<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[Maxmalloc的博客]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/Maxmalloc</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; Maxmalloc]]></copyright><item><title><![CDATA[shell脚本集合及学习笔记]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/103322384</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/103322384</guid><author>Maxmalloc</author><pubDate>Sat, 30 Nov 2019 11:28:26 +0800</pubDate><description><![CDATA[1.向指定类型的文件插入特定行
问题由来
/usr/bin/ld: /tmp/ccwmoa0L.o: in function `do_chrdev':
/home/hu/firmware-mod-kit/src/uncramfs/uncramfs.c:324: undefined reference to `minor'
/usr/bin/ld: /home/hu/firmware-mod-kit...]]></description><category></category></item><item><title><![CDATA[dll注入原理分析]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/102594173</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/102594173</guid><author>Maxmalloc</author><pubDate>Mon, 21 Oct 2019 21:10:51 +0800</pubDate><description><![CDATA[获取目标进程的pid
获取目标进程的句柄
向目标进程写入注入dll的路径字符串
建立远程线程
// zhuru1.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//

#include "pch.h"
#include &lt;iostream&gt;
#include &lt;stdio.h&gt; 
#include &lt;Windows.h&gt; 
#incl...]]></description><category></category></item><item><title><![CDATA[pwn题中 setbuf的用处]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/102556335</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/102556335</guid><author>Maxmalloc</author><pubDate>Mon, 14 Oct 2019 20:50:59 +0800</pubDate><description><![CDATA[在我们遇到的每一个需要输入输出的pwn题中一般都会有下面这几条语句
  setvbuf(stdin, 0LL, 2, 0LL);
  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stderr, 0LL, 2, 0LL);

直到今天才彻底搞明白这三句话的作用。
因为我们搭建pwn题一般都是用socat进行端口转发，pwn题搭建详情
但是socat不是一次写一行而...]]></description><category></category></item><item><title><![CDATA[onegadget不起作用]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/102535427</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/102535427</guid><author>Maxmalloc</author><pubDate>Sun, 13 Oct 2019 18:32:29 +0800</pubDate><description><![CDATA[one_gadget的执行是需要一些条件的
0x45216 execve("/bin/sh", rsp+0x30, environ)
constraints:
  rax == NULL

0x4526a execve("/bin/sh", rsp+0x30, environ)
constraints:
  [rsp+0x30] == NULL

0xf02a4 execve("/bin/sh",...]]></description><category></category></item><item><title><![CDATA[esp8266 deauther]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/102508866</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/102508866</guid><author>Maxmalloc</author><pubDate>Fri, 11 Oct 2019 19:54:47 +0800</pubDate><description><![CDATA[找到官方已经编译好的固件https://github.com/spacehuhn/esp8266_deauther/releases
用esp8266download tool烧录进去

按下rst按钮让其重启。
连接ssid为pwned的ap。默认密码是deauther。

登录192.168.4.1

点击我已阅读并明白上述注意事项
如果是英文界面，则点击设置，然后再LANG那栏填写cn

然...]]></description><category></category></item><item><title><![CDATA[ettercap 图形界面遇无线网卡报错]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/102508794</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/102508794</guid><author>Maxmalloc</author><pubDate>Fri, 11 Oct 2019 19:39:05 +0800</pubDate><description><![CDATA[ettercap 0.8.2 copyright 2001-2015 Ettercap Development Team

ERROR : 9, 错误的文件描述符
[/build/ettercap-W54WVV/ettercap-0.8.2/src/ec_network.c:source_init:245]

 libnet_init: unknown physical layer type 0...]]></description><category></category></item><item><title><![CDATA[sql注入学习（入门）]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/102291846</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/102291846</guid><author>Maxmalloc</author><pubDate>Mon, 07 Oct 2019 11:01:19 +0800</pubDate><description><![CDATA[主要借助sqllibs 学习了一下sql注入的大致原理。
sql大致流程都是这样（没试过盲注）
爆库名(通常不需要知道，可以直接调用database()函数)，爆表名，爆列名，最后爆数据
所以按照步骤来写sql语句：
爆表名
select group_concat(table_name)
from information_schema.tables
where table_schema=datab...]]></description><category></category></item><item><title><![CDATA[ctf - Dijkstra]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/101775908</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/101775908</guid><author>Maxmalloc</author><pubDate>Mon, 30 Sep 2019 15:47:22 +0800</pubDate><description><![CDATA[在进行数据处理的时候，学习了多维字典增加元素的方法。
对https://www.jb51.net/article/130370.htm 的算法做了一些修改。
# coding:utf-8
source='''
1 2 100 FLAG{
2 3 87 AFQWE
2 4 57 ETKLS
2 5 50 WEIVK
2 6 51 AWEIW
3 7 94 QIECJF
3 8 78 QSXKE
3 ...]]></description><category></category></item><item><title><![CDATA[re 入门]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/100805022</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/100805022</guid><author>Maxmalloc</author><pubDate>Sat, 14 Sep 2019 08:40:47 +0800</pubDate><description><![CDATA[总述
逆向一般都是先运行，了解程序大致功能，然后
不同的程序只有在相应的环境下才能运行
题目与工具链接：https://pan.baidu.com/s/1gdX74ko3d6HHt3uMWyrVoQ
提取码：q9hh
andriod
安卓虚拟机下载https://www.yeshen.com/
安装jeb
1、将apk文件先放到虚拟机里面跑一下
安装相应的apk文件

