|
http://www.hackerschool.org/HS_Boards/zboard.php?id=QNA_system&no=1726 [복사]
ftz구축해서 레벨12번 문제 풀고있는데요
gdb로 주소 확인하려고 하는데
확인할때마다 esp값이 계속바뀌어서 ret주소를 못찾겠습니다...
저와같은분의 글이 있어서 답변을보니 스택에 ASLR이 걸려있는것같다고 하셨는데
이럴경우 어떻게 해야되나요?;
가뜩이나 쉘코드공격하는것도 잘몰라서 책보면서 따라하고있는데
책그대로해도 안되니 진도를못나가겠네요 ㅠㅠㅠㅠ
0x08048470 <main+0>: push %ebp
0x08048471 <main+1>: mov %esp,%ebp
0x08048473 <main+3>: sub $0x108,%esp
0x08048479 <main+9>: sub $0x8,%esp
0x0804847c <main+12>: push $0xc15
0x08048481 <main+17>: push $0xc15
0x08048486 <main+22>: call 0x804835c <setreuid>
0x0804848b <main+27>: add $0x10,%esp
0x0804848e <main+30>: sub $0xc,%esp
0x08048491 <main+33>: push $0x8048538
0x08048496 <main+38>: call 0x804834c <printf>
0x0804849b <main+43>: add $0x10,%esp
0x0804849e <main+46>: sub $0xc,%esp
0x080484a1 <main+49>: lea 0xfffffef8(%ebp),%eax
0x080484a7 <main+55>: push %eax
0x080484a8 <main+56>: call 0x804831c <gets>
0x080484ad <main+61>: add $0x10,%esp
0x080484b0 <main+64>: sub $0x8,%esp
0x080484b3 <main+67>: lea 0xfffffef8(%ebp),%eax
0x080484b9 <main+73>: push %eax
0x080484ba <main+74>: push $0x804854c
0x080484bf <main+79>: call 0x804834c <printf>
0x080484c4 <main+84>: add $0x10,%esp
0x080484c7 <main+87>: leave
0x080484c8 <main+88>: ret
0x080484c9 <main+89>: lea 0x0(%esi),%esi
0x080484cc <main+92>: nop
0x080484cd <main+93>: nop
0x080484ce <main+94>: nop
0x080484cf <main+95>: nop
End of assembler dump.
(gdb) b *0x080484bf <--브레이크 걸음
(gdb) r <--- 실행
Starting program: /home/level12/tmp/attackme
문장을 입력하세요.
AAAA <--- 값 입력
Breakpoint 1, 0x080484bf in main ()
(gdb) x/12x $esp <---esp 값 확인
0xbfffdfb0: 0x0804854c 0xbfffdfc0 0xbfffdfe0 0x00000001
0xbfffdfc0: 0x41414141 0x00000000 0x00000000 0x078e530f
0xbfffdfd0: 0xbfffe070 0x40015a38 0x0029656e 0x00000000
(gdb) r <--- 다시 실행
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/level12/tmp/attackme
문장을 입력하세요.
AAAA
Breakpoint 1, 0x080484bf in main ()
(gdb) x/12x $esp (값 달라짐)
0xbfffe6b0: 0x0804854c 0xbfffe6c0 0xbfffe6e0 0x00000001
0xbfffe6c0: 0x41414141 0x00000000 0x00000000 0x078e530f
0xbfffe6d0: 0xbfffe770 0x40015a38 0x0029656e 0x00000000
(gdb)
|
Hit : 3825 Date : 2014/01/17 06:36
|
1574, 
6/79 
