漏洞挖掘 利用漏洞控制程序执行流程

#include <stdio.h>

#include <windows.h>



#define PASSWORD "1234567"



int verify_password(char *password)

{

    int authenticated;

    char buffer[8];

    authenticated = strcmp(password,PASSWORD);

    strcpy(buffer,password);  //溢出就在这里

    return authenticated;

}



void main()

{

    int valid_flag =0;

    char password[1024];

    FILE *fp;



    if (!(fp=fopen("password.txt","rw+")))

    {

        exit(0);

    }

    fscanf(fp,"%s",password);



    valid_flag = verify_password(password);



    if (valid_flag !=0)

    {

        printf("incorrect password!\n\n");

    }

    else

    {

        printf("Congratulation! You have passed the verification!\n");

    }

    fclose(fp);

    getchar();

}