• 120 points.

• Write two programs with the following properties:
  • On a host, called server host, write a program, called password_holder.c, that allows a user to input a character string.
  • After obtaining an input string from a user, password_holder.c opens a TCP/IP socket and listens on the socket to wait for any incoming request from a host, called client host.
  • When an incoming connection is established, password_holder.c sends the input string to the the client host as a password.
  • On a host, called client host, write a program, called mission_impossible.c, that connects to the above remote server to retrieve a password.
  • The compiled executable file of mission_impossible.c is called mission_impossible.exe.
  • After obtaining a password from the above server, mission_impossible.c asks its users to input a password.
  • If an input password is identical to the passwrod that mission_impossible.c retrieved from the above server, the program will execute a piece of code, called Mission Briefing Code (MBC) hereafter, that will display the following message ("Ethan Hunt, Run Now!") for 2 minutes and then delete the file and terminate itself.
  • If an erroneous password is input, the program will delete the file mission_impossible.c and terminate itself.
  • Initially, MBC must be stored in a global array and is encoded with your password. You can use any approach to encode MBC. When the input password is correct, your program will decode MBC and place it in the heap and then transfer your execution flow to the decoded MBC.

_start:

        jmp short ender

        starter:

        xor eax, eax    ;clean up the registers
        xor ebx, ebx
        xor edx, edx
        xor ecx, ecx

        mov al, 4       ;syscall write
        mov bl, 1       ;stdout is 1
        pop ecx         ;get the address of the string from the stack
        mov dl, 5       ;length of the string
        int 0x80

        xor eax, eax
        mov al, 1       ;exit the shellcode
        xor ebx,ebx
        int 0x80

        ender:
        call starter	;put the address of the string on the stack
        db 'hello'

• 編譯 ASM，測試 ASM 功能正確
  

  ~$ nasm -f elf hello.asm
  ~$ ld -o hello hello.o
  ~$ objdump -d hello
  ~$ ./hello

  指令說明，nasm 那行指令結束會產生 hello.o，而 ld - Using LD, the GNU linker，看字面描述看起來似乎是 link 的動作，藉由 -o 改檔案名稱 (及隨後的 hello 字串)。
  
  而藉由 objdump -d hello 可以得到該字串的反組譯。
  
  
• 編譯 mission_impossible.c 和 password_holder.c
  
  ~$ gcc -z execstack mission_impossible.c -o mission_impossible.exe
  ~$ ./mission_impossible.exe #keyin_port_number
  
  -z execstack 是為了能讓程序運行可以跳到 stack 上面去跑，根據作業系統的架構，全區變數也是 stack 中的一環。因此才這麼設置。而增加 -fno-stack-protector 這段參數，可以將 ASLR (Address space layout randomization) 關閉 ?
  在此次作業並不用使用這個參數即可運行。
  
  
• 如何將 ASM code 快速轉換成放在 C/C++ 的形式 ? (避免手打眼殘)
  
  • 方法 1：
    
    ~$ objdump -d ./PROGRAM|grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|sed 's/ /\\x/g'|paste -d '' -s |sed 's/^/"/'|sed 's/$/"/g'
    
    參考網址：http://www.commandlinefu.com/commands/view/6051/get-all-shellcode-on-binary-file-from-objdump
  • 方法 2:
    
    ~$ nasm -o hello hello.asm
    ~$ xxd -i hello
    
    參考出處 PTT。