缓冲区溢出，数据被踩的案例学习

news2024/11/15 7:40:21

继续在ubuntu上学习GDB，今天要学习的是缓冲区溢出。

程序的地址：

GitHub - gedulab/gebypass: bypass password by heap buffer overflow

编译的方法：

gcc -g -O2 -o gebypass gebypass.c

照例设置一下科学shangwang代理：

export https_proxy="https://xxx:8080"，为的是能下载符号。

这个代码通俗易懂，就一个.c文件，主要是使用最传统的gets方法，没有判断输入的内容是否超过了缓冲区长度，造成了buffer的输入覆盖了token内存，token内存被填入了刻意准备的值，绕过了鉴权，登录了系统。程序如下：

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <ctype.h>
#include <string.h>

#define GE_MAX_PASSWORD 20
#define GE_TOKEN_SIZE 26
#define GE_TOKEN_PREFIX "#TOKEN#"
#define GE_MINI_PASSWORD 6

int ge_set_token(char* user_token, int size) {
    if(size < GE_TOKEN_SIZE)
        return -1;
    snprintf(user_token, size, "%s:%08d%08d#", GE_TOKEN_PREFIX, getpid(), getpid());
    return 0;
}

int ge_check_token(char* user_token, int size) {
    int i;
    if(strncmp(user_token, GE_TOKEN_PREFIX, strlen(GE_TOKEN_PREFIX))!=0) {
        return -1;
    }
    char* ptr = user_token + strlen(GE_TOKEN_PREFIX)+1;
    for(i=0; i<16; i++) {
        if(isdigit(*ptr) == 0) {
            return -1;
        }
        ptr++;
    }
    if(*ptr != '#') {
        return -1;
    }
    return 0;
}

void ge_auth(const char* input, char* user_token, int size) {
    // check the password via user database etc.
    if(strcmp(input, "$$secret$$") == 0) {
        printf("Your password is correct\n");
        ge_set_token(user_token, size);
    } else {
        printf("You have entered the incorrect password\n");
    }
}

int main() {
    int ret = -1;
    char* buffer = (char*)malloc(GE_MAX_PASSWORD);  //20
    char* token = (char*)malloc(GE_TOKEN_SIZE);     //26

    puts("Please enter password:");
    if(gets(buffer) == NULL || strlen(buffer) < GE_MINI_PASSWORD) {
        printf("password is too short %ld\n", strlen(buffer));
        goto tag_exit;
    }
    ge_auth(buffer, token, GE_TOKEN_SIZE);

    if(ge_check_token(token, GE_TOKEN_SIZE) != 0) {
        printf("Login failed. You are denied.\n");
        goto tag_exit;
    }
    printf("Login succeeded. You are welcome.\n");
    puts("You can do privileged operations now...\n");
    getchar();
    ret = 0;

tag_exit:
    free(buffer);
    free(token);

    return ret;    
}

上GDB调试：

gdb ./gebypass

b main  -- 设置断点

r  -- run起来，会提示下载源码，前面我们设置的proxy,顺利下载。

l  --list一下源码，可以看到

(gdb) p buffer
$1 = <optimized out>
(gdb) p token
$2 = <optimized out>
(gdb) n
49          char* buffer = (char*)malloc(GE_MAX_PASSWORD);  //20
(gdb) n
50          char* token = (char*)malloc(GE_TOKEN_SIZE);     //26
(gdb) n
52          puts("Please enter password:");
(gdb) p bu
buf                     bufsize                 build_trtable           build_wcs_upper_buffer  builtin_modules
buffer                  build_charclass         build_trtable[cold]     builtin_aliases
buffer_size             build_charclass_op      build_wcs_buffer        builtin_map
(gdb) p buffer
$3 = 0x5555555592a0 ""
(gdb) p token
$4 = 0x5555555592c0 ""  --token紧挨着buffer

