{"id":129,"date":"2025-07-15T19:29:03","date_gmt":"2025-07-15T11:29:03","guid":{"rendered":"http:\/\/a1anx91.me\/?p=129"},"modified":"2025-07-18T15:01:24","modified_gmt":"2025-07-18T07:01:24","slug":"pwm%e5%87%ba%e9%a2%98%e8%bf%87%e7%a8%8b%e4%b8%ad%e9%81%87%e5%88%b0%e7%9a%84%e4%b8%80%e4%ba%9b%e9%97%ae%e9%a2%98%e4%bb%a5%e5%8f%8a%e8%a7%a3%e5%86%b3%e6%96%b9%e6%b3%95%e6%8c%81%e7%bb%ad%e6%9b%b4","status":"publish","type":"post","link":"https:\/\/a1anx91.me\/index.php\/2025\/07\/15\/pwm%e5%87%ba%e9%a2%98%e8%bf%87%e7%a8%8b%e4%b8%ad%e9%81%87%e5%88%b0%e7%9a%84%e4%b8%80%e4%ba%9b%e9%97%ae%e9%a2%98%e4%bb%a5%e5%8f%8a%e8%a7%a3%e5%86%b3%e6%96%b9%e6%b3%95%e6%8c%81%e7%bb%ad%e6%9b%b4\/","title":{"rendered":"PWM\u51fa\u9898\u8fc7\u7a0b\u4e2d\u9047\u5230\u7684\u4e00\u4e9b\u95ee\u9898\u4ee5\u53ca\u89e3\u51b3\u65b9\u6cd5(\u6301\u7eed\u66f4\u65b0)"},"content":{"rendered":"\n

\u4e00.gcc\u7f16\u8bd1\u6307\u4ee4\u4ee5\u53ca\u5bf9\u5e94\u4fdd\u62a4<\/h1>\n\n\n\n
\u7f16\u8bd1\u9009\u9879<\/strong><\/td>checksec<\/code><\/strong> \u68c0\u6d4b\u9879<\/strong><\/td>\u4f5c\u7528<\/strong><\/td>\u5178\u578b\u8f93\u51fa\uff08Enabled\/Disabled\uff09<\/strong><\/td><\/tr>
\u9ed8\u8ba4\u7f16\u8bd1<\/strong>gcc pwn.c -o pwn<\/code><\/td>CANARY<\/code>
NX<\/code>
PIE<\/code>
RELRO<\/code><\/td>		\u542f\u7528\u6240\u6709\u4fdd\u62a4<\/td>CANARY: Enabled<\/code>
NX: Enabled<\/code>
PIE: Enabled<\/code>
RELRO: Full<\/code><\/td><\/tr>
-fno-stack-protector<\/code><\/strong><\/td>CANARY<\/code><\/td>\u7981\u7528\u6808\u6ea2\u51fa\u4fdd\u62a4\uff08Canary\uff09<\/td>CANARY: Disabled<\/code><\/td><\/tr>
-z execstack<\/code><\/strong><\/td>NX<\/code><\/td>\u5141\u8bb8\u6808\u6267\u884c\uff08\u5173\u95ed NX\uff09<\/td>NX: Disabled<\/code><\/td><\/tr>
-no-pie<\/code><\/strong><\/td>PIE<\/code><\/td>\u7981\u7528\u5730\u5740\u968f\u673a\u5316\uff08PIE\uff09<\/td>PIE: Disabled<\/code><\/td><\/tr>
-Wl,-z,now<\/code><\/strong><\/td>RELRO<\/code><\/td>\u542f\u7528 Full RELRO\uff08\u91cd\u5b9a\u4f4d\u53ea\u8bfb\uff09<\/td>RELRO: Full<\/code><\/td><\/tr>
-Wl,-z,lazy<\/code><\/strong><\/td>RELRO<\/code><\/td>\u542f\u7528 Partial RELRO<\/td>RELRO: Partial<\/code><\/td><\/tr>
-static<\/code><\/strong><\/td>\u6240\u6709\u4fdd\u62a4<\/td>\u9759\u6001\u94fe\u63a5\uff08\u65e0\u52a8\u6001\u5e93\u4f9d\u8d56\uff09<\/td>NX: Enabled<\/code>\uff08\u9759\u6001\u4ee3\u7801\u6bb5\u4e0d\u53ef\u6267\u884c\uff09
PIE: Disabled<\/code>\uff08\u9759\u6001\u7f16\u8bd1\u65e0 ASLR\uff09<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

