From 8e6f1d8069a7f7ee7cc19e327b93ed2c1bc587a0 Mon Sep 17 00:00:00 2001 From: Cool-Y <1072916769@qq.com> Date: Fri, 26 Jul 2019 09:01:59 +0800 Subject: [PATCH] pic --- source/_posts/x86basic.md | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/source/_posts/x86basic.md b/source/_posts/x86basic.md index 60201949..c9ef1d67 100644 --- a/source/_posts/x86basic.md +++ b/source/_posts/x86basic.md @@ -18,7 +18,7 @@ categories: Pwn二进制漏洞 - Metasploit框架-[下载](https://www.metasploit.com/) - 靶机–Windows XP sp3 -![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562741903/%E6%8D%95%E8%8E%B7.png) +![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562741903/pwn/%E6%8D%95%E8%8E%B7.png) - 函数调用与栈：调用、返回 - 寄存器与函数栈帧：ESP、EBP - 函数栈帧：局部变量、栈帧状态值、函数返回地址 @@ -46,7 +46,7 @@ voidfunc(int a, int b, int c) * pop ebp * RETN【弹出返回地址，跳转】 3. 栈帧结构 -![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742079/%E6%8D%95%E8%8E%B71.png) +![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742079/pwn/%E6%8D%95%E8%8E%B71.png) # 0x01 简单栈溢出 @@ -63,7 +63,7 @@ voidfunc(int a, int b, int c) > `quit` ## 漏洞点 -![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742316/%E5%9B%BE%E7%89%871.png) +![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742316/pwn/%E5%9B%BE%E7%89%871.png) **产生崩溃** 将输出的1024个A发送给靶机程序 @@ -71,44 +71,44 @@ voidfunc(int a, int b, int c) python -c "print('A' * 1024)" telnet 192.168.64.138 4242 ``` -![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742366/%E5%9B%BE%E7%89%872.png) +![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742366/pwn/%E5%9B%BE%E7%89%872.png) ## 关闭防御措施 使用**PESecurity**检查可执行文件本身的防御措施开启情况 注意设置：Set-ExecutionPolicyUnrestricted -![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742444/%E5%9B%BE%E7%89%873.png) +![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742444/pwn/%E5%9B%BE%E7%89%873.png) **ASLR和DEP** ASLR在xp下不用考虑，DEP可通过修改boot.ini中的nonexecute来完成（AlwaysOff、OptOut） -![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742486/%E5%9B%BE%E7%89%874.png) +![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742486/pwn/%E5%9B%BE%E7%89%874.png) ## 整体的攻击流程 1. 任意非00的指令覆盖buffer和EBP 2. 从程序已经加载的dll中获取他们的jmp esp指令地址。 3. 使用jmp esp的指令地址覆盖ReturnAddress 4. 从下一行开始填充Shellcode -![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742543/%E5%9B%BE%E7%89%875.png) +![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742543/pwn/%E5%9B%BE%E7%89%875.png) ## 确定溢出点的位置 1. 生成字符序列 **pattern_create.rb** -![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742622/%E5%9B%BE%E7%89%876.png) +![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742622/pwn/%E5%9B%BE%E7%89%876.png) 2. 发送给目标程序 -![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742623/%E5%9B%BE%E7%89%877.png) +![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742623/pwn/%E5%9B%BE%E7%89%877.png) 3. 计算偏移量 **pattern_offset.rb** -![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742685/%E5%9B%BE%E7%89%878.png) +![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742685/pwn/%E5%9B%BE%E7%89%878.png) 4. 确定payload结构 -![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742686/%E5%9B%BE%E7%89%879.png) +![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742686/pwn/%E5%9B%BE%E7%89%879.png) ## 寻找jmp esp跳板 1. OD附加进程看一下服务器加载了哪些模块 -![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742794/%E5%9B%BE%E7%89%8710.png) +![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742794/pwn/%E5%9B%BE%E7%89%8710.png) 2. 查找JMP ESP指令的地址 在这里选择了ws2_32.dll作为对象，通过Metasploit的msfbinscan进行搜索 -![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742793/%E5%9B%BE%E7%89%8711.png) +![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562742793/pwn/%E5%9B%BE%E7%89%8711.png) ## 自动化攻击 ```ruby= @@ -226,7 +226,7 @@ vim -bz.txt - 将Easy File Sharing Web Server 7.2加载到ImmunityDebugger中，并处于运行状态。 - 发送溢出字符序列 - 查看Easy File Sharing Web Server 7.2溢出地址 -![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562744240/231.png) +![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562744240/pwn/231.png) 3. 计算偏移量 计算catch块偏移量&计算下一条SEH记录偏移量 @@ -325,7 +325,7 @@ Server username: WHU-3E3EECEBFD1\Administrator > **漏洞点** ![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562744461/%E5%9B%BE%E7%89%8712.png) ## 设置DEP保护 -![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562744518/%E6%8D%9511%E8%8E%B7.png) +![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1562744518/pwn/%E6%8D%9511%E8%8E%B7.png) *构建ROP链来调用VirtualProtect()关闭DEP并执行Shellcode* ## 计算偏移量