查看进程内存：

(gdb) !ps
    PID TTY          TIME CMD
   3138 pts/0    00:00:00 bash
   3290 pts/0    00:00:02 gdb
   3296 pts/0    00:00:00 gebypass
   5612 pts/0    00:00:00 ps
(gdb) !cat /proc/3296/maps
555555554000-555555555000 r--p 00000000 08:02 3969804                    /home/zxl/gelabs/gtk/bypass/gebypass
555555555000-555555556000 r-xp 00001000 08:02 3969804                    /home/zxl/gelabs/gtk/bypass/gebypass
555555556000-555555557000 r--p 00002000 08:02 3969804                    /home/zxl/gelabs/gtk/bypass/gebypass
555555557000-555555558000 r--p 00002000 08:02 3969804                    /home/zxl/gelabs/gtk/bypass/gebypass
555555558000-555555559000 rw-p 00003000 08:02 3969804                    /home/zxl/gelabs/gtk/bypass/gebypass
555555559000-55555557a000 rw-p 00000000 00:00 0                          [heap]
7ffff7d90000-7ffff7d93000 rw-p 00000000 00:00 0
7ffff7d93000-7ffff7dbb000 r--p 00000000 08:02 4219286                    /usr/lib/x86_64-linux-gnu/libc.so.6
7ffff7dbb000-7ffff7f43000 r-xp 00028000 08:02 4219286                    /usr/lib/x86_64-linux-gnu/libc.so.6
7ffff7f43000-7ffff7f92000 r--p 001b0000 08:02 4219286                    /usr/lib/x86_64-linux-gnu/libc.so.6
7ffff7f92000-7ffff7f96000 r--p 001fe000 08:02 4219286                    /usr/lib/x86_64-linux-gnu/libc.so.6
7ffff7f96000-7ffff7f98000 rw-p 00202000 08:02 4219286                    /usr/lib/x86_64-linux-gnu/libc.so.6
7ffff7f98000-7ffff7fa5000 rw-p 00000000 00:00 0
7ffff7fbd000-7ffff7fbf000 rw-p 00000000 00:00 0
7ffff7fbf000-7ffff7fc3000 r--p 00000000 00:00 0                          [vvar]
7ffff7fc3000-7ffff7fc5000 r-xp 00000000 00:00 0                          [vdso]
7ffff7fc5000-7ffff7fc6000 r--p 00000000 08:02 4215471                    /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
7ffff7fc6000-7ffff7ff1000 r-xp 00001000 08:02 4215471                    /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
7ffff7ff1000-7ffff7ffb000 r--p 0002c000 08:02 4215471                    /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
7ffff7ffb000-7ffff7ffd000 r--p 00036000 08:02 4215471                    /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
7ffff7ffd000-7ffff7fff000 rw-p 00038000 08:02 4215471                    /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0                          [stack]
ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0                  [vsyscall]
能看到刚刚malloc建立的堆块。

在ge_auth函数设置断点

(gdb) b ge_auth
Breakpoint 2 at 0x555555555460: ge_auth. (2 locations)
(gdb) l ge_auth
file: "/usr/include/x86_64-linux-gnu/bits/stdio2.h", line number: 86, symbol: "ge_auth"
81      }
82
83      __fortify_function int
84      printf (const char *__restrict __fmt, ...)
85      {
86        return __printf_chk (__USE_FORTIFY_LEVEL - 1, __fmt, __va_arg_pack ());
87      }
88      # elif !defined __cplusplus
89      #  define printf(...) \
90        __printf_chk (__USE_FORTIFY_LEVEL - 1, __VA_ARGS__)
file: "gebypass.c", line number: 37, symbol: "ge_auth"
32              return -1;
33          }
34          return 0;
35      }
36
37      void ge_auth(const char* input, char* user_token, int size) {
38          // check the password via user database etc.
39          if(strcmp(input, "$$secret$$") == 0) {
40              printf("Your password is correct\n");
41              ge_set_token(user_token, size);
(gdb) c
Continuing.
Please enter password:
$$secret$$

Breakpoint 2.1, ge_auth (input=0x5555555592a0 "$$secret$$", user_token=0x5555555592c0 "", size=26) at gebypass.c:37
37      void ge_auth(const char* input, char* user_token, int size) {
 

下面再跟踪一下异常覆盖的情况：

重新run,这次输入特殊的串：

(gdb) r
Starting program: /home/zxl/gelabs/gtk/bypass/gebypass

This GDB supports auto-downloading debuginfo from the following URLs:
  <https://debuginfod.ubuntu.com>
Enable debuginfod for this session? (y or [n]) y
Debuginfod has been enabled.
To make this setting permanent, add 'set debuginfod enabled on' to .gdbinit.
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Breakpoint 1, main () at gebypass.c:47
47      int main() {
(gdb) info b
Num     Type           Disp Enb Address            What
1       breakpoint     keep y   0x00005555555551c0 in main at gebypass.c:47
        breakpoint already hit 1 time
(gdb) c
Continuing.
Please enter password:
01234567890abcdefghijklmnopqrstu#TOKEN#:0002381800023638#

第一次少输入了一个0，结果错位了，造成没有到达token的条件，验证失败。所以这个串必须精心设计。

继续单步跟踪，提示输入错误：

(gdb) b ge_auth
Breakpoint 2 at 0x555555555460: ge_auth. (2 locations)
(gdb) c
Continuing.
Please enter password:
01234567890abcdefghijklmnopqrstu#TOKEN#:0002381800023638#

Breakpoint 2.1, ge_auth (input=0x5555555592a0 "01234567890abcdefghijklmnopqrstu#TOKEN#:0002381800023638#",
    user_token=0x5555555592c0 "#TOKEN#:0002381800023638#", size=26) at gebypass.c:37
37      void ge_auth(const char* input, char* user_token, int size) {
(gdb) n
39          if(strcmp(input, "$$secret$$") == 0) {
(gdb) p input
$1 = 0x5555555592a0 "01234567890abcdefghijklmnopqrstu#TOKEN#:0002381800023638#"
(gdb) n
86        return __printf_chk (__USE_FORTIFY_LEVEL - 1, __fmt, __va_arg_pack ());
(gdb) n
43              printf("You have entered the incorrect password\n");
(gdb) l
38          // check the password via user database etc.
39          if(strcmp(input, "$$secret$$") == 0) {
40              printf("Your password is correct\n");
41              ge_set_token(user_token, size);
42          } else {
43              printf("You have entered the incorrect password\n");
44          }
45      }
46
47      int main() {
(gdb)
接下来检查token

