mirror of
https://github.com/nganhkhoa/CTF-All-In-One.git
synced 2024-12-25 11:41:16 +07:00
38 lines
1.2 KiB
Markdown
38 lines
1.2 KiB
Markdown
# 6.1.6 pwn DefconCTF2015 fuckup
|
||
|
||
- [ret2vdso 原理](#ret2vdso-原理)
|
||
- [题目解析](#题目解析)
|
||
- [Exploit](#exploit)
|
||
- [参考资料](#参考资料)
|
||
|
||
|
||
[下载文件](../src/writeup/6.1.6_pwn_defconctf2015_fuckup)
|
||
|
||
## ret2vdso 原理
|
||
在你使用 `ldd` 命令时，通常会显示出 vDSO，如下：
|
||
```
|
||
$ ldd /usr/bin/ls
|
||
linux-vdso.so.1 (0x00007ffff7ffa000)
|
||
libcap.so.2 => /usr/lib/libcap.so.2 (0x00007ffff79b2000)
|
||
libc.so.6 => /usr/lib/libc.so.6 (0x00007ffff75fa000)
|
||
/lib64/ld-linux-x86-64.so.2 => /usr/lib64/ld-linux-x86-64.so.2 (0x00007ffff7dd8000)
|
||
```
|
||
32 位程序则会显示 `linux-gate.so.1`，都是一个意思。
|
||
|
||
|
||
## 题目解析
|
||
```
|
||
$ file fuckup
|
||
fuckup: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
|
||
$ checksec -f fuckup
|
||
RELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILE
|
||
No RELRO No canary found NX enabled No PIE No RPATH No RUNPATH No 0 0 fuckup
|
||
```
|
||
|
||
## Exploit
|
||
完整的 exp 如下：
|
||
|
||
## 参考资料
|
||
- `man vdso`
|
||
- [Return to VDSO using ELF Auxiliary Vectors](http://v0ids3curity.blogspot.in/2014/12/return-to-vdso-using-elf-auxiliary.html)
|