Πρώτο commit

static/34/fw.rules

@@ -0,0 +1,159 @@
+#!/bin/bash
+
+if [ -z $1 ]; then
+        # Äåí Ý÷ïõìå command line argument, ïðüôå äåí áöÞíïõìå êáíÝíáí íá óõíäåèåß ìå SSH óå ìáò.
+	echo Disallowing SSH access...
+	NOSSH=1
+else
+	# ¸÷ïõìå IP address óôç ãñáììÞ åíôïëþí, ðïõ èÝëïõìå íá óõíäÝåôáé óå ìáò ìå SSH.
+	echo Allowing SSH access for $1...
+fi
+
+##############################
+#### ÃÅÍÉÊÅÓ ÐÑÏÖÕËÁÎÅÉÓ #####
+##############################
+
+## Ìçí áðáíôÜò óå ping.
+/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
+
+## Ìçí áðáíôÜò óå broadcasts.
+/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
+
+## Ìç äÝ÷åóáé source routed ðáêÝôá.
+/bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
+
+## Ìç êÜíåéò ICMP redirect.
+/bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
+
+## Ðñïóôáóßá Ýíáíôé ðåñßåñãùí ëáèþí.
+/bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
+
+## Åíåñãïðïßçóå ôï reverse path filtering.
+for interface in /proc/sys/net/ipv4/conf/*/rp_filter; do
+   /bin/echo "1" > ${interface}
+ done
+
+## Óçìåßùóå óôá system logs (/var/log/messages by default) ôá ðáêÝôá ðïõ öáßíåôáé íá Ý÷ïõí øåýôéêåò äéåèýíóåéò Þ ãåíéêþò íá åßíáé ýðïðôá.
+/bin/echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
+
+## Ìçí ëåéôïõñãåßò óáí router (ìçí ðñïùèåßò ðáêÝôá óå Üëëåò äéåõèýíóåéò).
+/bin/echo "0" > /proc/sys/net/ipv4/ip_forward
+
+##################
+#### FIREWALL ####
+##################
+
+## Öüñôùóå ôá connection-tracking modules.
+/sbin/modprobe ipt_state
+/sbin/modprobe ip_conntrack
+/sbin/modprobe ip_conntrack_ftp #ports=2121
+#/sbin/modprobe ipt_owner
+
+## ÊáèÜñéóå ôõ÷üí åíåñãÜ rules
+/sbin/iptables -F
+## ÄéÝãñáøå ôõ÷üí custom tables
+/sbin/iptables -X
+## ÌçäÝíéóå üëïõò ôïõò ìåôñçôÝò ðáêÝôùí
+/sbin/iptables -Z
+
+## By default êÜíïõìå DROP (áãíïïýìå) üëá ôá ðáêÝôá (þóôå íá ðåñíÜíå ìüíï áõôÜ ðïõ Ý÷ïõí ëüãï íá ðåñíÜíå)
+/sbin/iptables -P INPUT DROP
+/sbin/iptables -P OUTPUT DROP
+
+
+#####################
+#### ÅÉÓÅÑ×ÏÌÅÍÁ ####
+#####################
+
+## Äå÷üìáóôå üëåò ôéò ôïðéêÝò óõíäÝóåéò
+/sbin/iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -i lo -j ACCEPT
+
+## Äå÷üìáóôå ðáêÝôá áðü üëåò ôéò Þäç õðÜñ÷ïõóåò óõíäÝóåéò (ëüãù ôùí õðïëïßðùí rules, áíáãêáóôéêÜ ôéò Ý÷ïõìå îåêéíÞóåé åìåßò ïðüôå õðïèÝôïõìå üôé åßíáé áóöáëåßò)
+/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+if [ $NOSSH ]; then
+	# Êáèüìáóôå.
+	echo
+else
+	## ÅðÝôñåøå óõíäÝóåéò SSH áðü ôç äéåýèõíóç ðïõ ðáñÝ÷ïõìå óôç ãñáììÞ åíôïëþí