(gdb) n
main () at gebypass.c:59
59          if(ge_check_token(token, GE_TOKEN_SIZE) != 0) {
(gdb) l
54              printf("password is too short %ld\n", strlen(buffer));
55              goto tag_exit;
56          }
57          ge_auth(buffer, token, GE_TOKEN_SIZE);
58
59          if(ge_check_token(token, GE_TOKEN_SIZE) != 0) {
60              printf("Login failed. You are denied.\n");
61              goto tag_exit;
62          }
63          printf("Login succeeded. You are welcome.\n");
(gdb) n
63          printf("Login succeeded. You are welcome.\n");
(gdb) p token
$2 = 0x5555555592c0 "#TOKEN#:0002381800023638#"
token值符合要求。

(gdb) p buffer  --超出了20个字节
$3 = 0x5555555592a0 "01234567890abcdefghijklmnopqrstu#TOKEN#:0002381800023638#"
(gdb) p token
$4 = 0x5555555592c0 "#TOKEN#:0002381800023638#"

重新运行，认识堆。ptmalloc的堆管理方式，有个一个主场地 main_arena

Breakpoint 1, main () at gebypass.c:47
47      int main() {
(gdb) p main_arena  --开始主场地大部分是0，
$5 = {mutex = 0, flags = 0, have_fastchunks = 0, fastbinsY = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, top = 0x0,
  last_remainder = 0x0, bins = {0x0 <repeats 254 times>}, binmap = {0, 0, 0, 0}, next = 0x7ffff7f96ac0 <main_arena>,
  next_free = 0x0, attached_threads = 1, system_mem = 0, max_system_mem = 0}
(gdb) p &main_arena --它本身在glibc中
$6 = (struct malloc_state *) 0x7ffff7f96ac0 <main_arena>
(gdb) !ps
    PID TTY          TIME CMD
   3138 pts/0    00:00:00 bash
   5884 pts/0    00:00:03 gdb
   6063 pts/0    00:00:00 gebypass
   6358 pts/0    00:00:00 ps
(gdb) !cat /proc/6063/maps
555555554000-555555555000 r--p 00000000 08:02 3969804                    /home/zxl/gelabs/gtk/bypass/gebypass
555555555000-555555556000 r-xp 00001000 08:02 3969804                    /home/zxl/gelabs/gtk/bypass/gebypass
555555556000-555555557000 r--p 00002000 08:02 3969804                    /home/zxl/gelabs/gtk/bypass/gebypass
555555557000-555555558000 r--p 00002000 08:02 3969804                    /home/zxl/gelabs/gtk/bypass/gebypass
555555558000-555555559000 rw-p 00003000 08:02 3969804                    /home/zxl/gelabs/gtk/bypass/gebypass
7ffff7d90000-7ffff7d93000 rw-p 00000000 00:00 0
7ffff7d93000-7ffff7dbb000 r--p 00000000 08:02 4219286                    /usr/lib/x86_64-linux-gnu/libc.so.6
7ffff7dbb000-7ffff7f43000 r-xp 00028000 08:02 4219286                    /usr/lib/x86_64-linux-gnu/libc.so.6
7ffff7f43000-7ffff7f92000 r--p 001b0000 08:02 4219286                    /usr/lib/x86_64-linux-gnu/libc.so.6
7ffff7f92000-7ffff7f96000 r--p 001fe000 08:02 4219286                    /usr/lib/x86_64-linux-gnu/libc.so.6
7ffff7f96000-7ffff7f98000 rw-p 00202000 08:02 4219286                    /usr/lib/x86_64-linux-gnu/libc.so.6
7ffff7f98000-7ffff7fa5000 rw-p 00000000 00:00 0
7ffff7fbd000-7ffff7fbf000 rw-p 00000000 00:00 0
7ffff7fbf000-7ffff7fc3000 r--p 00000000 00:00 0                          [vvar]
7ffff7fc3000-7ffff7fc5000 r-xp 00000000 00:00 0                          [vdso]
7ffff7fc5000-7ffff7fc6000 r--p 00000000 08:02 4215471                    /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
7ffff7fc6000-7ffff7ff1000 r-xp 00001000 08:02 4215471                    /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
7ffff7ff1000-7ffff7ffb000 r--p 0002c000 08:02 4215471                    /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
7ffff7ffb000-7ffff7ffd000 r--p 00036000 08:02 4215471                    /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
7ffff7ffd000-7ffff7fff000 rw-p 00038000 08:02 4215471                    /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0                          [stack]
ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0                  [vsyscall]
(gdb) s
49          char* buffer = (char*)malloc(GE_MAX_PASSWORD);  //20
(gdb) s
Download failed: 无效的参数.  Continuing without source file ./malloc/./malloc/malloc.c.
0x00007ffff7e40654 in __GI___libc_malloc (bytes=bytes@entry=20) at ./malloc/malloc.c:3301
warning: 3301   ./malloc/malloc.c: 没有那个文件或目录 --没有源码，看不了。

