ctf-wiki / ctf-wiki/ctf-challenges

ret2shellcode.c 用题目提供的执行文件可以,自己编译不能溢出成功!

Open
#70 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
HTML
Stars
1.7k
Forks
440
PR merge metrics
No merged PRs in 30d

Description

(https://github.com/ctf-wiki/ctf-challenges/tree/master/pwn/stackoverflow/ret2shellcode/ret2shellcode-example)/ret2shellcode.c
用这个文件编译之后,用给出的方法不行,用题目中提供的执行文件可以。通过gdb发现:
题目给的目标文件:
──────[ DISASM ]────
► 0x8048536 mov eax, dword ptr [0x804a060]
0x804853b mov dword ptr [esp + 0xc], 0 mov操作
0x8048543 mov dword ptr [esp + 8], 2
0x804854b mov dword ptr [esp + 4], 0
0x8048553 mov dword ptr [esp], eax
0x8048556 call setvbuf@plt
而自己编译之后这样:
────────────[ DISASM ]─────
► 0x80484f9 sub esp, 0x74
0x80484fc mov eax, dword ptr [stdout@@GLIBC_2.0] <0x804a044>
0x8048501 push 0 push操作
0x8048503 push 2
0x8048505 push 0
0x8048507 push eax
0x8048508 call setvbuf@plt
造成不能溢出成功
请问题目中的执行文件如何编译的?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with pwn/stackoverflow/ret2shellcode/ret2shellcode-example/ret2shellcode.c and compare it with the supplied executable using the shown GDB disassembly. Reproduce the build and record the compiler, flags, and environment needed to make the overflow work; done means the repository explains or provides a reproducible build matching the supplied binary.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
reverse-engineering, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.