Makefile

# ============================================================================
# Makefile -- builds the lab: the vulnerable daemon and its exploit
# ============================================================================
#
#   make            build food, fooc and the test harnesses
#   make run        start food in the background, on loopback
#   make test       run the full technique matrix (needs `make run` first)
#   make verify     prove the shellcode in fooc.c matches shellcode.S
#   make hardened   rebuild food with every mitigation ENABLED
#   make test-hardened  run the matrix against the hardened build
#   make stop       stop the daemon
#   make clean      remove build products
#
# ---------------------------------------------------------------------------
# WHY THESE FLAGS -- the single most important thing in this file
# ---------------------------------------------------------------------------
#
# `food` is built with three protections switched OFF, deliberately:
#
#   -fno-stack-protector   no stack canary
#   -no-pie                fixed load address, so win() is a constant
#   -z execstack           executable stack, so shellcode can run
#
# Each one corresponds to a real defence that a real program gets for free, and
# `make test-hardened` turns them all back on so you can watch the techniques
# fail. That contrast is the entire lesson. Do not copy these flags into
# anything you actually ship.
#
# The exploit (`fooc`) is built with the protections ON. There is no reason for
# an attacker to disable them, and leaving them on is a useful reminder that
# the tool works fine in a hardened process.
#
# ---------------------------------------------------------------------------
# WHY -O0 -g
# ---------------------------------------------------------------------------
#
# -O0  the compiler does not reorder, inline, or elide the code. At -O2 the
#      stack layout the exploit reasons about can change between builds, and
#      variables you were told exist may be gone. For a lab you have to be
#      able to read the disassembly and find the thing the comment promised.
# -g   symbols and line numbers, so gdb is actually usable. `make debug`
#      goes further and stops at the vulnerable read().
# ============================================================================

CC      ?= gcc
CSTD    := -std=c99

# Warnings we always want, even on the vulnerable build. Note that we do NOT
# use -Werror: food.c's deliberate overflow triggers -Wstringop-overflow, and
# that warning is *supposed* to fire (see the comment at the read() call).
WARN    := -Wall -Wextra

# Debug info and no optimisation: see above.
DBG     := -O0 -g

# --- the vulnerable build -----------------------------------------------------
# These are the flags we are trying to defeat. See the header comment.
VULN    := -fno-stack-protector -no-pie -z execstack

# --- the hardened build -------------------------------------------------------
# What a modern project actually does. Note that -fstack-protector-strong is
# gcc's DEFAULT on many distros, and -fPIE is too, so the hardened build is
# really just "stop overriding the defaults". `make test-hardened` shows the
# exploits failing, which is the point.
HARDEN  := -fstack-protector-strong -fPIE -pie -z noexecstack

# Shellcode needs a terminal, and the test harness is the only thing that
# provides one. It is a normal POSIX program, not part of the exploit.
TESTCFLAGS := $(CSTD) $(DBG) $(WARN)

all: food fooc tests/pty_test tests/sock_test

# -----------------------------------------------------------------------------
# The vulnerable daemon.
# -----------------------------------------------------------------------------
food: food.c
	$(CC) $(CSTD) $(DBG) $(WARN) $(VULN) -o $@ $<

# -----------------------------------------------------------------------------
# The exploit. -ldl is needed for dlsym(), which is how it locates libc's
# system() and "/bin/sh" at runtime instead of hardcoding offsets that would
# break the next time glibc is updated.
#
# It gets the mitigations ON, unlike the target.
# -----------------------------------------------------------------------------
fooc: fooc.c
	$(CC) $(CSTD) $(DBG) $(WARN) -fstack-protector-strong -o $@ $< -ldl

# -----------------------------------------------------------------------------
# Test harnesses. These exist because the exploit's last act is to hand its
# process over to a shell; verifying that needs a real terminal, which a pipe
# or a here-doc is not.
# -----------------------------------------------------------------------------
tests/pty_test: tests/pty_test.c
	$(CC) $(TESTCFLAGS) -o $@ $<

tests/sock_test: tests/sock_test.c
	$(CC) $(TESTCFLAGS) -o $@ $<

# -----------------------------------------------------------------------------
# The hardened daemon: same source, protections on. Build it, then run
# `make test-hardened` to see which techniques it survives.
# -----------------------------------------------------------------------------
hardened: food.c
	$(CC) $(CSTD) $(DBG) $(WARN) $(HARDEN) -o food_hardened $<
	@echo
	@echo "=== food_hardened built with the mitigations ON."
	@echo "=== Stack segment permissions ('RWE' would mean executable; you"
	@echo "=== want 'RW', i.e. no-execute):"
	@readelf -W -l food_hardened | grep GNU_STACK
	@echo "=== Now run:  make test-hardened"