需要下载源码：

zxl@qwq:~$ cat /etc/apt/sources.list
# Ubuntu sources have moved to /etc/apt/sources.list.d/ubuntu.sources
zxl@qwq:~$ cat  /etc/apt/sources.list.d/ubuntu.sources
Types: deb deb-src
URIs: http://mirrors.huaweicloud.com/repository/ubuntu/
Suites: noble noble-updates noble-security noble-backports
Components: main restricted universe
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
说明已经设置了HW的网站作为下载网站。deb-src

开始下载：

zxl@qwq:~$ sudo apt source lib
[sudo] zxl 的密码：
正在读取软件包列表... 完成
E: 无法找到与 lib 对应的源代码包
zxl@qwq:~$ sudo apt source glibc
正在读取软件包列表... 完成
提示：glibc 的打包工作被维护于以下位置的 Git 版本控制系统中：
https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/glibc
请使用：
git clone https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/glibc
获得该软件包的最近更新(可能尚未正式发布)。
需要下载 19.0 MB 的源代码包。
获取:1 http://mirrors.huaweicloud.com/repository/ubuntu noble-updates/main glibc 2.39-0ubuntu8.3 (dsc) [9,213 B]
获取:2 http://mirrors.huaweicloud.com/repository/ubuntu noble-updates/main glibc 2.39-0ubuntu8.3 (tar) [18.5 MB]
获取:3 http://mirrors.huaweicloud.com/repository/ubuntu noble-updates/main glibc 2.39-0ubuntu8.3 (asc) [833 B]
获取:4 http://mirrors.huaweicloud.com/repository/ubuntu noble-updates/main glibc 2.39-0ubuntu8.3 (diff) [463 kB]
已下载 19.0 MB，耗时 2秒 (9,716 kB/s)
dpkg-source: info: extracting glibc in glibc-2.39
dpkg-source: info: unpacking glibc_2.39.orig.tar.xz
dpkg-source: info: unpacking glibc_2.39-0ubuntu8.3.debian.tar.xz
dpkg-source: info: using patch list from debian/patches/series
dpkg-source: info: applying git-updates.diff
dpkg-source: info: applying locale/check-unknown-symbols.diff
dpkg-source: info: applying locale/locale-print-LANGUAGE.diff
dpkg-source: info: applying locale/LC_IDENTIFICATION-optional-fields.diff
dpkg-source: info: applying localedata/sort-UTF8-first.diff
dpkg-source: info: applying localedata/supported.diff
dpkg-source: info: applying localedata/locale-eu_FR.diff
......

dpkg-source: info: applying CVE-2024-33600_2.patch
dpkg-source: info: applying CVE-2024-33601_33602.patch
W: 由于文件'glibc_2.39-0ubuntu8.3.dsc'无法被用户'_apt'访问，已脱离沙盒并提权为根用户来进行下载。 - pkgAcquire::Run (13: 权限不够)
zxl@qwq:~$ ls
 公共的   examples.desktop                      idea                         orange
 模板     gegdb                                 IdeaProjects                 pg
 视频     gelabs                                java                         
 图片     glibc-2.39                            lmos                         rust
 文档     glibc_2.39-0ubuntu8.3.debian.tar.xz

malloc在：q:~/glibc-2.39/malloc$ pwd
/home/zxl/glibc-2.39/malloc

回到GDB设置源码路径

(gdb) bt
#0  0x00007ffff7e40654 in __GI___libc_malloc (bytes=bytes@entry=20) at ./malloc/malloc.c:3301
#1  0x00005555555551d2 in main () at gebypass.c:49
(gdb) dir /home/zxl/glibc-2.39/malloc
Source directories searched: /home/zxl/glibc-2.39/malloc:$cdir:$cwd
(gdb) l   --再调用list就可以看到源码了。不错
3296      void *victim;
3297
3298      _Static_assert (PTRDIFF_MAX <= SIZE_MAX / 2,
3299                      "PTRDIFF_MAX is not more than half of SIZE_MAX");
3300
3301      if (!__malloc_initialized)
3302        ptmalloc_init ();
3303    #if USE_TCACHE
3304      /* int_free also calls request2size, be careful to not pad twice.  */
3305      size_t tbytes = checked_request2size (bytes);
可以跟着一下malloc的细节

