Question

所以今天我正在运行一些战争游戏，直到我遇到一个特定级别才一直顺利。我无法让它工作的原因是我无处可放shellcode;两个缓冲区太小，无法容纳任何有用的shellcode，所有环境变量都将memset设置为0，任何额外的参数也是如此。

战争游戏是来自OverTheWire的“纳尼亚”系列，第6级。我可以查找一个解决方案，但我更倾向于在正确的方向上获得一个指针而不是用勺子作为答案：）

来源如下：

/*
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

extern char **environ;

// tired of fixing values...
// - morla
unsigned long get_sp(void) {
       __asm__("movl %esp,%eax\n\t"
               "and $0xff000000, %eax"
               );
}

int main(int argc, char *argv[]){
        char b1[8], b2[8];
        int  (*fp)(char *)=(int(*)(char *))&puts, i;

        if(argc!=3){ printf("%s b1 b2\n", argv[0]); exit(-1); }

        /* clear environ */
        for(i=0; environ[i] != NULL; i++)
                memset(environ[i], '\0', strlen(environ[i]));
        /* clear argz    */
        for(i=3; argv[i] != NULL; i++)
                memset(argv[i], '\0', strlen(argv[i]));

        strcpy(b1,argv[1]);
        strcpy(b2,argv[2]);
        //if(((unsigned long)fp & 0xff000000) == 0xff000000)
        if(((unsigned long)fp & 0xff000000) == get_sp())
                exit(-1);
        fp(b1);

        exit(1);
}

另外，作为一个额外的问题，整个函数指针运算是关于什么的？这可能是答案的关键吗？我没有做过很多C或C ++，所以我对指针fu不太教育了:)）

当缓冲区无法适应我的shellcode时利用缓冲区溢出

0 个答案: