https://mrbelieve.tech/tags/buu/ Recent content in buu on Mr.Be1ieVe's Treasure Hugo -- gohugo.io en-us mr_believe@outlook.com (Mr.Be1ieVe) mr_believe@outlook.com (Mr.Be1ieVe) Sun, 02 Feb 2020 00:00:00 +0000 https://mrbelieve.tech/post/babyheap_0ctf_2017/ Sun, 02 Feb 2020 00:00:00 +0000 mr_believe@outlook.com (Mr.Be1ieVe) https://mrbelieve.tech/post/babyheap_0ctf_2017/ 参考wp:https://blog.csdn.net/weixin_42151611/article/details/98119213?fp https://mrbelieve.tech/post/ciscn_2019_s_9/ Sat, 25 Jan 2020 00:00:00 +0000 mr_believe@outlook.com (Mr.Be1ieVe) https://mrbelieve.tech/post/ciscn_2019_s_9/ 啥保护没开，第一时间考虑shellcode 另外leak只有50，leak多才考虑直接走rop 尝试过ret2libc,但是怎么都调不出来= = shellcode https://mrbelieve.tech/post/buu-ciscn_2019-c_1-wp/ Mon, 13 Jan 2020 00:00:00 +0000 mr_believe@outlook.com (Mr.Be1ieVe) https://mrbelieve.tech/post/buu-ciscn_2019-c_1-wp/ // local variable allocation has failed, the output may be wrong! int __cdecl main(int argc, const char **argv, const char **envp) { int v4; // [rsp+Ch] [rbp-4h] init(*(_QWORD *)&argc, argv, envp); puts("EEEEEEE hh iii "); puts("EE mm mm mmmm aa aa cccc hh nn nnn eee "); puts("EEEEE mmm mm mm aa aaa cc hhhhhh iii nnn nn ee e "); puts("EE mmm mm mm aa aaa cc hh hh https://mrbelieve.tech/post/ciscn_2019_n_1-wp/ Mon, 13 Jan 2020 00:00:00 +0000 mr_believe@outlook.com (Mr.Be1ieVe) https://mrbelieve.tech/post/ciscn_2019_n_1-wp/ int func() { int result; // eax char v1; // [rsp+0h] [rbp-30h] float v2; // [rsp+2Ch] [rbp-4h] v2 = 0.0; puts("Let's guess the number."); gets(&v1); if ( v2 == 11.28125 ) result = system("cat /flag"); else result = puts("Its value should be 11.28125"); return result; } 看见==我还尝试了一下’a&rsqu https://mrbelieve.tech/post/get_started_3dsctf_2016/ Mon, 13 Jan 2020 00:00:00 +0000 mr_believe@outlook.com (Mr.Be1ieVe) https://mrbelieve.tech/post/get_started_3dsctf_2016/ mprotect函数原型： int mprotect(void *addr, size_t len, int prot); addr 内存启始地址 len 修改内存的长度 prot 内存的权限 [ 所以得到exp: from pwn import * elf = ELF('./get_started_3dsctf_2016') sh = elf.process() #sh = remote('node3.buuoj.cn',27037) pop3_ret = 0x804951D #为了后 https://mrbelieve.tech/post/ogeek2019-babyrop/ Mon, 13 Jan 2020 00:00:00 +0000 mr_believe@outlook.com (Mr.Be1ieVe) https://mrbelieve.tech/post/ogeek2019-babyrop/ 程序 为了绕过strncmp，我们在v6这里可以放一个\x00 因为strlen会在识别到\x00之后停止，这样strncmp就会默认返回0 这里