64位Linux上的缓冲区溢出

Question

I have been playing around with buffer overflows for fun. I have been able to run some simple exploits. I have been doing this by using a "C" code that casts a character string containing the shell code to a function pointer. Doing this is quite interesting for me, for instance I have never assumed that a function pointer, can allow the user to execute code, which is not even hard coded in the source. For a simple example see below:

#include <unistd.h>



char code[] = "\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb"
              "\x16\x5b\x31\xc0\x88\x43\x07\x89\x5b\x08\x89"
              "\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d\x53\x0c\xcd"
              "\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f"
              "\x73\x68\x4e\x41\x41\x41\x41\x42\x42\x42\x42";

int main(int argc, char **argv)
{

        /*creating a function pointer*/

        char (*func)();

        func = (char (*)()) code;
        func();



}

This small piece of code will spawn a shell on a 64 bit Linux. The question is: Is it possible to get root permissions using a shell script. This would be quite fun to try. I have found some shell scripts on the internet that claim to be able to do this, however, they produce only seg. faults when I try running them. I would be grateful if someone can give me any hints, whether this is at all possible. I would also appreciate any interesting shell scripts to play with.

Cheers.

Answer 1

With just a regular buffer overflow the shell code can't do anything the original program can't, you would need an actual kernel exploit for that.

You usually get root shells when you have programs that run as root, either because they have the +s flag (set uid) or because they are daemons that take userinput from somewhere outside the system.

Setuid-programs are programs that run as a different user than you launch them as. Take su for example, it is owned by root and has +s set, therefore it runs as root no matter who starts it. The program then tries to confirm that you are allowed to escalate privileges and spawns a shell for the user you requested. If there was buffer overflow vulnerability in su and you were to put a regular /bin/sh payload in it, you would end up with a root shell.

A daemon could be for example a webinterface that runs as root in order to do something (maybe it can shut down the pc). If it had a vulnerability that you could access from outside the computer, like a buffer overflow in the HTTP headers, you would again be able to spawn a root shell.

The shells you saw probably made use of the setuid() C function (or similar ones), which can do the same thing as +s if the process is privileged enough .