分配完成后，再看堆空间，就多了

(gdb) !cat /proc/6063/maps
555555554000-555555555000 r--p 00000000 08:02 3969804                    /home/zxl/gelabs/gtk/bypass/gebypass
555555555000-555555556000 r-xp 00001000 08:02 3969804                    /home/zxl/gelabs/gtk/bypass/gebypass
555555556000-555555557000 r--p 00002000 08:02 3969804                    /home/zxl/gelabs/gtk/bypass/gebypass
555555557000-555555558000 r--p 00002000 08:02 3969804                    /home/zxl/gelabs/gtk/bypass/gebypass
555555558000-555555559000 rw-p 00003000 08:02 3969804                    /home/zxl/gelabs/gtk/bypass/gebypass
555555559000-55555557a000 rw-p 00000000 00:00 0                          [heap]
7ffff7d90000-7ffff7d93000 rw-p 00000000 00:00 0
7ffff7d93000-7ffff7dbb000 r--p 00000000 08:02 4219286                    /usr/lib/x86_64-linux-gnu/libc.so.6
7ffff7dbb000-7ffff7f43000 r-xp 00028000 08:02 4219286                    /usr/lib/x86_64-linux-gnu/libc.so.6
7ffff7f43000-7ffff7f92000 r--p 001b0000 08:02 4219286                    /usr/lib/x86_64-linux-gnu/libc.so.6
7ffff7f92000-7ffff7f96000 r--p 001fe000 08:02 4219286                    /usr/lib/x86_64-linux-gnu/libc.so.6
7ffff7f96000-7ffff7f98000 rw-p 00202000 08:02 4219286                    /usr/lib/x86_64-linux-gnu/libc.so.6
7ffff7f98000-7ffff7fa5000 rw-p 00000000 00:00 0
再看主场地也变化了：

(gdb) p main_arena
$8 = {mutex = 0, flags = 0, have_fastchunks = 0, fastbinsY = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
  top = 0x5555555592e0, last_remainder = 0x0, bins = {0x7ffff7f96b20 <main_arena+96>, 0x7ffff7f96b20 <main_arena+96>,
    0x7ffff7f96b30 <main_arena+112>, 0x7ffff7f96b30 <main_arena+112>, 0x7ffff7f96b40 <main_arena+128>,
    0x7ffff7f96b40 <main_arena+128>, 0x7ffff7f96b50 <main_arena+144>, 0x7ffff7f96b50 <main_arena+144>,
    0x7ffff7f96b60 <main_arena+160>, 0x7ffff7f96b60 <main_arena+160>, 0x7ffff7f96b70 <main_arena+176>,
    0x7ffff7f96b70 <main_arena+176>, 0x7ffff7f96b80 <main_arena+192>, 0x7ffff7f96b80 <main_arena+192>,
    0x7ffff7f96b90 <main_arena+208>, 0x7ffff7f96b90 <main_arena+208>, 0x7ffff7f96ba0 <main_arena+224>,
    0x7ffff7f96ba0 <main_arena+224>, 0x7ffff7f96bb0 <main_arena+240>, 0x7ffff7f96bb0 <main_arena+240>,
    0x7ffff7f96bc0 <main_arena+256>, 0x7ffff7f96bc0 <main_arena+256>, 0x7ffff7f96bd0 <main_arena+272>,
    0x7ffff7f96bd0 <main_arena+272>, 0x7ffff7f96be0 <main_arena+288>, 0x7ffff7f96be0 <main_arena+288>,
    0x7ffff7f96bf0 <main_arena+304>, 0x7ffff7f96bf0 <main_arena+304>, 0x7ffff7f96c00 <main_arena+320>,
    0x7ffff7f96c00 <main_arena+320>, 0x7ffff7f96c10 <main_arena+336>, 0x7ffff7f96c10 <main_arena+336>,
    0x7ffff7f96c20 <main_arena+352>, 0x7ffff7f96c20 <main_arena+352>, 0x7ffff7f96c30 <main_arena+368>,
 

实验的原理：如何造特殊字符串：这就不讲了，自己体会一下：

(gdb) r
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/zxl/gelabs/gtk/bypass/gebypass
Downloading separate debug info for system-supplied DSO at 0x7ffff7fc3000
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Breakpoint 1, main () at gebypass.c:47
47      int main() {
(gdb) info b
Num     Type           Disp Enb Address            What
1       breakpoint     keep y   0x00005555555551c0 in main at gebypass.c:47
        breakpoint already hit 1 time
2       breakpoint     keep y   <MULTIPLE>
2.1                         y   0x0000555555555460 in ge_auth at gebypass.c:37
2.2                         y   0x000055555555547f in ge_auth at /usr/include/x86_64-linux-gnu/bits/stdio2.h:86
(gdb) c
Continuing.
Please enter password:
1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ

Breakpoint 2.1, ge_auth (input=0x5555555592a0 "1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ",
    user_token=0x5555555592c0 "wxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", size=26) at gebypass.c:37
37      void ge_auth(const char* input, char* user_token, int size) {
(gdb) s
39          if(strcmp(input, "$$secret$$") == 0) {
(gdb) b ge_check_token
Breakpoint 3 at 0x5555555553f0: file gebypass.c, line 19.
(gdb) c
Continuing.
You have entered the incorrect password

