22002, 2/1101 ȸ¿ø°¡ÀÔ  ·Î±×ÀΠ 
   lMaxl04
   http://1111
   libc °ü·Ã

http://www.hackerschool.org/HS_Boards/zboard.php?id=Free_Board&no=37634 [º¹»ç]


Æ÷³Êºí ¹®Á¦¸¦ Ç®´Ùº¸¸é libc°¡ Á¦°øµÇ´Â °æ¿ì°¡ ´Ù¼Ò ÀÖ´Â °Í °°½À´Ï´Ù

¹®Á¦ ÆÄÀÏ ½ÇÇà ½Ã ÇØ´ç ÆÄÀÏÀ» ÂüÁ¶ÇؾßÇϴµ¥ ¾î¶»°Ô ÂüÁ¶ÇÏ°Ô ¸¸µé ¼ö ÀÖ³ª¿ä?

libc¿¡ ¸Â´Â ld ÆÄÀÏÀ» ã¾Æ ÇÔ²² patchelf¸¦ Çغ¸·ÁÇßÀ¸³ª libc¿¡ ¸Â´Â ld ÆÄÀÏÀÌ Àß Ã£¾ÆÁöÁö ¾Ê±âµµ ÇÏ°í¿ä ¤Ð¤Ð

¹°·Ð ³ë°¡´Ù·Î ¿ÀÇÁ¼ÂÀ» ±¸ÇÒ ¼ö´Â ÀÖ´Ù´Â°Ç Áõ¸íÇÏ¿´½À´Ï´Ù ¤¾¤¾

  Hit : 1292     Date : 2022/07/29 06:02



    
lMaxl04 Ãß°¡·Î, strings·Î libc ÆÄÀÏ¿¡¼­ /bin/shÀÇ offsetÀ» ã´Âµ¥, ÇÔ¼ö ÁÖ¼Ò´Â ¿Ö ±×·¸°Ô ãÀ¸¸é offsetÀÌ ´Ù¸¥Áö ±Ã±ÝÇÕ´Ï´Ù. 2022/07/29  
cd80 º¸Åë libc°¡ ÁÖ¾îÁö´Â °æ¿ì¿¡ patchelf°°Àº°É·Î °°ÀÌ ½ÇÇàÇؾߵǴ °æ¿ì´Â Èü¹®Á¦Ç®¶§ ¾Æ´Ï¸é °ÅÀÇ ¾ø½À´Ï´Ù
Èü¹®Á¦Ç®¶§´Â ÁÖ¾îÁø libc·Î °°ÀÌ ½ÇÇàÇϸé ÁÁÀº ÀÌÀ¯°¡ libc ¹öÀü¸¶´Ù Èü¿¡ °É·ÁÀÖ´Â check & mitigationÀÌ ´Ù¸£±â ‹š¹®ÀÔ´Ï´Ù
´ñ±ÛÀÇ ³»¿ëÀ¸·Î º¸¾Æ ´Ü¼øÈ÷ systemÇÔ¼ö¿Í /bin/sh¹®ÀÚ¿­ÀÇ ¿ÀÇÁ¼Â¸¸ ãÀ¸¸é µÇ´Â °æ¿ì °°Àºµ¥
(base) ➜ ~ strings -t x /lib/x86_64-linux-gnu/libc.so.6 | grep /bin/sh
1b45bd /bin/sh
(base) ➜ ~ objdump -d /lib/x86_64-linux-gnu/libc.so.6 | grep system\.\*\>:
0000000000052290 <__libc_system@@GLIBC_PRIVATE>:
0000000000153ae0 <svcerr_systemerr@@GLIBC_2.2.5>:
(base) ➜ ~