+	/sbin/iptables -A INPUT -p tcp -s $1 --sport 1024: --dport 22 -j ACCEPT
+fi
+
+######################
+##### ÅÎÅÑ×ÏÌÅÍÁ #####
+######################
+
+## Äå÷üìáóôå ôïðéêÝò óõíäÝóåéò
+/sbin/iptables -A OUTPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
+
+## SSH
+/sbin/iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
+
+## HTTP
+/sbin/iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
+
+## HTTPS
+/sbin/iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
+
+## POP3
+/sbin/iptables -A OUTPUT -p tcp --dport 110 -j ACCEPT
+
+## SMTP
+/sbin/iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT
+
+## DNS
+/sbin/iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+
+## FTP (command)
+/sbin/iptables -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+## FTP (data::Active)
+/sbin/iptables -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
+
+## FTP (data::Passive)
+/sbin/iptables -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+if [ $NOSSH ]; then
+	echo
+else
+	## ÅðéôñÝðïõìå óôïí SSH server ìáò íá áðáíôÞóåé.
+	/sbin/iptables -A OUTPUT -p tcp --sport 22 --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
+fi
+
+## ICMP
+/sbin/iptables -A OUTPUT -p icmp -j ACCEPT
+
+## dict.org:2628
+/sbin/iptables -A OUTPUT -p tcp -d 66.111.36.30 --dport 2628 -j ACCEPT
+
+## Importing OpenPGP keys áðü pgp.mit.edu:11371
+/sbin/iptables -A OUTPUT -p tcp -d 18.7.14.139 --dport 11371 -j ACCEPT
+
+## JETDIRECT printing
+/sbin/iptables -A OUTPUT -p tcp --dport 9100 -j ACCEPT
+
+## Whois queries
+/sbin/iptables -A OUTPUT -p tcp --dport 43 -j ACCEPT
+
+## NTP updates
+/sbin/iptables -A OUTPUT -p tcp -d 128.2.4.21/16 --dport 123 -j ACCEPT
+/sbin/iptables -A OUTPUT -p udp --sport 123 -d 128.2.4.21/16 --dport 123 -j ACCEPT
+
+
+#################
+#### LOGGING ####
+#################
+## ÁõôÜ ôá ìçíýìáôá êáôá÷ùñïýíôáé óôï /var/log/messages
+# Ìå Ýíá tail -f /var/log/messages óáí root ôá ðáñáêïëïõèïýìå
+
+## Log åéóåñ÷üìåíá TCP ðáêÝôá ðïõ áðïññßöèçêáí.
+/sbin/iptables -A INPUT -p tcp -j LOG --log-prefix "iptables:IN-TCP DROPPED:"
+
+## Log åîåñ÷üìåíá TCP ðáêÝôá ðïõ áðïññßöèçêáí.
+/sbin/iptables -A OUTPUT -p tcp -j LOG --log-prefix "iptables:OUT-TCP DROPPED:"
+
+## Log ïôéäÞðïôå Üëëï ðïõ äåí ðÝñáóå
+#/sbin/iptables -A INPUT -j LOG --log-prefix "iptables:INCOMING DROPPED:"
+/sbin/iptables -A OUTPUT -j LOG --log-prefix "iptables:OUTGOING DROPPED:"
+
+## ÔÝëïò ôïõ iptables script												   

