tailieunhanh - gray hat hacking the ethical hackers handbook phần 4

Trong chương này, chúng tôi sẽ bao gồm các khái niệm khai thác cơ bản Linux. • hoạt động ngăn xếp • ngăn xếp cấu trúc dữ liệu • Làm thế nào các cấu trúc ngăn xếp dữ liệu được thực hiện • Thủ tục của các chức năng gọi điện thoại • tràn bộ đệm • Ví dụ về một lỗi tràn bộ đệm | CHAPTER Basic Linux Exploits In this chapter we will cover basic Linux exploit concepts. Stack operations Stack data structure How the stack data structure is implemented Procedure of calling functions Buffer overflows Example of a buffer overflow Overflow of previous Ramifications of buffer overflows Local buffer overflow exploits Components of the exploit sandwich Exploiting stack overflows by command line and generic code Exploitation of Exploiting small buffers by using the environment segment of memory Exploit development process Control eip Determine the offset s Determine the attack vector Build the exploit sandwich Test the exploit Why study exploits Ethical hackers should study exploits to understand if a vulnerability is exploitable. Sometimes security professionals will mistakenly believe and publish the statement The vulnerability is not exploitable. The black hat hackers know otherwise. They know that just because one person could not find an exploit to the vulnerability that doesn t mean someone else won t find it. It is all a matter of time and skill level. Therefore gray hat ethical hackers must understand how to exploit vulnerabilities and check for themselves. In the process they may need to produce proof of concept code to demonstrate to the vendor that the vulnerability is exploitable and needs to be fixed. 147 Gray Hat Hacking The Ethical Hacker s Handbook 148 Stack Operations The stack is one of the most interesting capabilities of an operating system. The concept of a stack can best be explained by remembering the stack of lunch trays in your school cafeteria. As you put a tray on the stack the previous trays on the stack are covered up. As you take a tray from the stack you take the tray from the top of the stack which happens to be the last one put on. More formally in computer science terms the stack is a data structure that has the quality of a first in last out FILO queue. The process of putting items on the stack is called