http://www.hackerschool.org/HS_Boards/zboard.php?id=QNA_system&no=1940 [º¹»ç]
[level14@ftz level14]$ ls
attackme hint public_html tmp
[level14@ftz level14]$ cat hint
·¹º§14 ÀÌÈķδ mainsourceÀÇ ¹®Á¦¸¦ ±×´ë·Î °¡Á®¿Ô½À´Ï´Ù.
¹öÆÛ ¿À¹öÇ÷οì, Æ÷¸Ë½ºÆ®¸µÀ» ÇнÀÇϴµ¥´Â ÀÌ ¹®Á¦µéÀÌ
ÃÖ°íÀÇ È¿°ú¸¦ °¡Á®´ÙÁÝ´Ï´Ù.
#include <stdio.h>
#include <unistd.h>
main()
{ int crap;
int check;
char buf[20];
fgets(buf,45,stdin);
if (check==0xdeadbeef)
{
setreuid(3095,3095);
system("/bin/sh");
}
}
[level14@ftz level14]$ cd tmp
[level14@ftz tmp]$ ls
attackme
[level14@ftz tmp]$ gdb -q attackme
(gdb) disas main
Dump of assembler code for function main:
0x08048490 <main+0>: push %ebp
0x08048491 <main+1>: mov %esp,%ebp
0x08048493 <main+3>: sub $0x38,%esp
0x08048496 <main+6>: sub $0x4,%esp
0x08048499 <main+9>: pushl 0x8049664
0x0804849f <main+15>: push $0x2d
0x080484a1 <main+17>: lea 0xffffffc8(%ebp),%eax
0x080484a4 <main+20>: push %eax
0x080484a5 <main+21>: call 0x8048360 <fgets>
0x080484aa <main+26>: add $0x10,%esp
0x080484ad <main+29>: cmpl $0xdeadbeef,0xfffffff0(%ebp)
0x080484b4 <main+36>: jne 0x80484db <main+75>
0x080484b6 <main+38>: sub $0x8,%esp
0x080484b9 <main+41>: push $0xc17
0x080484be <main+46>: push $0xc17
0x080484c3 <main+51>: call 0x8048380 <setreuid>
0x080484c8 <main+56>: add $0x10,%esp
0x080484cb <main+59>: sub $0xc,%esp
0x080484ce <main+62>: push $0x8048548
0x080484d3 <main+67>: call 0x8048340 <system>
0x080484d8 <main+72>: add $0x10,%esp
0x080484db <main+75>: leave
0x080484dc <main+76>: ret
0x080484dd <main+77>: lea 0x0(%esi),%esi
End of assembler dump.
µð¹ö±ëµÈ °ÍÁß¿¡¼ sub·Î µÈ ¾î¼Àºí¸®¾î ¸í·É¾î ÀÖÀݾƿä.
0x08048493 <main+3>: sub $0x38,%esp
0x08048496 <main+6>: sub $0x4,%esp
0x080484b6 <main+38>: sub $0x8,%esp
0x080484cb <main+59>: sub $0xc,%esp
ÀÌ 4°³ °¢°¢ ¹«½¼ ¿ªÇÒÀ» ÇÏ´ÂÁö ¼³¸íÇØÁÖ½Ç ºÐ °è½Ã³ª¿ä?
esp¿¡¼ »©´Â°Ç ¾Ë±ä ¾Æ´Âµ¥ C¾ð¾î ¼Ò½º Äڵ带 ºñ±³Çϸé¼
¿Ö Àú·± sub¸í·É¾î°¡ ÀÖ¾î¾ß µÇ´ÂÁö ±×°É ¸ð¸£°Ú½À´Ï´Ù. |
Hit : 1960 Date : 2018/09/21 02:14
|