Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Pwn勉強会

m412u
November 27, 2018

 Pwn勉強会

・学内で開催したPwn入門勉強会で使用したスライドです。

m412u

November 27, 2018
Tweet

More Decks by m412u

Other Decks in Programming

Transcript


  1. • 2 2 2

    View full-size slide


  2. • P
    • 1 1 3

    • F C 3 E C T

    View full-size slide


  3. • ( ) )
    4
    • 4 )

    View full-size slide


  4. • fi 2 n
    g l
    l h b3a 1
    • ( ./. h 2
    • )

    a

    View full-size slide



  5. • bCFE
    • iah
    • T h
    • ce L


    • iaf
    • /0 S
    ) (
    8 0 2 81 1 . 2 1:

    View full-size slide


  6. • 8
    • 3 1 6

    View full-size slide


  7. • PU U C U
    • ( ()
    • 1 PU U

    • C C 5

    View full-size slide


  8. • s p C
    • e
    • c 36 36
    (
    2.7
    207
    217
    2 7
    254
    2 4
    253
    213
    a 9 i8d b 7) P U 4

    View full-size slide

  9. ) (
    • CDE
    • )
    • ) S
    • )( G E P
    • ) D
    • ) G Eeb eb
    • )( G Eeb eb
    • ) X DEFBI L D
    • ) X DEFBI L D
    • A E
    • ) 8 D
    • ) CDE
    • ) i
    )
    134 1 42

    View full-size slide


  10. • 8 57
    • 4 1 32
    Ø 06 57
    • 9

    Ø 06 57
    • 9

    View full-size slide



  11. • 2 0
    • 2

    View full-size slide


  12. • 21

    mov eax, 0x0
    mov DWORD PTR [ebp-0x10], eax

    View full-size slide

  13. ( )
    • A
    • 2 A
    cmp eax, 0x1
    cmp DWORD PTR [ebp-0x10], eax

    View full-size slide

  14. ) (
    • 3 C 3 2

    jmp 0x08048574
    je 0x08048574

    View full-size slide

  15. ( , )
    • ))) 4
    • ))) 2 4
    2 2 (
    call printf@plt
    ret

    View full-size slide

  16. , ( ) ,




    add eax, edx
    sub eax, edx

    View full-size slide

  17. (( )



    lea ecx, [esp+0x4]
    lea eax, [ebp-0x18]

    View full-size slide

  18. ( () (
    • s
    • n O P e
    • \
    • O N 7 d s
    7 7 2
    • l 79 20

    View full-size slide

  19. ( )
    • c b 2
    • 82

    • a
    • a
    • b c
    • a

    View full-size slide


  20. • B :
    • B P 9
    • 12 12 2
    • I SL 9 : O
    • B FH : : EH
    • B FH : U: EH

    View full-size slide



  21. • U 4
    • 1 C 7 4
    • I
    • +

    View full-size slide


  22. • )
    2 .8
    (( 4 2
    1 3
    )
    $ git clone https://github.com/m412u/pwn_study.git
    $ cd pwn_study/sample

    View full-size slide


  23. • 9) 4 (

    View full-size slide







  24. $ objdump –d –M intel func

    View full-size slide

  25. ) (
    : 5
    : 5
    : 1

    View full-size slide


  26. • 2
    • 1

    $ gdb –q ./func
    d g
    b 5

    View full-size slide



  27. • 3 52 2
    2
    • 2 3 52
    gdb-peda$ break *0x08048535
    or
    gdb-peda$ b *0x08048535

    View full-size slide



  28. gdb-peda$ run
    or
    gdb-peda$ r

    View full-size slide




  29. • 6 1


    • 6 1
    • 5
    gdb-peda$ nexti
    or
    gdb-peda$ ni
    gdb-peda$ stepi
    or
    gdb-peda$ si

    View full-size slide

  30. +
    mov edx, DWORD PTR [ebp-0x14]
    5 3
    704
    704

    View full-size slide

  31. +
    mov eax, DWORD PTR [ebp-0x18]
    0
    3
    4

    View full-size slide

  32. +
    sub esp, 0x8
    4 3
    0 5

    View full-size slide

  33. +
    push edx
    423
    0
    56

    View full-size slide

  34. + 2
    2
    2
    2
    2
    2
    push eax
    534
    10
    6
    6

    View full-size slide

  35. +
    2
    2
    2
    333
    2
    2
    211110
    211110
    call 0x080484bb
    AB
    AB
    D 4 8
    4 8 5C6

    View full-size slide

  36. 22220
    888
    22220
    22220
    push ebp
    EI
    EI
    4653
    B D AC
    1 4

    View full-size slide

  37. 22220
    22220
    22220
    mov ebp, esp
    CD
    CD
    346 8B A
    E 1 5

    View full-size slide

  38. 55553
    (0
    )0
    0
    0
    ) 55553
    55553
    )
    sub esp, 0x10
    I
    I
    P
    A8 C
    426
    AB
    133
    AB D 8E

    View full-size slide

  39. 22220
    22220
    22220
    mov edx, DWORD PTR [ebp+0x8]
    CD
    CD
    8B A
    E 1 5
    346

    View full-size slide

  40. 833331
    8
    8
    8
    8
    8
    833331
    833331
    mov eax, DWORD PTR [ebp+0xc]
    DE
    DE
    A C B
    206
    I457

    View full-size slide

  41. +
    533331
    5
    5
    5
    5
    5
    533331
    533331
    add eax, edx
    AB
    AB
    E 11
    6
    CD 8204

    View full-size slide

  42. 8
    833331
    8
    8
    8
    8
    8
    833331
    833331
    mov DWORD PTR [ebp-0x4], eax
    DE
    DE
    A 9C B
    206
    I45

    View full-size slide

  43. 7
    722220
    7
    7
    7
    7
    7
    722220
    722220
    mov eax, DWORD PTR [ebp-0x4]
    CD
    CD
    8B A
    E 1 5
    34

    View full-size slide

  44. +
    4
    422220
    4
    4
    4
    4
    4
    422220
    422220
    leave = D mov esp, ebp
    E pop ebp
    A
    A
    D
    5
    BC 871 3

    View full-size slide

  45. +
    7
    744442
    7
    7
    7
    888
    7
    7
    744442
    744442 1
    leave = mov esp, ebp
    pop ebp
    P
    P
    E IC D
    S A 30
    5
    S 30 B
    22 B

    View full-size slide

  46. 44442
    44442
    44442 1
    ret
    I
    X E 308
    I A A IB P
    I C 57S B D

    View full-size slide

  47. +
    2
    2
    2
    555
    2
    2
    211110
    211110
    add esp, 0x10 I C E
    3 X7A
    00P 8S 4
    8 E DB

    View full-size slide



  48. gdb-peda$ quit
    or
    gdb-peda$ q

    View full-size slide