Buffer overflow attack and Shellcode under Linux

4.3.2 The return address of a function in the Linux32 environment

Compile, link, execute the program buffer_overflow.c, and turn off the Linux stack protection mechanism, see:

Debug the program with GDB below:

Set breakpoints at the entrance to the Foo function, at the call to the strcpy function, and at Foo return:

To continue running, locate the return address of the function:

Start address B of the buff to the offset between the return address a of the Save function:

A-b=0xbffff29c-0xbffff280=0x1c=16+12=28

Therefore, if the length of the Lbuffer exceeds 28 bytes, a buffer overflow will occur, and a 4-byte "ABCD" of 28 in Lbuffer will overwrite the value of the address as 0xbffff29c memory unit, that is, the return address of Foo becomes "ABCD" (0x44434241).

Because the 0x44434241 is inaccessible, a break error occurs.

Shellcode writing under the 4.3.3 Linux32 environment

Compile, link, execute shell_asm_fix_opcode.c, you can get the shell through a buffer overflow, see:

4.4 Doing experiments and writing experimental reports

Before the file is modified:

To find out why the overflow occurred, debug with GDB:

Because Lvictim did not overflow, so for debugging convenience, I put the teacher's source code buffer[512] changed to buffer[500],

Recompile run, a segment error occurred:

The following begins with GDB debugging to find out the memory unit where the return address of the SMASH_LARGEBUF function is located and the distance from the buffer start address.

First decompile the SMASH_LARGEBUF function:

Then set three breakpoints:

The following starts the process and gets the return address of the function 0xbffff35c:

Continue to the next breakpoint, the start address of the buff is in 0xbffff158, stored in the 0XBFFFED30:

So:

0xbffff35c-0xbffff158=0x204=516

off_set=516

Buffer_address has a range that can be set starting from 0xbffff158

The following changes are required in the program:

Below begins the demo attack Lvictim, and gets the shell, to be aware of closing the address randomization:

As you can see, the shell has been obtained and the experiment has succeeded.

Finish

Buffer overflow attack and Shellcode under Linux