执行指向 Shellcode 的函数指针

发布于 2024-12-21 02:24:27 字数 1067 浏览 5 评论 0原文

我试图通过覆盖 main 的返回地址来执行 exit(0) 调用的这个简单操作码。问题是我遇到了分段错误。

#include <stdio.h>

char shellcode[]= "/0xbb/0x14/0x00/0x00/0x00"
                  "/0xb8/0x01/0x00/0x00/0x00"
                  "/0xcd/0x80";

void main()
{
      int *ret;

      ret = (int *)&ret + 2; // +2 to get to the return address on the stack

      (*ret) = (int)shellcode;   

}

执行结果出现分段错误。

[user1@fedo BOF]$ gcc -o ExitShellCode ExitShellCode.c

[user1@fedo BOF]$ ./ExitShellCode

Segmentation fault (core dumped)

shellcode.a 系统的 Objdump

[user1@fedo BOF]$ objdump -d exitShellcodeaAss

exitShellcodeaAss:     file format elf32-i386


Disassembly of section .text:

08048054 <_start>:
 8048054:       bb 14 00 00 00          mov    $0x14,%ebx
 8048059:       b8 01 00 00 00          mov    $0x1,%eax
 804805e:       cd 80                   int    $0x80

这是我正在使用的

fedora Linux 3.1.2-1.fc16.i686 
ASLR is disabled.
Debugging with GDB.
gcc version 4.6.2

原文

I'm trying to execute this simple opcode for exit(0) call by overwriting the return address of main.
The problem is I'm getting segmentation fault.

#include <stdio.h>

char shellcode[]= "/0xbb/0x14/0x00/0x00/0x00"
                  "/0xb8/0x01/0x00/0x00/0x00"
                  "/0xcd/0x80";

void main()
{
      int *ret;

      ret = (int *)&ret + 2; // +2 to get to the return address on the stack

      (*ret) = (int)shellcode;   

}

Execution result in Segmentation error.

[user1@fedo BOF]$ gcc -o ExitShellCode ExitShellCode.c

[user1@fedo BOF]$ ./ExitShellCode

Segmentation fault (core dumped)

This is the Objdump of the shellcode.a

[user1@fedo BOF]$ objdump -d exitShellcodeaAss

exitShellcodeaAss:     file format elf32-i386


Disassembly of section .text:

08048054 <_start>:
 8048054:       bb 14 00 00 00          mov    $0x14,%ebx
 8048059:       b8 01 00 00 00          mov    $0x1,%eax
 804805e:       cd 80                   int    $0x80

System I'm using

fedora Linux 3.1.2-1.fc16.i686 
ASLR is disabled.
Debugging with GDB.
gcc version 4.6.2

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

謸气贵蔟 2024-12-28 02:24:27

嗯，也许现在回答这个问题已经太晚了，但它们可能是一个被动语法错误。看起来 shellcode 格式错误，我的意思是：

char shellcode[]= "/0xbb/0x14/0x00/0x00/0x00"
                  "/0xb8/0x01/0x00/0x00/0x00"
                  "/0xcd/0x80";

它不一样：

char shellcode[]= "\xbb\x14\x00\x00\x00"
                  "\xb8\x01\x00\x00\x00"
                  "\xcd\x80";

虽然这个修复不会帮助您解决这个问题，但是您是否尝试过禁用一些内核保护机制，例如：NX 位， 堆栈随机化等...？

mmm maybe it is to late to answer to this question, but they might be a passive syntax error. It seems like thet shellcode is malformed, I mean:

char shellcode[]= "/0xbb/0x14/0x00/0x00/0x00"
                  "/0xb8/0x01/0x00/0x00/0x00"
                  "/0xcd/0x80";

its not the same as:

char shellcode[]= "\xbb\x14\x00\x00\x00"
                  "\xb8\x01\x00\x00\x00"
                  "\xcd\x80";

although this fix won't help you solving this problem, but have you tried disabling some kernel protection mechanism like: NX bit, Stack Randomization, etc... ?

