CTF-All-In-One/doc/6.1.6_pwn_defconctf2015_fuckup.md

37 lines
1.3 KiB
Markdown
Raw Normal View History

2017-11-23 20:32:22 +07:00
# 6.1.6 pwn DefconCTF2015 fuckup
- [ret2vdso 原理](#ret2vdso-原理)
- [题目解析](#题目解析)
- [Exploit](#exploit)
- [参考资料](#参考资料)
## ret2vdso 原理
2017-11-24 17:48:00 +07:00
在你使用 `ldd` 命令时,通常会显示出 vDSO如下
```
$ ldd /usr/bin/ls
linux-vdso.so.1 (0x00007ffff7ffa000)
libcap.so.2 => /usr/lib/libcap.so.2 (0x00007ffff79b2000)
libc.so.6 => /usr/lib/libc.so.6 (0x00007ffff75fa000)
/lib64/ld-linux-x86-64.so.2 => /usr/lib64/ld-linux-x86-64.so.2 (0x00007ffff7dd8000)
```
32 位程序则会显示 `linux-gate.so.1`,都是一个意思。
2017-11-23 20:32:22 +07:00
## 题目解析
2017-11-25 15:45:09 +07:00
```
$ file fuckup
fuckup: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
$ checksec -f fuckup
RELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILE
No RELRO No canary found NX enabled No PIE No RPATH No RUNPATH No 0 0 fuckup
```
2017-11-23 20:32:22 +07:00
## Exploit
2017-11-25 15:45:09 +07:00
完整的 exp 如下,其他文件放在了[github](../src/writeup/6.1.6_pwn_defconctf2015_fuckup)相应文件夹中:
2017-11-23 20:32:22 +07:00
## 参考资料
2017-11-24 17:48:00 +07:00
- `man vdso`
- [Return to VDSO using ELF Auxiliary Vectors](http://v0ids3curity.blogspot.in/2014/12/return-to-vdso-using-elf-auxiliary.html)