详细过程及exp

1. Basic checks:

1
2
3
4
5
6
7
8
9
10
11
┌──(root💀kali)-[~/hackthebox/challenge/pwn/little_tommy]
└─# file little_tommy
little_tommy: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=861838865726f48aa954b8df920d1be3ae683b40, not stripped
┌──(root💀kali)-[~/hackthebox/challenge/pwn/little_tommy]
└─# checksec little_tommy
[*] '/root/hackthebox/challenge/pwn/little_tommy/little_tommy'
Arch: i386-32-little
RELRO: Partial RELRO
Stack: No canary found
NX: NX enabled
PIE: No PIE (0x8048000)
Read more »

详细过程及exp

1. Basic checks:

1
2
3
4
5
6
7
8
9
10
11
12
┌──(root💀kali)-[~/hackthebox/challenge/pwn/space]
└─# file space
space: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=90e5767272e16e26e1980cb78be61437b3d63e12, not stripped
┌──(root💀kali)-[~/hackthebox/challenge/pwn/space]
└─# checksec space
[*] '/root/hackthebox/challenge/pwn/space/space'
Arch: i386-32-little
RELRO: No RELRO
Stack: No canary found
NX: NX disabled
PIE: No PIE (0x8048000)
RWX: Has RWX segments
Read more »

LINUX PWN 技巧总结

这是目前使用的方法,用于在Linux操作系统上进行二进制攻击。

  • 它被写得像小抄一样,这样既简洁又不会太长。
  • 该方法正在用于手工pwn exploit编写开发,没有像AFL等工具的描述。
  • 会不时更新这篇文章,添加新的注释。
Read more »