回复收藏 0 原文

眼眸里的那抹悲凉 2024-12-28 02:24:27

基于另外两个问题，即如何确定堆栈上的返回地址？和 C：函数的返回地址（mac），我有信心你没有覆盖正确的地址。这基本上是由于您的假设造成的，即可以按照您的方式确定返回地址。但正如第一个问题 (1) 的答案所示，这必须事实并非如此。

因此：

检查地址是否确实正确
如果您不想使用内置的 GCC 功能，请找到一种方法来确定正确的返回地址

回复收藏 0 原文

以为你会在 2024-12-28 02:24:27

您还可以像在这种情况下一样执行 shellcode，通过将缓冲区转换为类似的函数

(*(int(*)()) shellcode)();

You can also execute shellcode like in this scenario, by casting the buffer to a function like

(*(int(*)()) shellcode)();

回复收藏 0 原文

狼性发作 2024-12-28 02:24:27

如果您希望 shellcode 在堆栈中执行，则必须在没有 NX（堆栈保护器）的情况下并具有正确的权限进行编译。

gcc -fno-stack-protector -z execstack shellcode.c -o shellcode

例如，

#include <stdio.h>
#include <string.h>

const char code[] ="\xbb\x14\x00\x00\x00"
              "\xb8\x01\x00\x00\x00"
              "\xcd\x80";


int main()
{
    printf("Length: %d bytes\n", strlen(code));
    (*(void(*)()) code)();
    return 0;
}

如果您想使用 gdb 对其进行调试：

[manu@debian /tmp]$ gdb ./shellcode 
GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
...
Reading symbols from ./shellcode...(no debugging symbols found)...done.
(gdb) b *&code
Breakpoint 1 at 0x4005c4
(gdb) r
Starting program: /tmp/shellcode 
Length: 2 bytes

Breakpoint 1, 0x00000000004005c4 in code ()
(gdb) disassemble 
Dump of assembler code for function code:
=> 0x00000000004005c4 <+0>: mov    $0x14,%ebx
   0x00000000004005c9 <+5>: mov    $0x1,%eax
   0x00000000004005ce <+10>:    int    $0x80
   0x00000000004005d0 <+12>:    add    %cl,0x6e(%rbp,%riz,2) 
End of assembler dump.

在这个概念证明示例中，空字节并不重要。但是当你开发 shellcode 时，你应该记住并删除坏字符。

If you want the shellcode be executed in the stack you must compile without NX (stack protector) and with correct permissions.

gcc -fno-stack-protector -z execstack shellcode.c -o shellcode

E.g.

#include <stdio.h>
#include <string.h>

const char code[] ="\xbb\x14\x00\x00\x00"
              "\xb8\x01\x00\x00\x00"
              "\xcd\x80";


int main()
{
    printf("Length: %d bytes\n", strlen(code));
    (*(void(*)()) code)();
    return 0;
}

If you want to debug it with gdb:

[manu@debian /tmp]$ gdb ./shellcode 
GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
...
Reading symbols from ./shellcode...(no debugging symbols found)...done.
(gdb) b *&code
Breakpoint 1 at 0x4005c4
(gdb) r
Starting program: /tmp/shellcode 
Length: 2 bytes

Breakpoint 1, 0x00000000004005c4 in code ()
(gdb) disassemble 
Dump of assembler code for function code:
=> 0x00000000004005c4 <+0>: mov    $0x14,%ebx
   0x00000000004005c9 <+5>: mov    $0x1,%eax
   0x00000000004005ce <+10>:    int    $0x80
   0x00000000004005d0 <+12>:    add    %cl,0x6e(%rbp,%riz,2) 
End of assembler dump.

In this proof of concept example is not important the null bytes. But when you are developing shellcodes you should keep in mind and remove the bad characters.

回复收藏 0 原文