Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Pwn勉強会
Search
m412u
November 27, 2018
Programming
8
11k
Pwn勉強会
・学内で開催したPwn入門勉強会で使用したスライドです。
m412u
November 27, 2018
Tweet
Share
More Decks by m412u
See All by m412u
slide.pdf
m412u
5
2.7k
学内Pwn勉強会
m412u
4
4.6k
Other Decks in Programming
See All in Programming
競技プログラミングへのお誘い@阪大BOOSTセミナー
kotamanegi
0
350
Discord Bot with AI -for English learners-
xin9le
1
120
テストコード文化を0から作り、変化し続けた組織
kazatohiei
2
1.5k
似たもの同士のPerlとPHP
uzulla
1
130
SymfonyCon Vienna 2025: Twig, still relevant in 2025?
fabpot
3
1.2k
The Efficiency Paradox and How to Save Yourself and the World
hollycummins
1
440
KMP와 kotlinx.rpc로 서버와 클라이언트 동기화
kwakeuijin
0
130
CSC305 Lecture 26
javiergs
PRO
0
140
プロダクトの品質に コミットする / Commit to Product Quality
pekepek
2
760
N.E.X.T LEVEL
pluu
2
300
Webエンジニア主体のモバイルチームの 生産性を高く保つためにやったこと
igreenwood
0
330
Jakarta EE meets AI
ivargrimstad
0
230
Featured
See All Featured
Building Your Own Lightsaber
phodgson
103
6.1k
Mobile First: as difficult as doing things right
swwweet
222
9k
Building Applications with DynamoDB
mza
91
6.1k
Principles of Awesome APIs and How to Build Them.
keavy
126
17k
Visualization
eitanlees
146
15k
Large-scale JavaScript Application Architecture
addyosmani
510
110k
CSS Pre-Processors: Stylus, Less & Sass
bermonpainter
356
29k
Helping Users Find Their Own Way: Creating Modern Search Experiences
danielanewman
29
2.3k
A designer walks into a library…
pauljervisheath
204
24k
Rails Girls Zürich Keynote
gr2m
94
13k
Distributed Sagas: A Protocol for Coordinating Microservices
caitiem20
330
21k
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
eileencodes
17
2.2k
Transcript
• 2 2 2 •
• P • 1 1 3 • • F
C 3 E C T
• ( ) ) 4 • 4 )
6 . .
. . 7
8 . .
9 .
0 . 1 0
• fi 2 n g l l h
b3a 1 • ( ./. h 2 • ) • a
• bCFE • iah • T h
• ce L • • • iaf • /0 S ) ( 8 0 2 81 1 . 2 1:
• 8 • 3 1 6 •
4 1
• PU U C U • ( () •
1 PU U • • C C 5
6 1
• s p C • e • c 36
36 ( 2.7 207 217 2 7 254 2 4 253 213 a 9 i8d b 7) P U 4
) ( • CDE • ) • ) S •
)( G E P • ) D • ) G Eeb eb • )( G Eeb eb • ) X DEFBI L D • ) X DEFBI L D • A E • ) 8 D • ) CDE • ) i ) 134 1 42
• 8 57 • 4 1 32 Ø 06
57 • 9 • Ø 06 57 • 9 •
• 2 0 • 2
• 21 • mov eax, 0x0 mov DWORD
PTR [ebp-0x10], eax
( ) • A • 2 A cmp eax, 0x1
cmp DWORD PTR [ebp-0x10], eax
) ( • 3 C 3 2 • jmp 0x08048574
je 0x08048574
( , ) • ))) 4 • ))) 2 4
2 2 ( call printf@plt ret
, ( ) , • • add
eax, edx sub eax, edx
(( ) • lea
ecx, [esp+0x4] lea eax, [ebp-0x18]
( () ( • s • n O P e
• \ • O N 7 d s 7 7 2 • l 79 20 •
( ) • c b 2 • 82 • •
a • a • b c • a
• B : • B P 9 • 12
12 2 • I SL 9 : O • B FH : : EH • B FH : U: EH
•
• U 4 • 1 C 7
4 • I • +
• ) 2 .8 (( 4 2 1
3 ) $ git clone https://github.com/m412u/pwn_study.git $ cd pwn_study/sample
• 9) 4 ( •
• •
$ objdump –d –M intel func
) ( : 5 : 5 : 1
• 2 • 1 • $ gdb –q ./func
d g b 5
• 3 52 2 2
• 2 3 52 gdb-peda$ break *0x08048535 or gdb-peda$ b *0x08048535
gdb-peda$ run or gdb-peda$ r
1 . 2 53 .
• 6 1 • •
6 1 • 5 gdb-peda$ nexti or gdb-peda$ ni gdb-peda$ stepi or gdb-peda$ si
+ mov edx, DWORD PTR [ebp-0x14] 5 3 704 704
+ mov eax, DWORD PTR [ebp-0x18] 0 3 4
+ sub esp, 0x8 4 3 0 5
+ push edx 423 0 56
+ 2 2 2 2 2 2 push eax 534
10 6 6
+ 2 2 2 333 2 2 211110 211110 call
0x080484bb <add> AB AB D 4 8 4 8 5C6
22220 888 22220 22220 push ebp EI EI 4653 B
D AC 1 4
22220 22220 22220 mov ebp, esp CD CD 346 8B
A E 1 5
55553 (0 )0 0 0 ) 55553 55553 ) sub
esp, 0x10 I I P A8 C 426 AB 133 AB D 8E
22220 22220 22220 mov edx, DWORD PTR [ebp+0x8] CD CD
8B A E 1 5 346
833331 8 8 8 8 8 833331 833331 mov eax,
DWORD PTR [ebp+0xc] DE DE A C B 206 I457
+ 533331 5 5 5 5 5 533331 533331 add
eax, edx AB AB E 11 6 CD 8204
8 833331 8 8 8 8 8 833331 833331 mov
DWORD PTR [ebp-0x4], eax DE DE A 9C B 206 I45
7 722220 7 7 7 7 7 722220 722220 mov
eax, DWORD PTR [ebp-0x4] CD CD 8B A E 1 5 34
+ 4 422220 4 4 4 4 4 422220 422220
leave = D mov esp, ebp E pop ebp A A D 5 BC 871 3
+ 7 744442 7 7 7 888 7 7 744442
744442 1 leave = mov esp, ebp pop ebp P P E IC D S A 30 5 S 30 B 22 B
44442 44442 44442 1 ret I X E 308 I
A A IB P I C 57S B D
+ 2 2 2 555 2 2 211110 211110 add
esp, 0x10 I C E 3 X7A 00P 8S 4 8 E DB
gdb-peda$ quit or gdb-peda$ q