Here's the problem : The CGI Executable CSUserCGI.exe is a child process of IIS, and only spawns when called by a user. The executable script then quickly closes after serving its purpose... and before we can attach our debugger. So how do we essentially debug this? Would configuring the debugger for JIT (Just In Time) work ?<\/p>\n
Let's see<\/p>\n
When we call the CGI script over HTTP we can see it open and close real quick.<\/p>\n
Try #1<\/p>\n
No luck! So How am I going to debug this? There has to be a way.<\/p>\n At the time one of my Corelan team mates sinn3r had completed a few HP NNM modules which he encountered similar circumstances. The idea was to put the child process to sleep until I attach a debugger, by inserting some code that would do this:<\/p>\n Okay made sense, so time to get my hands dirty. I opened the executable in immunity and picked a good function to hook (0x00401010). I wanted to skip some of the initial kernel calls and environment and jump right into main().<\/p>\n The next thing I needed to was find a place in .text that wasn\u2019t being used by the executable and would not corrupt any other functions, or prevent the executable from working as intended. The goal would be to use the existing call instruction (call 0x00401010 in this case), and change the offset value of that call to make a jump to the location where my custom routine will be placed.<\/p>\n I found a nice spot at 0x00415362 so I would edit the call at 0x00414CD6 to point to that location.<\/p>\n Now I need to find the location of kernel32.Sleep & kernel32.IsDebuggerPresent. Since this is just a patch I am doing locally on my system there is no need to look for a generic calls to these function, I can just look up the locations in Immunity under executable then names. On my Windows 2003 SP2 system the locations are 0x77e424de & 0x77e5da00. More than likely they will be different on your machine!<\/p>\n <\/p>\n Time to insert my function hook. Note that for this particular exploit there was not a need to jump back to the next instruction after our original (now updated) call but I did it anyways.<\/p>\n First, I patched the call offset (to make it jump to the custom routine, which I'm going to place at 0x00415362)<\/p>\n and I placed the custom routine at 0x00415362<\/p>\n <\/p>\n With immunity we can now right click and save the changes to a new name. I decided to name the file NEWCSUserCGI.exe and place it in our CGI script directory (C:\\Inetpub\\wwwroot\\securecgi-bin).<\/p>\n I then renamed the original executable to OLDCSUserCGI.exe and then changed NEWCSUserCGI.exe to CSUserCGI.exe (which is the original name of the file)<\/p>\n This time I launched with the proof of concept in our URL and viola the script is still running!<\/p>\n Now time to see our buffer overflow and to verify our public proof of concept code is working. If we take a look at (http:\/\/www.securityfocus.com\/archive\/1\/489463<\/a> by FX) we can see that when we supply a long string after \u201cLogout+\u201d we will reach our buffer overflow giving us control of EIP<\/p>\n The vulnerable function is a subroutine in the function we hooked (0x00401010). First we can see a fixed buffer of 0x60 being setup for our Logout argument.<\/p>\n msvcrt.strtok is called and is looking for the first string that ends in \u201c.\u201d<\/p>\n The string is then copied on the stack and we eventually reach our buffer overflow.<\/p>\n Woot! This was an easy stack buffer overflow and the final code can be seen here: (https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/unstable\/unstable-modules\/exploits\/untested\/cisco_acs_ucp.rb<\/a>)<\/p>\n I thought that this might be a good opportunity to create a script that would automate this process or come up with an alternative. I presented the idea to my teammates before leaving from work and drove home eager to give this a shot over the weekend. Low and behold I must have had a memory lapse and forgot that corelanc0d3r has over 5000 lines of python-fu with immunity (mona.py anyone?) and finished this before I even got home from work! All the credit goes to him for this one.<\/p>\n Here is his automated script that will essentially sleep the application until you attach the debugger and it does it all without calling any kernel32 API calls. <\/p>\n <\/p>\n What corelanc0d3r did was take advantage of pefile<\/a>, a python module that allows us to read and work with PE (Portable Executable) files. (This module is installed by default on BackTrack and Immunity Debugger, just for your information)<\/p>\n His script will load the executable file and get the original entrypoint of the module.