System Hacking (pwnable)/pwnable.TW Write-up 12
[pwnable.tw] bookwriter ( write-up )

Pwnable.tw bookwriter ( 350 pts )Summaryoff by onehouse of orange처음 풀어보는 오렌지 문제였습니다. 오렌지 꿀잼. Analysismain()void __fastcall main(__int64 a1, char **a2, char **a3) { setvbuf(stdout, 0LL, 2, 0LL); puts("Welcome to the BookWriter !"); input_author(); while ( 1 ) { menu(); switch ( read_int() ) { case 1LL: add(); break; case 2LL: view(); break; case 3LL: edit(); break; case 4LL: information(); break;..
System Hacking (pwnable)/pwnable.TW Write-up 2019.10.15

[pwnable.tw] babystack ( write-up )

pwnable.tw babystack ( 250pts )Mitigation[*] '/home/juntae/wargame/pwnable.tw/babystack/babystack' Arch: amd64-64-little RELRO: Full RELRO Stack: Canary found NX: NX enabled PIE: PIE enabled FORTIFY: Enabled매우 빡치게 미티게이션이 다걸려있습니다.여기서 카나리는 __stack_check_fail함수를 사용하기때문에 걸려있습니다.checksec에서는 해당 함수를 사용하면 카나리가 있다고 판단하나봐요. Analysismain()__int64 __fastcall main(__int64 a1, char **a2, char **a3) { _QWORD *..
System Hacking (pwnable)/pwnable.TW Write-up 2019.10.02

[pwnable.tw] seethefile ( write-up )

Pwnable.tw seethefile ( 250 pts )Summary/proc/self/mapsFSOPFake IO_file Analysismain에서는 open / read / write / close / exit 총 5개의 기능을 한다. openfile()int openfile() { int result; // eax ​ if ( fp ) { puts("You need to close the file first"); result = 0; } else { memset(magicbuf, 0, 0x190u); printf("What do you want to see :"); __isoc99_scanf("%63s", filename); if ( strstr(filename, "flag") ) { puts..
System Hacking (pwnable)/pwnable.TW Write-up 2019.09.24
1 2
더보기

티스토리툴바