qq_46441427的博客

Analysis checksec franex@franex-virtual-machine:~/桌面/babyaegis$ checksec aegis [*] '/home/franex/\xe6\xa1\x8c\xe9\x9d\xa2/babyaegis/aegis' Arch: amd64-64-little RELRO: Full RELRO Stack: Canary found NX: NX enabled PIE:

SEARCHING 先看一下ida的main函数 int __cdecl __noreturn main(int argc, const char **argv, const char **envp) { int v3; // [rsp+Ch] [rbp-4h] setbuf(stdin, 0LL); setbuf(stdout, 0LL); setbuf(stderr, 0LL); puts("All my homies hate fufu's."); puts("You can

目录zoom2win zoom2win 检查保护机制 [*] '/home/ubuntu16/Desktop/zoom2win' Arch: amd64-64-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x400000) 在ida里面看函数 int __cdecl main(int argc, const c

sonic checksec一下 发现开了PIE和NX还有relro，这里比赛的时候本来想打ret2csu的。。好像是这个名字。。忘了 程序打印出了main的地址，开PIE后三位不变，所以打印出main地址后直接取除了后三位的其他位，在ida找后三位地址加上就行，然后就可以栈溢出getshell from pwn import * #r=remote('123.60.63.90',6890) r = process('./sonic') context(arch='amd64', os='linux')