<\/p>\n Next, the script will look for a location in the file that has 12 consecutive null bytes (you could replace this with for example NOPS if needed).<\/p>\n At that location, an custom routine will be placed. This routine will clear out EAX, compare it with 0, and then jump back to the compare statement if the condition is true. Essentially this will be a loop until we attach our debugger. After the conditional jump (which ensures the loop), a call to the original location of the entrypoint is placed. Finally, the entrypoint RVA in the PE file is updated to point at the custom routine.<\/p>\n In other words, when you would run this executable, it would just hang (infinite loop). When attaching a debugger the process will pause. You then only need to find the location where the custom asm routine was inserted (the address is, in fact, right after the updated entrypoint), and either replace the cmp instruction with nops, or just change the cmp eax,0 into cmp eax,1. If you would continue to run the process, the executable would simply start doing what it's supposed to do. Alternatively, you can just let the application run and then pause (break)... it would halt on the cmp or the jump instruction inside the custom routine.<\/p>\n Lets go ahead now and run this from cmd.exe and see everything work automatically.<\/p>\n After the script finds and writes to a safe place for the loop, it will save a new file with the filename and \u201c_patched.exe\u201d.<\/p>\n If we go ahead and run we can see that it works and does the same thing as my manual patch.<\/p>\n Now if we rename our patched file and run our proof of concept again we can then attach the debugger and press \u201cpause\u201d to stop the loop. We then break out of the loop and the call back to the original entrypoint will be executed.<\/p>\n Woot! Looks like everything is working properly. So that\u2019s pretty much it, this is just a short article on a problem I encountered and how it was solved. Note that this technique most likely won't worked with packed\/encoded binaries...<\/p>\n You can, of course, do the same thing with other debuggers as well. The basic procedure will be exactly the same, you only need to know how to edit the instruction in memory to break out of the loop.<\/p>\n Let's say you want to change the CMP instruction into CMP EAX,1. This requires us to change one byte in memory (the byte at 0x00415337 in this case).<\/p>\n With the debugger attached (and the process interrupted), simply run the following command:<\/p>\n eb = edit byte. Other windbg 'edit' commands are ew (edit word) and ed (edit dword).<\/p>\n Afer making the change, press F5 (or type 'g') to let the process break out of the loop and return to the original entrypoint.<\/p>\n <\/p>\n As various people on twitter suggested, you can obviously also use \\xeb\\xfe as patch routine (which will just jump to itself). Tx @fdfalcon<\/a> and @pa_kt<\/a> for the good feedback !<\/p>\n <\/p>\n <\/p>\n Recently I played with an older CVE (CVE-2008-0532, http:\/\/www.securityfocus.com\/archive\/1\/489463, by FX) and I was having trouble debugging the CGI executable where the vulnerable function was located.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[3708,244,2561,127,1],"tags":[2576,2128,2124,1978,262,261],"class_list":["post-8783","post","type-post","status-publish","format-standard","hentry","category-debugging","category-exploit-writing-tutorials","category-malware-and-reversing","category-security","category-uncategorized","tag-debugging","tag-immunity-debugger","tag-debugger","tag-python","tag-corelan-team","tag-corelan"],"yoast_head":"\n![\"pic1\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic1_thumb1.png\")
<\/a><\/p>\n![\"pic2\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic2_thumb1.png\")
<\/a><\/p>\nPutting the process to sleep()<\/h3>\n
\/\/ (pseudo code):<\/span>\n\nwhile<\/span> (IsDebuggerPresent == false<\/span>) {\n sleep(1);\n}\n\n\/\/ Repair the prologue of the entry point you hijacked,<\/span>\n\/\/ and then jmp back to the entry point.<\/span><\/pre>\n![\"pic3\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic3_thumb1.png\")
<\/a><\/p>\n![\"pic4\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic4_thumb1.png\")
<\/a><\/p>\n![\"pic5\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic5_thumb1.png\")
<\/a><\/p>\n00414CD6 E8 87060000 CALL CSUserCG.00415362 ; jmp to custom routine<\/pre>\n
00415362 6A 01 PUSH 1\n00415364 E8 75D1A277 CALL kernel32.Sleep\n00415369 E8 9286A477 CALL kernel32.IsDebuggerPresent\n0041536E 83F8 01 CMP EAX,1\n00415371 ^75 EF JNZ SHORT CSuserCG.00415362\n00415373 CC INT3\n00415374 83C4 04 ADD ESP,4\n00415377 E8 94BCFEFF CALL CSuserCG.00401010 ;go back\n0041537C ^E9 5AF9FFFF JMP CSuserCG.00414CDB<\/pre>\n
