博客
关于我
攻防世界-pwn-200-Writeup
阅读量:572 次
发布时间:2019-03-09

本文共 2103 字,大约阅读时间需要 7 分钟。

pwn-200 Vulnerability Analysis

Overview of the Issue

The sub_8048484 function in the provided code is vulnerable to a stack overflow attack. This function reads data into a buffer using read(0, &buf, 0x100u) which can cause a stack overflow if not handled correctly. The vulnerable code is:

ssize_t sub_8048484() {    char buf;    setbuf(stdin, &buf);    return read(0, &buf, 0x100u); // Overflow here}

Exploiting the Vulnerability

To exploit this vulnerability, we need to analyze how the stack buffer works. The function uses a single-byte buffer and attempts to read data directly into the stack without proper bounds checking. Exploiting this requires understanding how the stack is structured and how overflow affects it.

The key to this exploit is to identify the location where the return address is stored after the stack overflow. By overwriting the return address, we can control the program's flow and gain arbitrary code execution.

Finding libc Base

Using the provided exploit code, the following steps can be taken:

  • Identify the libc base

    After successful exploitation, we can leak the memory address of the write function from libc6-i386_2.23-0ubuntu11_amd64.so. This is done by sending a crafted payload that forces the program to use the overwritten return address as the write function's target.

  • Calculate libc_base

    Once the write function's address is identified, we subtract the libc.symbols['write'] value from it to get the base address of libc.

  • Identify system() Function

    With libc_base, we can find the system() function's address and eventually gain a shell using /bin/sh.

  • Exploit Execution

    The provided remote exploit code demonstrates how to:

  • Bypass stack guard pages by sending a payload that triggers the stack overflow.
  • Update the return address to point to the write function's address.
  • Read the leaked memory address to find the write function's base, hence determining the libc_base.
  • Use system() for shelling out by leveraging binsh from libc.
  • By following these steps, a full RDI (Remote Differential Exploit) can be achieved, allowing for full control over the system.

    转载地址:http://amppz.baihongyu.com/

    你可能感兴趣的文章
    MySQL中的关键字深入比较:UNION vs UNION ALL
    查看>>
    mysql中的四大运算符种类汇总20多项,用了三天三夜来整理的,还不赶快收藏
    查看>>
    mysql中的字段如何选择合适的数据类型呢?
    查看>>
    MySQL中的字符集陷阱:为何避免使用UTF-8
    查看>>
    mysql中的数据导入与导出
    查看>>
    MySQL中的时间函数
    查看>>
    mysql中的约束
    查看>>
    MySQL中的表是什么?
    查看>>
    mysql中穿件函数时候delimiter的用法
    查看>>
    Mysql中索引的分类、增删改查与存储引擎对应关系
    查看>>
    Mysql中索引的最左前缀原则图文剖析(全)
    查看>>
    MySql中给视图添加注释怎么添加_默认不支持_可以这样取巧---MySql工作笔记002
    查看>>
    Mysql中获取所有表名以及表名带时间字符串使用BetweenAnd筛选区间范围
    查看>>
    Mysql中视图的使用以及常见运算符的使用示例和优先级
    查看>>
    Mysql中触发器的使用示例
    查看>>
    Mysql中设置只允许指定ip能连接访问(可视化工具的方式)
    查看>>
    mysql中还有窗口函数?这是什么东西?
    查看>>
    mysql中间件
    查看>>
    MYSQL中频繁的乱码问题终极解决
    查看>>
    MySQL为Null会导致5个问题,个个致命!
    查看>>