CS:APP Attack Lab

最新推荐文章于 2024-05-25 18:58:05 发布

沐林森

最新推荐文章于 2024-05-25 18:58:05 发布

阅读量1k

点赞数 1

分类专栏： CS:APP

本文链接：https://blog.csdn.net/Yuan_Cl/article/details/84033112

版权

准备

解压之后得到以下文件

->ls
cookie.txt  ctarget  farm.c  hex2raw  README.txt  rtarget

ctarget

Linux binary with code-injection vulnerability. To be used for phases
1-3 of the assignment.

rtarget

Linux binary with return-oriented programming vulnerability. To be
used for phases 4-5 of the assignment.

cookie.txt

Text file containing 4-byte signature required for this lab instance.

farm.c

Source code for gadget farm present in this instance of rtarget. Youcan compile (use flag -Og) and disassemble it to look for gadgets.

hex2raw

Utility program to generate byte sequences. See documentation in lab handout.

Part I: Code Injection Attacks(代码注入攻击)

ctarget包含以下C语言代码，要做的就是通过代码注入，分别进入到touch1-3三个函数中
方法就是通过读入字符串，更改getbuf这个函数的返回地址

void test()
 {
   
	int val;
	val = getbuf();
	printf("No exploit. Getbuf returned 0x%x\n", val);
}

Level 1

反汇编函数test

Dump of assembler code for function test:
   0x0000000000401968 <+0>:	sub    $0x8,%rsp
   0x000000000040196c <+4>:	mov    $0x0,%eax
   0x0000000000401971 <+9>:	callq  0x4017a8 <getbuf>
   0x0000000000401976 <+14>:	mov    %eax,%edx
   0x0000000000401978 <+16>:	mov    $0x403188,%esi
   0x000000000040197d <+21>:	mov    $0x1,%edi
   0x0000000000401982 <+26>:	mov    $0x0,%eax
   0x0000000000401987 <+31>:	callq  0x400df0 <__printf_chk@plt>
   0x000000000040198c <+36>:	add    $0x8,%rsp
   0x0000000000401990 <+40>:	retq   
End of assembler dump.

反汇编函数getbuf

Reading symbols from ctarget...done.
(gdb) disas getbuf
Dump of assembler code for function getbuf:
   0x00000000004017a8 <+0>:	sub    $0x28,%rsp
   0x00000000004017ac <+4>:	mov    %rsp,%