https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/ctf-wiki/Recent content in ctf-wiki on 蛇索尼 AidenHugo -- gohugo.iozh-CNshesl-meow@qq.com (佘崧林)shesl-meow@qq.com (佘崧林)Mon, 26 Aug 2019 23:35:49 +0800https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/ctf-wiki/useafterfree/Mon, 26 Aug 2019 23:35:49 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/ctf-wiki/useafterfree/题目：Hitcon Training lab10 文件信息 检查文件安全性： 1 2 3 4 5 6 7 $ checksec ./hacknote [*] '/mnt/d/program/ctf/ctf-wiki/useafterfree/hacknote' Arch: i386-32-little RELRO: Partial RELRO Stack: Canary found NX: NX enabled PIE: No PIE (0x8048000) 程序没有开启地址随机化，有栈保护和堆栈不https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/ctf-wiki/offbyone/Tue, 06 Aug 2019 22:13:24 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/ctf-wiki/offbyone/题目：Asis CTF 2016 b00ks 文件信息 首先检查保护等级： 1 2 3 4 5 6 7 $ checksec ./b00ks [*] '/mnt/d/program/ctf/ctf-wiki/offbyone/b00ks' Arch: amd64-64-little RELRO: Full RELRO Stack: No canary found NX: NX enabled PIE: PIE enabled 程序没有开启栈保护。查看各个段的权限： 1https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/ctf-wiki/ret2libc3/Mon, 25 Feb 2019 15:16:23 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/ctf-wiki/ret2libc3/保护等级 首先检查保护等级： 1 2 3 4 5 6 7 $ checksec ret2libc3 [*] '/mnt/d/program/ctf/ctf-wiki/ret2libc3/ret2libc3' Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x8048000) 可以看到这是一个开启了部分只读和栈溢出保护的程序。 程序逻辑