https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/pwnable/Recent content in pwnable on 蛇索尼 AidenHugo -- gohugo.iozh-CNshesl-meow@qq.com (佘崧林)shesl-meow@qq.com (佘崧林)Wed, 24 Jul 2019 14:38:29 +0800https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/pwnable/4.3x17/Wed, 24 Jul 2019 14:38:29 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/pwnable/4.3x17/参考资料： https://github.com/maroueneboubakri/lscan/wiki/Reverse-Engineer-a-stripped-binary-with-lscan-and-IDApro https://www.jianshu.com/p/7a1441e4f355 保护等级 首先检查程序的保护等级： 1 2 3 4 5 6 7 $ checksec 3x17 [*] '/media/data/program/ctf/pwnable/3x17/3x17' Arch: amd64-64-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x400000) 首先我们发现这是一个 64 位的程序，另外程https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/pwnable/3.calc/Sun, 21 Jul 2019 11:19:49 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/pwnable/3.calc/保护等级 首先检查安全保护等级： 1 2 3 4 5 6 7 $ checksec calc [*] '/media/data/program/ctf/pwnable/calc/calc' Arch: i386-32-little RELRO: Partial RELRO Stack: Canary found NX: NX enabled PIE: No PIE (0x8048000) 程序开启了 NX 保护，不能执行栈代码。我们再看程序的链接方式https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/pwnable/2.orw/Tue, 16 Jul 2019 21:49:20 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/pwnable/2.orw/参考资料： https://www.anquanke.com/post/id/150359 首先检查安全保护等级： 1 2 3 4 5 6 7 8 $ checksec orw [*] '/media/data/program/ctf/pwnable/orw/orw' Arch: i386-32-little RELRO: Partial RELRO Stack: Canary found NX: NX disabled PIE: No PIE (0x8048000) RWX: Has RWX segments 可以看到这个程序开启了以下保护机制： Canary 开启https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/pwnable/1.start/Tue, 16 Jul 2019 21:49:20 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E5%B7%A5%E5%85%B7%E4%BD%BF%E7%94%A8%E6%8E%A5%E5%8F%A3/ctf-writeup/pwnable/1.start/参考资料： 安全客，前六题的题解：https://www.anquanke.com/post/id/150359 Linux Syscall Reference：htt