From 0c428da33f081a66a9662f505e9d7fe2d651f788 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20=C5=98epa?= Date: Sun, 10 Nov 2024 21:43:41 +0100 Subject: [PATCH] kick-off class8 --- classes/class08/Dockerfile | 19 + classes/class08/docker-compose.yml | 19 + classes/class08/files/demo0/Makefile | 7 + classes/class08/files/demo0/main.c | 16 + classes/class08/files/stack0/Makefile | 2 + classes/class08/files/stack0/main.c | 19 + classes/class08/files/stack1/Makefile | 2 + classes/class08/files/stack1/exploit.py | 12 + classes/class08/files/stack1/main.c | 22 + classes/class08/files/stack2/Makefile | 2 + classes/class08/files/stack2/exploit.py | 10 + classes/class08/files/stack2/main.c | 14 + classes/class08/files/stack3/Makefile | 2 + classes/class08/files/stack3/exploit.py | 9 + classes/class08/files/stack3/main.c | 12 + classes/class08/meta.json | 7 + classes/class08/seccomp-profile.json | 769 ++++++++++++++++++++++++ classes/class08/sshd_config | 7 + docs/development.md | 3 +- 19 files changed, 951 insertions(+), 2 deletions(-) create mode 100644 classes/class08/Dockerfile create mode 100644 classes/class08/docker-compose.yml create mode 100644 classes/class08/files/demo0/Makefile create mode 100644 classes/class08/files/demo0/main.c create mode 100644 classes/class08/files/stack0/Makefile create mode 100644 classes/class08/files/stack0/main.c create mode 100644 classes/class08/files/stack1/Makefile create mode 100644 classes/class08/files/stack1/exploit.py create mode 100644 classes/class08/files/stack1/main.c create mode 100644 classes/class08/files/stack2/Makefile create mode 100644 classes/class08/files/stack2/exploit.py create mode 100644 classes/class08/files/stack2/main.c create mode 100644 classes/class08/files/stack3/Makefile create mode 100644 classes/class08/files/stack3/exploit.py create mode 100644 classes/class08/files/stack3/main.c create mode 100644 classes/class08/meta.json create mode 100644 classes/class08/seccomp-profile.json create mode 100644 classes/class08/sshd_config diff --git a/classes/class08/Dockerfile b/classes/class08/Dockerfile new file mode 100644 index 0000000..1a117b0 --- /dev/null +++ b/classes/class08/Dockerfile @@ -0,0 +1,19 @@ +FROM debian:bookworm + +RUN apt update && apt install -y openssh-server gdb vim nano tmux make gcc python3 checksec python3-pip git + +RUN pip3 install --user ropper --break-system-packages + +RUN mkdir -p /var/run/sshd +RUN mkdir -p /root/.ssh + +COPY sshd_config /etc/ssh/sshd_config +COPY files /data/binary-exploit-class + +ENV TERM=xterm-256color + +RUN echo "PS1='\e[92m\u\e[0m@\e[94m\h\e[0m:\e[35m\w\e[0m# '" >> /root/.bashrc +RUN echo "root:admin" | chpasswd +RUN echo 'PATH=$PATH:/root/.local/bin' >> /root/.bashrc # for the ropper binary + +CMD ["/usr/sbin/sshd", "-D"] diff --git a/classes/class08/docker-compose.yml b/classes/class08/docker-compose.yml new file mode 100644 index 0000000..a652dbc --- /dev/null +++ b/classes/class08/docker-compose.yml @@ -0,0 +1,19 @@ +version: '3.3' + +services: + class-08-exploit-lab: + build: . + platform: linux/amd64 # important + security_opt: + - seccomp:/classes/class08/seccomp-profile.json + stop_grace_period: 0s + hostname: class8-exploitation-lab + container_name: scl-class-08-exploitation-lab + + networks: + playground-net: + ipv4_address: 