<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[SuperGate的博客]]></title><description><![CDATA[烫烫烫烫烫烫]]></description><link>https://blog.youkuaiyun.com/getsum</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; getsum]]></copyright><item><title><![CDATA[CTF-PWN-babydriver (linux kernel pwn+UAF)]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/104516106</link><guid>https://blog.youkuaiyun.com/getsum/article/details/104516106</guid><author>getsum</author><pubDate>Wed, 26 Feb 2020 18:39:09 +0800</pubDate><description><![CDATA[第一次接触linux kernal pwn，和传统的pwn题区别较大，需要比较多的前置知识，以及这种题的环境搭建、运行和调试相关的知识。
文章目录Linux内核及内核模块Linux内核(Kernal)内核模块(LKM)iocltstruct credSLUB&amp;SLAB内核态函数题目分析程序概述漏洞分析exp内核调试相关

Linux内核及内核模块
Linux内核(Kernal)
这里只对内...]]></description><category></category></item><item><title><![CDATA[CTF-PWN-house-of-orange (unsortedbin attack+IO_FILE文件结构利用)]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/104448441</link><guid>https://blog.youkuaiyun.com/getsum/article/details/104448441</guid><author>getsum</author><pubDate>Sat, 22 Feb 2020 19:41:24 +0800</pubDate><description><![CDATA[程序综述
[*] '/home/supergate/Desktop/Pwn/houseoforange'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
    FORTIFY:  ...]]></description><category></category></item><item><title><![CDATA[CTF-PWN-play (条件竞争，多进程共享同一数据文件)]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/104343017</link><guid>https://blog.youkuaiyun.com/getsum/article/details/104343017</guid><author>getsum</author><pubDate>Sun, 16 Feb 2020 15:32:28 +0800</pubDate><description><![CDATA[程序概述
[*] '/home/supergate/Desktop/Pwn/pwn'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)

只打开了NX保护，这为...]]></description><category></category></item><item><title><![CDATA[CTF-PWN-magic （FILE结构体攻击）]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/104105969</link><guid>https://blog.youkuaiyun.com/getsum/article/details/104105969</guid><author>getsum</author><pubDate>Wed, 29 Jan 2020 19:16:44 +0800</pubDate><description><![CDATA[程序综述
checksec 查看程序保护
supergate@ubuntu:~/Desktop/Pwn$ checksec pwn
[*] '/home/supergate/Desktop/Pwn/pwn'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:    ...]]></description><category></category></item><item><title><![CDATA[CTF-PWN-HouseOfGrey（栈溢出+maps泄露地址+mem泄露内存）]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/104096038</link><guid>https://blog.youkuaiyun.com/getsum/article/details/104096038</guid><author>getsum</author><pubDate>Mon, 27 Jan 2020 23:38:01 +0800</pubDate><description><![CDATA[程序概述
[*] '/home/supergate/Desktop/Pwn/pwn'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled

查看程序保护后发现保护全开
supergate...]]></description><category></category></item><item><title><![CDATA[CTF-Pwn echo_back(文件IO指针利用+格式化字符串漏洞)]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/103616163</link><guid>https://blog.youkuaiyun.com/getsum/article/details/103616163</guid><author>getsum</author><pubDate>Thu, 19 Dec 2019 16:57:46 +0800</pubDate><description><![CDATA[程序综述
supergate@ubuntu:~/Desktop/Pwn$ checksec echo_back
[*] '/home/supergate/Desktop/Pwn/echo_back'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX e...]]></description><category></category></item><item><title><![CDATA[CTF-PWN-heap (off-by-one+unlink+malloc_hook利用)]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/103355246</link><guid>https://blog.youkuaiyun.com/getsum/article/details/103355246</guid><author>getsum</author><pubDate>Mon, 02 Dec 2019 19:41:12 +0800</pubDate><description><![CDATA[程序综述
[*] '/home/supergate/Desktop/Pwn/pwn1'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled

