Buffer overflower

Address Overwrite the first parameter of the main function to write the main parameter of the main function to the position in the stack to return to the __lib_start_main function to return the process of writing the return address of the FOO function to the main function to return the return address of the MAIN function. When the MAIN function performs the end of the return, you will be jumped to the FOO function (overflow)

Execution Process 1, __ lib_start_main Create a stack space write back address 2 for the main function, the main function executes the address output Now in main execution end return (jump) to the FOO function 3, the FOO function output JUMP Here execute the shell End Return to _ _LIB_START_MAIN function calls Main's next command 4, __ lib_start_main function continues to execute, end the program

The LEN can be set to 1 or 2. When compiling, open up 4 or 8 bytes of space directly in the top, and when setting it to other values, there will be some bytes of spaces at the top of the stack to the data. It is not easy to get functions. Return address

: push% EBP; 将 e (_ @Start_main) Press the 0x8048569

: MOV% ESP,% EBP; assign the EBP AT & T compilation Mode 0x804856B

: SUB $ 0x8,% ESP; is open space for local variables, just two bytes 0x804856e

: MOV 0x4 (% EBP),% EBP 4 is Main Return address, 0x8048571

: MOV% EAX, 0x8 (% EBP); writing the return address of Main to the unit below, so that the overflow returns to __lib_start_main 0x8048574

: MOVL $ 0x8048540,0x4 (% EBP); writing the entry address of the FOO function to the main function return address 0x804857b

: SUB $ 0xc,% ESP0X804857E

: push $ 0x804861a0x8048583

: Call 0x80483f4 0x8048588

: add $ 0x10,% ESP0X804858B

: MOV $ 0x0,% EAX0X8048590

: Leave 0x8048591

: Ret End of Assembler DUMP.

foo function Dump of assembler code for function foo__Fv: 0x8048540 : push% ebp0x8048541 : mov% esp,% ebp0x8048543 : sub $ 0x8,% esp0x8048546 : sub $ 0 xc,% esp0x8048549 : push $ 0x80486080x804854e : call 0x80483f4 0x8048553 : add $ 0x10,% esp0x8048556 : sub $ 0xc,% esp0x8048559 < foo__Fv 25>: push $ 0x80486120x804855e : call 0x80483e4 0x8048563 : add $ 0x10,% esp0x8048566 : leave 0x8048567 : ret End of assembler DUMP. The stack structure is performed when

ESP -> Offset 0 [BUF [0]] Offset 1 [BUF [1]] EBP -> Offset 2 [Old EBP (__2_start_main)] Offset 3 [Main Return Address] Offset 4 [ Argc = 1 main function running parameters]

The stack structure is executed when is

Offset 0 [Local Variable Space] ESP -> Offset 1 [Local Variable Space] Offset 2 [Local Variable Space] EBP -> Offset 3 [Old EBP (Main)] Offset 4 [Main Return Address] Source code #include #include

Void foo ("jump here"); system ("/ bin / sh");} # define len 2int main () {int buf [len]; * (int *) (buf len 2 ) = * (BUF LEN 1); * (int *) (buf LEN 1) = (int) ((void (*)) foo); PUTS ("now in main"); Return }

Under the shell # g -g test.c # lsa.out test.c # ./a.outnow in mainjump hersh-2.05a # lsa.out test.csh-2.05a # ExitXit #

Buffer overflower

9cbs