http://kaspyx.tistory.com/86?category=939328
'HACKING > System hacking' 카테고리의 다른 글
| ROP를 익히기 좋은 문제들 (0) | 2018.05.18 |
|---|---|
| 알아두면 좋은 명령어 모음 (다시 정리하자) (0) | 2018.05.13 |
| 64bit rop tip (0) | 2018.05.13 |
| double free bug (0) | 2018.05.10 |
| pwnable 풀 때 objdump (0) | 2018.02.25 |
모든 카테고리
- Rootme : ELF x64 - Stack buffer overflow - advanced 2018.05.15
- 알아두면 좋은 명령어 모음 (다시 정리하자) 2018.05.13
- libc-database 사용법 2018.05.13
- 64bit rop tip 2018.05.13
- double free bug 2018.05.10
- Rootme : ELF x86 - Stack buffer overflow - C++ vtables 2018.05.05
- Rootme : ELF x86 - Stack buffer overflow basic 5 2018.05.05
- Rootme : ELF x86 - Stack buffer and integer overflow 2018.04.22
- Rootme : ELF x86 - BSS buffer overflow 2018.04.22
- Rootme : ELF x86 - Race condition 2018.04.21
Rootme : ELF x64 - Stack buffer overflow - advanced
2018. 5. 15. 09:36
알아두면 좋은 명령어 모음 (다시 정리하자)
2018. 5. 13. 20:30
libc-database 사용법
2018. 5. 13. 19:46
64bit rop tip
2018. 5. 13. 17:09
[buff] + gadget [pop rdi; ret] + [/bin/sh string addr] + [system addr]
/bin/sh 문자열 offset 확인
babyhack@ubuntu:~/tmp$ strings -a -tx /lib/x86_64-linux-gnu/libc.so.6 | grep "/bin/sh"
17ccdb /bin/sh
system 함수 offset 확인
babyhack@ubuntu:~/tmp$ readelf -s /lib/x86_64-linux-gnu/libc.so.6 | grep "system"
223: 000000000012b2c0 70 FUNC GLOBAL DEFAULT 12 svcerr_systemerr@@GLIBC_2.2.5
577: 0000000000046640 45 FUNC GLOBAL DEFAULT 12 __libc_system@@GLIBC_PRIVATE
1337: 0000000000046640 45 FUNC WEAK DEFAULT 12 system@@GLIBC_2.2.5
라이브러리 주소 확인
babyhack@ubuntu:~/tmp$ ldd ./r0pbaby
linux-vdso.so.1 => (0x00007ffca2aeb000)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f2b712e3000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f2b70f1e000)
/lib64/ld-linux-x86-64.so.2 (0x00007f2b716ea000)
Ref.http://crattack.tistory.com/tag/64bit%20ROP
'HACKING > System hacking' 카테고리의 다른 글
| 알아두면 좋은 명령어 모음 (다시 정리하자) (0) | 2018.05.13 |
|---|---|
| libc-database 사용법 (0) | 2018.05.13 |
| double free bug (0) | 2018.05.10 |
| pwnable 풀 때 objdump (0) | 2018.02.25 |
| GOT Overwrite (0) | 2018.02.24 |
double free bug
2018. 5. 10. 16:59
http://www.hackerschool.org/HS_Boards/data/Lib_system/dfb_leon.txt
'HACKING > System hacking' 카테고리의 다른 글
| libc-database 사용법 (0) | 2018.05.13 |
|---|---|
| 64bit rop tip (0) | 2018.05.13 |
| pwnable 풀 때 objdump (0) | 2018.02.25 |
| GOT Overwrite (0) | 2018.02.24 |
| CTF pwn 문제용 nc 서버 만들기 (0) | 2018.02.15 |
Rootme : ELF x86 - Stack buffer overflow - C++ vtables
2018. 5. 5. 21:01
Rootme : ELF x86 - Stack buffer overflow basic 5
2018. 5. 5. 14:36
Rootme : ELF x86 - Stack buffer and integer overflow
2018. 4. 22. 19:54
Rootme : ELF x86 - BSS buffer overflow
2018. 4. 22. 14:45
Rootme : ELF x86 - Race condition
2018. 4. 21. 20:56