½Ã½ºÅÛ ÇØÅ·

 1576, 1/79 ȸ¿ø°¡ÀÔ  ·Î±×ÀΠ 
   vngkv123
   asis CTF ¹®Á¦Ç®´Ù°¡....

http://www.hackerschool.org/HS_Boards/zboard.php?AllArticle=true&no=1852 [º¹»ç]


pwn¿µ¿ª ¹®Á¦¸¦ Ǫ´Âµ¥
°£´ÜÇÑ ¿ö¹Ö¾÷ ¹®Á¦·Î ASLRÀ» Á¦¿ÜÇÑ ¸ðµç º¸È£±â¹ýÀÌ Ç®¸° ¹®Á¦°¡ ÇϳªÀÖ¾ú´Âµ¥, bss¼½¼ÇÀÇ +0x100ÀÇ ±¸°£ºÎÅͰ¡ ½©Äڵ带 ³Ö°í È帧À» µ¹·ÇÀ» ¶§ ½ÇÇàÀÌ µÇ´øµ¥ ±× ±¸°£ÀÌ Heap¿µ¿ªÀ̶ó ±×·±°¡¿ä?

±×¸®°í universal gadget from __libc_csu_init À̶ó°í ÇØ¼­ Àú·±°Ô Àִٴµ¥
gdb»ó¿¡¼± ¾Æ¹«¸®ºÁµµ ÇØ´çÆÄÀÏ¿£ ¾ø´ø°Å °°Àºµ¥ Àú°Ô ¹ºÁö ¸ð¸£°Ú³×¿ë ¤Ð
¸ÞÀÎÇÔ¼ö ½ÇÇàÀü¿¡ Àִٴµ¥ ¤Ð¤Ì

(Àâ´ã : 64ºñÆ® Àç¹Ô³×¿ë ¤»¤»¤»¤»)

  Hit : 2895     Date : 2017/04/12 12:55



    
ÇØÄð·¯ ¾Æ´¢ bss+0x100Àº Èü¿µ¿ªÀÌ ¾Æ´Õ´Ï´Ù
universal gadgetÀº Áö±Ý °Ë»öÇØºÃ´Âµ¥ ±×³É ÀÎÀÚÄÁÆ®·ÑÇÏ´Â °¡Á¬À̳׿ä
ÀÌ °¡Á¬Àº ÇÁ·Î±×·¥¿¡¼­ ½ÇÁ¦ ½ÇÇàµÇ´Â°ÍÀº ¾Æ´Ï°í,
ÀÎÅÚ ¸í·ÉÀº ¾îµðºÎÅÍ ÀдÀ³Ä¿¡ µû¶ó ´Ù¸¥¸í·ÉÀÌ µÇ´Âµ¥
push $0x12345678 ˼
68 78 56 34 12 Àε¥ ÀÌ°É 78ºÎÅÍ ÀÐÀ¸¸é ´Ù¸¥ ¸í·É, 56ºÎÅÍ ÀÐÀ¸¸é ´Ù¸¥¸í·ÉÀÌ µË´Ï´Ù
±×·±½ÄÀ¸·Î ½ÇÁ¦ ÇÁ·Î±×·¥¿¡ Á¸ÀçÇÏÁö ¾Ê´Â °ÍÀ¸·Î º¸ÀÌ´Â ÀνºÆ®·°¼ÇµéÀ» ½ÇÇàÇÒ ¼ö ÀÖ½À´Ï´Ù
2017/04/13  
vngkv123 reafelf»ó¿¡¼± bss¿µ¿ª »çÀÌÁî°¡ 8·Î ³ª¿Ó´Âµ¥ ±×·¯¸é bss+0x100ÀÌ¸é ¾îµð¿¡ ÇØ´çÇϴ°ǰ¡¿ä? ±×´ë·Î bss¿µ¿ªÀΰ¡¿ä? 2017/04/13  
ÇØÄð·¯ ¾Æ ±×°Ç ½ÇÁ¦·Î ÇÁ·Î±×·¥¿¡¼­ bss¿µ¿ªÀ» »ç¿ëÇÏ´Â Å©±â±¸¿ä
¸Þ¸ð¸®´Â Ç×»ó ÆäÀÌÁö ´ÜÀ§(¸®´ª½º¿¡¼­´Â 0x1000´ÜÀ§)·Î ¸ÅÇεDZ⠶§¹®¿¡ ¿¹¸¦µé¾î¼­ bss°¡
0x804a0b0ÀÎ °æ¿ì¿¡ ½ÇÁ¦ ¸Þ¸ð¸® ÇÒ´çÀº 0x804b000±îÁö ÀÌ·ïÁý´Ï´Ù
2017/04/13  
vngkv123 °¨»çÇÕ´Ï´Ù ¤· ¤¾¤¾ 2017/04/13