保护全开。
IDA查看后发现是一个菜单题，主...]]></description><category></category></item><item><title><![CDATA[CTF-PWN Noleak (unsortedbin attack+fastbin attack+malloc_hook)]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/103244661</link><guid>https://blog.youkuaiyun.com/getsum/article/details/103244661</guid><author>getsum</author><pubDate>Mon, 25 Nov 2019 21:19:44 +0800</pubDate><description><![CDATA[漏洞简述
[*] '/home/supergate/Desktop/Pwn/timu'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX disabled
    PIE:      No PIE (0x400000)
    RWX:      Ha...]]></description><category></category></item><item><title><![CDATA[CTF-PWN-note-service2 (堆中shellcode执行)]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/103128511</link><guid>https://blog.youkuaiyun.com/getsum/article/details/103128511</guid><author>getsum</author><pubDate>Mon, 18 Nov 2019 19:55:32 +0800</pubDate><description><![CDATA[checksec
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX disabled
    PIE:      PIE enabled
    RWX:      Has RWX segments

发现没有开启NX，因此很有可能是要我们将sh...]]></description><category></category></item><item><title><![CDATA[CTF-PWN100levels(vsyscall利用)]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/102827841</link><guid>https://blog.youkuaiyun.com/getsum/article/details/102827841</guid><author>getsum</author><pubDate>Wed, 30 Oct 2019 22:06:29 +0800</pubDate><description><![CDATA[程序流程&amp;漏洞分析
checksec:
supergate@ubuntu:~/Desktop/Pwn$ checksec pwn
[*] '/home/supergate/Desktop/Pwn/pwn'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    N...]]></description><category></category></item><item><title><![CDATA[CTF-PWN-4-ReeHY-main-100（堆溢出+double free+unlink）]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/102451891</link><guid>https://blog.youkuaiyun.com/getsum/article/details/102451891</guid><author>getsum</author><pubDate>Wed, 09 Oct 2019 09:52:33 +0800</pubDate><description><![CDATA[程序综述
题目包含了一个动态库.so文件和elf文件，checksec查看：
supergate@ubuntu:~/Desktop/Pwn$ checksec pwn
[*] '/home/supergate/Desktop/Pwn/pwn'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No can...]]></description><category></category></item><item><title><![CDATA[CTF-PWN-pwn100 (ROP+DynELF定位system函数)]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/101277909</link><guid>https://blog.youkuaiyun.com/getsum/article/details/101277909</guid><author>getsum</author><pubDate>Tue, 24 Sep 2019 13:14:20 +0800</pubDate><description><![CDATA[漏洞分析
程序中只开了NX,查看程序逻辑发现：
int sub_40068E()
{
  char buf; // [rsp+0h] [rbp-40h]

  sub_40063D((__int64)&amp;buf, 200);
  return puts("bye~");
}

使用sub_40063D函数向buf中读取200个字符，显然存在栈溢出。接下来我们要思考如何利用这个漏洞。
观察到程...]]></description><category></category></item><item><title><![CDATA[CTF-RE-cello_rule (lib库函数的分析)]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/100709693</link><guid>https://blog.youkuaiyun.com/getsum/article/details/100709693</guid><author>getsum</author><pubDate>Tue, 10 Sep 2019 20:16:25 +0800</pubDate><description><![CDATA[题目概述
题目给出了一个linux下的可执行程序和一个加密过的flag.png。可以知道程序是对这个文件进行加密，然后输出加密后的文件。因此我们的思路就是逆向程序的加密方式和逻辑，从而逆推出flag.enc的源文件。
具体分析
由于我们不清楚程序真正逻辑的入口点，因此第一步是ida查看程序的可以字符串。

这些字符串显然是值得我们去研究的，在google上面可以查到这些字符串的信息。发现这些字符串...]]></description><category></category></item><item><title><![CDATA[CTF-RE-tar_tar_binks]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/100097109</link><guid>https://blog.youkuaiyun.com/getsum/article/details/100097109</guid><author>getsum</author><pubDate>Tue, 27 Aug 2019 12:12:12 +0800</pubDate><description><![CDATA[题目给出了两个文件，一个是已经损坏的.tar文件，一个是.dylib的动态链接库
首先尝试解压.tar压缩包
supergate@ubuntu:~/Desktop/task1$ tar -xf flag.tar
tar: This does not look like a tar archive
tar: Skipping to next header
tar: Exiting with fail...]]></description><category></category></item><item><title><![CDATA[CTF-PWN-pivot32 （ROP+plt+GOT+栈帧转移）]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/99882551</link><guid>https://blog.youkuaiyun.com/getsum/article/details/99882551</guid><author>getsum</author><pubDate>Tue, 20 Aug 2019 21:06:23 +0800</pubDate><description><![CDATA[程序概述
首先本程序是一个32位程序，checksec后观察发现只开启了NX。
由于题目中使用了libpivot.so动态链接库，并且重要的得到flag的函数也在libpivot.so函数中，因此考虑用plt和got的映射关系，然后根据函数在.so文件中的偏移来找到cat_flag函数的地址，从而栈溢出控制程序流程。
有一个小问题在于题目中给的栈溢出的缓冲区比较小，很显然无法存下我们所需要的所有R...]]></description><category></category></item><item><title><![CDATA[CTF-PWN-callme32 [ROP+栈溢出]]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/99436556</link><guid>https://blog.youkuaiyun.com/getsum/article/details/99436556</guid><author>getsum</author><pubDate>Tue, 13 Aug 2019 15:07:50 +0800</pubDate><description><![CDATA[首先发现在pwnme函数中有一个明显的缓冲区溢出，长度为40，经调试发现填入44长度的垃圾信息即可填入shellcode

