218,

11/11

멍멍

http://cyworld.co.kr/codesire

LEVEL6(darkelf) - 에그헌터 + 버퍼헌터 + 인자 길이 체크

http://www.hackerschool.org/HS_Boards/zboard.php?id=bof_fellowship&no=19 [복사]

[환경]
- Redhat 6.2
- Dummy : X
- Drop Privileage : X
- NON-EXEC STACK : X
- NON-EXEC HEAP : X
- Canary : X
- Random Stack : X
- Random Library : X
- ASCII Armor : X
- Env deleting(Egg hunter) : O
- Local Buffer Hunter : O
- Argv deleting : X
- Allow jump to only stack : O
- Check Length of argv : O, argv[1]

[소스코드]
#include <stdio.h>
#include <stdlib.h>

extern char **environ;

main(int argc, char *argv[])
{
        char buffer[40];
        int i;

        if(argc<2){
                printf("argv error\n");
                exit(0);
        }

        // egghunter
        for(i=0; environ[i]; i++)
                memset(environ[i], 0, strlen(environ[i]));

        if(argv[1][47]!='\xbf')
        {
                printf("stack is still your friend.\n");
                exit(0);
        }

        // check the length of argument
        if(strlen(argv[1]) > 48){
                printf("argument is too long!\n");
                exit(0);
        }

        strcpy(buffer, argv[1]);
        printf("%s\n", buffer);

        // shellcode hunter
        memset(buffer, 0, 40);
}

Hit : 2381 Date : 2010/02/27 09:34