格式化字符串攻击设计实现.doc

西南科技大学本科生毕业论文 Ⅰ 格式化字符串攻击设计实现 摘要：格式化字符串漏洞对计算机系统和网络有很大的威胁，攻击者可以利用格式化字符串漏洞实现远程攻击，比如使程序崩溃，偷窥堆栈内容，甚至还可以修改程序返回地址为恶意代码，从而得到系统控制权。 本文首先通过分析在格式化字符串漏洞中常用的格式化字符和格式化参数来详细的说明格式化字符串漏洞形成的原因，然后根据不同的格式化字符串漏洞，编写相应的调试程序，然后针对程序进行模拟攻击，并分析攻击结果。本文主要在模拟环境下实现了使程序崩溃、偷窥堆栈内容和修改程序返回地址的攻击。其次本文还结合现实中的格式化字符串漏洞进行解析，阐述如何利用这些漏洞进行攻击。最后本文还介绍了格式化字符串漏洞的防范工具，包括静态分析软件和动态保护工具。 关键词：格式化字符串漏洞； 形成原因； 攻击； 防范工具 西南科技大学本科生毕业论文 Ⅱ Design and Implementation of a format string attack Abstract：Format string vulnerability is a vital threat to computer systems and networks, an attacker could exploit format string vulnerabilities for remote attack, such as cause program crashes,peeping stack content, even modify the return address of program to malicious code to get control of the system. Firstly,this paper through the analysis of the common format characters and formatting parameters in the format string vulnerability to detailed description of the reasons for the formation of the format string vulnerability.Then according to the different format string vulnerabilities,preparation the appropriate debugger, then simulated attacks against the program and analyze the result of the attack.In this paper, in a simulated environment to make the program crashes,peeping stack content and modify the program to return address.Furthermore, this article combined with format string vulnerabilities in the reality to parse,explains how to exploit these vulnerabilities to attack. The last，this paper also describes the prevention tool of the format string vulnerability,include static analysis software and dynamic protection tools. Keyword：Format string vulnerability，Formation，Attack, Prevention tools