http://www.hackerschool.org/HS_Boards/zboard.php?id=QNA_system&no=1589 [º¹»ç]
½Ç½À ³»¿ëó·³ RET(¸®ÅÏ ¾îµå·¹½º)¸¦ 0xdeadbeef·Î ¹Ù²Ù·Á°í ÇÕ´Ï´Ù.
¼Ò½ºÄÚµå´Â ¾Æ·¡¿Í °°½À´Ï´Ù.
Jack2@SchoolPC ~/BOF/12
$ cat ex3.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "dumpcode.h"
int main(int argc, char *argv[])
{
char buffer[20] = {0,}; //0À¸·Î ÃʱâÈ
int *pointer_to_ret = (int *)(buffer+24); //ret¸¦ Ãâ·ÂÇϱâ À§ÇÑ Æ÷ÀÎÅÍ
if(argc < 2)
{
printf("argument error\n");
exit(-1);
}
//dumpcode·Î ¸Þ¸ð¸® ´ýÇÁ
dumpcode(buffer, 28);
printf("[+] BEFORE : the return address is 0x%08x\n\n", *pointer_to_ret);
//buffer overflow ¹ß»ý!!
strcpy(buffer, argv[1]);
//dumpcode·Î ¸Þ¸ð¸® ´ýÇÁ
dumpcode(buffer, 28);
printf("[+] AFTER : the return address is 0x%08x\n\n", *pointer_to_ret);
}
¸·»ó 0xdeadbeef·Î ¹Ù²Ù·Á°í Çϴµ¥ ¾Æ·¡¿Í °°Àº °á°ú°¡ ³ªÅ¸³³´Ï´Ù.
Jack2@SchoolPC ~/BOF/12
$ ./ex3 aaaaaaaaaaaaaaaaaaaaaaaa`python -c 'print "\xef\xbe\xad\xde"'`
0x0022ac78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x0022ac88 00 00 00 00 90 ac 22 00 2f 00 00 00 ......"./...
[+] BEFORE : the return address is 0x0000002f
0x0022ac78 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa
0x0022ac88 61 61 61 61 61 61 61 61 ef be ad de aaaaaaaa....
Segmentation fault (core dumped)
Áï , printf("[+] AFTER : the return address is 0x%08x\n\n", *pointer_to_ret);
ÀÌ Äڵ尡 ½ÇÇàµÇÁö ¾Ê´Âµ¥¿ä...
Ȥ½Ã³ª ÇÏ´Â »ý°¢¿¡ ftz ¼¹ö¿¡ Á¢¼ÓÀ» ÇÑ µÚ °°Àº ¼Ò½ºÄڵ带 ÄÄÆÄÀÏ ÇÑ °á°ú
[guest@ftz practice]$ ./ex3 aaaaaaaaaaaaaaaaaaaaaaaa`python -c 'print "\xef\xbe\xad\xde"'`
0xbffffa90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0xbffffaa0 00 00 00 00 04 fb ff bf b8 fa ff bf ............
[+] BEFORE : the return address is 0xbffffab8
0xbffffa90 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa
0xbffffaa0 61 61 61 61 61 61 61 61 ef be ad de aaaaaaaa....
[+] AFTER : the return address is 0xdeadbeef
´ÙÀ½°ú °°ÀÌ Àß ³ªÅ¸³³´Ï´Ù.
Á¦°¡ ½Ç½ÀÇÑ È¯°æÀÌ windows xp cygwin ȯ°æ¿¡¼ ÄÄÆÄÀÏÀ» Çß½À´Ï´Ù.
±×·¡¼ ¹®Á¦°¡ »ý±ä°Í °°Àºµ¥
ÀÚ¼¼ÇÑ ¿øÀÎ ¾Æ½Ã´Â ºÐ ÀÖÀ¸½Ã¸é ´äº¯ Á» ºÎŹµå¸±²²¿ä
|
Hit : 3363 Date : 2012/06/27 01:55
|