\u4e8c.\u9879\u76ee\u63a8\u8350<\/h1>\n\n\n\n

\u5728github\u4e0a\u6709\u5f88\u591a\u53ef\u4ee5\u4e00\u952e\u90e8\u7f72\u7684\u9879\u76ee<\/p>\n\n\n\n

\u5982\uff1a<\/p>\n\n\n\n

ctf-docker-template<\/a><\/strong><\/mark>\uff0cctf_xinetd<\/a><\/strong><\/mark><\/p>\n\n\n\n

\u8fd8\u6709\u5f88\u591a\u5176\u4ed6\u9879\u76ee\u90fd\u53ef\u4ee5\u4e00\u952e\u90e8\u7f72<\/p>\n\n\n\n

\u6211\u8fd9\u91cc\u63a8\u8350\u4f7f\u7528ctf-docker-template<\/strong><\/mark>\uff0c\u5bf9\u6b63\u51c6\u5907\u51fa\u9898\u7684\u65b0\u624b\u975e\u5e38\u53cb\u597d\uff0c\u529f\u80fd\u9f50\u5168\uff0c\u5404\u79cd\u65b9\u5411\u90fd\u6709<\/p>\n\n\n\n

\u4e09.\u9047\u5230\u7684\u4e00\u4e9b\u95ee\u9898<\/h1>\n\n\n\n

\u4e00\u822c\u6253pwn\u7684\u90fd\u4f1a\u7528\u5230\u865a\u62df\u673a\uff0c\u6bd4\u5982kali<\/mark><\/strong>,Ubuntu<\/mark><\/strong>\u7b49<\/p>\n\n\n\n

\u8fd9\u91cc\u4f7f\u7528\u7684\u662fUbuntu<\/mark><\/strong>\uff0c\u4e0d\u6e05\u695akali<\/strong><\/mark>\u662f\u5426\u4f1a\u51fa\u73b0\u4e00\u6837\u7684\u95ee\u9898<\/p>\n\n\n\n

1. \u865a\u62df\u673a\u73af\u5883\u914d\u7f6e\u95ee\u9898<\/h2>\n\n\n\n

\u6211\u7528\u6765\u6253ctf<\/strong>\u7684\u73af\u5883\u5c31\u4e00\u4e2a\uff1avm<\/mark><\/strong>\u4e0a\u7684Ubuntu24.04\u865a\u62df\u673a<\/mark><\/strong><\/p>\n\n\n\n

\u7531\u4e8e\u662f\u65b0\u7248\u672c\uff0c\u6709\u7684\u535a\u5ba2\u53c8\u6bd4\u8f83\u8001\u4e86\uff0c\u6240\u4ee5\u5f88\u591a\u6307\u4ee4\u4e0d\u9002\u7528<\/p>\n\n\n\n

\u5343\u8f9b\u4e07\u82e6\u914d\u7f6e\u5b8cpwn\u73af\u5883\uff0c\u73b0\u5728\u51fa\u9898\u65f6\u53c8\u662f\u4e00\u5806\u95ee\u9898\uff0c\u6bd4\u5982docker\u914d\u7f6e\u95ee\u9898\uff0c\u6211\u7684docker\u4e0d\u77e5\u9053\u600e\u4e48\u56de\u4e8b\u4e00\u76f4\u62c9\u4e0d\u4e86\u955c\u50cf\uff0c\u95eeai\u53c8\u662f\u5404\u79cd\u95ee\u9898\uff0c<\/p>\n\n\n\n