Breakpoint 3, ge_check_token (user_token=user_token@entry=0x5555555592c0 "wxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", size=size@entry=26)
    at gebypass.c:19
19      int ge_check_token(char* user_token, int size) {
(gdb)
 

valgrind工具：

q:~/gelabs/gtk/bypass$ sudo apt update
[sudo] zxl 的密码：
命中:1 http://mirrors.huaweicloud.com/repository/ubuntu noble InRelease
命中:2 http://mirrors.huaweicloud.com/repository/ubuntu noble-updates InRelease
命中:3 http://mirrors.huaweicloud.com/repository/ubuntu noble-security InRelease
命中:4 http://mirrors.huaweicloud.com/repository/ubuntu noble-backports InRelease
正在读取软件包列表... 完成
正在分析软件包的依赖关系树... 完成
正在读取状态信息... 完成
有 10 个软件包可以升级。请执行 ‘apt list --upgradable’ 来查看它们。
zxl@qwq:~/gelabs/gtk/bypass$ sudo apt install valgrind
正在读取软件包列表... 完成
正在分析软件包的依赖关系树... 完成
正在读取状态信息... 完成

wq:~/gelabs/gtk/bypass$ valgrind --version
valgrind-3.22.0
zxl@qwq:~/gelabs/gtk/bypass$ valgrind ./gebypass
==7220== Memcheck, a memory error detector
==7220== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==7220== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info
==7220== Command: ./gebypass
==7220==
Please enter password:
1111111111112222222222222222222222333333333333333333333333333333333
==7220== Invalid write of size 8
==7220==    at 0x4850643: memcpy@GLIBC_2.2.5 (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==7220==    by 0x48F8FE3: memcpy (string_fortified.h:29)
==7220==    by 0x48F8FE3: _IO_getline_info (iogetline.c:96)
==7220==    by 0x48F91DD: gets (iogets.c:54)
==7220==    by 0x1091F7: main (gebypass.c:53)
==7220==  Address 0x4a87050 is 16 bytes inside a block of size 20 alloc'd
==7220==    at 0x4846828: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==7220==    by 0x1091D1: main (gebypass.c:49)
==7220==
==7220== Invalid write of size 8
==7220==    at 0x485064B: memcpy@GLIBC_2.2.5 (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==7220==    by 0x48F8FE3: memcpy (string_fortified.h:29)
==7220==    by 0x48F8FE3: _IO_getline_info (iogetline.c:96)
==7220==    by 0x48F91DD: gets (iogets.c:54)
==7220==    by 0x1091F7: main (gebypass.c:53)
==7220==  Address 0x4a87058 is 4 bytes after a block of size 20 alloc'd
==7220==    at 0x4846828: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==7220==    by 0x1091D1: main (gebypass.c:49)
==7220==
==7220== Invalid write of size 8
==7220==    at 0x4850653: memcpy@GLIBC_2.2.5 (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==7220==    by 0x48F8FE3: memcpy (string_fortified.h:29)
==7220==    by 0x48F8FE3: _IO_getline_info (iogetline.c:96)
==7220==    by 0x48F91DD: gets (iogets.c:54)
==7220==    by 0x1091F7: main (gebypass.c:53)
==7220==  Address 0x4a87060 is 12 bytes after a block of size 20 alloc'd
==7220==    at 0x4846828: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==7220==    by 0x1091D1: main (gebypass.c:49)
==7220==
==7220== Invalid write of size 8
==7220==    at 0x4850691: memcpy@GLIBC_2.2.5 (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==7220==    by 0x48F8FE3: memcpy (string_fortified.h:29)
==7220==    by 0x48F8FE3: _IO_getline_info (iogetline.c:96)
==7220==    by 0x48F91DD: gets (iogets.c:54)
==7220==    by 0x1091F7: main (gebypass.c:53)
==7220==  Address 0x4a87068 is 20 bytes after a block of size 20 alloc'd
==7220==    at 0x4846828: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==7220==    by 0x1091D1: main (gebypass.c:49)
==7220==

valgrind: m_mallocfree.c:304 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
valgrind: Heap block lo/hi size mismatch: lo = 96, hi = 3689348814741910323.
This is probably caused by your program erroneously writing past the
end of a heap block and corrupting heap metadata.  If you fix any
invalid writes reported by Memcheck, this assertion failure will
probably go away.  Please try that before reporting this as a bug.


host stacktrace:
==7220==    at 0x58044A9A: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
==7220==    by 0x58044BDF: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
==7220==    by 0x58044D75: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
==7220==    by 0x5804EDB8: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
==7220==    by 0x5803CDCA: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
==7220==    by 0x5803B3E7: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
==7220==    by 0x5803FFD0: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
==7220==    by 0x5803A260: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
==7220==    by 0x58010887: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
==7220==    by 0x1002E874AC: ???
==7220==    by 0x1002DA9F0F: ???

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable (lwpid 7220)
==7220==    at 0x48506E3: memcpy@GLIBC_2.2.5 (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==7220==    by 0x48F8FE3: memcpy (string_fortified.h:29)
==7220==    by 0x48F8FE3: _IO_getline_info (iogetline.c:96)
==7220==    by 0x48F91DD: gets (iogets.c:54)
==7220==    by 0x1091F7: main (gebypass.c:53)
client stack range: [0x1FFEFFE000 0x1FFF000FFF] client SP: 0x1FFEFFFF18
valgrind stack range: [0x1002CAA000 0x1002DA9FFF] top usage: 18232 of 1048576


Note: see also the FAQ in the source distribution.
It contains workarounds to several common problems.
In particular, if Valgrind aborted or crashed after
identifying problems in your program, there's a good chance
that fixing those problems will prevent Valgrind aborting or
crashing, especially if it happened in m_mallocfree.c.