static/34/rce2-files/listing1.txt

@@ -0,0 +1,32 @@
+bash$ ltrace -i -o hands-on.lt hands-on
+Ready> 1+2
+Result: 3
+Ready> q
+bash$ cat hands_on.lt
+[08048939] __libc_start_main(0x080489c8, 1, 0xbffff774, 0x080487e0, 0x08048f90 <unfinished ...>
+[08048b0f] _ZNSt8ios_base4InitC1Ev(0x0804a47c, 0xbffff6d4, 0x4006114a, 1, 65535) = 3
+[08048b23] __cxa_atexit(0x08048b28, 0, 0x0804a054, 1, 65535)                = 0
+[080489e4] __xstat(3, "hands-on", 0xbffff6a0)                               = 0
+[08048be0] time(NULL)                                                       = 1062082695
+[08048c02] _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc(0x0804a348, 0x08048fc9, 0x40014020, 0xbffff774, 0xbffff718) = 0x0804a348
+[08048c11] _ZStrsIcSt11char_traitsIcESaIcEERSt13basic_istreamIT_T0_ES7_RSbIS4_S5_T1_E(0x0804a3d8, 0xbffff6a4, 0x40014020, 0xbffff774, 0xbffff718) = 0x0804a3d8
+[08048d40] _ZNSs12_M_leak_hardEv(0xbffff6a4, 3, 10, 0x01048447, 0x400d31e0) = 0x0804a51c
+[08048cf6] isdigit(49, 3, 10, 0x01048447, 0x400d31e0)                       = 2048
+[08048d65] isdigit(49, 3, 10, 0x01048447, 0x400d31e0)                       = 2048
+[08048d65] isdigit(43, 3, 10, 0x01048447, 0x400d31e0)                       = 0
+[08048e34] time(NULL)                                                       = 1062082700
+[08048ec5] isdigit(50, 3, 10, 0x01048447, 0x400d31e0)                       = 2048
+[08048f0a] isdigit(50, 3, 10, 0x01048447, 0x400d31e0)                       = 2048
+[08048c34] _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc(0x0804a348, 0x08048fc0, 0x40014020, 0xbffff774, 0xbffff718) = 0x0804a348
+[08048c82] _ZNSolsEl(0x0804a348, 3, 0x40014020, 0xbffff774, 0xbffff718)     = 0x0804a348
+[08048c70] _ZNSolsEPFRSoS_E(0x0804a348, 0x080488e8, 0x40014020, 0xbffff774, 0xbffff718 <unfinished ...>
+[40094e0a] _ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_(0x0804a348, 0x0804a348, 3, 0x08048421, 0x4002e201) = 0x0804a348
+[08048c70] <... _ZNSolsEPFRSoS_E resumed> )                                 = 0x0804a348
+[08048be0] time(NULL)                                                       = 1062082700
+[08048c02] _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc(0x0804a348, 0x08048fc9, 0x40014020, 0xbffff774, 0xbffff718) = 0x0804a348
+[08048c11] _ZStrsIcSt11char_traitsIcESaIcEERSt13basic_istreamIT_T0_ES7_RSbIS4_S5_T1_E(0x0804a3d8, 0xbffff6a4, 0x40014020, 0xbffff774, 0xbffff718) = 0x0804a3d8
+[08048d40] _ZNSs12_M_leak_hardEv(0xbffff6a4, 1, 10, 0x01048447, 0x400d31e0) = 0x0804a51c
+[08048cf6] isdigit(113, 1, 10, 0x01048447, 0x400d31e0)                      = 0
+[08048aaf] _ZNSs4_Rep10_M_destroyERKSaIcE(0x0804a510, 0xbffff6f0, 0xbffff6a0, 1, 0xbffff700) = 0x0804a500
+[401312c1] _ZNSt8ios_base4InitD1Ev(0x0804a47c, 0, 172800, 0x40233234, 0x40014020) = 0x400bfd50
+[ffffffff] +++ exited (status 0) +++

