缓冲区溢出光速入门

《缓冲区溢出光速入门》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。

1、缓冲区溢出光速入门缂撳啿鍖烘孩鍑哄厜閫熷叆闂?閫傜敤锛氬缂撳啿鍖烘孩鍑烘劅鍏磋叮浣嗕竴鐩翠笉寰楄棰嗙殑骞垮ぇ浜烘皯缇や紬浣滆€咃細watercloud@xfocus.org鏃ユ湡锛?006-2鏈堢紪鍐欙紝2007-9鏈堜慨璁?缂撳啿鍖烘孩鍑哄熀鍩虹缂撳啿鍖烘孩鍑洪€氬父鏄悜鏁扮粍涓啓鏁版嵁鏃讹紝鍐欏叆鐨勬暟鎹殑闀垮害瓒呭嚭浜嗘暟缁勫師濮嬪畾涔夌殑澶у皬銆?姣斿鍓嶉潰浣犲畾涔変簡intbuff[10]锛岄偅涔堝彧鏈?buff[0]-buff[9]鐨勭┖闂存槸鎴戜滑瀹氫箟buff鏃?鐢宠鐨勫悎娉曠┖闂达紝浣嗗悗鏉ュ線閲岄潰鍐欏叆鏁版嵁鏃跺嚭鐜颁簡buf

2、f[12]=0x10鍒欒秺鐣屼簡銆侰璇█甯哥敤鐨?strcpy銆乻printf銆乻trcat绛夊嚱鏁伴兘闈炲父瀹规槗瀵艰嚧缂撳啿鍖烘孩鍑洪棶棰樸€?鏌ラ槄C璇█缂栫▼鐨勪功绫嶆椂閫氬父浼氬憡璇変綘绋嬪簭婧㈠嚭鍚庝細鍙戠敓涓嶅彲棰勬枡鐨勭粨鏋溿€傚湪缃戠粶瀹?鍏ㄩ鍩燂紝缂撳啿鍖烘孩鍑哄埄鐢ㄧ殑鑹烘湳鍦ㄤ簬璁╄繖涓€滀笉鍙鏂欑殑缁撴灉鈥濆彉涓烘垜浠湡鏈涚殑缁撴灉銆?鐪嬩笅闈㈣繖涓紨绀虹▼搴忥細buf.c/*bufferoverflowexamplebywatercloud@xfocus.org*/#includevoidwhy_her

3、e(void)/*杩欎釜鍑芥暟娌℃湁浠讳綍鍦版柟璋冪敤杩?*/{printf("whyuhere?!");_exit(0);}intmain(intargc,char*argv[]){intbuff[1];buff[2]=(int)why_here;return0;}鍦ㄥ懡浠よ鐢?VC鐨勫懡浠よ缂栬瘧鍣ㄧ紪璇?鍦?Linux涓嬬敤gcc缂栬瘧骞惰繍琛屼篃鏄悓鏍风粨鏋滐級锛?C:Temp>clbuf.c杩愯绋嬪簭锛?C:Temp>buf.exewhyuhere?!浠旂粏鍒嗘瀽绋嬪簭鍜屾墦鍗颁俊鎭紝浣犲彲浠ュ彂鐜扮▼搴忎腑鎴戜滑娌℃湁璋冪敤杩?why

