看雪CTF2019Q1-第9题-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

看雪CTF2019Q1-第9题

发表于: 2019-3-19 00:50 3352

看雪CTF2019Q1-第9题

风间仁

2019-3-19 00:50

3352

checksec candcpp

    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)
    FORTIFY:  Enabled

    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)
    FORTIFY:  Enabled

功能

 malloc
 free
 new
 delete
 puts
 exit
>> 

 malloc
 free
 new
 delete
 puts
 exit
>> 

创建malloc/new

nblock=(len+14)/15;
g_ary_ptr[ary_index] = fn(nblock);
g_ary_block_size[ary_index] = nblock;
 
struct st_malloc_block{
    QWORD unused;
    char buf[16]; //初始化为0
};
 
struct st_malloc {
    st_malloc_block[nblock]; // << ret_ptr
};
 
struct st_new_block {
    QWORD vtbl; //delete时会判断vtbl[0], 如果不是0x400F20就会调用 
    char buf[16]; //初始化为0
};
 
struct st_new {
    QWORD nblock;
    st_new_block[nblock]; // << ret_ptr
};

nblock=(len+14)/15;
g_ary_ptr[ary_index] = fn(nblock);
g_ary_block_size[ary_index] = nblock;
 
struct st_malloc_block{
    QWORD unused;
    char buf[16]; //初始化为0
};
 
struct st_malloc {
    st_malloc_block[nblock]; // << ret_ptr
};
 
struct st_new_block {
    QWORD vtbl; //delete时会判断vtbl[0], 如果不是0x400F20就会调用 
    char buf[16]; //初始化为0
};
 
struct st_new {
    QWORD nblock;
    st_new_block[nblock]; // << ret_ptr
};