Home pwn basic
Post
Cancel

pwn basic

入门材料现在还蛮多的,看书《从0到1 CTFer成长之路》《CTF特训营》,网站ctfwiki都可以,但是我还是安利一下我觉得很好的入门视频

image-20211226111936633链接:https://www.youtube.com/watch?v=8zO47WDUdIk

真的从0开始教,适合我这样的小白入门,这里粘一下他slide里的知识点

useful tools

image-20211226113603510

image-20211226115957029

image-20211226120056784

image-20211226120159038

image-20211226120402402

image-20211226120415990

Binary Format

image-20211226120633248

x64 Calling Convention

image-20211226120708921

2021-12-26 12.19.21

https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/linux-x64-calling-convention-stack-frame

Stack Frame

image-20211226122332317

Function Prologure

image-20211226122738297

image-20211226122748300

2021-12-26 12.28.05

Function Epilogue

image-20211226122841325

image-20211226123106303

2021-12-26 12.31.31

leave = mov rsp, rbp & pop rbp

Buffer Overflow利用

Return To Text

image-20211226124412277

覆盖return addr

Return To Shellcode

image-20211226124509013

image-20211226124539678

Linux syscalls: https://chromium.googlesource.com/chromiumos/docs/+/master/constants/syscalls.md

Protection

Stack Guard

image-20211226124814754

image-20211226124832066

穿插一句,canary的值可以通过 pwngdb插件的tls命令获得

image-20220110215656956

image-20220110215734695

DEP

image-20211226124932418

image-20211226124948889

ASLR & PIE

image-20211226125001583

image-20211226125009794

image-20211226125102935

GOT Hijacking

image-20211226131439624

Lazy Binding

image-20211226131505102

GOT

image-20211226131531631

image-20211226131540947

Lazy Binding Proceduce

2021-12-26 13.18.16

第一次调用<puts@plt>表,会将puts的真实地址写到GOT表里

image-20211226132108718

第二次调用<puts@plt>表时,就直接拿到puts的真实地址了。

热知识:C语言里printf如果带\n,汇编里实际是调用putsimage-20211226133110635

GOT Hijacking

image-20211226133428269

image-20211226133510956

RELRO

image-20211226133549715

ROP

image-20211226133602924

image-20211226133622543

image-20211226133649165

Return to PLT

image-20211226133756509

image-20211226133810671

image-20211226133950468

Return to libc

image-20211226134254989

image-20211226134305331

image-20211226134312366

image-20211226134337196

image-20211226134425877

image-20211226135515936

  • https://github.com/niklasb/libc-database
  • https://github.com/lieanu/LibcSearcher

summary

基础知识记录。用来查阅忘记的知识点的话,还是可以的,能够帮助回想起来。

This post is licensed under CC BY 4.0 by the author.

异度之刃1战斗系统攻略

NTUSTISC - stack overflow