bạn có thể không có khả năng để xem kết quả của bạn, bởi vì hầu hết các ứng dụng không được thiết kế để xử lý nhiều bộ hồ sơ, do đó, bạn có thể cần phải dò dẫm theo cách của bạn xung quanh cho đến khi bạn xác minh rằng bạn có quyền truy cập. | 298 Chapter 8 Buffer Overflow 156 GetStringTypeW 261 SetEndOfFile 1BF LCMapStringA 1C0 LCMapStringW Summary 3000 .data 1000 .idata 2000 .rdata 1000 .reloc 20000 .text This shows that the only linked DLL loaded directly is . also has dependencies but for now we will just use that to find a jump point. Next we load findjmp looking in for places that can redirect us to the ESP. We run it as follows findjmp ESP And it tells us Scanning for code useable with the ESP register 0X77E8250A call ESP Finished Scanning for code useable with the ESP register Found 1 usable addresses So we can overwrite the saved EIP on the stack with 0x77E8250A and when the ret hits it will put the address of a call ESP into the EIP. The processor will execute this instruction which will redirect processor control back to our stack where our payload will be waiting. In the exploit code we define this address as follows DWORD EIP 0x77E8250A a pointer to a call ESP in found with and then write it in our exploit buffer after our 12 byte filler like so memcpy writeme 12 EIP 4 overwrite EIP here Buffer Overflow Chapter 8 299 Writing a Simple Payload Finally we need to create and insert our payload code. As stated before we chose to create a simple MessageBox that says HI to us just as a proof of concept. I typically like to prototype my payloads in C and then convert them to C code to do this is as follows MessageBox NULL hi NULL MB_OK Typically we would just recreate this function in can use a disassembler or debugger to find the exact ASM syntax from compiled C code. We have one issue though the MessageBox function is exported from which is not imported into our attacked program so we have to force it to load do this by using a LoadLibraryA call. LoadLibraryA is the function that WIN32 platforms use to load DLLs into a process s memory space. .