# -----------------------------------------------------------------------------
# verify-shellcode: prove the bytes in fooc.c are what nasm produces from
# shellcode.S. This is the check that keeps the inline byte array honest --
# a hand-maintained hex dump and a disassembler are both easy to get wrong, and
# a single wrong byte means a payload that crashes instead of running.
# -----------------------------------------------------------------------------
verify verify-shellcode: shellcode.S fooc.c
	@command -v nasm >/dev/null 2>&1 || { \
	    echo "verify-shellcode: nasm is not installed; skipping."; \
	    echo "  (Arch:  pacman -S nasm)"; exit 0; }
	@echo "=== Assembling shellcode.S ..."
	@nasm -f bin -o shellcode.bin shellcode.S
	@echo "=== nasm output:"
	@od -An -tx1 -v shellcode.bin | tr -s ' \n' ' ' | sed -e 's/^ //' \
	    -e 's/[[:space:]]*$$//'
	@echo
	@# Pull the byte list out of the C array. `sed s,/*.**/,` first strips the
	@# trailing /* ... */ annotations, so a hex constant mentioned inside a
	@# comment (there is one: "push 0x3b (execve)") is not counted as data.
	@# Stripping comments before grepping is the whole trick here.
	@sed -n '/^static const unsigned char SHELLCODE\[\] = {/,/^};/p' fooc.c \
	    | sed -e 's,/\*.*\*,,' \
	    | grep -o '0x[0-9a-fA-F][0-9a-fA-F]' \
	    | tr 'A-F' 'a-f' | tr '\n' ' ' | sed -e 's/^ //' -e 's/[[:space:]]*$$//' \
	    > .sc_c_raw.txt
	@echo "=== bytes declared in fooc.c's SHELLCODE[] array:"
	@cat .sc_c_raw.txt
	@echo
	@echo "=== comparing ..."
	@# Both sides reduced to the same plain "31 f6 31 d2 ..." form, so the
	@# comparison is on VALUES and not on how each tool happens to print them.
	@sed -e 's/0x//g' .sc_c_raw.txt > .sc_c.txt
	@od -An -tx1 -v shellcode.bin | tr -s ' \n' ' ' | sed -e 's/^ //' \
	    -e 's/[[:space:]]*$$//' > .sc_asm.txt
	@if cmp -s .sc_c.txt .sc_asm.txt; then \
	    n=$$(wc -c < shellcode.bin); \
	    echo "MATCH: the $$n bytes in fooc.c are byte-for-byte what"; \
	    echo "       shellcode.S assembles to."; \
	    rm -f .sc_c_raw.txt .sc_c.txt .sc_asm.txt; \
	else \
	    echo "MISMATCH -- the two differ:"; \
	    diff .sc_c.txt .sc_asm.txt || true; \
	    rm -f .sc_c_raw.txt .sc_c.txt .sc_asm.txt; exit 1; \
	fi

# -----------------------------------------------------------------------------
# run: start the daemon in the background.
#
# setsid + nohup + </dev/null are all needed. Without setsid the daemon dies
# when the invoking shell exits; without </dev/null it inherits your terminal
# and competes with you for it; without nohup it gets SIGHUP.
#
# It listens on 127.0.0.1 only. Please keep it that way.
# -----------------------------------------------------------------------------
PORT ?= 2342
run: food
	@echo "=== starting food on 127.0.0.1:$(PORT)"
	@setsid nohup ./food -p $(PORT) > food.log 2>&1 </dev/null & \
	    disown 2>/dev/null || true
	@sleep 1
	@if pgrep -x food >/dev/null; then \
	    echo "=== food is running (pid $$(pgrep -x food | head -1))"; \
	    echo "=== stack segment -- 'rwxp' means executable (needed for shellcode):"; \
	    grep '\[stack\]' /proc/$$(pgrep -x food | head -1)/maps; \
	else \
	    echo "=== food failed to start; see food.log"; exit 1; \
	fi

# -----------------------------------------------------------------------------
# test: the technique matrix. Every technique must print both SEEN.
#
# Note this runs against whatever ./food currently is. If you last ran
# `make hardened`, you are testing the hardened build -- which is what
# test-hardened is for.
# -----------------------------------------------------------------------------
#
# Note on the redirection below. The verdict is the "[pty_test] ..." line the
# harness prints to STDERR, and its EXIT STATUS, so stderr is sent to the
# terminal and the shell's chatter (stdout) is discarded. Piping the two
# together and tailing is what hid a real failure during development: the pty's
# echo of our own command line contains the marker string, so a loose grep on
# the transcript was always going to pass.
test: tests/pty_test
	@fail=0; \
	for t in ret2win ret2libc shellcode; do \
	    echo "=================== $$t"; \
	    if ./tests/pty_test -t $$t 2>&1 >/dev/null; then \
	        :; \
	    else \
	        fail=1; \
	    fi; \
	done; \
	echo; \
	if [ $$fail -eq 0 ]; then \
	    echo "=== all three techniques gave a working shell"; \
	else \
	    echo "=== at least one technique did NOT work."; \
	    echo "=== If food was built with `make hardened`, that is the"; \
	    echo "=== mitigations doing their job. See README.md."; \
	fi; \
	exit $$fail

