2016-01-27

frame-faking-介绍-函数调用伪造

0x00 frame-faking

在处理fusion的level02时遇到新的问题，需要了解frame-faking的原理，查阅了一些资料。

The advanced return-into-lib(c) exploits

Advanced Exploit Techique之–frame faking技术

ROP轻松谈

首先感谢各位前辈写的文章。

Frame Faking是一种栈溢出的技巧，使用framefaking可以通过控制ebp修改程序的运行流程，可以用来对抗DEP。

2015-12-14

protostar详细解析 heap3-通过heap3理解堆腐坏的原理及利用方法

1 源码

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <stdio.h>

void winner()
{
  printf("that wasn't too bad now, was it? @ %d\n", time(NULL));
}

int main(int argc, char **argv)
{
  char *a, *b, *c;

  a = malloc(32);
  b = malloc(32);
  c = malloc(32);

  strcpy(a, argv[1]);
  strcpy(b, argv[2]);
  strcpy(c, argv[3]);

  free(c);
  free(b);
  free(a);

  printf("dynamite failed?\n");
}

2015-12-12

图解DWORDSHOOT

在解决protostar heap3之前需要学习一些新的堆溢出的知识，其中之一就是DWORDSHOOT。

1 简介

DWORD SHOOT是发生在一种发生在双向链表删除节点的时会发生的情况。他有可能导致任意地址被改写。

2015-12-09

protostar详细解析 heap2 解答

1源码

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <stdio.h>

struct auth {
  char name[32];
  int auth;
};

struct auth *auth;
char *service;

int main(int argc, char **argv)
{
  char line[128];

  while(1) {
      printf("[ auth = %p, service = %p ]\n", auth, service);

      if(fgets(line, sizeof(line), stdin) == NULL) break;
      
      if(strncmp(line, "auth ", 5) == 0) {
          auth = malloc(sizeof(auth));
          memset(auth, 0, sizeof(auth));
          if(strlen(line + 5) < 31) {
              strcpy(auth->name, line + 5);
          }
      }
      if(strncmp(line, "reset", 5) == 0) {
          free(auth);
      }
      if(strncmp(line, "service", 6) == 0) {
          service = strdup(line + 7);
      }
      if(strncmp(line, "login", 5) == 0) {
          if(auth->auth) {
              printf("you have logged in already!\n");
          } else {
              printf("please enter your password\n");
          }
      }
  }
}

2015-12-09

protostar详细解析 heap1 解答

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <sys/types.h>

struct internet {
  int priority;
  char *name;
};

void winner()
{
  printf("and we have a winner @ %d\n", time(NULL));
}

int main(int argc, char **argv)
{
  struct internet *i1, *i2, *i3;

  i1 = malloc(sizeof(struct internet));
  i1->priority = 1;
  i1->name = malloc(8);

  i2 = malloc(sizeof(struct internet));
  i2->priority = 2;
  i2->name = malloc(8);

  strcpy(i1->name, argv[1]);
  strcpy(i2->name, argv[2]);

  printf("and that's a wrap folks!\n");
}