2021-01-08 ycdxsb CTF / pwn / stack_overflow / ROP_Emporium11 分钟读完 (大约 1666 个字)

ROP Emporium (中)

ROP Emporium 第二部分

2020-04-22 ycdxsb CTF / pwn / stack_overflow25 分钟读完 (大约 3736 个字)

栈溢出与ROP分析与利用

¶基础知识

¶栈溢出与ROP

栈溢出指的是程序向栈中某个变量中写入的字节数超过了这个变量本身所申请的字节数，因而导致与其相邻的栈中的变量的值被改变。栈溢出漏洞就是由于栈溢出而导致的漏洞。在程序执行过程中，常使用栈帧记录程序执行过程中的状态，在栈帧中保存着返回地址，当利用栈溢出漏洞修改函数返回地址跳转到非预期地址执行时，就产生了ROP攻击，又称返回导向编程。

2020-04-08 ycdxsb CTF / pwn / pwnable.kr / Toddler'sBottle2 分钟读完 (大约 315 个字)

pwnable.kr —— horcruxes

¶question

Voldemort concealed his splitted soul inside 7 horcruxes.
Find all horcruxes, and ROP it!
author: jiwon choi

ssh horcruxes@pwnable.kr -p2222 (pw:guest)

2020-04-08 ycdxsb CTF / pwn / pwnable.kr / Toddler'sBottle几秒读完 (大约 87 个字)

pwnable.kr —— blukat

¶question

Sometimes, pwnable is strange...
hint: if this challenge is hard, you are a skilled player.

ssh blukat@pwnable.kr -p2222 (pw: guest)

2020-04-08 ycdxsb CTF / pwn / pwnable.kr / Toddler'sBottle5 分钟读完 (大约 778 个字)

pwnable.kr —— unlink

¶question

1
2
3

Daddy! how can I exploit unlink corruption?

ssh unlink@pwnable.kr -p2222 (pw: guest)

2020-04-08 ycdxsb CTF / pwn / pwnable.kr / Toddler'sBottle4 分钟读完 (大约 557 个字)

pwnable.kr —— asm

¶question

1
2
3

Mommy! I think I know how to make shellcodes

ssh asm@pwnable.kr -p2222 (pw: guest)

2020-04-07 ycdxsb CTF / pwn / pwnable.kr / Toddler'sBottle6 分钟读完 (大约 963 个字)

pwnable.kr —— memcpy

¶question

Are you tired of hacking?, take some rest here.
Just help me out with my small experiment regarding memcpy performance. 
after that, flag is yours.

http://pwnable.kr/bin/memcpy.c

ssh memcpy@pwnable.kr -p2222 (pw:guest)

2020-04-06 ycdxsb CTF / pwn / pwnable.kr / Toddler'sBottle6 分钟读完 (大约 949 个字)

pwnable.kr —— uaf

¶question

1
2
3

Mommy, what is Use After Free bug?

ssh uaf@pwnable.kr -p2222 (pw:guest)

题目要求我们使用ssh登录到服务器上ssh uaf@pwnable.kr -p2222，密码是cmd1的flag,有的时候可能有身份的校验，这个时候需要加上参数-o StrictHostKeyChecking=no进行登录

2020-04-05 ycdxsb CTF / pwn / stack_overflow / ROP_Emporium17 分钟读完 (大约 2520 个字)

ROP Emporium (上)

注意：64位传参前六个参数使用寄存器RDI、RSI、RDX、RCX、R8、R9

2020-04-04 ycdxsb CTF / pwn / pwnable.kr / Toddler'sBottle2 分钟读完 (大约 268 个字)

pwnable.kr —— cmd2

¶question

Daddy bought me a system command shell.
but he put some filters to prevent me from playing with it without his permission...
but I wanna play anytime I want!

ssh cmd2@pwnable.kr -p2222 (pw:flag of cmd1)

题目要求我们使用ssh登录到服务器上ssh cmd2@pwnable.kr -p2222，密码是cmd1的flag,有的时候可能有身份的校验，这个时候需要加上参数-o StrictHostKeyChecking=no进行登录

ROP Emporium (中)

栈溢出与ROP分析与利用

¶基础知识

¶栈溢出与ROP

pwnable.kr —— horcruxes

¶question

pwnable.kr —— blukat

¶question

pwnable.kr —— unlink

¶question

pwnable.kr —— asm

¶question

pwnable.kr —— memcpy

¶question

pwnable.kr —— uaf

¶question

ROP Emporium (上)

pwnable.kr —— cmd2

¶question

链接

归档

订阅更新

分类

最新文章

标签