172.20.0.115 + +networks: + playground-net: + external: true \ No newline at end of file diff --git a/classes/class08/files/demo0/Makefile b/classes/class08/files/demo0/Makefile new file mode 100644 index 0000000..c26ac96 --- /dev/null +++ b/classes/class08/files/demo0/Makefile @@ -0,0 +1,7 @@ +make: normal no-pie + +normal: + gcc main.c -o main + +no-pie: + gcc main.c -o main-no-pie -no-pie diff --git a/classes/class08/files/demo0/main.c b/classes/class08/files/demo0/main.c new file mode 100644 index 0000000..ff75979 --- /dev/null +++ b/classes/class08/files/demo0/main.c @@ -0,0 +1,16 @@ +#include +#include + +int foo() { + return 0; +} + +int main() { + int stackVar = 666; + + printf("Address of a local variable : %p\n", &stackVar); + printf("Address of a our 'foo' function : %p\n", &foo); + printf("Address of a libc 'system' function: %p\n", &system); + + return 0; +} diff --git a/classes/class08/files/stack0/Makefile b/classes/class08/files/stack0/Makefile new file mode 100644 index 0000000..ee9349d --- /dev/null +++ b/classes/class08/files/stack0/Makefile @@ -0,0 +1,2 @@ +make: + gcc main.c -o main diff --git a/classes/class08/files/stack0/main.c b/classes/class08/files/stack0/main.c new file mode 100644 index 0000000..749968a --- /dev/null +++ b/classes/class08/files/stack0/main.c @@ -0,0 +1,19 @@ +#include +#include + +int main() { + volatile int modified; + char buffer[64]; + + modified = 0; + + gets(buffer); + + if (modified != 0 ) { + printf("Access granted\n"); + } else { + printf("Access denied\n"); + } + + return 0; +} diff --git a/classes/class08/files/stack1/Makefile b/classes/class08/files/stack1/Makefile new file mode 100644 index 0000000..2bc43a3 --- /dev/null +++ b/classes/class08/files/stack1/Makefile @@ -0,0 +1,2 @@ +make: + gcc main.c -o main -fno-stack-protector -no-pie diff --git a/classes/class08/files/stack1/exploit.py b/classes/class08/files/stack1/exploit.py new file mode 100644 index 0000000..0b155fc --- /dev/null +++ b/classes/class08/files/stack1/exploit.py @@ -0,0 +1,12 @@ +import struct +import sys + + +buff_size = 0x0 # CHANGE ME +func_adrr = 0x0 # CHANGE ME + +buff = b"A"* (buff_size-8) +buff += struct.pack("Q", func_adrr) +buff += b"\n" + +sys.stdout.buffer.write(buff) diff --git a/classes/class08/files/stack1/main.c b/classes/class08/files/stack1/main.c new file mode 100644 index 0000000..1999851 --- /dev/null +++ b/classes/class08/files/stack1/main.c @@ -0,0 +1,22 @@ +#include +#include + +void success() { + printf("Access granted!\n"); +} + +void failure() { + printf("Access denied!\n"); +} + +int main() { + volatile void (*fp)() = failure; + + char buffer[64]; + + gets(buffer); + + fp(); + + return 0; +} diff --git a/classes/class08/files/stack2/Makefile b/classes/class08/files/stack2/Makefile new file mode 100644 index 0000000..f9c6a67 --- /dev/null +++ b/classes/class08/files/stack2/Makefile @@ -0,0 +1,2 @@ +make: + gcc main.c -o main -no-pie -fno-stack-protector diff --git a/classes/class08/files/stack2/exploit.py b/classes/class08/files/stack2/exploit.py new file mode 100644 index 0000000..ae05d46 --- /dev/null +++ b/classes/class08/files/stack2/exploit.py @@ -0,0 +1,10 @@ +import struct +import sys + +size = 0x0 # CHANGE ME +func_addr = 0x0 # CHANGE ME + +buff = b"" # CHANGE ME +buff += b"\n" + +sys.stdout.buffer.write(buff) diff --git a/classes/class08/files/stack2/main.c b/classes/class08/files/stack2/main.c new file mode 100644 index 0000000..4e22d88 --- /dev/null +++ b/classes/class08/files/stack2/main.c @@ -0,0 +1,14 @@ +#include +#include + +void success() { + printf("Access granted!