\u7f51\u4e0a\u53c8\u641c\u4e0d\u5230\u76f8\u5173\u4fe1\u606f\uff0c\u7d22\u6027\u5c31\u76f4\u63a5\u4e70\u4e86\u4e2a\u4e91\u670d\u52a1\u5668<\/strong><\/mark>\uff0c\u7cfb\u7edf\u662fubuntu22.04<\/strong><\/mark>\uff0c\u5c31\u89e3\u51b3\u4e86\u5f88\u591a\u95ee\u9898\uff0c\u603b\u800c\u8a00\u4e4b\u5c31\u662f\u4e0d\u80fd\u968f\u4fbf\u6309\u7167\u7f51\u4e0a\u8bf4\u7684\u4e71\u6539<\/p>\n\n\n\n

\u6700\u7ec8\u89e3\u51b3\u529e\u6cd5\u5c31\u662f\u91cd\u88c5\u865a\u62df\u673a<\/strong><\/mark><\/p>\n\n\n\n

\u81f3\u4e8e\u8be6\u7ec6\u95ee\u9898\u4e0b\u9762\u518d\u8bb2<\/p>\n\n\n\n

2.\u9898\u76ee\u7f16\u8bd1\u95ee\u9898<\/h2>\n\n\n\n

\u7531\u4e8e\u6211\u7684\u865a\u62df\u673a\u73af\u5883\u6709\u4e00\u70b9\u5c0f\u95ee\u9898<\/p>\n\n\n\n

\u6240\u4ee5\u4e00\u5f00\u59cb\u6211\u7528\u4e91\u670d\u52a1\u5668\u5f00\u4e86\u4e2aubuntu24.04\u5bb9\u5668\uff0c\u7136\u540e\u5728\u5bb9\u5668\u4e2d\u7f16\u8bd1\u9898\u76ee\uff0c\u7f16\u8bd1\u597d\u540e\u7528ROPgadget<\/code><\/strong>\u4e00\u67e5\uff0c\u6839\u672c\u6ca1\u6709\u4ec0\u4e48gadget\uff0c<\/p>\n\n\n\n

0x000000000040115d : pop rbp ; ret<\/strong><\/mark><\/code><\/p>\n\n\n\n

0x000000000040101a : ret<\/strong><\/mark><\/code><\/p>\n\n\n\n

0x000000000040105a : ret 0xffff<\/strong><\/mark><\/code><\/p>\n\n\n\n

\u53ea\u6709\u8fd9\u4e9b\uff0c\u4f46\u662f\u6211\u51fa\u7684\u9898\u76ee\u662f\u9700\u8981\u50cfpop rdi \uff1bret<\/code><\/strong>\u8fd9\u6837\u7684gadget\u7684\uff0c\u4e00\u95eeai\u5c31\u8bf4\u662f\u6e90\u4ee3\u7801\u91cc\u9762\u6ca1\u6709\u8c03\u7528\u50cfread<\/strong>\uff0cputs<\/strong>\u7b49libc<\/strong>\u51fd\u6570\uff0c\u4f46\u662f\u6211\u7684\u6e90\u4ee3\u7801\u91cc\u9762\u786e\u5b9e\u8c03\u7528\u4e86\uff0c\u4e4b\u540e\u53c8\u8bf4ubuntu24.04libc\u7248\u672c\u6709\u95ee\u9898\uff0c\u7a0b\u5e8f\u592a\u5c0f\u4e86\u4ec0\u4e48\u7684<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

\u56e0\u6b64\u6211\u6362\u4e86\u4e2aubuntu18.04<\/strong><\/mark>\u7248\u672c\u7684\u5bb9\u5668<\/p>\n\n\n\n

