一、环境搭建
安装ndk r10e,必须得这个版本,其他版本可能导致 -fno-stack-protector 不生效!
r10e
- Darwin: https://dl.google.com/android/repository/android-ndk-r10e-darwin-x86_64.zip
- Linux: https://dl.google.com/android/repository/android-ndk-r10e-linux-x86_64.zip
- Windows: https://dl.google.com/android/repository/android-ndk-r10e-windows-x86_64.zip
二、Pwn代码编译
VSCode 新建个main.cpp文件,代码如下
#include<stdio.h>
#include<stdlib.h>
#include<unistd.h>
#include<string.h>
void callsystem()
{
write(STDOUT_FILENO, "Flag:XY2024\n", 13);
write(STDOUT_FILENO, "call shell...\n", 13);
system("/system/bin/sh");
}
void vulnerable_function() {
int i = 128;
char buf[i];
read(STDIN_FILENO, buf, 256);
}
int main(int argc, char** argv) {
char buf[128] = {0};
if (argc==2&&strcmp("passwd",argv[1])==0)
callsystem();
snprintf(buf, 128, "vulnerable_function=%p\n", vulnerable_function);
write(STDOUT_FILENO, buf, strlen(buf));
write(STDOUT_FILENO, "Hello, World\n", 13);
vulnerable_function();
}
新建Android.mk,内容如下:
LOCAL_PATH := $(call my-dir)
include $(CLEAR_VARS)
LOCAL_MODULE := level6
LOCAL_SRC_FILES := main.cpp
LOCAL_LDLIBS := -llog
LOCAL_CFLAGS += -fno-stack-protector
include $(BUILD_EXECUTABLE)
新建Application.mk,内容如下:
APP_ABI := armeabi-v7a
APP_STL := c++_static
APP_CFLAGS += -fno-stack-protector
APP_PLATFORM := android-21
cd到项目所在目录,执行编译:
d:\android-ndk-r10e\ndk-build NDK_PROJECT_PATH=. NDK_APPLICATION_MK=Application.mk APP_BUILD_SCRI