엮은이는 아는데요

uaf.c #include #include typedef struct test{char *name[50];void (*greetings)(void *name);void (*bye)(void *name);}VULN; void *say_hello(void *name){printf("Hello! %s\n", (char*)name);} void *say_goodbye(void *name){printf("ByeBye! %s\n", (char*)name);} void main(){void *vuln_test;VULN *vuln = (char*)malloc(100); vuln->greetings = say_hello;vuln->bye = say_goodbye; printf("Input your name : ");sc..

heap2.c #include #include #include #include #include struct auth { char name[32]; int auth; }; struct auth *auth; char *service; int main(int argc, char **argv) { char line[128]; while(1) { printf("[ auth = %p, service = %p ]\n", auth, service); if(fgets(line, sizeof(line), stdin) == NULL) break; if(strncmp(line, "auth ", 5) == 0) { auth = malloc(sizeof(auth)); memset(auth, 0, sizeof(auth)); if(..

heap1.c #include #include #include #include #include struct internet { int priority; char *name; }; void winner() { printf("and we have a winner @ %d\n", time(NULL)); } int main(int argc, char **argv) { struct internet *i1, *i2, *i3; i1 = malloc(sizeof(struct internet)); i1->priority = 1; i1->name = malloc(8); i2 = malloc(sizeof(struct internet)); i2->priority = 2; i2->name = malloc(8); strcpy(i..

heap0.c #include #include #include #include #include struct data { char name[64]; }; struct fp { int (*fp)(); }; void winner() { printf("level passed\n"); } void nowinner() { printf("level has not been passed\n"); } int main(int argc, char **argv) { struct data *d; struct fp *f; d = malloc(sizeof(struct data)); f = malloc(sizeof(struct fp)); f->fp = nowinner; printf("data is at %p, fp is at %p\n..

format4.c #include #include #include #include int target; void hello() { printf("code execution redirected! you win\n"); _exit(1); } void vuln() { char buffer[512]; fgets(buffer, sizeof(buffer), stdin); printf(buffer); exit(1); } int main(int argc, char **argv) { vuln(); } 출처: http://liveoverflow.com/binary_hacking/protostar/format4.html 1. 문제 해결 및 분석 1-1. exploit할 위치 확인 vuln() 함수의 exit 부분을 hell..

stack7.c #include #include #include #include char *getpath() { char buffer[64]; unsigned int ret; printf("input path please: "); fflush(stdout); gets(buffer); ret = __builtin_return_address(0); if((ret & 0xb0000000) == 0xb0000000) { printf("bzzzt (%p) ", ret); _exit(1); } printf("got path %s ", buffer); return strdup(buffer); } int main(int argc, char **argv) { getpath(); } 출처: http://liveoverfl..

stack7.c #include #include #include #include char *getpath() { char buffer[64]; unsigned int ret; printf("input path please: "); fflush(stdout); gets(buffer); ret = __builtin_return_address(0); if((ret & 0xb0000000) == 0xb0000000) { printf("bzzzt (%p) ", ret); _exit(1); } printf("got path %s ", buffer); return strdup(buffer); } int main(int argc, char **argv) { getpath(); } 1. 문제 해결 1-1. aslr 끄기..

stack6.c #include #include #include #include void getpath() { char buffer[64]; unsigned int ret; printf("input path please: "); fflush(stdout); gets(buffer); ret = __builtin_return_address(0); if((ret & 0xbf000000) == 0xbf000000) { printf("bzzzt (%p)\n", ret); _exit(1); } printf("got path %s\n", buffer); } int main(int argc, char **argv) { getpath(); } 출처: http://liveoverflow.com/binary_hacking/..

stack5.c #include #include #include #include int main(int argc, char **argv) { char buffer[64]; gets(buffer); } 출처: http://liveoverflow.com/binary_hacking/protostar/stack5.html 1. 문제 해결 / 분석 1-1. lib32z1 다운로드 32bit 환경에서 해야한다. file stack5를 통해서 몇 비트 파일인지 알 수 있다. 1-2. gdb ./stack5 disas main b *main r 1-3. R2L bufferebpret -> system lib로 실행하게 하면 된다. 그러나ret (system 주소로 가는 ret)argument (쉘 코드가 들어가는 영역..

stack5.c #include #include #include #include int main(int argc, char **argv) { char buffer[64]; gets(buffer); } 1. 해결 1-1. stack5.c 저장 및 aslr 제거 aslr 제거 echo 0 | sudo tee /proc/sys/kernel/randomize_va_space가변적 스택을 고정하기 위함.고정하지 않으면 shell code의 위치가 변하므로 고정해주어야 한다. 출처: https://askubuntu.com/questions/318315/how-can-i-temporarily-disable-aslr-address-space-layout-randomization 1-2. msfvenom 사용 msfve..