\u5728\u8fd9\u4e2a\u5bb9\u5668\u7f16\u8bd1\u540e\uff0c\u90a3\u4e9b\u8be5\u6709\u7684gadget\u4e5f\u6709\u4e86\uff0c\u7b2c\u4e8c\u5929<\/strong><\/mark>\uff0c\u6253\u5f00\u7535\u8111\uff0c\u518d\u4e00\u6b21ROPgadget<\/code>\uff0c<\/strong>\u90a3\u4e9bgadget\u53c8\u6d88\u5931\u4e86\u53c8\u53d8\u6210\u4e86<\/p>\n\n\n\n

0x000000000040115d : pop rbp ; ret<\/strong><\/mark><\/code><\/p>\n\n\n\n

0x000000000040101a : ret<\/strong><\/mark><\/code><\/p>\n\n\n\n

0x000000000040105a : ret 0xffff<\/strong><\/mark><\/code><\/p>\n\n\n\n

\u8fd9\u79cd\u60c5\u51b5\uff0c\u5e76\u4e14checksec\u4e4b\u540e\u4fdd\u62a4\u4e5f\u548c\u6211\u6628\u5929checksec\u5b8c\u5168\u4e0d\u540c\u4e86\uff0c\u672c\u6765\u662f\u5f00\u4e86NX\u4fdd\u62a4\u7684\uff0c\u7ed3\u679c\u7b2c\u4e8c\u5929\u53c8\u5173\u4e86\uff0c\u7b80\u76f4\u79bb\u4e86\u4e2a\u5927\u8c31<\/p>\n\n\n\n

\u540e\u6765\u95ee\u4e86\u4e00\u4e9b\u5927\u4f6c\uff0c\u8bf4ubuntu18.04\u7248\u672c\u592a\u8001<\/strong><\/mark>\u4e86\uff0c\u4e8e\u662f\u6211\u53c8\u6362\u6210\u4e86ubuntu22.04<\/strong><\/mark><\/p>\n\n\n\n

\u7136\u540e\u7f16\u8bd1\uff0c\u4fdd\u62a4\u6b63\u5e38\u4e86\uff0cgadget\u53c8\u6ca1\u4e86<\/strong><\/mark><\/p>\n\n\n\n

\u4e8e\u662f\u6211\u51c6\u5907\u542cai\u7684\uff0c\u5199\u4e00\u4e2agadgets.S<\/strong><\/mark><\/code>\u6587\u4ef6<\/p>\n\n\n\n

\n

.intel_syntax noprefix
.section .text<\/code><\/strong><\/p>\n\n\n\n

.global gadget_pop_rdi_ret
gadget_pop_rdi_ret:
pop rdi
ret<\/code><\/strong><\/p>\n\n\n\n

.global gadget_pop_rsi_r15_ret
gadget_pop_rsi_r15_ret:
pop rsi
pop r15
ret<\/code><\/strong><\/p>\n\n\n\n

.global gadget_pop_r12_r13_r14_r15_ret
gadget_pop_r12_r13_r14_r15_ret:
pop r12
pop r13
pop r14
pop r15
ret<\/code><\/strong><\/p>\n\n\n\n

.global gadget_ret
gadget_ret:
ret<\/code><\/strong><\/p>\n\n\n\n

.att_syntax prefix<\/code><\/strong><\/p>\n<\/div><\/div>\n\n\n\n

\u9996\u5148<\/p>\n\n\n\n

gcc -c gadgets.S -o gadgets.o<\/strong><\/mark><\/code><\/p>\n\n\n\n

\u751f\u6210\u4e00\u4e2agadgets.o<\/strong><\/mark><\/code><\/p>\n\n\n\n

\u63a5\u7740\u518d<\/p>\n\n\n\n

gcc -no-pie -fno-stack-protector -O0 ezstack.c gadgets.o -o ezstack<\/strong><\/mark><\/code><\/p>\n\n\n\n

\u5c06gadgets.o<\/code><\/strong>\u4e00\u8d77\u7f16\u8bd1\u8fdb\u53bb<\/p>\n\n\n\n

