qq_33769475的博客

Canary机制的绕过+栈迁移漏洞分析拿到题目检查保护和链接的动态库（题目给的是libc-2.27.so，分析本地的/lib/x86_64-linux-gnu/libc.so.6就行）这题的重点在于Canary保护┌──(root????e267254b2ec9)-[/home/babyrop]└─# checksec babyrop[*] '/home/babyrop/babyrop' Arch: amd64-64-little RELRO: Full RELRO

漏洞分析题目ret2syscall查看保护，开启了NX保护，不能ret2shellcode┌──(root????e267254b2ec9)-[/home/ret2sys]└─# checksec rop [*] '/home/ret2sys/rop' Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE:

分析题目下载查看保护，ret2shellcode类型的题是没有NX保护的┌──(root????e267254b2ec9)-[/home/pwn]└─# checksec shellcode [*] '/home/pwn/shellcode' Arch: amd64-64-little RELRO: Partial RELRO Stack: No canary found NX: NX disabled PIE: P