fdvoid0's blog

by fdvoid0

Posted on Edited on In , Word count in article: 2.1k Reading time ≈ 8 mins.

为了用sys_execve syscall执行/bin/sh，需要解决一些障碍，根据参考，需要设置寄存器如下;

EAX = 11 (or 0x0B in hex) – The execve syscall number
EBX = Address in memory of the string “/bin/sh”
ECX = Address of a pointer to the string “/bin/sh”
EDX = Null (可选的指向描述环境的结构的指针)

一旦所有这些都设置好了，执行int 0x80指令应该会生成一个shell。

Read more »

Posted on Edited on In , Word count in article: 1.3k Reading time ≈ 5 mins.

基于上个ROP exploit建立的,学习编写ROP chains的另一种方法, 而不是using sys_execve to spawn a shell, 用sys_mprotect关掉NX保护, 并执行shellcode。

Read more »

Posted on Edited on In , Word count in article: 785 Reading time ≈ 3 mins.

详细过程及exp

1. Basic checks:

1
2
3
4
5
6
7
8
9
10
11
┌──(root💀kali)-[~/hackthebox/challenge/pwn/little_tommy]
└─# file little_tommy
little_tommy: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=861838865726f48aa954b8df920d1be3ae683b40, not stripped
┌──(root💀kali)-[~/hackthebox/challenge/pwn/little_tommy]
└─# checksec little_tommy
[*] '/root/hackthebox/challenge/pwn/little_tommy/little_tommy'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)
Read more »