|
http://www.hackerschool.org/HS_Boards/zboard.php?AllArticle=true&no=1904 [복사]
[level13@ftz level13]$ gdb -q attackme
(gdb) disas main
Dump of assembler code for function main:
0x080484a0 <main+0>: push %ebp
0x080484a1 <main+1>: mov %esp,%ebp
0x080484a3 <main+3>: sub $0x418,%esp
0x080484a9 <main+9>: movl $0x1234567,0xfffffff4(%ebp)
0x080484b0 <main+16>: sub $0x8,%esp
0x080484b3 <main+19>: push $0xc16
0x080484b8 <main+24>: push $0xc16
0x080484bd <main+29>: call 0x8048370 <setreuid>
0x080484c2 <main+34>: add $0x10,%esp
0x080484c5 <main+37>: cmpl $0x1,0x8(%ebp)
0x080484c9 <main+41>: jle 0x80484e5 <main+69>
0x080484cb <main+43>: sub $0x8,%esp
0x080484ce <main+46>: mov 0xc(%ebp),%eax
0x080484d1 <main+49>: add $0x4,%eax
0x080484d4 <main+52>: pushl (%eax)
0x080484d6 <main+54>: lea 0xfffffbe8(%ebp),%eax
0x080484dc <main+60>: push %eax
0x080484dd <main+61>: call 0x8048390 <strcpy>
0x080484e2 <main+66>: add $0x10,%esp
0x080484e5 <main+69>: cmpl $0x1234567,0xfffffff4(%ebp)
0x080484ec <main+76>: je 0x804850d <main+109>
0x080484ee <main+78>: sub $0xc,%esp
0x080484f1 <main+81>: push $0x80485a0
0x080484f6 <main+86>: call 0x8048360 <printf>
0x080484fb <main+91>: add $0x10,%esp
0x080484fe <main+94>: sub $0x8,%esp
0x08048501 <main+97>: push $0xb
0x08048503 <main+99>: push $0x0
0x08048505 <main+101>: call 0x8048380 <kill>
0x0804850a <main+106>: add $0x10,%esp
0x0804850d <main+109>: leave
0x0804850e <main+110>: ret
0x0804850f <main+111>: nop
End of assembler dump.
(gdb) b *main+69
Breakpoint 1 at 0x80484e5
(gdb) r 'python -c 'print "A"*1024'`
Starting program: /home/level13/attackme 'python -c 'print "A"*1024'`
/bin/bash: -c: line 1: unexpected EOF while looking for matching `''
/bin/bash: -c: line 2: syntax error: unexpected end of file
Program exited with code 02.
You can't do that without a process to debug.
(gdb) r `python -c 'print "A"*1024'`
Starting program: /home/level13/attackme `python -c 'print "A"*1024'`
Breakpoint 1, 0x080484e5 in main ()
(gdb) x/100x $ebp-100
0xbffff6d4: 0x41414141 0x41414141 0x41414141 0x41414141
0xbffff6e4: 0x41414141 0x41414141 0x41414141 0x41414141
0xbffff6f4: 0x41414141 0x41414141 0x41414141 0x41414141
0xbffff704: 0x41414141 0x41414141 0x41414141 0x41414141
0xbffff714: 0x41414141 0x41414141 0x41414141 0x08048300
0xbffff724: 0x401541c0 0xbffff738 0x01234567 0x40029078
0xbffff734: 0x401541c0 0xbffff758 0x40033917 0x00000002
0xbffff744: 0xbffff784 0xbffff790 0x4001582c 0x00000002
0xbffff754: 0x080483a0 0x00000000 0x080483c1 0x080484a0
0xbffff764: 0x00000002 0xbffff784 0x08048308 0x08048550
0xbffff774: 0x4000c660 0xbffff77c 0x00000000 0x00000002
0xbffff784: 0xbffff873 0xbffff88a 0x00000000 0xbffffc8b
0xbffff794: 0xbffffca4 0xbffffcc2 0xbffffccd 0xbffffcdd
0xbffff7a4: 0xbffffceb 0xbffffcf8 0xbffffebb 0xbffffefe
0xbffff7b4: 0xbfffff1b 0xbfffff2d 0xbfffff42 0xbfffff53
0xbffff7c4: 0xbfffff64 0xbfffff77 0xbfffff7f 0xbfffff9e
0xbffff7d4: 0xbfffffae 0xbfffffd0 0x00000000 0x00000010
0xbffff7e4: 0x0fabfbff 0x00000006 0x00001000 0x00000011
0xbffff7f4: 0x00000064 0x00000003 0x08048034 0x00000004
0xbffff804: 0x00000020 0x00000005 0x00000006 0x00000007
0xbffff814: 0x40000000 0x00000008 0x00000000 0x00000009
0xbffff824: 0x080483a0 0x0000000b 0x00000c15 0x0000000c
0xbffff834: 0x00000c15 0x0000000d 0x00000c15 0x0000000e
0xbffff844: 0x00000c15 0x0000000f 0xbffff86e 0x00000000
0xbffff854: 0x00000000 0x00000000 0x00000000 0x00000000
(gdb)
$ebp의 내용을 봐도 A값이 쭈루룩 나오고
$ebp-100을 해도 A값이 쭈루룩 나오네요.
근데 0x01234567을 볼려면 $ebp-100을 해야지
그 위치가 나옵니다.
왜 그런건가요? |
Hit : 2498 Date : 2017/12/19 06:35
|
1576, 
1/79 
