mirror of
https://github.com/nganhkhoa/CTF-All-In-One.git
synced 2024-10-19 09:22:51 +07:00
169 lines
4.8 KiB
Markdown
169 lines
4.8 KiB
Markdown
# 6.1 更多 Linux 工具
|
||
|
||
- [file](#file)
|
||
- [edb](#edb)
|
||
- [ldd](#ldd)
|
||
- [ltrace](#ltrace)
|
||
- [md5sum](#md5sum)
|
||
- [objdump](#objdump)
|
||
- [readelf](#readelf)
|
||
- [ssdeep](#ssdeep)
|
||
- [strace](#strace)
|
||
- [strings](#strings)
|
||
- [xxd](#xxd)
|
||
|
||
## <span id="file">file</span>
|
||
**file**命令用来探测给定文件的类型。
|
||
|
||
|
||
## <span id="edb">edb</span>
|
||
**edb**是一个同时支持x86、x86-64的调试器。它主要向 OllyDbg 工具看齐，并可通过插件体系进行功能的扩充。
|
||
|
||
|
||
## <span id="ldd">ldd</span>
|
||
用于打印程序或者库文件所依赖的共享库列表。
|
||
|
||
|
||
## <span id="ltrace">ltrace</span>
|
||
**ltrace**命令用于跟踪进程调用库函数的情况。
|
||
|
||
#### 重要参数
|
||
```text
|
||
-f trace children (fork() and clone()).
|
||
-p PID attach to the process with the process ID pid.
|
||
-S trace system calls as well as library calls.
|
||
```
|
||
|
||
|
||
## <span id="md5sum">md5sum</span>
|
||
**md5sum**命令采用MD5报文摘要算法（128位）计算和检查文件的校验和。
|
||
|
||
#### 重要参数
|
||
```text
|
||
-b, --binary read in binary mode
|
||
-c, --check read MD5 sums from the FILEs and check them
|
||
```
|
||
|
||
|
||
## <span id="objdump">objdump</span>
|
||
**objdump**命令是用查看目标文件或者可执行的目标文件的构成的gcc工具。
|
||
|
||
#### 重要参数
|
||
```text
|
||
-d, --disassemble Display assembler contents of executable sections
|
||
-R, --dynamic-reloc Display the dynamic relocation entries in the file
|
||
```
|
||
|
||
#### 常见用法
|
||
结合使用 *objdump* 和 *grep*。
|
||
```text
|
||
objdump -d [executable] | grep -A 30 [function_name]
|
||
```
|
||
|
||
查找 **GOT** 表地址：
|
||
```text
|
||
objdump -R [binary] | grep [function_name]
|
||
```
|
||
|
||
从可执行文件中提取 **shellcode** (注意，在objdump中可能会删除空字节):
|
||
```text
|
||
for i in `objdump -d print_flag | tr '\t' ' ' | tr ' ' '\n' | egrep '^[0-9a-f]{2}$' ` ; do echo -n "\x$i" ; done
|
||
```
|
||
|
||
|
||
## <span id="readelf">readelf</span>
|
||
**readelf**命令用来显示一个或者多个 elf 格式的目标文件的信息，可以通过它的选项来控制显示哪些信息。
|
||
|
||
#### 重要参数
|
||
```text
|
||
-h --file-header Display the ELF file header
|
||
-l --program-headers Display the program headers
|
||
-S --section-headers Display the sections' header
|
||
-s --syms Display the symbol table
|
||
```
|
||
|
||
#### 常见用法
|
||
查找库中函数的偏移量，常用于**ret2lib**：
|
||
```text
|
||
readelf -s [path/to/library.so] | grep [function_name]
|
||
```
|
||
|
||
|
||
## <span id="ssdeep">ssdeep</span>
|
||
模糊哈希算法又叫基于内容分割的分片分片哈希算法（context triggered piecewise hashing, CTPH），主要用于文件的相似性比较。
|
||
|
||
#### 重要参数
|
||
```text
|
||
-m - Match FILES against known hashes in file
|
||
-b - Uses only the bare name of files; all path information omitted
|
||
```
|
||
|
||
#### 常见用法
|
||
```text
|
||
ssdeep -b orginal.elf > hash.txt
|
||
ssdeep -bm hash.txt modified.elf
|
||
```
|
||
|
||
|
||
## <span id="strace">strace</span>
|
||
**strace**命令对应用的系统调用和信号传递的跟踪结果进行分析，以达到解决问题或者是了解应用工作过程的目的。
|
||
|
||
#### 重要参数
|
||
```text
|
||
-o file send trace output to FILE instead of stderr
|
||
-c count time, calls, and errors for each syscall and report summary
|
||
-e expr a qualifying expression: option=[!]all or option=[!]val1[,val2]...
|
||
options: trace, abbrev, verbose, raw, signal, read, write, fault
|
||
-p pid trace process with process id PID, may be repeated
|
||
```
|
||
|
||
|
||
## <span id="strings">strings</span>
|
||
**strings**命令在对象文件或二进制文件中查找可打印的字符串。字符串是4个或更多可打印字符的任意序列，以换行符或空字符结束。strings命令对识别随机对象文件很有用。
|
||
|
||
#### 重要参数
|
||
```text
|
||
-a --all Scan the entire file, not just the data section [default]
|
||
-t --radix={o,d,x} Print the location of the string in base 8, 10 or 16
|
||
-e --encoding={s,S,b,l,B,L} Select character size and endianness:
|
||
s = 7-bit, S = 8-bit, {b,l} = 16-bit, {B,L} = 32-bit
|
||
```
|
||
|
||
#### 常见用法
|
||
组合使用 *strings* 和 *grep*。
|
||
|
||
在 **ret2lib** 攻击中，得到字符串的偏移：
|
||
```text
|
||
strings -t x /lib32/libc-2.24.so | grep /bin/sh
|
||
```
|
||
|
||
检查是否使用了 **UPX** 加壳
|
||
```text
|
||
strings [executable] | grep -i upx
|
||
```
|
||
|
||
#### 练习
|
||
[strings_crackme](../source/Reverse/strings_crackme)
|
||
|
||
[flag_pwnablekr](../source/Reverse/flag_pwnablekr)
|
||
|
||
|
||
## <span id="xxd">xxd</span>
|
||
**xxd**的作用就是将一个文件以十六进制的形式显示出来。
|
||
|
||
#### 重要参数：
|
||
```text
|
||
-g number of octets per group in normal output. Default 2 (-e: 4).
|
||
-i output in C include file style.
|
||
-l len stop after <len> octets.
|
||
-u use upper case hex letters.
|
||
```
|
||
|
||
#### 常见用法
|
||
```text
|
||
xxd -g1
|
||
```
|
||
|
||
#### 练习
|
||
[xxd_crackme](../source/Reverse/xxd_crackme) (使用 *strings* 再做一次)
|