我们是否用操作码或内存地址覆盖 EIP（返回地址）？
char shellcode[] = "\xeb\x2a\x5e\x89\x76\x08\xc6\x46\x07\x00\xc7\x46\x0c\x00\x00\x00" "\x00\xb8\x0b\x00\x00\x00\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80" "\xb8\x01\x00\x00\x00\xbb\x00\x00\x00\x00\xcd\x80\xe8\xd1\xff\xff" "\xff\x2f\x62\x69\x6e\x2f\x73\x68\x00\x89\xec\x5d\xc3";
void main() {
int *ret;
ret = (int *)&ret + 2;
(*ret) = (int)shellcode;
}
据我所知，shellcode[] 是用于生成 shell 的十六进制操作码，代码的最后一行用操作码覆盖 ret。我们是否将操作码或内存地址插入到 RET 中？
char shellcode[] = "\xeb\x2a\x5e\x89\x76\x08\xc6\x46\x07\x00\xc7\x46\x0c\x00\x00\x00" "\x00\xb8\x0b\x00\x00\x00\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80" "\xb8\x01\x00\x00\x00\xbb\x00\x00\x00\x00\xcd\x80\xe8\xd1\xff\xff" "\xff\x2f\x62\x69\x6e\x2f\x73\x68\x00\x89\xec\x5d\xc3";
void main() {
int *ret;
ret = (int *)&ret + 2;
(*ret) = (int)shellcode;
}
to my knowledge, shellcode[] is hex opcode for spawning a shell and the last line of the code overwrite the ret with the opcode. Do we insert opcode or memory address into RET ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
它不会覆盖返回操作码，而是覆盖堆栈上的返回地址（假设它靠近堆栈上声明的变量），以便当
main()返回时它不会返回到_start+n而是改为shellcode。It doesn't overwrite the return opcode, it overwrites the return address on the stack (by assuming it's near a variable declared on the stack) so that when
main()returns it doesn't go back to_start+nbut instead toshellcode.堆栈上的 ret 寄存器是代码返回到的位置，在那里放置操作码不会有太大帮助。我怀疑您想要运行的代码的地址是最有可能的候选者。耶！总体而言，最好考虑您正在交互的项目的用途以及它们的使用方式，而不是试图盲目地将数据转储到其中。
The ret register on the stack is a location that code gets returned to, putting an opcode there wouldn't be of much help. I suspect an address to code you want to run is the most likely candidate. Yay! It's probably best overall to consider what the items you are interacting with are used for, and how they get used rather then trying to blindly dump data into them.
就目前而言，它将地址插入到字符串中。我想在这种情况下，指出它完全不可移植是浪费时间，而且几乎肯定是一个非常糟糕的主意......
As it stands, it's inserting the address the address into the string. I suppose in this case, it's kind of a waste of time to point out that it's completely non-portable and almost certainly a really bad idea...