有了shellcode,就可以进行攻击了,但是要有漏洞才行,真实世界中的漏洞很复杂,并且很难发现,因此我专门做一个漏洞来进行攻击。
具体来说就是做一个简单的tcp server,里面包含明显的栈溢出漏洞。
具体如下:
1 /* server.c */
2 #include <stdio.h>
3 #include <stdlib.h>
4 #include <errno.h>
5 #include <string.h>
6 #include <sys/types.h>
7 #include <netinet/in.h>
8 #include <sys/socket.h>
9 #include <sys/wait.h>
10 #include <arpa/inet.h>
11 void showClientInf(struct sockaddr_in client_addr) {
12 printf("\nThe IP of client is:%s",inet_ntoa(client_addr.sin_addr));
13 printf("\nThe Port of client is:%d\n",ntohs(client_addr.sin_port));
14 }
15 unsigned long get_sp(void)
16 {
17 __asm__("movl %esp,%eax");
18 }
19 void testf()
20 {
21 printf("ttttt\n");
22 }
23
24
25 void recvastring(int new_fd)
26 {
27 unsigned char buff[100];
28 int i=0;
29 printf("sp=0x%x,addr=0x%x bytes.\n",get_sp(),&buff);
30 int numbytes = recv(new_fd,buff,1024,0);
31 if(numbytes==-1)
32 {
33 perror("recv");
34 exit(9);
35 }
36 }
37 int main() {
38 int sockfd,new_fd;
39 struct sockaddr_in my_addr;
40 struct sockaddr_in their_addr;
41 int flag=1,len=sizeof(int);
42 int sin_size;
43 char buff[100];
44 int numbytes;
45 printf("socket\n");
46 if((sockfd = socket(AF_INET,SOCK_STREAM,0))==-1) {
47 perror("socket");
48 exit(1);
49 }
50 my_addr.sin_family = AF_INET;
51 my_addr.sin_port = htons(7777);
52 my_addr.sin_addr.s_addr = INADDR_ANY;
53 bzero(&(my_addr.sin_zero),8);
54 printf("bind\n");
55 if( setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &flag, len) ==-1)
56 {
57 perror("setsockopt");
58 exit(1);
59 }
60 if(bind(sockfd,(struct sockaddr *)&my_addr,sizeof(struct sockaddr))==-1)
61 {
62 perror("bind");
63 exit(1);
64 }
65 printf("listen\n");
66 if(listen(sockfd,10)==-1) {
67 perror("listen");
68 exit(1);
69 }
70 printf("server is run...\n");
71 while(1) {
72 sin_size = sizeof(struct sockaddr_in);
73 printf("accept\n");
74 if((new_fd = accept(sockfd,(struct sockaddr *)
75 &their_addr,&sin_size))==-1)
76 {
77 perror("accept");
78 exit(1);
79 }
80 showClientInf(their_addr);
81 if(!fork()) {
82 printf("recv\n");
83 recvastring(new_fd);
84 printf("close-new_fd 1\n");
85 close(new_fd);
86 exit(0);
87 }
88 printf("close-new_fd 2\n");
89 close(new_fd);
90 }
91 printf("close-sockfd\n");
92 close(sockfd);
93 }
这个核心就是我们关注的recvastring函数,包含明显的栈溢出漏洞。我们专门看一下:
1 void recvastring(int new_fd)
2 {
3 unsigned char buff[100];
4 int i=0;
5 printf("sp=0x%x,addr=0x%x bytes.\n",get_sp(),&buff);
6 int numbytes = recv(new_fd,buff,1024,0);
7 if(numbytes==-1)
8 {
9 perror("recv");
10 exit(9);
11 }
12 }
同样编译生成:
bai@ubuntu:/mnt/hgfs/r/stack$ gcc -fno-stack-protector -z execstack -g -o server socketserver.c
bai@ubuntu:/mnt/hgfs/r/stack$ ./server
socket
bind
listen
server is run...
accept