\u8fd9\u6837\uff0c\u6211\u9700\u8981\u7684gadgets\u5c31\u6709\u4e86<\/p>\n\n\n\n

\u9898\u76ee\u7f16\u8bd1\u7684\u95ee\u9898\u5c31\u89e3\u51b3\u4e86<\/p>\n\n\n\n

3.Dockerfile\u914d\u7f6e\u95ee\u9898<\/h2>\n\n\n\n

\u7531\u4e8e\u4e00\u5f00\u59cb\u6211\u7684Dockerfile\u662f\u53ebai<\/strong>\u5e2e\u6211\u5199\u7684\uff0c\u6240\u4ee5\u540e\u671f\u51fa\u73b0\u4e86\u4e00\u5927\u5806\u95ee\u9898<\/p>\n\n\n\n

\u8fd9\u91cc\u5b50\u786e\u5b9e\u8111\u5b50\u8fdb\u6c34\u4e86\uff0c\u4e0d\u8be5\u8ddf\u7740ai<\/strong>\u6765\u7684<\/p>\n\n\n\n

\u6240\u4ee5\u6700\u597d\u4e0d\u8981\u8ddf\u7740ai\u778e\u641e\uff0c\u95ee\u9898\u53ea\u4f1a\u8d8a\u6765\u8d8a\u590d\u6742<\/p>\n\n\n\n

\u5173\u4e8e\u8fd9\u4e2a\u95ee\u9898\uff0c\u6700\u597d\u7684\u89e3\u51b3\u65b9\u6cd5\u5c31\u662f\u76f4\u63a5\u7528github<\/mark>\u9879\u76ee\u91cc\u81ea\u5e26\u7684Dockerfile<\/p>\n\n\n\n

\u8fd9\u4e9b\u9879\u76ee\u5f80\u5f80\u6709\u4e13\u95e8\u7684Readme.md<\/strong>\u6587\u4ef6\u53ea\u9700\u8ddf\u7740\u4ecb\u7ecd\u6765\u6539\u5c31\u884c\u4e86<\/p>\n\n\n\n

\u6211\u6682\u65f6\u5c31\u9047\u5230\u8fd9\u4e9b\u95ee\u9898\u4e86\uff0c\u4ee5\u540e\u518d\u9047\u5230\u5176\u4ed6\u7c7b\u578b\u95ee\u9898\u4f1a\u7ee7\u7eed\u66f4\u65b0<\/p>\n","protected":false},"excerpt":{"rendered":"

\u4e00.gcc\u7f16\u8bd1\u6307\u4ee4\u4ee5\u53ca\u5bf9\u5e94\u4fdd\u62a4 \u7f16\u8bd1\u9009\u9879 checksec \u68c0\u6d4b\u9879 \u4f5c\u7528 \u5178\u578b\u8f93\u51fa\uff08Enabled\/Disabled\uff09 \u9ed8\u8ba4\u7f16\u8bd1g …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[9],"tags":[],"class_list":["post-129","post","type-post","status-publish","format-standard","hentry","category-9"],"_links":{"self":[{"href":"https:\/\/a1anx91.me\/index.php\/wp-json\/wp\/v2\/posts\/129","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/a1anx91.me\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/a1anx91.me\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/a1anx91.me\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/a1anx91.me\/index.php\/wp-json\/wp\/v2\/comments?post=129"}],"version-history":[{"count":11,"href":"https:\/\/a1anx91.me\/index.php\/wp-json\/wp\/v2\/posts\/129\/revisions"}],"predecessor-version":[{"id":154,"href":"https:\/\/a1anx91.me\/index.php\/wp-json\/wp\/v2\/posts\/129\/revisions\/154"}],"wp:attachment":[{"href":"https:\/\/a1anx91.me\/index.php\/wp-json\/wp\/v2\/media?parent=129"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/a1anx91.me\/index.php\/wp-json\/wp\/v2\/categories?post=129"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/a1anx91.me\/index.php\/wp-json\/wp\/v2\/tags?post=129"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}