|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
 |
  1576,  1/79 |
  |
 |
 |
 |
 |
hj7933 | ||||||
 |
|||||||
 |
http://없음 | ||||||
|
|||||||
 |
perl, python 을 이용해 메모리 \xff 입력 방법 아시는 분~ | ||||||
|
|||||||
|
http://www.hackerschool.org/HS_Boards/zboard.php?AllArticle=true&no=1496 [복사]
Hit : 4353 Date : 2011/06/23 02:32
|
|||||||
 |
|||||||
|  |
| |
| hj7933 | Redhat 6.2 입니다. 방금 CentOS 최근 버젼에서 테스트 했는데 거기서는 잘들어가네요;; Perl 스크립트 또는 OS의 언어팩 문제 일 수도 있겠네요.. |
2011/06/23 | |
| hj7933 | 헉;; BOF원정대 1번 문제 에서 테스트 해봤는데 거기서도 마찬가지네요 Perl, Python 버젼 문제?? 아시는분 답좀옴~~ㅠㅠ | 2011/06/23 | |
| W.H. | bash2 실행하시고 해보세요 버그땜시 bash에선 0xff가 잘 않먹힙니다. | 2011/06/23 | |
| hj7933 | 그랬군요.. 답변 감사합니다 ^^ 다른 분들을 위해 테스트 붙여 넣기 [root@BOF /home]# printenv PWD=/home HOSTNAME=BOF LESSOPEN=|/usr/bin/lesspipe.sh %s ENV=/root/.bashrc USER=root LS_COLORS=no=00:fi=00:di=01;34:ln=01;36:pi=40;33:so=01;35:bd=40;33;01:cd=40;33;01:or=01;05;37;41:mi=01;05;37;41:ex=01;32:*.cmd=01;32:*.exe=01;32:*.com=01;32:*.btm=01;32:*.bat=01;32:*.sh=01;32:*.csh=01;32:*.tar=01;31:*.tgz=01;31:*.arj=01;31:*.taz=01;31:*.lzh=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.gz=01;31:*.bz2=01;31:*.bz=01;31:*.tz=01;31:*.rpm=01;31:*.cpio=01;31:*.jpg=01;35:*.gif=01;35:*.bmp=01;35:*.xbm=01;35:*.xpm=01;35:*.png=01;35:*.tif=01;35: MACHTYPE=i386-redhat-linux-gnu MAIL=/var/spool/mail/root INPUTRC=/etc/inputrc LANG=en_US LOGNAME=root SHLVL=1 SHELL=/bin/bash2 <-- /bin/bash2 사용 USERNAME=root HOSTTYPE=i386 OSTYPE=linux-gnu HISTSIZE=1000 TERM=vt100 HOME=/root PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/bin/X11:/usr/X11R6/bin:/root/bin _=/usr/bin/printenv OLDPWD=/root [root@BOF /home]# ls bof0x01 bof0x02 ftp httpd lost+found [root@BOF /home]# cd bof0x01 [root@BOF bof0x01]# ls 1.NOP 2.ENV 3.HEAP 4.Func_overflow 5.Format_String 6.DTOR My_exploit_Tools [root@BOF bof0x01]# cd 1.NOP/ [root@BOF 1.NOP]# gdb vuln GNU gdb 19991004 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux"... (gdb) disass main Dump of assembler code for function main: 0x80483d0 <main>: push %ebp 0x80483d1 <main+1>: mov %esp,%ebp 0x80483d3 <main+3>: sub $0x1f4,%esp 0x80483d9 <main+9>: mov 0xc(%ebp),%eax 0x80483dc <main+12>: add $0x4,%eax 0x80483df <main+15>: mov (%eax),%edx 0x80483e1 <main+17>: push %edx 0x80483e2 <main+18>: lea 0xfffffe0c(%ebp),%eax 0x80483e8 <main+24>: push %eax 0x80483e9 <main+25>: call 0x8048308 <strcpy> 0x80483ee <main+30>: add $0x8,%esp 0x80483f1 <main+33>: xor %eax,%eax 0x80483f3 <main+35>: jmp 0x80483f5 <main+37> 0x80483f5 <main+37>: leave 0x80483f6 <main+38>: ret End of assembler dump. (gdb) b *main+9 Breakpoint 1 at 0x80483d9: file vuln.c, line 3. (gdb) b *main+30 Breakpoint 2 at 0x80483ee: file vuln.c, line 3. (gdb) r `perl -e 'print "\x45\x45\xff\xff\xff\xff\x45\x45"'` Starting program: /home/bof0x01/1.NOP/vuln `perl -e 'print "\x45\x45\xff\xff\xff\xff\x45\x45"'` Breakpoint 1, main (argc=2, argv=0xbffffb64) at vuln.c:3 3 strcpy( buffer, argv[1] ); (gdb) info reg esp esp 0xbffff924 -1073743580 (gdb) c Continuing. Breakpoint 2, 0x80483ee in main (argc=2, argv=0xbffffb64) at vuln.c:3 3 strcpy( buffer, argv[1] ); (gdb) x/4 0xbffff924 0xbffff924: 0xffff4545 0x4545ffff 0x00000000 0x400139d0 (gdb) 잘 들어가네요. 감사합니다. |
2011/06/28 | |
|
|