![\"pic6\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic6_thumb1.png\")
<\/a><\/p>\n![\"pic7\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic7_thumb1.png\")
<\/a><\/p>\n![\"pic8\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic8_thumb1.png\")
<\/a><\/p>\n![\"pic9\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic9_thumb1.png\")
<\/a><\/p>\n![\"pic10\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic10_thumb1.png\")
<\/a><\/p>\n![\"pic11\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic11_thumb1.png\")
<\/a><\/p>\n![\"pic12\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic12_thumb1.png\")
<\/a><\/p>\n![\"pic13\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic13_thumb1.png\")
<\/a><\/p>\n![\"pic14\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic14_thumb1.png\")
<\/a><\/p>\nWhat about automating this?<\/h3>\n
# binary patcher\n# will inject routine to make the binary hang\n# so you can attach to it with a debugger\n#\n# corelanc0d3r\n# (c) 2012 - www.corelan.be\n\nimport<\/span> sys<\/span>,pefile,os<\/span>,binascii\n\ndef<\/span> patch_file(binaryfile):\n\n\troutine = "\\x33\\xc0<\/span>"\t\t# xor<\/span> eax,eax\n\troutine += "\\x83\\xF8\\x00<\/span>"\t# cmp eax,0\n\troutine += "\\x74\\xFB<\/span>"\t\t# JE back to cmp\n\n\tprint<\/span> "[+] Opening file %s<\/span>" % binaryfile\n\tpe = pefile.PE(binaryfile)\n\n\tentrypoint = pe.OPTIONAL_HEADER.AddressOfEntryPoint\n\tbase = pe.OPTIONAL_HEADER.ImageBase\n\tprint<\/span> " - Original Entrypoint : 0x%x<\/span>" % (base + entrypoint)\n\n\tsearchend = 0\n\tstartrva = 0\n\tfor section in pe.sections:\n\t\tif<\/span> section.Name.replace<\/span>('\\x00','') == '.text':\n\t\t\t# code<\/span> segment\n\t\t\tprint<\/span> " - Finding a good spot in code segment at 0x%x<\/span>" % (base + section.VirtualAddress)\n\t\t\tprint<\/span> " Size : 0x%x<\/span>" % section.SizeOfRawData\n\t\t\tsearchend = section.SizeOfRawData\n\t\t\tstartrva = section.VirtualAddress\n\t\t\t#print<\/span> (section.Name, hex(section.VirtualAddress), hex(section.Misc_VirtualSize), section.SizeOfRawData )\n\tif<\/span> searchend > 0:\n\t\tcnt = 0\n\t\tconsecutive = 0\n\t\tstopnow = False\n\t\toffsethere = 0\n\t\twhile cnt < searchend and not stopnow:\n\t\t\tthisbyte = pe.get_dword_at_rva(startrva+cnt)\n\t\t\tif<\/span> thisbyte == 0:\n\t\t\t\tif<\/span> offsethere == 0:\n\t\t\t\t\toffsethere = startrva+cnt\n\t\t\t\tconsecutive += 1\n\t\t\telse<\/span>:\n\t\t\t\toffsethere = 0\n\t\t\t\tconsecutive = 0\n\t\t\tif<\/span> consecutive >= len(routine)+5:\n\t\t\t\tstopnow=True\n\t\t\tcnt = cnt + 1\n\t\tprint<\/span> " - Found %d consecutive null bytes at offset 0x%x<\/span>" % (consecutive,offsethere)\n\t\tprint<\/span> " Distance from original entrypoint : %x bytes<\/span>" % (offsethere - entrypoint)\n\t\tjmpback = "%x<\/span>" % (4294967295 - (offsethere - entrypoint + 4 + len(routine)))\n\t\tprint<\/span> " Jmpback : 0x%s<\/span>" % jmpback\n\t\troutine += "\\xe8<\/span>"\n\t\troutine += binascii.a2b_hex(jmpback[6:8])\n\t\troutine += binascii.a2b_hex(jmpback[4:6])\n\t\troutine += binascii.a2b_hex(jmpback[2:4])\n\t\troutine += binascii.a2b_hex(jmpback[0:2])\n\t\tprint<\/span> " - Injecting hang + redirect (%d bytes) at 0x%x<\/span>" % (len(routine),(base+offsethere))\n\t\tpe.set_bytes_at_rva(offsethere,routine)\n\t\tprint<\/span> " - Setting new EntryPoint to 0x%x<\/span>" % (base+offsethere)\n\t\tpe.OPTIONAL_HEADER.AddressOfEntryPoint = offsethere\n\t\tentrypoint = pe.OPTIONAL_HEADER.AddressOfEntryPoint\n\t\tprint<\/span> " - Entrypoint now set to : 0x%x<\/span>" % (base + entrypoint)\n\n\t\tprint<\/span> "[+] Saving file<\/span>"\n\t\tpe.write<\/span>(filename=binaryfile.replace<\/span>(".exe<\/span>","")+"_patched.exe<\/span>")\n\t\tprint<\/span> "[+] Patched.<\/span>"\n\telse<\/span>:\n\t\tprint<\/span> "[-] No code segment found ?<\/span>"\n\nif<\/span> len(sys<\/span>.argv) == 2:\n\ttarget = sys<\/span>.argv[1]\n\tif<\/span> os<\/span>.path<\/span>.exists(target):\n\t\tpatch_file(target)\n\telse<\/span>:\n\t\tprint<\/span> " ** Unable to find file '%s' **<\/span>" % target\nelse<\/span>:\n\tprint<\/span> "\\nUsage : patchbinary.py filename\\r\\n<\/span>"<\/pre>\n![\"pic15\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic15_thumb.png\")
<\/a><\/p>\n![\"pic16\"](\"https:\/\/www.corelan.be\/wp-content\/uploads\/2012\/02\/pic16_thumb.png\")
<\/a><\/p>\nWindbg ?<\/h3>\n
eb 0x00415337 0x01<\/pre>\n
Update (march 1st 2012)<\/h3>\n
\n","protected":false},"excerpt":{"rendered":"