缓冲区溢出跳转到部分代码
我的老师给了我一些代码，我必须运行它并使用缓冲区溢出使其跳转到管理部分。我无法修改源代码。有人可以解释一下我如何使用缓冲区溢出跳转到管理方法吗？我在 ubuntu 8.10 上运行它，它是用旧版本的 gcc 编译的，所以溢出会起作用。
My teacher gave me some code and I have to run it and make it jump to the admin section using a buffer overflow. I cannot modify the source code. Could someone explain how I could jump to the admin method using a buffer overflow? I'm running it on ubuntu 8.10 and it was compiled with an older version of gcc so the overflow will work.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
在无法看到代码的情况下，一般来说，您需要设计函数的输入，以覆盖堆栈上的返回地址（或函数将控制权转移到的另一个地址）。
据猜测，代码有一个固定长度的字符缓冲区，并将函数参数中的值复制到该缓冲区中，而不验证长度是否超过缓冲区的长度。
您需要记下应用程序的堆栈布局（在调试器下运行它可能是最快的方法），以找出需要覆盖的地址在哪里，然后将一个字符串放在一起用您需要调用的管理函数的地址覆盖它。
Without being able to see the code, on a general level you need to design inputs to the function that will overwrite the return address (or another address to which control will be transferred by the function) on the stack.
At a guess, the code has a fixed length character buffer and copies values from a function parameter into that buffer without validating that the length does not exceed the length of the buffer.
You need to make a note of what the stack layout looks like for your application (running it under a debugger may well be the quickest way to do this) to work out where the address you need to override is, then put together a string to overwrite this with the address of the admin function you need to call.
你总是可以得到它的 asm 输出（我现在忘记了……脑残），看看你想要溢出的缓冲区正在哪里被使用/读取，并检查它的长度。接下来，您要计算需要溢出多远，以便您可以用 JMP（管理代码的地址）替换下一条指令，或者将 JMP 地址更改为管理部分的地址。 0xE8 是 x86 的跳转操作码（如果您需要的话），因为您想用自己的指令覆盖指令的二进制数据。
You can always get the asm output of it (I forgot how right now... brainfart) and see where the buffer you want to overflow is being used/read and check it's length. Next you want to calculate how far you need to overflow it so that you either replace the next instruction with a JMP (address of admin code) or change a JMP address to that of the admin section. 0xE8 is the jump opcode for x86 if you need it since you want to overwrite the binary data of the instruction with your own.