c - 黑客攻击 : how to perform buffer overflow attack?

Question

我陷入了黑客练习。

程序执行时会显示以下内容:

Build your own string!

Usage:
  ./4 length command...

Each command consist of a single character followed by its index.

Example:
  ./4 11 h0 e1 l2 l3 o4 w6 o7 r8 l9 d10

如何使用命令行参数执行缓冲区溢出攻击？

atoi 将字符串参数 str 转换为整数(int 类型)。

memset 将字符 c(无符号字符)复制到参数 str 所指向的字符串的前 n 个字符。

感谢您的见解!

#include <alloca.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>

static void usage(const char *argv0) {
        printf("Build your own string!\n");
        printf("\n");
        printf("Usage:\n");
        printf("  %s length command...\n", argv0);
        printf("\n");
        printf("Each command consist of a single character followed by its index.\n");
        printf("\n");
        printf("Example:\n");
        printf("  %s 11 h0 e1 l2 l3 o4 w6 o7 r8 l9 d10\n", argv0);
        exit(1);
}

int main(int argc, char **argv) {
        char *buffer;
        unsigned short buffersize, i, index, length;

        if (argc < 2) usage(argv[0]);

        length = atoi(argv[1]);
        if (length <= 0) {
                fprintf(stderr, "bad length\n");
                return 1;
        }

        buffersize = length + 1;
        buffer = alloca(buffersize);
        memset(buffer, ' ', buffersize);
        buffer[buffersize - 1] = 0;

        for (i = 2; i < argc; i++) {
                if (strlen(argv[i]) < 2) {
                        fprintf(stderr, "bad command \"%s\"\n", argv[i]);
                        return 1;
                }

                index = atoi(argv[i] + 1);
                if (index >= length) {
                        fprintf(stderr, "bad index in command \"%s\"\n", argv[i]);
                        return 1;
                }

                buffer[index] = argv[i][0];
        }

        printf("%s\n", buffer);
        return 0;
}

Answer 1

据我所知，缓冲区溢出是指覆盖缓冲区内存地址以执行代码或简单地指向另一个地址的好函数!在你的脚本中，我相信要进入下一个级别，你必须将内存地址指向 printf("%s\n", buffer); 。为此，请使用 gdb 调试代码并将内存地址覆盖到 printf 函数的任意位。一个不错的教程是 http://www.tenouk.com/Bufferoverflowc/Bufferoverflow4.html 。但是您应该阅读有关 C 编程以及源代码中所有易受攻击的代码的内容。哪一个是 printf("imvulnerable");