If that doesn't help, please report this bug to: www.valgrind.org

In the bug report, send all the above text, the valgrind
version, and what OS and version you are using.  Thanks.
 

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.coloradmin.cn/o/2240706.html

如若内容造成侵权/违法违规/事实不符，请联系多彩编程网进行投诉反馈，一经查实，立即删除！

相关文章

数据库SQL——连接表达式（JOIN）图解

数据库SQL——连接表达式（JOIN）图解

目录 一、基本概念 二、常见类型 内连接&#xff08;INNER JOIN&#xff09;&#xff1a; 左连接&#xff08;LEFT JOIN 或 LEFT OUTER JOIN&#xff09;&#xff1a; 右连接&#xff08;RIGHT JOIN 或 RIGHT OUTER JOIN&#xff09;&#xff1a; 全连接&#xff08;FULL…
阅读更多...
sql注入之二次注入（sqlilabs-less24）

sql注入之二次注入（sqlilabs-less24）

二阶注入&#xff08;Second-Order Injection&#xff09;是一种特殊的 SQL 注入攻击&#xff0c;通常发生在用户输入的数据首先被存储在数据库中&#xff0c;然后在后续的操作中被使用时&#xff0c;触发了注入漏洞。与传统的 SQL 注入&#xff08;直接注入&#xff09;不同&a…
阅读更多...
查询DBA_FREE_SPACE缓慢问题

查询DBA_FREE_SPACE缓慢问题

这个是一个常见的问题&#xff0c;理论上应该也算是一个bug&#xff0c;在oracle10g&#xff0c;到19c&#xff0c;我都曾经遇到过&#xff1b;今天在给两套新建的19C RAC添加监控脚本时&#xff0c;又发现了这个问题&#xff0c;在这里记录一下。 Symptoms 环境&#xff1a;…
阅读更多...
实验6记录网络与故障排除

实验6记录网络与故障排除

实验6记录网络与故障排除 实验目的及要求&#xff1a; 通过实验&#xff0c;掌握如何利用文档记录网络设备相关信息并完成网络拓扑结构的绘制。能够使用各种技术和工具来找出连通性问题&#xff0c;使用文档来指导故障排除工作&#xff0c;确定具体的网络问题&#xff0c;实施…
阅读更多...
「QT」文件类 之 QTextStream 文本流类

「QT」文件类 之 QTextStream 文本流类

✨博客主页何曾参静谧的博客&#x1f4cc;文章专栏「QT」QT5程序设计&#x1f4da;全部专栏「Win」Windows程序设计「IDE」集成开发环境「UG/NX」BlockUI集合「C/C」C/C程序设计「DSA」数据结构与算法「UG/NX」NX二次开发「QT」QT5程序设计「File」数据文件格式「UG/NX」NX定制…
阅读更多...
【go从零单排】JSON序列化和反序列化

【go从零单排】JSON序列化和反序列化

&#x1f308;Don’t worry , just coding! 内耗与overthinking只会削弱你的精力&#xff0c;虚度你的光阴&#xff0c;每天迈出一小步&#xff0c;回头时发现已经走了很远。 &#x1f4d7;概念 在 Go 语言中&#xff0c;处理 JSON 数据主要依赖于 encoding/json 包。这个包提…
阅读更多...
网络学习第四篇

网络学习第四篇

引言&#xff1a; 我们在第三篇的时候出现了错误&#xff0c;我们要就行排错&#xff0c;那么我们要知道一下怎么配置静态路由实现ping通&#xff0c;这样子我们才知道下一跳到底是什么&#xff0c;为什么这样子做。 实验目的 理解和掌握静态路由的基本概念和配置方法。 实…
阅读更多...
蓝桥杯竞赛单片机组备赛【经验帖】

蓝桥杯竞赛单片机组备赛【经验帖】

本人获奖情况说明 笔者本人曾参加过两次蓝桥杯电子赛&#xff0c;在第十二届蓝桥杯大赛单片机设计与开发组获得省级一等奖和国家级二等奖&#xff0c;在第十五届嵌入式设计开发组获得省级二等奖。如果跟着本帖的流程备赛&#xff0c;只要认真勤奋&#xff0c;拿个省二绝对没问…
阅读更多...
yolo标签自动标注（使用python和yolo方法）

yolo标签自动标注（使用python和yolo方法）

yolo代码自动标注 1.引言1.初阶“自动标注”&#xff0c;给每个图像都生成一个固定的标注文件&#xff0c;进而在labglimg中对矩形框进行微调&#xff0c;减少标注的工作量2.高阶自动标注&#xff0c;利用我们训练好的&#xff08;但是没有特别精准的&#xff09;yolo文件先对每…
阅读更多...
Git在版本控制中的应用

