Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Pwn勉強会
Search
m412u
November 27, 2018
Programming
8
11k
Pwn勉強会
・学内で開催したPwn入門勉強会で使用したスライドです。
m412u
November 27, 2018
Tweet
Share
More Decks by m412u
See All by m412u
slide.pdf
m412u
5
2.7k
学内Pwn勉強会
m412u
4
4.5k
Other Decks in Programming
See All in Programming
利用者視点で考える、イテレータとの上手な付き合い方
syumai
4
210
◯◯エンジニアになった理由
gessy0129
PRO
0
600
sqlcを利用してsqlに型付けを
kamiyam
0
230
Taking LLMs out of the black box: A practical guide to human-in-the-loop distillation
inesmontani
PRO
3
1.1k
文化が生産性を作る
jimpei
2
490
ROS 2のZenoh対応とZenohのROS 2対応
takasehideki
2
250
ビット演算の話 / Let's play with bit operations
kaityo256
PRO
4
160
Findy - エンジニア向け会社紹介 / Findy Letter for Engineers
findyinc
4
93k
コードレビューと私の過去と未来
jxmtst
0
170
実践Dash - 手を抜きながら本気で作るデータApplicationの基本と応用 / Dash for Python and Baseball
shinyorke
2
220
為醫療加裝Python的引擎
cclai999
0
270
Pythonによるイベントソーシングへの挑戦と現状に対する考察 / Challenging Event Sourcing with Python and Reflections on the Current State
nrslib
3
880
Featured
See All Featured
Embracing the Ebb and Flow
colly
83
4.4k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
tammyeverts
44
2k
BBQ
matthewcrist
84
9.2k
Debugging Ruby Performance
tmm1
73
12k
Being A Developer After 40
akosma
84
590k
The Art of Delivering Value - GDevCon NA Keynote
reverentgeek
4
99
A Tale of Four Properties
chriscoyier
155
22k
Designing for Performance
lara
604
68k
Building Adaptive Systems
keathley
37
2.1k
[RailsConf 2023] Rails as a piece of cake
palkan
49
4.7k
Build The Right Thing And Hit Your Dates
maggiecrowley
31
2.3k
Git: the NoSQL Database
bkeepers
PRO
425
64k
Transcript
• 2 2 2 •
• P • 1 1 3 • • F
C 3 E C T
• ( ) ) 4 • 4 )
6 . .
. . 7
8 . .
9 .
0 . 1 0
• fi 2 n g l l h
b3a 1 • ( ./. h 2 • ) • a
• bCFE • iah • T h
• ce L • • • iaf • /0 S ) ( 8 0 2 81 1 . 2 1:
• 8 • 3 1 6 •
4 1
• PU U C U • ( () •
1 PU U • • C C 5
6 1
• s p C • e • c 36
36 ( 2.7 207 217 2 7 254 2 4 253 213 a 9 i8d b 7) P U 4
) ( • CDE • ) • ) S •
)( G E P • ) D • ) G Eeb eb • )( G Eeb eb • ) X DEFBI L D • ) X DEFBI L D • A E • ) 8 D • ) CDE • ) i ) 134 1 42
• 8 57 • 4 1 32 Ø 06
57 • 9 • Ø 06 57 • 9 •
• 2 0 • 2
• 21 • mov eax, 0x0 mov DWORD
PTR [ebp-0x10], eax
( ) • A • 2 A cmp eax, 0x1
cmp DWORD PTR [ebp-0x10], eax
) ( • 3 C 3 2 • jmp 0x08048574
je 0x08048574
( , ) • ))) 4 • ))) 2 4
2 2 ( call printf@plt ret
, ( ) , • • add
eax, edx sub eax, edx
(( ) • lea
ecx, [esp+0x4] lea eax, [ebp-0x18]
( () ( • s • n O P e
• \ • O N 7 d s 7 7 2 • l 79 20 •
( ) • c b 2 • 82 • •
a • a • b c • a
• B : • B P 9 • 12
12 2 • I SL 9 : O • B FH : : EH • B FH : U: EH
•
• U 4 • 1 C 7
4 • I • +
• ) 2 .8 (( 4 2 1
3 ) $ git clone https://github.com/m412u/pwn_study.git $ cd pwn_study/sample
• 9) 4 ( •
• •
$ objdump –d –M intel func
) ( : 5 : 5 : 1
• 2 • 1 • $ gdb –q ./func
d g b 5
• 3 52 2 2
• 2 3 52 gdb-peda$ break *0x08048535 or gdb-peda$ b *0x08048535
gdb-peda$ run or gdb-peda$ r
1 . 2 53 .
• 6 1 • •
6 1 • 5 gdb-peda$ nexti or gdb-peda$ ni gdb-peda$ stepi or gdb-peda$ si
+ mov edx, DWORD PTR [ebp-0x14] 5 3 704 704
+ mov eax, DWORD PTR [ebp-0x18] 0 3 4
+ sub esp, 0x8 4 3 0 5
+ push edx 423 0 56
+ 2 2 2 2 2 2 push eax 534
10 6 6
+ 2 2 2 333 2 2 211110 211110 call
0x080484bb <add> AB AB D 4 8 4 8 5C6
22220 888 22220 22220 push ebp EI EI 4653 B
D AC 1 4
22220 22220 22220 mov ebp, esp CD CD 346 8B
A E 1 5
55553 (0 )0 0 0 ) 55553 55553 ) sub
esp, 0x10 I I P A8 C 426 AB 133 AB D 8E
22220 22220 22220 mov edx, DWORD PTR [ebp+0x8] CD CD
8B A E 1 5 346
833331 8 8 8 8 8 833331 833331 mov eax,
DWORD PTR [ebp+0xc] DE DE A C B 206 I457
+ 533331 5 5 5 5 5 533331 533331 add
eax, edx AB AB E 11 6 CD 8204
8 833331 8 8 8 8 8 833331 833331 mov
DWORD PTR [ebp-0x4], eax DE DE A 9C B 206 I45
7 722220 7 7 7 7 7 722220 722220 mov
eax, DWORD PTR [ebp-0x4] CD CD 8B A E 1 5 34
+ 4 422220 4 4 4 4 4 422220 422220
leave = D mov esp, ebp E pop ebp A A D 5 BC 871 3
+ 7 744442 7 7 7 888 7 7 744442
744442 1 leave = mov esp, ebp pop ebp P P E IC D S A 30 5 S 30 B 22 B
44442 44442 44442 1 ret I X E 308 I
A A IB P I C 57S B D
+ 2 2 2 555 2 2 211110 211110 add
esp, 0x10 I C E 3 X7A 00P 8S 4 8 E DB
gdb-peda$ quit or gdb-peda$ q