4、_here鍑芥暟锛屼絾璇ュ嚱鏁板嵈鍦ㄨ繍琛岀殑鏃跺€欒璋冪敤浜嗭紒锛?杩欓噷鍞竴鐨勮В閲婃槸buff[2]=why_here;鎿嶄綔瀵艰嚧浜嗙▼搴忔墽琛屾祦绋嬬殑鍙樺寲銆?瑕佽В閲婃鐜拌薄闇€瑕佺悊瑙ｄ竴浜?C璇█搴曞眰锛堝拰璁＄畻鏈轰綋绯荤粨鏋勭浉鍏筹級鍙婁竴浜涙眹缂栫煡璇嗭紝灏ゅ叾鏄?鈥滄爤鈥濆拰姹囩紪涓?CALL/RET鐨勭煡璇嗭紝濡傛灉杩欐柟闈綘灏氭湁鎵€娆犵己鐨勮瘽寤鸿鍙傝€冧竴涓嬬浉鍏充功绫嶏紝鍚﹀垯鍚庨潰鐨勫唴瀹逛細寰堥毦璺熶笂銆?鍋囪浣犲凡缁忔湁浜嗗鏍堢殑鍩烘湰璁よ瘑锛屾垜浠潵鐞嗚В涓€涓嬬▼搴忚繍琛屾儏鍐碉細杩涘叆main鍑芥暟

5、鍚庣殑鏍堝唴瀹逛笅锛?[eip][ebp][buff[0]]楂樺湴鍧€<----浣庡湴鍧€浠ヤ笂3涓瓨鍌ㄥ崟鍏冧腑eip涓?main鍑芥暟鐨勮繑鍥炲湴鍧€锛宐uff[0]鍗曞厓灏辨槸buff鐢虫槑鐨勪竴涓?int绌洪棿銆傜▼搴忎腑鎴戜滑瀹氫箟intbuff[1]锛岄偅涔堝彧鏈夊buff[0]鐨勬搷浣滄墠鏄悎鐞嗙殑锛堟垜浠彧鐢宠浜嗕竴涓?int绌洪棿锛?鑰屾垜浠殑buff[2]=why_here鎿嶄綔瓒呭嚭浜?buff鐨勭┖闂达紝锛?杩欎釜鎿嶄綔瓒婄晫浜嗭紝涔熷氨鏄孩鍑轰簡銆傛孩鍑虹殑鍚庢灉鏄細瀵?buff[2]璧嬪€煎叾瀹炲氨鏄鐩栦簡鏍堜腑鐨?

6、eip瀛樻斁鍗曞厓鐨勬暟鎹紝灏?main鍑芥暟鐨勮繑鍥炲湴鍧€鏀逛负浜?why_here鍑芥暟鐨勫叆鍙ｅ湴鍧€銆傝繖鏍?main鍑芥暟缁撴潫鍚庤繑鍥?鐨勬椂鍊欏皢杩欎釜鍦板潃浣滀负浜嗚繑鍥炲湴鍧€鑰屽姞浠ヨ繍琛屻€?涓婇潰杩欎釜婕旂ず鏄紦鍐插尯婧㈠嚭鏈€绠€鍗曚篃鏄渶鏍稿績鐨勬孩鍑烘湰璐ㄧ殑婕旂ず锛岄渶瑕佷粩缁嗙殑鐞嗚В銆傚鏋滆繕涓嶅お娓呮鐨勮瘽鍙互缁撳悎瀵瑰簲鐨勬眹缂栦唬鐮佺悊瑙ｃ€?鐢?VC鐨勫懡浠よ缂栬瘧鍣ㄧ紪璇戠殑鏃跺€欐寚瀹?FA鍙傛暟鍙互鑾峰緱瀵瑰簲鐨勬眹缂栦唬鐮侊紙Linux骞冲彴鍙互鐢?gcc鐨?S鍙傛暟鑾峰緱锛夛細C:Temp

7、>cl/FAtex.cC:Temp>typetex.asmTITLEtex.c.386Pincludelisting.incif@Versiongt510.modelFLATelse_TEXTSEGMENTPARAUSE32PUBLIC'CODE'_TEXTENDS_DATASEGMENTDWORDUSE32PUBLIC'DATA'_DATAENDSCONSTSEGMENTDWORDUSE32PUBLIC'CONST'CONSTENDS_BSSSEGMENTDWORDUSE32PUBLIC'BSS'_BSSENDS$$SYMBOLSSEGMENTBYTEUSE3

8、2'DEB