[B! ãƒã‚¤ãƒŠãƒª] ionisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ionis id:ionis

ãƒã‚¤ãƒŠãƒªã«é–¢ã™ã‚‹ionisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (23)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

2019å¹´ã®pwnå•ã‚’å…¨éƒ¨è§£ããƒãƒ£ãƒ¬ãƒ³ã‚¸ã€å‰åŠæˆ¦ã€‘ - CTFã™ã‚‹ãž
å¾ŒåŠæˆ¦ï¼š 2019å¹´ã®pwnå•ã‚’å…¨éƒ¨è§£ããƒãƒ£ãƒ¬ãƒ³ã‚¸ã€å¾ŒåŠæˆ¦ã€‘ - CTFã™ã‚‹ãž ã¾ãˆãŒã (2019å¹´3æœˆè¨˜) æœ€è¿‘CTFã«å‡ºã‚‹ã¨ãã“ãã“è‰¯ã„æˆç¸¾ãŒæ®‹ã›ã‚‹ä¸€æ–¹ï¼Œãƒãƒ¼ãƒ ã®pwnæ‹…å½“ã¨ã—ã¦å®ŸåŠ›ä¸è¶³ã‚’æ„Ÿã˜ã¦ã„ã¾ã™ï¼Ž ãã“ã§ï¼Œpwnè‹¦æ‰‹æ„è˜ã‚’å…‹æœã™ã¹ãæœ¬æ—¥2019å¹´3æœˆ13æ—¥ã‹ã‚‰ï¼Œ2019å¹´1æœˆ1æ—¥ã‹ã‚‰2019å¹´12æœˆ31æ—¥ã¾ã§ã«å‡ºé¡Œã•ã‚Œã‚‹pwnå•ã‚’å…¨ã¦è§£ã„ã¦writeupã‚’æ›¸ãã“ã¨ã«ã—ã¾ã—ãŸï¼Ž é€±2ç¨‹åº¦ã§CTFãŒã‚ã£ã¦ï¼Œå„CTFã«3å•ãã‚‰ã„pwnãŒã‚ã‚‹ã‚¤ãƒ¡ãƒ¼ã‚¸ãªã®ã§ï¼Œä»Šã‹ã‚‰ã‚³ãƒ„ã‚³ãