使用metasploit进行栈溢出攻击-3

有了shellcode，就可以进行攻击了，但是要有漏洞才行，真实世界中的漏洞很复杂，并且很难发现，因此我专门做一个漏洞来进行攻击。

具体来说就是做一个简单的tcp server，里面包含明显的栈溢出漏洞。

具体如下：

 1 /* server.c */

 2 #include <stdio.h>

 3 #include <stdlib.h>

 4 #include <errno.h>

 5 #include <string.h>

 6 #include <sys/types.h>

 7 #include <netinet/in.h>

 8 #include <sys/socket.h>

 9 #include <sys/wait.h>

10 #include <arpa/inet.h>

11 void showClientInf(struct sockaddr_in client_addr) {

12         printf("\nThe IP of client is:%s",inet_ntoa(client_addr.sin_addr));

13         printf("\nThe Port of client is:%d\n",ntohs(client_addr.sin_port));

14 }

15 unsigned long get_sp(void) 

16 { 

17 __asm__("movl %esp,%eax"); 

18 } 

19 void testf()

20 {

21     printf("ttttt\n");

22 }

23 

24 

25 void recvastring(int new_fd)

26 {

27     unsigned char buff[100];

28     int i=0;

29     printf("sp=0x%x,addr=0x%x bytes.\n",get_sp(),&buff);

30     int numbytes = recv(new_fd,buff,1024,0);

31     if(numbytes==-1)

32     {

33         perror("recv");

34         exit(9);

35     }

36 }

37 int main() {

38     int sockfd,new_fd;

39     struct sockaddr_in my_addr;

40     struct sockaddr_in their_addr;

41     int flag=1,len=sizeof(int); 

42     int sin_size;

43     char buff[100];

44     int numbytes;

45     printf("socket\n");

46     if((sockfd = socket(AF_INET,SOCK_STREAM,0))==-1) {

47         perror("socket");

48         exit(1);

49     }

50     my_addr.sin_family = AF_INET;

51     my_addr.sin_port = htons(7777);

52     my_addr.sin_addr.s_addr = INADDR_ANY;

53     bzero(&(my_addr.sin_zero),8);

54     printf("bind\n");

55     if( setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &flag, len) ==-1) 

56     { 

57         perror("setsockopt"); 

58         exit(1); 

59     }

60     if(bind(sockfd,(struct sockaddr *)&my_addr,sizeof(struct sockaddr))==-1)

61     {

62         perror("bind");

63         exit(1);

64     }

65     printf("listen\n");

66     if(listen(sockfd,10)==-1) {

67         perror("listen");

68         exit(1);

69     }

70     printf("server is run...\n");

71     while(1) {

72         sin_size = sizeof(struct sockaddr_in);

73         printf("accept\n");

74         if((new_fd = accept(sockfd,(struct sockaddr *)

75         &their_addr,&sin_size))==-1)

76         {

77             perror("accept");

78             exit(1);

79         }

80         showClientInf(their_addr);

81         if(!fork()) {

82             printf("recv\n");

83             recvastring(new_fd);

84             printf("close-new_fd 1\n");

85             close(new_fd);

86             exit(0);

87         }

88         printf("close-new_fd 2\n");

89         close(new_fd);

90     }

91     printf("close-sockfd\n");

92     close(sockfd);

93 }

这个核心就是我们关注的recvastring函数，包含明显的栈溢出漏洞。我们专门看一下：

 1 void recvastring(int new_fd)

 2 {

 3     unsigned char buff[100];

 4     int i=0;

 5     printf("sp=0x%x,addr=0x%x bytes.\n",get_sp(),&buff);

 6     int numbytes = recv(new_fd,buff,1024,0);

 7     if(numbytes==-1)

 8     {

 9         perror("recv");

10         exit(9);

11     }

12 }

同样编译生成：

bai@ubuntu:/mnt/hgfs/r/stack$ gcc -fno-stack-protector -z execstack -g -o server socketserver.c

bai@ubuntu:/mnt/hgfs/r/stack$ ./server

socket

bind

listen

server is run...

accept