Network penetration technology Beginners
August 24, 2011
buffer overflow write data to the array, the length of the write data exceeds the size of the original definition of an array.
For example, in front of you define the intbuff [10], then the only buff [0], buff [9] space we define buff
application legal space, but Later, when the data is entered, write the buff [12] 0×10 you crossed the line. The C language commonly used
strcpy, sprintf, strcat function, are very easy to cause a buffer overflow problem.
access to the C programming language books will usually tell you when the program will overflow unpredictable results. Buffer overflow exploit in the field of network security
art is to make this “unpredictable results” into the results we expect.
to see this demo program: buf.c
“the> 2133529@qq.com * /
# include
voidwhy_here (void)
{
printf (“whyu here?!”);
_exit (0) ;
}
intmain (intargc, char * argv [])
{
intbuff [1];
buff [2] (int) why_here;
return 0;
}
on the command line with VC command-line compiler to compile (under Linux with gcc to compile and run is the same result):
C: \ Temp> clbuf.c
run the program:
C: \ Temp> buf.E Ⅹ E
whyu here?!
careful analysis of the program and print the information, you can find the program, we do not call why_here function, but the function
at run time is called!
The only explanation is buff [2] why_here; operation causes the program execution process
To explain this phenomenon need to understand some of the C language the underlying (and related) computer architecture and compilation of knowledge, especially in the CALL
“stack” and the compilation / change. RET knowledge, if you still lack the proposed reference books,
or behind will be difficult to keep up.
assume the you already have basic understanding of the stack, we have to understand the procedures for the operation:
into the main function of the stack contents:
of eip] [ebp] [buff [0]
address <----
more than three storage units of the low address eip is the main function return address, buff [0] unit is to buff the stated int
space program we defined intbuff to [1], then only the operation buff [0] is reasonable (we only apply
an int space) buff [2] why_here operating beyond the space of the buff, this operating cross-border
overflow overflow consequences: buff [2] assignment in fact, cover the stack eip in the storage unit number
, the main function of the return address to the why_here function entry address returned so that the main function after the end of this address as the return address will be run.
The above demonstrates the buffer overflow to overflow the nature of the simplest and most core demo, requires careful understanding. If you
is not clear can be combined with the corresponding assembly The code to understand.
FA parameters can be specified when the VC command-line compiler to compile corresponding assembly code (Linux platform
gcc-S-parameters) :
C: \ Temp> cl / FA tex.c
C: \ Temp> typetex.asm
TITLE tex.c
.386 P
include listing.inc
if @ Version gt510
. modelFLAT
else
_TEXT SEGMENTPARA USE32PUBLIC ODE
_TEXT ENDS
_DATA SEGMENTDWORDUSE32PUBLIC ATA
_DATA ENDS
CONST SEGMENTDWORDUSE32PUBLIC ONST
CONST ENDS
_BSS SEGMENTDWORDUSE32PUBLIC SS
_BSS ENDS
$ $ SYMBOLS SEGMENTBYTEUSE32 EBSYM
$ $ SYMBOLS ENDS
_TLS SEGMENTDWORDUSE32PUBLIC LS
_TLS ENDS
FLAT GROUP_DATA, CONST, _BSS
ASSUME CS: FLAT, DS: FLAT, SS: FLAT
endif
INCLUDELIB LIBC
INCLUDELIB OLDNAMES
_DATA SEGMENT
$ SG775 DB hyu here?! 0aH, 00H
_DATA ENDS
PUBLIC _why_here
EXTRN _printf: NEAR
EXTRN __ exit: NEAR
_TEXT SEGMENT
_why_herePROCNEAR
push ebp
mov ebp, esp
push OFFSETFLATSG775
call _printf
addesp, 4
push 0
call __ exit
addesp, 4
popebp
ret0
_why_hereENDP
_TEXT ENDS
PUBLIC _main
_TEXT SEGMENT
_buff $ -4; size 4
_argc $ 8; size 4
_argv $ 12; size 4
_main PROCNEAR
< br /> push ebp
mov ebp, esp
push ecx
mov DWORD PTR_buff $ [ebp 8], OFFSETFLAT: _why_here
xor eax, eax
mov esp, ebp
pop ebp ret 0
,
that _main is ENDP
the _TEXT ENDS
END
this example, we overflow buff cover the function return address stack coverage data stack the data
also known as stack overflow. corresponding overflow cover in the heap, is called heap overflow occurred in the initialization data
zone is called to initialize the data area overflow.
implementation of the use (ie, attack this problem the program) need more themes that are not yet involved in buffer overflow:
the shellcode function
2. the shellcode to store address locator
3. overflow address location
will later chapters explain in detail.
the
SHELLCODE basis
overflow occurred after control overflow after the behavior of the key is the function of the shellcode. the shellcode is actually
segments machine code written in assembler because we are usually at most, will never directly use machine code programming, so it feels very mysterious
shellcode here to let us uncover its mystery.
see the program shell0.c:
the # include
intadd (int x, inty) {
return x y;
}
intmain (void) {
resultadd (129,127);
printf (“result% i”, result);
return 0;
}
This program is too simple to look at this program it? shell1.c
# the include
the # include
an int the add (int x, inty )
{
return x y;
}
typedef for an int (* PF) (int, int );
intmain (void)
{
unsignedcharbuff [256];
unsignedchar * ps (unsignedchar * )
unsignedchar * pdbuff;
intresult0;
PF pf (PF) buff;
while ( 1)
{
* pd * ps,;
printf (“[url = file :/ / \ \ xx \ \ xx” , * ps);
if (* ps, 0xc3)
{
break;
}
pd , ps ;
}
resultpf (129,127);
printf (“result% i”, result);
return 0;
compiled to run, the results are as follows:
the shell: \ x55 \ x89 \ xe5 \ x8b \ x45 \ x0c \ x03 \ x45 \ x08 \ x5d \ xc3
result25
lies shell1 shell1 and shell0 different add function correspond to the machine code from the code space to copy to the buff
(copy process, the way they print out), then run through a function pointer code in the buff!
key code to explain:
unsignedchar * ps (unsignedchar *)