ida发现一个重要函数如下：



点入后发现这三个函数为系统级调用。正好题目给了我们一个.so文件。进入查看，发现有这三个函数的反编译。依次是将加密后的flag通过key1,key2解密。调用顺序应该是callme_one -&gt; callme_two -&gt; c...]]></description><category></category></item><item><title><![CDATA[2019 UESTC ACM Training for Graph[L] (最小割+最大权闭合子图)]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/91845953</link><guid>https://blog.youkuaiyun.com/getsum/article/details/91845953</guid><author>getsum</author><pubDate>Sun, 21 Jul 2019 20:24:57 +0800</pubDate><description><![CDATA[题意：有一些物品，一些集合，买每个物品需要一定 的费用，每个集合包含一些物品，如果集合内物品都被 买了，就会得到一定价值，求能得到的最大价值。

首先本题的模型是最大权闭合子图，而且是裸的……
问题一般情况：选择某个东西可以得到一定收益，但选了它就必须选择它的一些后继，而不同物品可能有一些相同后继，求能选到的最大收益。
这种类型的题大多都可以用这个模型做。
先对所有的电视频道的点向t连边，容量为...]]></description><category></category></item><item><title><![CDATA[CTF-RE baleful （pin打桩+虚拟机+upx脱壳）]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/96755058</link><guid>https://blog.youkuaiyun.com/getsum/article/details/96755058</guid><author>getsum</author><pubDate>Sun, 21 Jul 2019 20:16:15 +0800</pubDate><description><![CDATA[本文部分借鉴文章：https://firmianay.gitbooks.io/ctf-all-in-one/src/writeup/6.2.5_re_picoctf2014_baleful#%E5%8F%82%E8%80%83%E8%B5%84%E6%96%99

首先查看文件信息


supergate@ubuntu:~/Desktop/task1$ file baleful
baleful: ...]]></description><category></category></item><item><title><![CDATA[CTF-RE dont_panic （pin二进制打桩暴力）]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/95787002</link><guid>https://blog.youkuaiyun.com/getsum/article/details/95787002</guid><author>getsum</author><pubDate>Sat, 13 Jul 2019 20:47:42 +0800</pubDate><description><![CDATA[部分参考题解：http://eternal.red/2017/dont_panic-writeup/

方便起见，题目文件名改成go

运行题目程序，发现flag是跟在命令行参数之后的。用IDA打开后发现没有找到main函数，因此选择在Linux下查看段信息：


supergate@ubuntu:~/Desktop/task1$ readelf -S go

得到信息如下：


Section ...]]></description><category></category></item><item><title><![CDATA[2019 UESTC ACM Training for Graph[O] (最优比例生成树)]]></title><link>https://blog.youkuaiyun.com/getsum/article/details/91846316</link><guid>https://blog.youkuaiyun.com/getsum/article/details/91846316</guid><author>getsum</author><pubDate>Thu, 13 Jun 2019 13:38:01 +0800</pubDate><description><![CDATA[题意：空间中内有n个点，连n-1条边，使得这些边 的高度差之和比上水平距离之和最小。 

最优比例生成树问题
对于一个最小生成树，可以表达为如下形式：
x1 * a1+x2 * a2+…+xm * am
其中x1 ~ xm要么为1要么为0，并且xi的和为n-1。ai是编号为i的边的权值，并且选择的点要使得图联通。
那么对于题中的问题，取一个生成树满足sum{xi * hi}/sum{xi * di...]]></description><category></category></item></channel></rss>