Socket programming in python and Integer Overflow - bin 0x1B

Key Takeaways

these networking levels from protostar are not really security related but they are great to do some first simple Network programming and just for the sake of having a complete series from exploit exercises we will solve these challenges [Music] too the previous two videos were already a good introduction to networking sockets TCP and so let's build on this Foundation by writing a python script to interact with this program over the network especially for ctfs this is an important part because for many many challenges you interact with a service over TCP so the exploit you write has to do this over the network let's have a look at this level I won't go over the meaning of all these unknown functions because we have done so in episode hex one9 as we see in the defines or simply by checking netet on the VM we can see that net level one is running on Port 29 and8 again we could use netkat to talk to the servers but this time we want to write a python script but let's first have a look at the Run function first run generates a random unsigned integer and then we s printf the number into Fab fub we haven't seen s print F before so other than regular print F which writes a resulting string to STD out s printf will write the resulting string to the address specified in the first argument in this case buff this means fub will contain the decimal representation of the number in ASI and not contain the raw bite values then write will write to the socket that's sending us the integer number does the raw bites that's what we saw returned by netkit after that the program will wait for user input with f gets once we send some data it will override any new line or car return with nobite this makes sense because when we for example use netkat and hit enter to send something it will include a new line at the end because that's the key we pressed but obviously this program only wants the characters we actually meant to send thus stripping away the new line then it compares the original number with the number it received and either print success or fail so let's start to write our python script but how do we do that maybe a first hint on how to do Network programming could be to look at how netcat connects to a server so we can use S trce to trace all sour calls of netkat now let's try identify the important ones and then we try to figure out how to implement them in Python first one is obviously the call to socket so let's look into python socket documentation on how to do that in our script so the call to socket uses parameters pfet and sock stream and when we look here in the python doc we see something very similar except that it suggest to use AF inet so I wonder what's the difference between PF and AF inet so I Google and surprisingly it turns out that this is a remnant of an idea that never really took off and in fact in a Linux col it's now simply defined as being the same as AF inet huh learn something today and the python doc then uses connect to a host name or an IP and Port which we can see in the estray here it's called with Port 298 and the IP address 12701 so we can also just use that cool now we can use send and receive with the socket obviously we want to read the number that is sent to us so we use receive but we have to specify how much data we want to read in this case we expect an unsigned integer which is 32 bit large th we have to read four bytes now let's simply print the data we receive and then test it cool by the way also notice that when we request a new number very quickly that a lot of numbers are the same and not random that's because in the code the random number generator is seated by the time and seconds thus if we send fast enough the second will be the same and thus produce the same pseudo random number don't you ever use a non-random source or a seed for a pseudo random number generator if it's important and now it's easy to solve it because we are already very experienced with converting numbers to raw bytes and raw bytes to numbers from all the exploits with memory values that we have written so we can simply use the stru module and convert raw binary data back to an unsigned integer and then send it as a string back to the server remember that struct unpack returns a tupal so the actual unpack number is the first element hm it seems to hang let's try it again now it seems to work the receive hangs when it is waiting for data and doesn't get any so I assume the server sends too fast and there is no buffer buffering the data and when we are finally ready to receive data the data is already lost in the void anyhow it worked doesn't have to be perfect as long as you succeed once the attack was successful this episode is so short and these challenges are not really about security anyway so let's quickly solve the next one too net two is very similar we again have a network set up with a program listening on Port 2997 in the Run function we see a for Loop that runs four times and each time it generates a random number adds it to the sum of them all and sends it over the network the description also says that we have to add four 32-bit integers and it already warns us about the possib ability of it wrapping or in proper terms it warns us about an integer overflow which again is security relevant okay so let's copy our previous script and quickly modify to read four integers and then calculate the sum we can simply extend the struct unpack modifier and then we can also just create a sum over the resulting Tuple easy as that the code expects the result not in an asky decimal representation but as a raw binary so we can use struct pack to convert it to a binary string and then send it oh huh I wanted to show that this doesn't work because of the integer overflow if you have a look at the result of the sumon biner we can see that it contains more than 32 bits and that cannot be an integer is only 32 bit large so what happens is that the integer is simply overflowing or wrapping around this means the carry of the highest bit is just lost well it's not entirely true the CPU is actually aware of this when an Matic operation such as an addition ends up overflowing the value in a register a special overflow flag is set that could be checked but anyway in this case our unsent integer on the server always W around and apparently this old python struct version actually did that for us but this Behavior got deprecated so we can simply do the same in our code as I said the issue is called integer overflow and when you search for this you will find many back reports about it let's make a simple example of a typical integer overflow issue let's say you have a loop that keeps reading data and adds the size to an overall size variable once it's done with a loop it will know for how much data it has to allocate space for the issue is now if you manage to send so much data that the counter overflows wraps around a smaller space is allocated for the huge amounts of data and then you have a typical overflow condition we are slowly heading into the final levels of exploit exercises protar and we start to see a little bit more intricate challenges so let's stay focused and tackle the next [Music]