Git在版本控制中的应用

&#x1f493; 博客主页&#xff1a;瑕疵的CSDN主页 &#x1f4dd; Gitee主页&#xff1a;瑕疵的gitee主页 ⏩ 文章专栏&#xff1a;《热点资讯》 Git在版本控制中的应用 Git在版本控制中的应用 Git在版本控制中的应用 引言 Git 概述 定义与原理 发展历程 Git 的关键技术 分布…
阅读更多...
vue2.7.14 + vant + vue cli脚手架转vite启动运行问题记录

vue2.7.14 + vant + vue cli脚手架转vite启动运行问题记录

文章目录 前言方案一&#xff08;借用插件转换&#xff09;启动命令&#xff0c;转换方案一转换遇到的问题 方案二&#xff08;手动调整&#xff09;方案两者对比小结 前言 vue cli 脚手架转成vite启动 简单说说这个项目的一些底层基本结构哈&#xff0c;以及写这篇博客的目的…
阅读更多...
边缘提取函数 [OPENCV--2]

边缘提取函数 [OPENCV--2]

OPENCV中最常用的边界检测是CANNY函数 下面展示它的用法 通常输入一个灰度图像&#xff08;边界一般和颜色无关&#xff09;这样也可以简化运算cv::Canny(inmat , outmat , therhold1, therhold2 ) 第一个参数是输入的灰度图像&#xff0c;第二个是输出的图像这两个参数都是引用…
阅读更多...
SpringBoot基础系列学习(七):整合Mybatis

SpringBoot基础系列学习(七):整合Mybatis

文章目录 一丶介绍1.基本信息2.特性 二丶代码1.项目结构2.数据表3.引入依赖4.实体类5.mapper6.sql.xml7.Controller8.结果 一丶介绍 1.基本信息 MyBatis 是一款优秀的持久层框架&#xff0c;它支持定制化 SQL、存储过程以及高级映射。MyBatis 避免了几乎所有的 JDBC 代码和手…
阅读更多...
什么岗位需要学习 OpenGL ES ？说说 3.X 的新特性

什么岗位需要学习 OpenGL ES ？说说 3.X 的新特性

什么是 OpenGL ES OpenGL ES 是一种为嵌入式系统和移动设备设计的3D图形API（应用程序编程接口）。它是标准 OpenGL 3D 图形库的一个子集，专门为资源受限的环境（如手机、平板电脑、游戏机和其他便携式设备）进行了优化。 由于其在移动设备上的广泛适用性，OpenGL ES是学习移…
阅读更多...
记一次谷歌chrome浏览器 18 以上和 18 以下，最小字号不一致，导致的样式兼容问题解决过程

记一次谷歌chrome浏览器 18 以上和 18 以下，最小字号不一致，导致的样式兼容问题解决过程

**记录一次谷歌chrome浏览器 18 以上和 18 以下&#xff0c;最小字号不一致&#xff0c;导致的样式兼容问题解决过程&#xff1a;** 定位问题尝试解决方案第一时间想到的解决方案&#xff1a;方案一尝试方案二&#xff1a;scale 缩放方案三&#xff1a;rem、em测试 方案四 SVG最…
阅读更多...
Elasticsearch 和 Kibana 8.16：Kibana 获得上下文和 BBQ 速度并节省开支！

Elasticsearch 和 Kibana 8.16：Kibana 获得上下文和 BBQ 速度并节省开支！

作者&#xff1a;来自 Elastic Platform Product Team Elastic Search AI 平台&#xff08;Elasticsearch、Kibana 和机器学习&#xff09;的 8.16 版本包含大量新功能&#xff0c;可提高性能、优化工作流程和简化数据管理。 使用更好的二进制量化 (Better Binary Quantizatio…
阅读更多...
HarmonyOS Next星河版笔记--界面开发（5）

HarmonyOS Next星河版笔记--界面开发（5）

1.字符串 1.1.字符串拼接 作用&#xff1a;把两个或多个字符串&#xff0c;拼成一个字符串。&#xff08;通常是用来拼接字符串和变量&#xff09; hello world > helloworld 加好作用&#xff1a;拼接 let name:string 小明 console.log(简介信息,名字是 name) …
阅读更多...
kafka中topic的数据抽取不到hdfs上问题解决

kafka中topic的数据抽取不到hdfs上问题解决

在上一个博客中有一个案例&#xff1a; 将json文件抽取到kafka的消息队列&#xff08;topic&#xff09;中&#xff0c;再从topic中将数据抽取到hdfs https://blog.csdn.net/qq_62984376/article/details/143759037?spm1001.2014.3001.5501 我们在从kafka中topic的数据抽到hdf…
阅读更多...
scala中的case class

scala中的case class

package test_27 //Set的特点&#xff1a;唯一&#xff08;元素不同&#xff09;&#xff1b;无序 //case class定义一组数据 case class Book(var bookName:String,var author:String,var price:Double){} object caseclass {def main(args: Array[String]): Unit {//定义一个…
阅读更多...
【Excel】数据透视表分析方法大全

【Excel】数据透视表分析方法大全

数据透视表的最常用的功能是分类汇总&#xff0c;其实它还有很强大的数据分析功能。在数据透视表右键菜单的值显示方式中&#xff0c;可以看到有14个很实用的分析选项。 1、总计的百分比 作用&#xff1a;透视表中每一个数字&#xff08;包括汇总行、总计行&#xff09;占右…
阅读更多...
推荐文章
最新文章

Copyright @ 2022~2023