运行apk

大致可以推测出...]]></description><category></category></item><item><title><![CDATA[De1CTF Weapon(IO_2_1_stdout)]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/98492570</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/98492570</guid><author>Maxmalloc</author><pubDate>Mon, 05 Aug 2019 16:41:51 +0800</pubDate><description><![CDATA[1.保护机制
    [*] '/home/yzl/Documents/delta/weapon/pwn'
        Arch:     amd64-64-little
        RELRO:    Full RELRO
        Stack:    Canary found
        NX:       NX enabled
        PIE:      PIE e...]]></description><category></category></item><item><title><![CDATA[2015 plaidctf datastore(off by one)]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/98438303</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/98438303</guid><author>Maxmalloc</author><pubDate>Sun, 04 Aug 2019 09:29:05 +0800</pubDate><description><![CDATA[1、检查
[*] '/home/yzl/Documents/off_by_one/datastore'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
    FORTIFY:  E...]]></description><category></category></item><item><title><![CDATA[flagen]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/88369423</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/88369423</guid><author>Maxmalloc</author><pubDate>Sat, 09 Mar 2019 18:09:57 +0800</pubDate><description><![CDATA[题目
提取码：g36p
ida静态分析
找到sub_80488C6（）函数中存在一个漏洞点。
      case 0x48:
      case 0x68:
        v4 = v15;
        v5 = v15 + 1;
        *v4 = 0x31;
        *v5 = 0x2D;
        v6 = v5 + 1;
        v15 = v5 +...]]></description><category></category></item><item><title><![CDATA[pwn准备]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/87884064</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/87884064</guid><author>Maxmalloc</author><pubDate>Fri, 22 Feb 2019 18:57:13 +0800</pubDate><description><![CDATA[IDA
静态调试神器
https://pan.baidu.com/s/17cN_utKmAb-iVvH9L7ROow
提取码：3hl3
VMware work
虚拟机
https://pan.baidu.com/s/1tzW2qr3ZQRyPaI7mRom2pA
提取码：e872
ubuntu16.04 ios
https://pan.baidu.com/s/1P_TPVTIj2aTz63yKke...]]></description><category></category></item><item><title><![CDATA[任务5]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/87341971</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/87341971</guid><author>Maxmalloc</author><pubDate>Fri, 15 Feb 2019 09:41:14 +0800</pubDate><description><![CDATA[说一下思路
1.泄露libc，得到system
2.将/bin/sh写入bss
3.将system写入read的got表里
4.执行read
from pwn import *
from LibcSearcher import *

context.log_level='debug'
context.terminal=['gnome-terminal','-x','sh','-c']
p=proc...]]></description><category></category></item><item><title><![CDATA[2018-骇极杯]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/87180442</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/87180442</guid><author>Maxmalloc</author><pubDate>Wed, 13 Feb 2019 14:28:12 +0800</pubDate><description><![CDATA[arm
第一次做arm，花了很多时间，希望整理的详细一点。
环境安装
首先需要安装qemu，和相应的依赖库
qemu
sudo apt-get install qemu

依赖库
sudo apt-get install -y gcc-aarch64-linux-gun g++-aarch64-linux-gnu

合在一起安装不了的话就分开来安装
运行
qemu-aarch64 -g 1234 ...]]></description><category></category></item><item><title><![CDATA[ret2syscall]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/86773932</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/86773932</guid><author>Maxmalloc</author><pubDate>Fri, 08 Feb 2019 08:54:14 +0800</pubDate><description><![CDATA[xx@ubuntu:~/Documents/rop$ file pwn 
pwn: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=fca490f050dc...]]></description><category></category></item><item><title><![CDATA[2018护网杯pwn]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/86417715</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/86417715</guid><author>Maxmalloc</author><pubDate>Mon, 14 Jan 2019 19:25:15 +0800</pubDate><description><![CDATA[





]]></description><category></category></item><item><title><![CDATA[gdb 调试 PIE程序]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/86037537</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/86037537</guid><author>Maxmalloc</author><pubDate>Tue, 08 Jan 2019 00:02:14 +0800</pubDate><description><![CDATA[方法1
可以安装gdb的pwndbg插件
使用
b *$rebase(0x相对基址偏移)

方法二
可以先找到pie
$ ps -aux|grep task_shoppingCart
hu         6158  0.0  0.0   4356   632 pts/18   S+   07:50   0:00 ./task_shoppingCart
hu         6162  0.0  ...]]></description><category></category></item><item><title><![CDATA[hitcon lab1-lab14]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/85109592</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/85109592</guid><author>Maxmalloc</author><pubDate>Sun, 23 Dec 2018 11:44:59 +0800</pubDate><description><![CDATA[lab 1
ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=0840aeca8337fc97ba1134067d05ee2563b3f4ce, not st...]]></description><category></category></item><item><title><![CDATA[2018 -12月份 安恒月赛 pwn]]></title><link>https://blog.youkuaiyun.com/Maxmalloc/article/details/85218784</link><guid>https://blog.youkuaiyun.com/Maxmalloc/article/details/85218784</guid><author>Maxmalloc</author><pubDate>Sun, 23 Dec 2018 11:44:12 +0800</pubDate><description><![CDATA[Messageb0x
$ file messageb0x 
messageb0x: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=d932d2afbca74...]]></description><category></category></item></channel></rss>