Copy code #include "stdio。h" /*利用函數(shù)*/ exploitfunction() { /*如果緩沖區(qū)溢出被成功利用，就會輸出此行內(nèi)容*/ printf("This line will be printed after successfully exploiting the buffer overflow. "); system("pause"); ExitProcess(0); }
main(int argc, char *argv[]) { if(argc>1) { normalfunction(argv[1]); printf(" These lines get printed during normal execution with at least 1 commandline argument.The address of exploitfunction is 0x%。8X ",exploitfunction); } else printf("Please provide the program with at least 1 commandline argument. "); ExitProcess(0); }
這段程序所做的就是復(fù)制字符串"vulnerable_program AAAAAAAAAAAAAAAAAAAAAAAAAAAA"到一個緩沖區(qū)中，并用新的返回地址創(chuàng)建另一個緩沖區(qū)，附加在工作緩沖區(qū)之上。 在那之后，程序調(diào)用system()來執(zhí)行字符串中的命令。輸出結(jié)果是： C:>exploit.exe This line will be printed after successfully exploiting the buffer overflow. Press any key to continue……
太棒了，它執(zhí)行了！
難道那不偉大嗎？
雖然我們實際上并沒有成功讓程序運行我們自己的代碼，但經(jīng)過一些小小的改變就能完成。 關(guān)于緩沖區(qū)溢出的更多相關(guān)信息請參考Aleph One寫的著名文章"Smashing the stack for fun and profit"
