttp://stackoverflow.com/q/6034390/333353 and https://gist.github.com/4466320 for a fix)

    C:\sulley_build\libdisasm\pydasm>python setup.py build_ext -c mingw32
    running build_ext
    building 'pydasm' extension
    ...snip...
    C:\sulley_build\libdisasm\pydasm>python setup.py install
    running install
    running build
    running build_ext
    running install_lib
    copying build\lib.win32-2.7\pydasm.pyd -> C:\python27\Lib\site-packages
    running install_egg_info
    Writing C:\python27\Lib\site-packages\pydasm-1.5-py2.7.egg-info
    
  9. Checkout Sulley

    C:\sulley_build>git clone https://github.com/OpenRCE/sulley.git
    Cloning into 'sulley'...
    remote: Counting objects: 148, done.
    remote: Compressing objects: 100% (91/91), done.
    remote: Total 148 (delta 53), reused 146 (delta 51)
    Receiving objects: 100% (148/148), 267.03 KiB, done.
    Resolving deltas: 100% (53/53), done.
    
  10. Make sure process_monitor.py works (no import errors)

     C:\sulley_build\sulley>python process_monitor.py
     ERR> USAGE: process_monitor.py
         <-c|--crash_bin FILENAME> filename to serialize crash bin class to
         [-p|--proc_name NAME]     process name to search for and attach to
         [-i|--ignore_pid PID]     ignore this PID when searching for the target process
         [-l|--log_level LEVEL]    log level (default 1), increase for more verbosity
         [--port PORT]             TCP port to bind this agent to
    
  11. Download and extract PCapy

  12. Download and extract WinPcap Dev Kit (I put mine in C:\sulley_build\WpdPack)

  13. Build PCapy (pointing to WinPcap's include and lib directories) and install it

    C:\sulley_build\pcapy-0.10.5>python setup.py build_ext -c mingw32 -I "C:\sulley_build\WpdPack\Include" -L "C:\sulley_build\WpdPack\Lib"
    running build_ext
    building 'pcapy' extension
    creating build
    creating build\temp.win32-2.7
    creating build\temp.win32-2.7\Release
    creating build\temp.win32-2.7\Release\win32
    ...snip...
    C:\sulley_build\pcapy-0.10.5>python setup.py install
    running install
    running build
    running build_ext
    running install_lib
    copying build\lib.win32-2.7\pcapy.pyd -> C:\python27\Lib\site-packages
    running install_data
    creating C:\python27\share
    creating C:\python27\share\doc
    creating C:\python27\share\doc\pcapy
    copying README -> C:\python27\share\doc\pcapy
    copying LICENSE -> C:\python27\share\doc\pcapy
    copying pcapy.html -> C:\python27\share\doc\pcapy
    running install_egg_info
    Writing C:\python27\Lib\site-packages\pcapy-0.10.5-py2.7.egg-info
    
  14. Download and install WinPcap

  15. Download and extract Impacket

  16. Install Impacket

    C:\sulley_build\Impacket-0.9.6.0>python setup.py install
    running install
    running build
    running build_py
    creating build
    creating build\lib
    creating build\lib\impacket
    copying impacket\ImpactDecoder.py -> build\lib\impacket
    copying impacket\ImpactPacket.py -> build\lib\impacket
    copying impacket\nmb.py -> build\lib\impacket
    copying impacket\ntlm.py -> build\lib\impacket
    copying impacket\smb.py -> build\lib\impacket
    copying impacket\structure.py -> build\lib\impacket
    copying impacket\uuid.py -> build\lib\impacket
    copying impacket\__init__.py -> build\lib\impacket
    creating build\lib\impacket\dcerpc
    ...snip...
    
  17. Check to make sure network_monitor.py works

    C:\sulley_build\sulley>python network_monitor.py
    ERR> USAGE: network_monitor.py
        <-d|--device DEVICE #>    device to sniff on (see list below)
        [-f|--filter PCAP FILTER] BPF filter string
        [-P|--log_path PATH]      log directory to store pcaps to
        [-l|--log_level LEVEL]    log level (default 1), increase for more verbosity
    
        [--port PORT]             TCP port to bind this agent to
    
    Network Device List:
        [0] \Device\NPF_GenericDialupAdapter
        [1] {CF0B388B-8DF5-4BC4-8ECF-404F2A1B489C}  10.0.2.64


반응형

+ Recent posts