《0day安全》之代码植入

古城微笑少年丶 2022-03-15 11:46 200阅读 0赞

## 参考 ##

*  《0day安全》第二版
 *  https://bbs.pediy.com/thread-217164.htm

## 实验的源码 ##

#include<stdio.h>
    #include<string.h>
    #include<windows.h>
    #define pass "1234567"
    
    int verify(char *passwd)
    { 
    	int flag;
    	char buffer[44];
    	flag = strcmp(passwd, pass);
    	strcpy(buffer, passwd);
    	return flag;
    }
    
    int main()
    { 
    	int valid = 0;
    	char password[1024];
    	FILE *fp;
    	LoadLibrary("user32.dll");
    	if(!(fp=fopen("a.txt","r+")))
    		exit(0);
    	fscanf(fp,"%s",password);
    	
    // while (1)
    	{ 
    	// printf("input password:");
    	// scanf("%s", password);
    		valid = verify(password);
    		if (valid)
    		{ 
    			printf("incorrect\n");
    			//continue;
    		}
    		else
    		{ 
    			printf("congratulations!\n");
    			//break;
    		}
    	}
    	fclose(fp);
    	return 0;
    }

## 可执行程序和代码植入文件 ##

可执行程序的编译环境是Windows10，DEV-C++5.11  
代码植入文件和exe下载地址[百度云盘][Link 1]  
key: zzwg

## 获取user32.dll基地址和MessageBoxA的地址 ##

参考了https://bbs.pediy.com/thread-217164.htm  
编译环境Windows10，VS2017

#include<stdio.h>
    #include<Windows.h>
    
    typedef void(*FuncPointer)(LPTSTR);
    
    int main()
    { 
    	HINSTANCE LibHandle;
    	FuncPointer GetFuncAddr;
    	LibHandle = LoadLibraryA("user32.dll");
    	printf_s("user32 LibHandle = 0x%x\n", LibHandle);
    	GetFuncAddr = (FuncPointer)GetProcAddress(LibHandle, "MessageBoxA");
    	printf_s("MessageBoxA Addr = 0x%x\n", GetFuncAddr);
    	return 0;
    }

实验是可以成功的，用buffer首地址覆盖函数的返回地址之后，EIP从buffer首地址开始执行指令，然而buffer里面的内容正是我们植入的代码指令，于是我们植入的指令被执行。利用我提供的可执行程序，只要计算出自己机器的MessageBoxA地址，重新编写代码植入文件，实验是会成功的。![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2OTYzMjE0_size_16_color_FFFFFF_t_70]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2OTYzMjE0_size_16_color_FFFFFF_t_70 1]

[Link 1]: https://pan.baidu.com/s/13mONv67oOK-Gyv6rMDgUOg
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2OTYzMjE0_size_16_color_FFFFFF_t_70]: /images/20220315/eb2d5d8fa47a4fb8b571952738d0f759.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2OTYzMjE0_size_16_color_FFFFFF_t_70 1]: /images/20220315/00d79ffa1d1c40c3a5d3f39f8dbbd838.png