ÀÌ·±½ÄÀ¸·Î ãÀ¸½Ã¸é µË´Ï´Ù
/bin/shÀÇ offset = 0x1b45bd
systemÀÇ offset = 0x52290

ÇÔ¼öÁÖ¼Ò¸¦ strings·Î ãÀ¸¸é ´Ù¸¥ ÀÌÀ¯´Â systemÇÔ¼öÀÇ ½ÃÀÛÀº "system"¹®ÀÚ¿­ÀÇ ÁÖ¼Ò°¡ ¾Æ´Ï¶ó systemÇÔ¼ö ÄÚµåÀÇ ½ÃÀÛÁּұ⠶§¹®À̱¸¿ä
2022/08/01  
lMaxl04 ¿ª½Ã ¤¾¤¾ ±â´Ù·È½À´Ï´Ù
¿ì¼± ´ñ±ÛÀÇ Áú¹®¿¡ ´ëÇÑ ´äÀº Àß ÀÌÇØÇß½À´Ï´Ù.

¸»¾¸ÇϽŠ°Í°ú °°ÀÌ ´Ü¼øÈ÷ offsetÀ» ±¸ÇÏ´Â °æ¿ì°¡ ´ëºÎºÐÀ̶ó »ç½Ç ±×³É ãÀ¸¸é µÇ±ä Çϴµ¥, °£È¤ libc ³»ÀÇ Æ¯Á¤ ÇÔ¼öÀÇ Áß°£ÁîÀ½¿¡¼­ memory leakÀÌ ÀϾ´Â °æ¿ì libc ¹öÀü¿¡ µû¶ó¼­ ÇØ´ç ÇÔ¼öÀÇ À§Ä¡°¡ ´Ù¸¥ °æ¿ì°¡ ÀÖ´Â °ÍÀ» È®ÀÎÇÏ¿©¼­ ±×·± ±Ã±ÝÁõÀÌ µé¾ú½À´Ï´Ù ¤¾¤¾

¿¹¸¦ µé¾î libc_1.so ¿¡¼­ printf + 100ÀÇ À§Ä¡°¡ leak µÇ¾ú´Âµ¥,
libc_2.so¿¡¼­´Â printf + 200ÀÇ À§Ä¡°¡ leak µÇ´Â °æ¿ì ÀÔ´Ï´Ù.

