XDCTF2015 bof - ret2dlresolve attack in i386 - thinkycx.me

thinkycx / thinkycx.me-comments

0 stars 0 forks source link

XDCTF2015 bof - ret2dlresolve attack in i386 - thinkycx.me #26

Open thinkycx opened 5 years ago

thinkycx commented 5 years ago

https://thinkycx.me/posts/2018-11-16-XDCTF2015-bof-ret2dlresolve-attack-in-i386.html

本文以XDCTF2015的bof这题为例记录一下利用ret2 dl-runtime resolve来控制程序函数解析，最终getshell的过程。想要实现整个过程，需要非常清楚动态链接的程序调用libc中函数时的解析过程，原理可以参考《程序员的自我修养》chapter7.4和chapter7.5，之后可以继续阅读...

thinkycx commented 5 years ago

ret2dlresolve的资源汇总（持续更新）：

通过ELF动态装载构造ROP链（ Return-to-dl-resolve）@Bigtang