static/34/rce2-files/listing2.txt

@@ -0,0 +1,28 @@
+bash$ cat hands-on.lt | c++filt
+[08048939] __libc_start_main(0x080489c8, 1, 0xbffff774, 0x080487e0, 0x08048f90 <unfinished ...>
+[08048b0f] std::ios_base::Init::Init[in-charge]()(0x0804a47c, 0xbffff6d4, 0x4006114a, 1, 65535) = 3
+[08048b23] __cxa_atexit(0x08048b28, 0, 0x0804a054, 1, 65535)                = 0
+[080489e4] __xstat(3, "hands-on", 0xbffff6a0)                               = 0
+[08048be0] time(NULL)                                                       = 1062082695
+[08048c02] std::basic_ostream<char, std::char_traits<char> >& std::operator<< <std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&, char const*)(0x0804a348, 0x08048fc9, 0x40014020, 0xbffff774, 0xbffff718) = 0x0804a348
+[08048c11] std::basic_istream<char, std::char_traits<char> >& std::operator>><char, std::char_traits<char>, std::allocator<char> >(std::basic_istream<char, std::char_traits<char> >&, std::basic_string<char, std::char_traits<char>, std::allocator<char> >&)(0x0804a3d8, 0xbffff6a4, 0x40014020, 0xbffff774, 0xbffff718) = 0x0804a3d8
+[08048d40] std::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_leak_hard()(0xbffff6a4, 3, 10, 0x01048447, 0x400d31e0) = 0x0804a51c
+[08048cf6] isdigit(49, 3, 10, 0x01048447, 0x400d31e0)                       = 2048
+[08048d65] isdigit(49, 3, 10, 0x01048447, 0x400d31e0)                       = 2048
+[08048d65] isdigit(43, 3, 10, 0x01048447, 0x400d31e0)                       = 0
+[08048e34] time(NULL)                                                       = 1062082700
+[08048ec5] isdigit(50, 3, 10, 0x01048447, 0x400d31e0)                       = 2048
+[08048f0a] isdigit(50, 3, 10, 0x01048447, 0x400d31e0)                       = 2048
+[08048c34] std::basic_ostream<char, std::char_traits<char> >& std::operator<< <std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&, char const*)(0x0804a348, 0x08048fc0, 0x40014020, 0xbffff774, 0xbffff718) = 0x0804a348
+[08048c82] std::basic_ostream<char, std::char_traits<char> >::operator<<(long)(0x0804a348, 3, 0x40014020, 0xbffff774, 0xbffff718)     = 0x0804a348
+[08048c70] std::basic_ostream<char, std::char_traits<char> >::operator<<(std::basic_ostream<char, std::char_traits<char> >& (*)(std::basic_ostream<char, std::char_traits<char> >&))(0x0804a348, 0x080488e8, 0x40014020, 0xbffff774, 0xbffff718 <unfinished ...>
+[40094e0a] std::basic_ostream<char, std::char_traits<char> >& std::endl<char, std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&)(0x0804a348, 0x0804a348, 3, 0x08048421, 0x4002e201) = 0x0804a348
+[08048c70] <... std::basic_ostream<char, std::char_traits<char> >::operator<<(std::basic_ostream<char, std::char_traits<char> >& (*)(std::basic_ostream<char, std::char_traits<char> >&)) resumed> )                                 = 0x0804a348
+[08048be0] time(NULL)                                                       = 1062082700
+[08048c02] std::basic_ostream<char, std::char_traits<char> >& std::operator<< <std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&, char const*)(0x0804a348, 0x08048fc9, 0x40014020, 0xbffff774, 0xbffff718) = 0x0804a348
+[08048c11] std::basic_istream<char, std::char_traits<char> >& std::operator>><char, std::char_traits<char>, std::allocator<char> >(std::basic_istream<char, std::char_traits<char> >&, std::basic_string<char, std::char_traits<char>, std::allocator<char> >&)(0x0804a3d8, 0xbffff6a4, 0x40014020, 0xbffff774, 0xbffff718) = 0x0804a3d8
+[08048d40] std::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_leak_hard()(0xbffff6a4, 1, 10, 0x01048447, 0x400d31e0) = 0x0804a51c
+[08048cf6] isdigit(113, 1, 10, 0x01048447, 0x400d31e0)                      = 0
+[08048aaf] std::basic_string<char, std::char_traits<char>, std::allocator<char> >::_Rep::_M_destroy(std::allocator<char> const&)(0x0804a510, 0xbffff6f0, 0xbffff6a0, 1, 0xbffff700) = 0x0804a500
+[401312c1] std::ios_base::Init::~Init [in-charge]()(0x0804a47c, 0, 172800, 0x40233234, 0x40014020) = 0x400bfd50
+[ffffffff] +++ exited (status 0) +++

static/34/rce2-files/listing3.txt

@@ -0,0 +1,3 @@
+bash$ c++filt _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc
+std::basic_ostream<char, std::char_traits<char> >& std::operator<< <std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&, char const*)
+

static/34/rce2-files/listing4.txt

@@ -0,0 +1,4 @@
+8048c04 !   push    dword ptr [ebp-10h]                                                                                  
+8048c07 !   push    std::cin
+8048c0c !   call    std::basic_istream<char, std::char_traits<char> >& std::operator>><char, std::char_traits<char>, std::allocator<char> >(std::basic_istream<char, std::char_traits<char> >&, std::basic_string<char, std::char_traits<char>, std::allocator<char> >&)
+