*** stack smashing detected ***: terminated readme.bin PC:~/ Desktop$ python - c ' print "A"* 536+ "\n"'|./readme.bin readme.bin PC:~/ Desktop$ python - c ' print "A"* 535+ "\n"'|./readme.bin Please overwrite the flag: Thank you, bye! Hello! What's your name? Nice to meet you, AAAAAAAA. Try to find _libc_argv The location of PC:~/ Desktop$ python - c ' print "A"* 0x128+ "\n"'|./readme.bin There are two inputs in the program, And you can find _IO_gets(&v3) There is an obvious stack overflow at.
Please overwrite the flag: aaa Thank you, bye! ~/Desktop$ checksec readme.bin '/home/pwn/Desktop/readme.bin' Arch: amd64-64-little RELRO: No RELRO Stack: Canary found NX: NX enabled PIE: No PIE (0x400000) FORTIFY: Enabled readme.bin Hello! What's your name? aaa Nice to meet you, aaa. Let's see in detail canary Where is the ？ How to form ？ And how to use it ？ Take a small example ： # include void main ( int argc, char **argv) ~/Desktop$. canary The position is higher than the local variable, lower than ESP, In the middle of it, So when we do overflow attacks, Will be covered canary Value, This leads to the end of the program. stay brop It's also mentioned in, Bypass by blasting canary Protect, because canary The value of is different every time the program runs, So it takes certain conditions ：fork The subprocess of does not change, It's hard to come across in the title, So we can use it stack smash The way to leak content.
Stack protection based on error reporting classĬanary This value is called canary (“canary”) value, It means that the miners used canaries to confirm whether there was a gas leak, If the canary is poisoned by a gas leak, It can warn miners.
0 kommentar(er)
