网络安全远程缓冲区溢出实验

最新推荐文章于 2025-06-25 10:08:17 发布

SmallBillows

最新推荐文章于 2025-06-25 10:08:17 发布

阅读量1.7k

点赞数 3

CC 4.0 BY-SA版权

文章标签：堆栈 linux ubuntu gdb 安全漏洞

本文链接：https://blog.youkuaiyun.com/SmallBillows/article/details/106751369

本文详细介绍了如何进行一次远程缓冲区溢出攻击实验，包括关闭ASLR、禁用堆栈保护、构造Payload和ShellCode、GDB动态调试以确定溢出点和内存地址差异。实验中，通过编写CS架构的Server和Client，利用Send数组溢出覆盖Turn函数的返回地址，最终实现远程Shellcode的执行和反弹Shell。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

网络安全远程缓冲区溢出实验

//Server.c
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <stdio.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>


#define PORT 5555
#define MaxDataSize 200

char sendBuf[180] = {'0'};

void Test(char *send,char *recvBuf){
	int i,len;
	len = strlen(recvBuf);
	for(int i=0;i<len;i++)
        	send[i] = recvBuf[len-i-1];
	strcpy(sendBuf,send);
}

void Turn(char *recvBuf){
    char send[180] = {'0'};
    //printf("send addr is %p\n",send);
    Test(send,recvBuf);
}

int main(int argc, char *argv[])
{
    int fd, new_fd, struct_len, numbytes,i;
    struct sockaddr_in server_addr;
    struct sockaddr_in client_addr;
    char recvBuf[MaxDataSize];

    server_addr.sin_family = AF_INET;
    server_addr.sin_port = htons(PORT);
    server_addr.sin_addr.s_addr = INADDR_ANY;
    bzero(&(server_addr.sin_zero), 8);
	
    struct_len = sizeof(struct sockaddr_in);

    fd = socket(AF_INET, SOCK_STREAM, 0);
	
    bind(fd, (struct sockaddr *)&server_addr, struct_len);
	
    listen(fd, 10);
    printf("Start to listen......\n");
	
	while(1){
		new_fd = accept(fd, (struct sockaddr *)&client_addr, &struct_len);
		printf("One client connect...\n");
		
		recv(new_fd, recvBuf, MaxDataSize, 0);
		
		printf("%s\n",recvBuf);
		
		Turn(recvBuf);
		
		printf("%s\n",sendBuf);
		
		send(new_fd,sendBuf,strlen(sendBuf)+1,0);
		
		close(new_fd);
	}
	close(fd);
    return 0;
}

//Client.c
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <arpa/inet.h>

#define PORT 5555

#define MaxDataSize 200

stat