\n"); +} + +int main() { + char buffer[64]; + + gets(buffer); + + return 0; +} diff --git a/classes/class08/files/stack3/Makefile b/classes/class08/files/stack3/Makefile new file mode 100644 index 0000000..ee2fd27 --- /dev/null +++ b/classes/class08/files/stack3/Makefile @@ -0,0 +1,2 @@ +make: + gcc main.c -o main -fno-stack-protector diff --git a/classes/class08/files/stack3/exploit.py b/classes/class08/files/stack3/exploit.py new file mode 100644 index 0000000..bbe6ec5 --- /dev/null +++ b/classes/class08/files/stack3/exploit.py @@ -0,0 +1,9 @@ +import struct +import sys + +# Finish the exploit + +buff = b"" +buff += b"\n" + +sys.stdout.buffer.write(buff) diff --git a/classes/class08/files/stack3/main.c b/classes/class08/files/stack3/main.c new file mode 100644 index 0000000..4b54359 --- /dev/null +++ b/classes/class08/files/stack3/main.c @@ -0,0 +1,12 @@ +#include +#include + +int main() { + char buffer[64]; + + gets(buffer); + + printf("%s\n", buffer); + + return 0; +} diff --git a/classes/class08/meta.json b/classes/class08/meta.json new file mode 100644 index 0000000..d1ec06a --- /dev/null +++ b/classes/class08/meta.json @@ -0,0 +1,7 @@ +{ + "name": "Class 08 - Binary exploitation", + "id": "class-08", + "description": "The eight class focuses on binary exploitation and fuzzing. Please open the Google document provided to all registered students and follow the document.", + "google_doc_url": "", + "yt_recording_url": "" +} diff --git a/classes/class08/seccomp-profile.json b/classes/class08/seccomp-profile.json new file mode 100644 index 0000000..eb01da7 --- /dev/null +++ b/classes/class08/seccomp-profile.json @@ -0,0 +1,769 @@ +{ + "defaultAction": "SCMP_ACT_ERRNO", + "defaultErrnoRet": 1, + "archMap": [ + { + "architecture": "SCMP_ARCH_X86_64", + "subArchitectures": [ + "SCMP_ARCH_X86", + "SCMP_ARCH_X32" + ] + }, + { + "architecture": "SCMP_ARCH_AARCH64", + "subArchitectures": [ + "SCMP_ARCH_ARM" + ] + }, + { + "architecture": "SCMP_ARCH_MIPS64", + "subArchitectures": [ + "SCMP_ARCH_MIPS", + "SCMP_ARCH_MIPS64N32" + ] + }, + { + "architecture": "SCMP_ARCH_MIPS64N32", + "subArchitectures": [ + "SCMP_ARCH_MIPS", + "SCMP_ARCH_MIPS64" + ] + }, + { + "architecture": "SCMP_ARCH_MIPSEL64", + "subArchitectures": [ + "SCMP_ARCH_MIPSEL", + "SCMP_ARCH_MIPSEL64N32" + ] + }, + { + "architecture": "SCMP_ARCH_MIPSEL64N32", + "subArchitectures": [ + "SCMP_ARCH_MIPSEL", + "SCMP_ARCH_MIPSEL64" + ] + }, + { + "architecture": "SCMP_ARCH_S390X", + "subArchitectures": [ + "SCMP_ARCH_S390" + ] + }, + { + "architecture": "SCMP_ARCH_RISCV64", + "subArchitectures": null + } + ], + "syscalls": [ + { + "names": [ + "accept", + "accept4", + "access", + "adjtimex", + "alarm", + "bind", + "brk", + "cachestat", + "capget", + "capset", + "chdir", + "chmod", + "chown", + "chown32", + "clock_adjtime", + "clock_adjtime64", + "clock_getres", + "clock_getres_time64", + "clock_gettime", + "clock_gettime64", + "clock_nanosleep", + "clock_nanosleep_time64", + "close", + "close_range", + "connect", + "copy_file_range", + "creat", + "dup", + "dup2", + "dup3", + "epoll_create", + "epoll_create1", + "epoll_ctl", + "epoll_ctl_old", + "epoll_pwait", + "epoll_pwait2", + "epoll_wait", + "epoll_wait_old", + "eventfd", + "eventfd2", + "execve", + "execveat", + "exit", + "exit_group", + "faccessat", + "faccessat2", + "fadvise64", + "fadvise64_64", + "fallocate", + "fanotify_mark", + "fchdir", + "fchmod", + "fchmodat", + "fchmodat2", + "fchown", + "fchown32", + "fchownat", + "fcntl", + "fcntl64", + "fdatasync", + "fgetxattr", + "flistxattr", + "flock", + "fork", + "fremovexattr", + "fsetxattr", + "fstat", + "fstat64", + "fstatat64", + "fstatfs", + "fstatfs64", + "fsync", + "ftruncate", + "ftruncate64", + "futex", + "futex_requeue", + "futex_time64", + "futex_wait", + "futex_waitv", + "futex_wake", + "futimesat", + "getcpu", + "getcwd", + "getdents", + "getdents64", + "getegid", + "getegid32", + "geteuid", + "geteuid32", + "getgid", + "getgid32", + "getgroups", + "getgroups32", + "getitimer", + "getpeername", + "getpgid", + "getpgrp", + "getpid", + "getppid", + "getpriority", + "getrandom", + "getresgid", + "getresgid32", + "getresuid", + "getresuid32", + "getrlimit", + "get_robust_list", + "getrusage", + "getsid", + "getsockname", + "getsockopt", + "get_thread_area", + "gettid", + "gettimeofday", + "getuid", + "getuid32", + "getxattr", + "inotify_add_watch", + "inotify_init", + "inotify_init1", + "inotify_rm_watch", + "io_cancel", + "ioctl", + "io_destroy", + "io_getevents", + "io_pgetevents", + "io_pgetevents_time64", + "ioprio_get", + "ioprio_set", + "io_setup", + "io_submit", + "ipc", + "kill", + "landlock_add_rule", + "landlock_create_ruleset", + "landlock_restrict_self", + "lchown", + "lchown32", + "lgetxattr", + "link", + "linkat", + "listen", + "listxattr", + "llistxattr", + "_llseek", + "lremovexattr", + "lseek", + "lsetxattr", + "lstat", + "lstat64", + "madvise", + "map_shadow_stack", + "membarrier", + "memfd_create", + "memfd_secret", + "mincore", + "mkdir", + "mkdirat", + "mknod", + "mknodat", + "mlock", + "mlock2", + "mlockall", + "mmap", + "mmap2", + "mprotect", + "mq_getsetattr", + "mq_notify", + "mq_open", + "mq_timedreceive", + "mq_timedreceive_time64", + "mq_timedsend", + "mq_timedsend_time64", + "mq_unlink", + "mremap", + "msgctl", + "msgget", + "msgrcv", + "msgsnd", + "msync", + "munlock", + "munlockall", + "munmap", + "name_to_handle_at", + "nanosleep", + "newfstatat", + "_newselect", + "open", + "openat", + "openat2", + "pause", + "pidfd_open", + "pidfd_send_signal", + "pipe", + "pipe2", + "pkey_alloc", + "pkey_free", + "pkey_mprotect", + "poll", + "ppoll", + "ppoll_time64", + "prctl", + "pread64", + "preadv", + "preadv2", + "prlimit64", + "process_mrelease", + "pselect6", + "pselect6_time64", + "pwrite64", + "pwritev", + "pwritev2", + "read", + "readahead", + "readlink", + "readlinkat", + "readv", + "recv", + "recvfrom", + "recvmmsg", + "recvmmsg_time64", + "recvmsg", + "remap_file_pages", + "removexattr", + "rename", + "renameat", + "renameat2", + "restart_syscall", + "rmdir", + "rseq", + "rt_sigaction", + "rt_sigpending", + "rt_sigprocmask", + "rt_sigqueueinfo", + "rt_sigreturn", + "rt_sigsuspend", + "rt_sigtimedwait", + "rt_sigtimedwait_time64", + "rt_tgsigqueueinfo", + "sched_getaffinity", + "sched_getattr", + "sched_getparam", + "sched_get_priority_max", + "sched