0

I've been working my way through a security games site, trying to automate what I'm doing using pwntools. I've come across a problem somewhere in my process, however. When I try to run the vulnerable program on the server with my exploit string, it gets changed somewhere between the Python 2.7 script on my machine, and being returned back to me.

My general process for this particular challenge is as follows:

  1. Initiate SSH connection
  2. Open a shell through the SSH connection, I've tried "/bin/bash", "/bin/sh"
  3. Wait until I get the prompt
  4. Send the command in the format "%s %s" % (program_on_server, payload_string)

My payload string is the bytes "\x74\x84\x04\x08" repeated many times. The problem I'm having is that when the server echoes back what I've sent to the running shell, this is transformed into "\x74\x84\x07\x08\x1b\x5b\x4b". After some troubleshooting, I can't figure out where the extra bytes are coming from, or why the \x04 is getting turned into \x07. Pwntools seems to think it's sending the right bytes, the debug output shows the correct ones at least, so I am thinking the problem is somewhere server side in the chain from ssh to bash to the vulnerable program. Hence, posting it here and not somewhere more related to pwntools. Does anybody have any insight what might be causing this and why it's doing it?

The following is my code, with functions where the login information would go.

#!/usr/bin/python2
from pwn import *

context.log_level = 'debug'

def makePayloadString():
    return p32(0x8048474)* 20 # p32 takes a 32 bit number and converts it to bytes

sshConnection = ssh(user=getUser(), host=getHost(), password=getPassword())
command = "%s %s" % (getProgramLocation(), makePayloadString())
shell = sshConnection.shell("/bin/bash")
shell.recvuntil("$ ", timeout=10)
shell.sendline(command)
shell.recvline(timeout=10)
  • We would need at the very least to see your code. And we'd also need to understand why you expect the server to echo back what you typed. What program is running on the server? How is it set up — a security game is likely to have some unusual setup? How does bash get into the chain between your client and the vulnerable program? – Gilles Sep 27 '15 at 23:36
  • I added my code. I'm not actually sure why the server echoes back, I was just using that to debug. What's running on the server is bash, from which I run a simple vulnerable binary that takes a single argument from the command line. But I don't think that's the issue, from what the server is echoing back, I'm thinking the input is getting edited before the program is run. – Paul Sep 28 '15 at 0:32
2

It appears that the bytes you are getting back from the server side are coming from the shell, reacting to the input bytes as if they are being typed into the terminal session.

Not sure what 0x84 is interpreted as a non-7bit ascii code, but the 0x04 would be equivalent to a Ctrl-D (EOF) character, that bash will reject if not entered at the beginning of the line. Bash will send a 0x07 (BEL) character to the terminal to ring the bell (beep). The 0x08 is a backspace (BS) character, that bash echoes back the ANSI escape sequence (ESC[K) (\x1b\x5b\x4b) that backs the input cursor one space left.

In an interactive terminal, try typing the characters 't', and you should be able to reproduce the programmatic output you see in close approximation.

Perhaps these bytes should be sent to a different program's input instead of bash or sh ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.