[摘要]... ★ 2.4 演示四 /* fs4.c* * specially crafted to feed your brain by gera@co...
...
★ 2.4 演示四
/* fs4.c*
* specially crafted to feed your brain by gera@core-sdi.com */
/* Have you ever heard about code reusability?*/
int main(int argv,char **argc) {
char buf[256];
snprintf(buf,sizeof buf,"%s%6$hn",argc[1]);
printf(buf);
}
%6$hn格式化字符串表示%hn对应的格式化参数使用第六个参数
明白这一点，写出exploit应该不是问题。
看了下面一个例子就应该明白%6$是怎么回事了
[alert7@redhat62 alert7]$ cat test.c
#include <stdio.h>
int main(int argc, char *argv[])
{
int a=2,b=3;
printf("%d %d\n",a ,b);
printf("%2$d %1$d\n",a ,b);
return 0;
}
[alert7@redhat62 alert7]$ gcc -o test test.c -g
[alert7@redhat62 alert7]$ ./test
2 3
3 2
这样，我们可以在格式化串中自己指定所用哪个参数，而无需按照参数次序。
★ 2.5 演示五
/* fs5.c*
* specially crafted to feed your brain by gera@core-sdi.com */
/* go, go, go!*/
int main(int argv,char **argc) {
char buf[256];
snprintf(buf,sizeof buf,argc[1]);
/* this line'll make your life easier */
//printf("%s\n",buf);
}
[alert7@redhat]$ gcc -o test test.c -g
给个exploit更感性一点
[alert7@redhat]$ cat exp.c
关键词：非安全编程演示之格式化字符串篇