¿ª½Ã patchelf ¸»°í´Â ¹æ¹ýÀÌ ¾øÀ¸·Á³ª¿ä?
2022/08/01  
cd80 ½±Áö ¾Ê³×¿ä ¾î¶² °æ¿ìÀÎÁö ¾Ë°Ú´Âµ¥ Àúµµ ±×·²¶§¸¶´Ù Á¤È®È÷ ½ÃÀÛÁ¡ÀÌ ¸¯µÇ´Â ÇÔ¼öµé·Î ¹Ù²ã¼­ ¸¯½ÃÄ×¾ú°Åµç¿ä memcpyÇÔ¼ö°°Àº°æ¿ì´Â base³ª lenÀÇ align¿¡ µû¶ó fast path, slow path·Î ³ª´²Áö±âµµ Çϴµ¥ ±×·±°æ¿ì¿¡ ´Ù¸£°Ô ¸¯µÇ´Â°Ô ¾Æ´Ò±î ½Í³×¿ä Á¤È®ÇÑ ÀÌÀ¯´Â ¸ð¸£°Ú½À´Ï´Ù 2022/08/02  
lMaxl04 ´äº¯ °¨»çÇÕ´Ï´Ù ¤¾¤¾
¿ì¼±Àº patchelf¿¡ ´ëÇؼ­ Á¶±Ý ¾Ë¾ÆºÁ¾ß°Ú½À´Ï´Ù.
¿ª½Ã³ª À̹ø¿¡µµ Å« µµ¿ò µÇ¾ú½À´Ï´Ù. °¨»çÇÕ´Ï´Ù
2022/08/03  
21982   ADHD ÀÇ °íÅë ½º·¯¿î »î[1]     gggg
09/20 720
21981   ÇØÅ· º¸¾È °ü·Ã °ú¿Ü¸¦ ÁøÇàÇÕ´Ï´Ù.     bluewindsoul
09/11 713
21980   È­ÀÌÆ® ÇØÅ· ¹è¿ì°í ½Í½À´Ï´Ù.     dok1027@@!
09/09 553
21979   ¼­¿ï ¿ÕÃʺ¸ ¼Ó¼ºÀ¸·Î °¡¸£ÄÑÁÖ½Ç ¼±»ý´Ô ã½À´Ï´Ù [1]     wowo8877
09/01 704
21978   °£ÀýÇÕ´Ï´Ù. ½º½Â´Ô ã½À´Ï´Ù.[1]     anakin12
08/14 952
21977   ÀúÁ» µµ¿ÍÁֽǺР°è½Ã³ª¿ä...[1]     wjsrbqls009
08/02 712
21976   [Ã¥ È«º¸] ù Ã¥Àε¥, ebook ÃâÆÇÇÕ´Ï´Ù.     jdo
08/02 774
21975   ÇØÅ·, ÇÁ·Î±×·¡¹Ö °ú¿Ü ÇÕ´Ï´Ù(1ÀÚ¸® ¸¶Áö¸·)[3]     sysadm
07/16 1132
21974   ½Ã½ºÅÛ/À¥ ÇØÅ· °ú¿Ü ½º½Â´Ô ã½À´Ï´Ù.[1]     bbs171717
06/29 996
21973   ÇØÅ· º¸¾È °ü·Ã °ú¿Ü¸¦ ÁøÇàÇÕ´Ï´Ù.     bluewindsoul
06/29 837
21972   º¸¾È ÇØÅ· Àü¹®°¡ ¸ð¼Å¿ä     qwepoi
06/28 656
21971   [¹«·á] ÇØÅ· ¼±»ý´Ô ±¸ÀÎ (¿Â¶óÀÎ)      kali1234
06/23 934
21970   ÇØÅ· ¹× ÇÁ·Î±×·¡¹Ö °ú¿Ü °¡¸£Ä¨´Ï´Ù.(2ÀÚ¸®) [1]     sysadm
06/18 1048
21969   ½ßÃʺ¸ °ú¿Ü ¼±»ý´Ô ±¸ÀÎ[2]     na48jung
06/02 828
21968   ÇØÅ·°ú¿Ü ¸ðÁý ÇϽǶ§ Á¦¸ñ¿¡ Áö¿ª¸í Àû¾îÁÖ¼¼¿ä.     chanjung111
05/17 590
21967   [Ã¥ È«º¸] ù Ã¥Àε¥ Àß ºÁÁÖ¼¼¿ä~     jdo
05/03 1097
21966   ÇØÅ· °øºÎ °°ÀÌ ÇÏ°íÀÚ ÇÏ´Â ºÐ µð½ºÄÚµå °øÀ¯ÇØ¿ä     aovcoder999
05/03 845
21965   ¾È³çÇϼ¼¿ä ¸ðÀÇÇØÅ·ÁøÇàÁß¿¡ À¥½© ¿¡´ëÇØ À߸ô¶ó¼­ ±×·¯´Âµ¥ °í¼öºÐµé µµ¿ÍÁÖ¼¼¿ä ![1]     ploplo333
04/28 870
21964   µð½ºÄڵ忡 ¸ð¿©¼­ º¸¾È½ºÅ͵ðÇϽǺР±¸ÇØ¿ä     fkdlzm34
04/02 970
21963   2023 ÇÙÅ׿ ¼¼Á¾(HackTheon Sejong) ±¹Á¦ ´ëÇлý »çÀ̹öº¸¾È °æÁø´ëȸ (Á¢¼ö 3¿ù 22ÀÏ ¸¶°¨)     Geni pco COM
03/06 956
[1] 2 [3][4][5][6][7][8][9][10]..[1101]

Copyright 1999-2024 Zeroboard / skin by Hackerschool.org / Secure Patch by Hackerschool.org