Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Binary Exploitation - Basic 補充篇

Avatar for LJP-TW LJP-TW
May 26, 2021
Technology
72
1

Binary Exploitation - Basic 補充篇

2021/05/26 台科資安社 社課
直播記錄檔: https://www.youtube.com/watch?v=I3X69ADZOnw
- TLS

Avatar for LJP-TW

LJP-TW

May 26, 2021

More Decks by LJP-TW

See All by LJP-TW
Reverse Engineering - 1
Avatar for LJP-TW ljptw
0
1.9k
Reverse Engineering - 2
Avatar for LJP-TW ljptw
0
830
Reverse Engineering - 3
Avatar for LJP-TW ljptw
0
680
Re:0 從零開始的逆向工程
Avatar for LJP-TW ljptw
1
1.3k
Linux 極入門篇
Avatar for LJP-TW ljptw
1
340
Fuzzing 101
Avatar for LJP-TW ljptw
1
270
Binary Exploitation - File Structure
Avatar for LJP-TW ljptw
1
370
Binary Exploitation - Heap
Avatar for LJP-TW ljptw
1
220
Binary Exploitation - Basic
Avatar for LJP-TW ljptw
1
180

Other Decks in Technology

See All in Technology
AIは推し活である。
Avatar for くらず / Kurazu kurazuuuuuu
1
970
AWS FinOps Agent 結局何が得意なの？
Avatar for Siromi siromi
0
160
Von-Neumann Machines, Dreams & The Futures of IT
Avatar for Uwe Friedrichsen ufried
0
130
[Kiro Meetup #7] Kiro Crew Dive Deep
Avatar for Kyosuke Konishi konippi
0
320
Oracle Cloud Infrastructure(OCI)：Onboarding Session(はじめてのOCI/Oracle Supportご利⽤ガイド)
Avatar for oracle4engineer oracle4engineer
PRO
2
20k
10年欲しかった音楽管理アプリを、AIと一緒に作りはじめた
Avatar for log5 judau
1
110
人間はどの意思決定を手放せるのか
Avatar for Yoshitaka Kawashima kawasima
16
8.2k
Oracle Base Database Service 技術詳細
Avatar for oracle4engineer oracle4engineer
PRO
16
120k
AIに書かせて、プラットフォームで縛る ― EKSプラットフォームで実践した責任境界と権限設計
Avatar for elmo elmodev09
0
430
Harness Engineering on Rails
Avatar for Joël Quenneville joelq
0
490
The Knowledge Spine: A Machine-Executable Ontology for Governed Marketing Activation
Avatar for Ananth Packkildurai vananth22
0
130
Claude Codeを「使うほど育つ」AI秘書にするノウハウ
Avatar for みのるん minorun365
PRO
33
32k

Featured

See All Featured
Principles of Awesome APIs and How to Build Them.
Avatar for Keavy McMinn keavy
128
18k
Exploring anti-patterns in Rails
Avatar for Elle Meredith aemeredith
4
510
The World Runs on Bad Software
Avatar for Brandon Keepers bkeepers
PRO
72
12k
Docker and Python
Avatar for Tania Allard trallard
47
4.2k
Lightning talk: Run Django tests with GitHub Actions
Avatar for Sarah Abderemane sabderemane
0
260
エンジニアに許された特別な時間の終わり
Avatar for watany watany
109
250k
Making Projects Easy
Avatar for Brett Harned brettharned
120
6.8k
Chasing Engaging Ingredients in Design
Avatar for Sebastian Deterding codingconduct
0
340
WCS-LA-2024
Avatar for Leonardo Collado-Torres lcolladotor
0
830
Applied NLP in the Age of Generative AI
Avatar for Ines Montani inesmontani
PRO
4
2.5k
The B2B funnel & how to create a winning content strategy
Avatar for Katarina Dahlin katarinadahlin
PRO
1
540
The Art of Programming - Codeland 2020
Avatar for Erika Heidi erikaheidi
57
14k

Transcript

  1. 2021/5/26 NTUSTISC Binary Exploitation aka Pwn Basic 補充篇

  2. # whoami - LJP / LJP-TW - Pwn / Rev

    - NTUST / NCTU / NYCU - 10sec CTF Team 1

  3. Outline - TLS 2

  4. TLS 3

  5. TLS - TLS 全名 Thread-Local Storage - Linux x64 使用

    fs 暫存器記著 TLS 的位置 - Stack Canary 就是存在 TLS 中 4

  6. TLS - fs 為 Segment Register - 計算方式 reg:offset =

    ref + offset - 這時候你用 gdb 想看一下 fs 等於多少卻發現 - 難道 Canary 從 [0+0x28] 拿來的?? 5

  7. TLS - GDB 也是 Process, fs = 0 是指 GDB

    自己的 fs - 所以要怎麼拿到觀測中的 Process 的 fs? - 呼叫 arch_prctl 6 Ref: https://fasterthanli.me/series/making-our-own-executable-packer/part-13

  8. TLS - Pwngdb 有實作取得 TLS 的功能 - 閱讀一下怎麼實作的, 發現其實一樣 -

    https://github.com/scwuaptx/Pwngdb/blob/master/pwndbg/pwngdb.py#L77 7

  9. TLS Demo 8