diff --git a/SUMMARY.md b/SUMMARY.md index df67d7b..60f3a01 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -149,6 +149,8 @@ GitHub 地址:https://github.com/firmianay/CTF-All-In-One * [6.1.23 pwn BCTF2016 bcloud](doc/6.1.23_pwn_bctf2016_bcloud.md) * [6.1.24 pwn HCTF2017 babyprintf](doc/6.1.24_pwn_hctf2017_babyprintf.md) * [6.1.25 pwn 34C3CTF2017 300](doc/6.1.25_pwn_34c3ctf2017_300.md) + * [6.1.26 pwn SECCONCTF2016 tinypad](doc/6.1.26_pwn_secconctf2016_tinypad.md) + * [6.1.27 pwn ASISCTF2016 b00ks](doc/6.1.27_pwn_asisctf2016_b00ks.md) * Reverse * [6.2.1 re XHPCTF2017 dont_panic](doc/6.2.1_re_xhpctf2017_dont_panic.md) * [6.2.2 re ECTF2016 tayy](doc/6.2.2_re_ectf2016_tayy.md) diff --git a/doc/6.1.24_pwn_hctf2017_babyprintf.md b/doc/6.1.24_pwn_hctf2017_babyprintf.md index cca2b91..4fbe071 100644 --- a/doc/6.1.24_pwn_hctf2017_babyprintf.md +++ b/doc/6.1.24_pwn_hctf2017_babyprintf.md @@ -19,6 +19,7 @@ $ strings libc-2.24.so | grep "GNU C" GNU C Library (Ubuntu GLIBC 2.24-9ubuntu2.2) stable release version 2.24, by Roland McGrath et al. Compiled by GNU CC version 6.3.0 20170406. ``` +64 位程序,开启了 canary 和 NX,默认开启 ASLR。 ## 题目解析 diff --git a/doc/6.1.25_pwn_34c3ctf2017_300.md b/doc/6.1.25_pwn_34c3ctf2017_300.md index b375ff6..e278dc9 100644 --- a/doc/6.1.25_pwn_34c3ctf2017_300.md +++ b/doc/6.1.25_pwn_34c3ctf2017_300.md @@ -19,6 +19,7 @@ $ strings libc.so.6 | grep "GNU C" GNU C Library (Ubuntu GLIBC 2.24-9ubuntu2.2) stable release version 2.24, by Roland McGrath et al. Compiled by GNU CC version 6.3.0 20170406. ``` +64 位程序 ,开启了 canary、NX 和 PIE,默认开启 ASLR。 ## 题目解析 diff --git a/doc/6.1.26_pwn_secconctf2016_tinypad.md b/doc/6.1.26_pwn_secconctf2016_tinypad.md new file mode 100644 index 0000000..3f86a8e --- /dev/null +++ b/doc/6.1.26_pwn_secconctf2016_tinypad.md @@ -0,0 +1,29 @@ +# 6.1.26 pwn SECCONCTF2016 tinypad + +- [题目复现](#题目复现) +- [题目解析](#题目解析) +- [漏洞利用](#漏洞利用) +- [参考资料](#参考资料) + + +[下载文件](../src/writeup/6.1.26_pwn_secconctf2016_tinypad) + +## 题目复现 +``` +$ file tinypad +tinypad: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=1333a912c440e714599a86192a918178f187d378, not stripped +$ checksec -f tinypad +RELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILE +Full RELRO Canary found NX enabled No PIE No RPATH No RUNPATH Yes 0 4 tinypad +$ strings libc-2.19.so | grep "GNU C" +GNU C Library (Ubuntu EGLIBC 2.19-0ubuntu6.9) stable release version 2.19, by Roland McGrath et al. +Compiled by GNU CC version 4.8.4. +``` + + +## 题目解析 + +## 漏洞利用 + +## 参考资料 +- https://ctftime.org/task/3189 diff --git a/doc/6.1.27_pwn_asisctf2016_b00ks.md b/doc/6.1.27_pwn_asisctf2016_b00ks.md new file mode 100644 index 0000000..6e2250f --- /dev/null +++ b/doc/6.1.27_pwn_asisctf2016_b00ks.md @@ -0,0 +1,29 @@ +# 6.1.27 pwn ASISCTF2016 b00ks + +- [题目复现](#题目复现) +- [题目解析](#题目解析) +- [漏洞利用](#漏洞利用) +- [参考资料](#参考资料) + + +[下载文件](../src/writeup/6.1.27_pwn_asisctf2016_b00ks) + +## 题目复现 +``` +$ file b00ks +b00ks: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=cdcd9edea919e679ace66ad54da9281d3eb09270, stripped +$ checksec -f b00ks +RELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILE +Full RELRO No canary found NX enabled PIE enabled No RPATH No RUNPATH No 0 2 b00ks +$ strings libc.so.6 | grep "GNU C" +GNU C Library (Ubuntu GLIBC 2.23-0ubuntu10) stable release version 2.23, by Roland McGrath et al. +Compiled by GNU CC version 5.4.0 20160609. +``` + + +## 题目解析 + +## 漏洞利用 + +## 参考资料 +- https://ctftime.org/task/2492 diff --git a/doc/6_writeup.md b/doc/6_writeup.md index c6419ac..42ada78 100644 --- a/doc/6_writeup.md +++ b/doc/6_writeup.md @@ -26,6 +26,8 @@ * [6.1.23 pwn BCTF2016 bcloud](6.1.23_pwn_bctf2016_bcloud.md) * [6.1.24 pwn HCTF2017 babyprintf](6.1.24_pwn_hctf2017_babyprintf.md) * [6.1.25 pwn 34C3CTF2017 300](6.1.25_pwn_34c3ctf2017_300.md) + * [6.1.26 pwn SECCONCTF2016 tinypad](6.1.26_pwn_secconctf2016_tinypad.md) + * [6.1.27 pwn ASISCTF2016 b00ks](6.1.27_pwn_asisctf2016_b00ks.md) * Reverse * [6.2.1 re XHPCTF2017 dont_panic](6.2.1_re_xhpctf2017_dont_panic.md) * [6.2.2 re ECTF2016 tayy](6.2.2_re_ectf2016_tayy.md) diff --git a/src/writeup/6.1.26_pwn_secconctf2016_tinypad/libc-2.19.so b/src/writeup/6.1.26_pwn_secconctf2016_tinypad/libc-2.19.so new file mode 100644 index 0000000..e3636fe Binary files /dev/null and b/src/writeup/6.1.26_pwn_secconctf2016_tinypad/libc-2.19.so differ diff --git a/src/writeup/6.1.26_pwn_secconctf2016_tinypad/tinypad b/src/writeup/6.1.26_pwn_secconctf2016_tinypad/tinypad new file mode 100644 index 0000000..a995d4a Binary files /dev/null and b/src/writeup/6.1.26_pwn_secconctf2016_tinypad/tinypad differ diff --git a/src/writeup/6.1.27_pwn_asisctf2016_b00ks/b00ks b/src/writeup/6.1.27_pwn_asisctf2016_b00ks/b00ks new file mode 100644 index 0000000..c4fbce6 Binary files /dev/null and b/src/writeup/6.1.27_pwn_asisctf2016_b00ks/b00ks differ diff --git a/src/writeup/6.1.27_pwn_asisctf2016_b00ks/libc.so.6 b/src/writeup/6.1.27_pwn_asisctf2016_b00ks/libc.so.6 new file mode 100644 index 0000000..6e0b032 Binary files /dev/null and b/src/writeup/6.1.27_pwn_asisctf2016_b00ks/libc.so.6 differ