对Ubuntu20进行缓冲区攻击测试时为什么出现以下响应：./exploit Return Address: 0xffffde00 Address: 0xffffdf5e *** stack smashing detected ***: terminated 已放弃 (核心已转储)

这个响应表明你的程序遭受了缓冲区溢出攻击，并且被操作系统检测到了。操作系统会自动终止程序，以防止攻击者利用漏洞进一步攻击系统。

"*** stack smashing detected ***" 这行信息告诉您，程序中的一部分代码试图覆盖了栈的边界，即缓冲区溢出。这样的攻击可以让攻击者执行恶意代码或者修改程序的行为。操作系统检测到这种攻击后，会立即终止程序。

为了解决这个问题，您需要重新设计您的程序，防止输入的数据超出缓冲区的范围。可以使用安全的编程语言，或者使用像地址随机化、堆栈保护等技术来增强程序的安全性。此外，您还可以使用工具来检测缓冲区溢出漏洞，如Valgrind等。

相关问题

static -pthread ./exploit.c -o ./exploit ./exploit.c: In function ‘spray_simple_xattr’: ./exploit.c:142:9: warning: implicit declaration of function ‘mkdir’ [-Wimplicit-function-declaration] 142 | if (mkdir("/tmp/tmpfs", S_IRWXU) == -1 && errno != EEXIST) | ^~~~~ ./exploit.c: In function ‘print_hex’: ./exploit.c:243:23: warning: format ‘%llx’ expects argument of type ‘long long unsigned int’, but argument 2 has type ‘size_t’ {aka ‘long unsigned int’} [-Wformat=] 243 | printf(" %16llx",*(size_t * )(buf + i*8)); | ~~~~~^ ~~~~~~~~~~~~~~~~~~~~~~~ | | | | | size_t {aka long unsigned int} | long long unsigned int | %16lx ./exploit.c: In function ‘get_root_shell’: ./exploit.c:354:3: warning: null argument where non-null required (argument 2) [-Wnonnull] 354 | execve("/tmp/dummy", NULL, NULL); | ^~~~~~

根据您的问题描述，这似乎是一个编译警告信息，并不影响代码的运行。其中包括：

1. `implicit declaration of function ‘mkdir’` 表示您的代码中使用了mkdir函数，但是编译器没有找到该函数的声明，需要添加头文件`#include <sys/stat.h>`。

2. `format ‘%llx’ expects argument of type ‘long long unsigned int’, but argument 2 has type ‘size_t’` 表示在打印输出时使用了错误的格式标识符。应该将`%llx`改为`%lx`。

3. `null argument where non-null required (argument 2)` 表示您在`execve()`函数中使用了NULL参数，但该参数不能为NULL。您需要将第二个和第三个参数设置为合适的值。

请您检查一下代码并进行相应的修改，以消除这些警告信息。

ALERT: ET EXPLOIT Grafana 8.x Path Traversal (CVE-2021-43798) 82 Timestamp 2023-06-07T14:21:22.266209+0000 Sensor suricata Protocol TCP Source 172.16.1.23:34770 Destination 10.0.1.4:445 In Interface eno2 Flow ID 997920879570354 Signature ET EXPLOIT Grafana 8.x Path Traversal (CVE-2021-43798) Category Attempted Administrator Privilege Gain Signature ID 1: 2034629 :2 Severity 1 History 2023-06-07 22:26:19 - Archived by anonymous HTTP Hostname: 10.0.1.4 Http Method: GET Http Port: 445 Http User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15 Length: 0 Protocol: HTTP/1.1 Url: /public/plugins/welcome/../../../../../../../../../etc/passwd User Agent.Device: Mac User Agent.Major: 12 User Agent.Minor: 0 User Agent.Name: Safari User Agent.Os: Mac OS X User Agent.Os Full: Mac OS X 10.14.3 User Agent.Os Major: 10 User Agent.Os Minor: 14 User Agent.Os Name: Mac OS X User Agent.Os Patch: 3 User Agent.Os Version: 10.14.3 User Agent.Patch: 3 User Agent.Version: 12.0.3 Payload GET /public/plugins/welcome/../../../../../../../../../etc/passwd HTTP/1.1..Host: 10.0.1.4:445..User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15..Accept-Encoding: gzip....

It looks like you have provided a log of a security event that alerts of a potential exploit of CVE-2021-43798, which is a path traversal vulnerability found in Grafana 8.x. The log shows that there was an attempted administrator privilege gain on the destination IP address 10.0.1.4 from the source IP address 172.16.1.23. The HTTP request was a GET method to the URL "/public/plugins/welcome/../../../../../../../../../etc/passwd" which is an attempt to access the system's password file. The user agent in the request shows that it was made using Safari on a Mac OS X machine. It is important to investigate and mitigate this security event to prevent any potential damage to the system.