# -----------------------------------------------------------------------------
# test-hardened: swap in the hardened daemon, prove the mitigations hold, then
# put the vulnerable one back. Leaves your tree exactly as it found it.
# -----------------------------------------------------------------------------
#
# Two things this target has to get right, both of which bit during development:
#
#   * `pgrep -x` matches the process NAME, and the hardened binary is
#     food_hardened, not food. Using the wrong name silently inspects nothing.
#   * The verdict is pty_test's EXIT STATUS (0 = both markers seen), not the
#     presence of its output line. Grepping for a line that is also printed on
#     failure reports success for a run that crashed.
test-hardened: hardened tests/pty_test
	@if ! pgrep -x food >/dev/null; then \
	    echo "=== start the daemon first:  make run"; exit 1; \
	fi
	@echo "### stopping the vulnerable daemon"
	@$(MAKE) --no-print-directory stop
	@echo "### starting food_hardened instead"
	@setsid nohup ./food_hardened -p $(PORT) > food_hardened.log 2>&1 \
	    </dev/null & disown 2>/dev/null || true
	@sleep 1
	@if ! pgrep -x food_hardened >/dev/null; then \
	    echo "!!! food_hardened did not start; see food_hardened.log"; \
	    $(MAKE) --no-print-directory stop; exit 1; \
	fi
	@echo "### stack segment: 'rw-p' (NOT executable) is what you want to see"
	@grep '\[stack\]' /proc/$$(pgrep -x food_hardened | head -1)/maps || true
	@echo
	@for t in ret2win ret2libc shellcode; do \
	    echo "=================== $$t"; \
	    if ./tests/pty_test -t $$t 2>&1 >/dev/null; then \
	        echo "!!! $$t STILL WORKED against the hardened build"; \
	    else \
	        echo "--- $$t was stopped by the mitigations (as expected)"; \
	    fi; \
	done; \
	echo
	@$(MAKE) --no-print-directory stop
	@echo "### restoring the vulnerable daemon"
	@setsid nohup ./food -p $(PORT) > food.log 2>&1 </dev/null \
	    & disown 2>/dev/null || true
	@sleep 1
	@echo
	@echo "=== mitigation comparison is above."
	@echo "=== Read the table in README.md to see which flag stopped what,"
	@echo "=== and note which mitigations are NOT enough on their own."

# -----------------------------------------------------------------------------
# debug: build food and run it under gdb, stopping at the vulnerable read() so
# you can watch the stack frame get overwritten.
# -----------------------------------------------------------------------------
debug: food.c
	$(CC) $(CSTD) $(DBG) $(WARN) $(VULN) -o food $<
	@echo "=== built ./food for gdb. Try:"
	@echo "    gdb -q ./food"
	@echo "    (gdb) break food.c:393      # the read() that overflows"
	@echo "    (gdb) run -p 2342"
	@echo "    (gdb) info registers rsp rbp"
	@echo "    (gdb) x/24gx \$rsp         # watch the return address"

# -----------------------------------------------------------------------------
# stop: kill the daemon.
#
# `pkill -x food` matches the process NAME exactly. Do NOT use
# `pkill -f ./food` -- that pattern also matches the shell you typed it into,
# so it kills your own session. This is not a theoretical risk; it happened
# while building this lab.
# -----------------------------------------------------------------------------
stop:
	@if pgrep -x food >/dev/null; then \
	    pkill -x food; sleep 0.5; \
	    echo "=== food stopped"; \
	else \
	    echo "=== food was not running"; \
	fi
	@# The hardened binary has a different process name, so it needs its own
	@# pkill. A leftover food_hardened keeps port 2342 bound and makes the
	@# next `make run` fail with "Address already in use".
	@if pgrep -x food_hardened >/dev/null; then \
	    pkill -x food_hardened; sleep 0.5; \
	    echo "=== food_hardened stopped"; \
	fi

clean:
	rm -f food fooc food.hardened shellcode.bin
	rm -f .sc_c_raw.txt .sc_c.txt .sc_asm.txt
	rm -f tests/pty_test tests/sock_test
	@echo "=== cleaned. (food.log is left alone; it is your evidence.)"

.PHONY: all run stop test test-hardened verify verify-shellcode hardened debug clean