½Ã½ºÅÛ ÇØÅ·

 1576, 1/79 ȸ¿ø°¡ÀÔ  ·Î±×ÀΠ 
   pwnnnt
   °í¼ö´Ôµé²² Áú¹®ÇÕ´Ï´Ù.

http://www.hackerschool.org/HS_Boards/zboard.php?id=QNA_system&no=1838 [º¹»ç]


Codegate 2014 - angry doraemon ¹ÙÀ̳ʸ®¸¦ º¸´Ù ÀÌÇØ°¡ ¾È µÅ¼­ Áú¹®ÇÕ´Ï´Ù.


payload += (»ý·«)
paylaod += p32(elf.plt["write"]) # RET ¿µ¿ª
payload += pop3ret
payload += p32(4) + p32(elf.got["read"]) + p32(4) + text section + argv(4)

# Write() ÀÎÀÚ p32(4) + p32(elf.got["read"]) + p32(4)

pop3retÀº gdb peda¸¦ ÅëÇØ °¡Á®¿Í¼­ »ç¿ëÇß½À´Ï´Ù.
payload¸¦ º¸³»¸é eip°¡ argv °ªÀ¸·Î ¼¼ÆÃµË´Ï´Ù.... (??)
±×·¡¼­ Å×½ºÆ®¸¦ Çϱâ À§ÇØ payload¸¦ ´ÙÀ½°ú °°ÀÌ ¼öÁ¤ÇÏ¿´´õ´Ï,

payload += p32(4) + p32(elf.got["read"]) + p32(4) + p32(10) + text section + argv(4)

write()°¡ ³¡³ª¸ç pop3retÀ» ¸¸³ª eip°¡ Á¤»óÀûÀ¸·Î 0xa·Î ¹Ù²î¾ú½À´Ï´Ù.
¿Ö óÀ½ ¸¸µç payload¿¡¼­´Â eip°¡ text section·Î ¹Ù²îÁö ¾Ê´Â °É±î¿ä ?
ÀÌÀ¯¸¦ ¸ð¸£°Ú½À´Ï´Ù.... ¤Ì¤Ì¤Ì¤Ì¤Ì¤Ì

* angrydoraemonÀº ¼ÒÄÏÀ» ÀÌ¿ëÇÑ ¹®Á¦ÀÔ´Ï´Ù.



  Hit : 2903     Date : 2017/03/30 12:32



    
ÇØÄð·¯ text sectionÀ̶ó°í ¾²½Å°Ô ¾î¶² ÀνºÆ®·°¼Ç ½ÃÄö½ºÀÇ ÁÖ¼ÒÀÎÁö¸¦ ¾Ë¾Æ¾ß ÇÕ´Ï´Ù
0xa·Î ¼³Á¤ÀÌ µÆ´Ù¸é óÀ½¿¡µµ ºÐ¸íÈ÷ text sectionÀ¸·Î º¯°æµÆÀ»°Å°í ±× Äڵ忡¼­ argv·Î ¸®ÅÏÇϸ鼭 eip°¡ argv·Î ¼³Á¤µÆÀ»°Ì´Ï´Ù
2017/03/30  
pwnnnt °¨»çÇÕ´Ï´Ù :D 2017/03/30  
1576   ¹ö±×¹Ù¿îƼ¸¦ ÇÒ Á¤µµÀÇ ¼öÁØÀÌ¸é ¾î¶»°Ô ·Îµå¸ÊÀ» Àâ¾Æ¾ß Çϳª¿ä?     ÇØÅ·ÀßÇϰí½Í´Ù
05/03 1275
1575   LOB ¹®Á¦ ÀͽºÇ÷ÎÀÕÀ» C·Î ÀÛ¼ºÇϸ鼭 Ǫ´Âµ¥¿ä.[2]     ÇØÅ·ÀßÇϰí½Í´Ù
09/18 1550
1574   pwnable.kr echo1 Áú¹®2 (½ºÆ÷ ÁÖÀÇ)[2]     turttle2s
10/05 2658
1573   LOB GATE¹®Á¦ Ç®¸é¼­ ±Ã±ÝÇÑÁ¡[3]     hackxx123
08/24 2278
1572   libc°ü·Ã - 2[5]     lMaxl04
08/24 2247
1571   ASLRÀÌ °É·ÁÀÖÀ»¶§ ret¿¡ ROPÀ¸·Î jmp %espÀ» »ç¿ëÇÑ °æ¿ì.[3]     lMaxl04
06/29 2449
1570   ¸®¸ðÆ® ȯ°æ¿¡¼­ÀÇ ½ºÅà ÁÖ¼Ò È®ÀÎ ¹æ¹ýÀÌ ±Ã±ÝÇÕ´Ï´Ù.[2]     lMaxl04
06/16 2056
1569   ÇØÅ· ÇÁ¸®¼­¹ö ¾ø¾îÁ³³ª¿ä?[1]     terfkim
04/15 2948
1568   ½ºÅÿ¡ µ¥ÀÌÅÍ ³ÖÀ» ¶§ SIGSEGV[4]     turttle2s
02/04 2643
1567   pwnable.kr echo1 Áú¹®[2]     turttle2s
06/17 2934
1566   ROP strcpy °ü·Ã Áú¹®ÀÔ´Ï´Ù.[3]     heeyoung0511
06/16 2610
1565   Level2 -> Level3 ¿¡¼­ vi¿Í /usr/bin/EditorÀÇ Â÷ÀÌ[2]     hyemin1826
07/18 3030
1564   Trainer3 ftz.hackerschool.org È£½ºÆ® Á¢¼Ó ºÒ°¡[1]     hyemin1826
07/18 4826
1563   dllÀÎÁ§¼Ç ½ÇÇèÁß Áú¹® µå¸³´Ï´Ù.[1]     kkk477
05/31 2981
1562   ÆÐŶ º¹È£È­¸¦ ¸¶½ºÅÍ ÇÏ·Á¸é ¾î¶² °úÁ¤ÀÌ ÀÖ¾î¾ßÇϳª¿ä?     sa0814
04/01 2550
1561   »ç±â[2]     jas08
03/31 2897
1560   ½Ã½ºÅÛ ÄÝÀÌ °¡´ÉÇÑ ¸Þ¸ð¸® ¿µ¿ª°ú ºÒ°¡´ÉÇÑ ¸Þ¸ð¸® ¿µ¿ªÀÌ Á¸ÀçÇϳª¿ä?     ocal
03/30 2556
1559   pwntools »ç¿ë½Ã¿Í ±âº» socket ¸ðµâ ÀÌ¿ë½Ã Â÷ÀÌ?[4]     ocal
01/09 3470
1558   lob level19(nightmare) °ü·ÃÁú¹®[1]     dnjsdnwja
12/18 2551
1557   ftz level2 Áú¹®ÀÖ½À´Ï´Ù[1]     kihyun1998
12/13 2746
1 [2][3][4][5][6][7][8][9][10]..[79]

Copyright 1999-2026 Zeroboard / skin by Hackerschool.org / Secure Patch by Hackerschool.org