https://blog.haitai-social.com/note/%E7%B3%BB%E7%BB%9F%E7%90%86%E8%AE%BA%E8%AF%BE%E7%A8%8B/ctf-wiki/7.1.stackoverflow/Recent content in 7.1.StackOverflow on 蛇索尼 AidenHugo -- gohugo.iozh-CNshesl-meow@qq.com (佘崧林)shesl-meow@qq.com (佘崧林)Tue, 30 Jul 2019 11:01:03 +0800https://blog.haitai-social.com/note/%E7%B3%BB%E7%BB%9F%E7%90%86%E8%AE%BA%E8%AF%BE%E7%A8%8B/ctf-wiki/7.1.stackoverflow/1.canary/Tue, 30 Jul 2019 11:01:03 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E7%B3%BB%E7%BB%9F%E7%90%86%E8%AE%BA%E8%AF%BE%E7%A8%8B/ctf-wiki/7.1.stackoverflow/1.canary/学习资料： https://ctf-wiki.github.io/ctf-wiki/pwn/linux/mitigation/Canary/ https://blog.csdn.net/Virtual_Func/article/details/48789947 http://blog.fourthbit.com/2014/12/23/traffic-analysis-of-an-ssl-slash-tls-session 学习内容： Linux-Pwn，安全保护机制 由于 stack overflow 而引发的攻击非常普遍也非常古老，相应地一种叫做 canary 的 mitigation 技术很早就出现在 glibc 里，https://blog.haitai-social.com/note/%E7%B3%BB%E7%BB%9F%E7%90%86%E8%AE%BA%E8%AF%BE%E7%A8%8B/ctf-wiki/7.1.stackoverflow/3.rop/Tue, 30 Jul 2019 11:01:03 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E7%B3%BB%E7%BB%9F%E7%90%86%E8%AE%BA%E8%AF%BE%E7%A8%8B/ctf-wiki/7.1.stackoverflow/3.rop/基本 ROP ret2text ret2text 即控制程序执行程序本身已有的的代码 (.text)。例子 ret2shellcode ret2shellcode，即控制程序执行 shellcode 代码。一般来说，shellcohttps://blog.haitai-social.com/note/%E7%B3%BB%E7%BB%9F%E7%90%86%E8%AE%BA%E8%AF%BE%E7%A8%8B/ctf-wiki/7.1.stackoverflow/2.protection/Tue, 30 Jul 2019 11:01:03 +0800shesl-meow@qq.com (佘崧林)https://blog.haitai-social.com/note/%E7%B3%BB%E7%BB%9F%E7%90%86%E8%AE%BA%E8%AF%BE%E7%A8%8B/ctf-wiki/7.1.stackoverflow/2.protection/参考： https://ctf-wiki.github.io/ctf-wiki/pwn/linux/stackoverflow/stack-intro-zh/ https://ctf-wiki.github.io/ctf-wiki/pwn/linux/stackoverflow/stackoverflow-basic-zh/ https://introspelliam.github.io/2017/09/30/linux程序的常用保护机制/ Canary 简单地说： 函