_get_priority_min", + "sched_getscheduler", + "sched_rr_get_interval", + "sched_rr_get_interval_time64", + "sched_setaffinity", + "sched_setattr", + "sched_setparam", + "sched_setscheduler", + "sched_yield", + "seccomp", + "select", + "semctl", + "semget", + "semop", + "semtimedop", + "semtimedop_time64", + "send", + "sendfile", + "sendfile64", + "sendmmsg", + "sendmsg", + "sendto", + "setfsgid", + "setfsgid32", + "setfsuid", + "setfsuid32", + "setgid", + "setgid32", + "setgroups", + "setgroups32", + "setitimer", + "setpgid", + "setpriority", + "setregid", + "setregid32", + "setresgid", + "setresgid32", + "setresuid", + "setresuid32", + "setreuid", + "setreuid32", + "setrlimit", + "set_robust_list", + "setsid", + "setsockopt", + "set_thread_area", + "set_tid_address", + "setuid", + "setuid32", + "setxattr", + "shmat", + "shmctl", + "shmdt", + "shmget", + "shutdown", + "sigaltstack", + "signalfd", + "signalfd4", + "sigprocmask", + "sigreturn", + "socketcall", + "socketpair", + "splice", + "stat", + "stat64", + "statfs", + "statfs64", + "statx", + "symlink", + "symlinkat", + "sync", + "sync_file_range", + "syncfs", + "sysinfo", + "tee", + "tgkill", + "time", + "timer_create", + "timer_delete", + "timer_getoverrun", + "timer_gettime", + "timer_gettime64", + "timer_settime", + "timer_settime64", + "timerfd_create", + "timerfd_gettime", + "timerfd_gettime64", + "timerfd_settime", + "timerfd_settime64", + "times", + "tkill", + "truncate", + "truncate64", + "ugetrlimit", + "umask", + "uname", + "unlink", + "unlinkat", + "utime", + "utimensat", + "utimensat_time64", + "utimes", + "vfork", + "vmsplice", + "wait4", + "waitid", + "waitpid", + "write", + "writev", + "personality" + ], + "action": "SCMP_ACT_ALLOW" + }, + { + "names": [ + "process_vm_readv", + "process_vm_writev", + "ptrace" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "minKernel": "4.8" + } + }, + { + "names": [ + "socket" + ], + "action": "SCMP_ACT_ALLOW", + "args": [ + { + "index": 0, + "value": 40, + "op": "SCMP_CMP_NE" + } + ] + }, + { + "names": [ + "sync_file_range2", + "swapcontext" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "arches": [ + "ppc64le" + ] + } + }, + { + "names": [ + "arm_fadvise64_64", + "arm_sync_file_range", + "sync_file_range2", + "breakpoint", + "cacheflush", + "set_tls" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "arches": [ + "arm", + "arm64" + ] + } + }, + { + "names": [ + "arch_prctl" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "arches": [ + "amd64", + "x32" + ] + } + }, + { + "names": [ + "modify_ldt" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "arches": [ + "amd64", + "x32", + "x86" + ] + } + }, + { + "names": [ + "s390_pci_mmio_read", + "s390_pci_mmio_write", + "s390_runtime_instr" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "arches": [ + "s390", + "s390x" + ] + } + }, + { + "names": [ + "riscv_flush_icache" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "arches": [ + "riscv64" + ] + } + }, + { + "names": [ + "open_by_handle_at" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_DAC_READ_SEARCH" + ] + } + }, + { + "names": [ + "bpf", + "clone", + "clone3", + "fanotify_init", + "fsconfig", + "fsmount", + "fsopen", + "fspick", + "lookup_dcookie", + "mount", + "mount_setattr", + "move_mount", + "open_tree", + "perf_event_open", + "quotactl", + "quotactl_fd", + "setdomainname", + "sethostname", + "setns", + "syslog", + "umount", + "umount2", + "unshare" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_SYS_ADMIN" + ] + } + }, + { + "names": [ + "clone" + ], + "action": "SCMP_ACT_ALLOW", + "args": [ + { + "index": 0, + "value": 2114060288, + "op": "SCMP_CMP_MASKED_EQ" + } + ], + "excludes": { + "caps": [ + "CAP_SYS_ADMIN" + ], + "arches": [ + "s390", + "s390x" + ] + } + }, + { + "names": [ + "clone" + ], + "action": "SCMP_ACT_ALLOW", + "args": [ + { + "index": 1, + "value": 2114060288, + "op": "SCMP_CMP_MASKED_EQ" + } + ], + "comment": "s390 parameter ordering for clone is different", + "includes": { + "arches": [ + "s390", + "s390x" + ] + }, + "excludes": { + "caps": [ + "CAP_SYS_ADMIN" + ] + } + }, + { + "names": [ + "clone3" + ], + "action": "SCMP_ACT_ERRNO", + "errnoRet": 38, + "excludes": { + "caps": [ + "CAP_SYS_ADMIN" + ] + } + }, + { + "names": [ + "reboot" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_SYS_BOOT" + ] + } + }, + { + "names": [ + "chroot" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_SYS_CHROOT" + ] + } + }, + { + "names": [ + "delete_module", + "init_module", + "finit_module" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_SYS_MODULE" + ] + } + }, + { + "names": [ + "acct" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_SYS_PACCT" + ] + } + }, + { + "names": [ + "kcmp", + "pidfd_getfd", + "process_madvise", + "process_vm_readv", + "process_vm_writev", + "ptrace" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_SYS_PTRACE" + ] + } + }, + { + "names": [ + "iopl", + "ioperm" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_SYS_RAWIO" + ] + } + }, + { + "names": [ + "settimeofday", + "stime", + "clock_settime", + "clock_settime64" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_SYS_TIME" + ] + } + }, + { + "names": [ + "vhangup" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_SYS_TTY_CONFIG" + ] + } + }, + { + "names": [ + "get_mempolicy", + "mbind", + "set_mempolicy", + "set_mempolicy_home_node" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_SYS_NICE" + ] + } + }, + { + "names": [ + "syslog" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_SYSLOG" + ] + } + }, + { + "names": [ + "bpf" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_BPF" + ] + } + }, + { + "names": [ + "perf_event_open" + ], + "action": "SCMP_ACT_ALLOW", + "includes": { + "caps": [ + "CAP_PERFMON" + ] + } + } + ] +} \ No newline at end of file diff --git a/classes/class08/sshd_config b/classes/class08/sshd_config new file mode 100644 index 0000000..26578be --- /dev/null +++ b/classes/class08/sshd_config @@ -0,0 +1,7 @@ +PermitRootLogin yes +ChallengeResponseAuthentication no +UsePAM yes +X11Forwarding yes +PrintMotd no +AcceptEnv LANG LC_* +Banner /etc/banner \ No newline at end of file diff --git a/docs/development.md b/docs/development.md index f0612eb..4262bd4 100644 --- a/docs/development.md +++ b/docs/development.md @@ -57,8 +57,7 @@ | playground-net | `172.20.0.99` | [Class06](./../classes/class06) | | playground-net | `172.20.0.108` | [Class07](./../classes/class07) | | playground-net | `172.20.0.110` | [Class07](./../classes/class07) | - -TODO +| playground-net | `172.20.0.115` | [Class08](./../classes/class08) | ## Testing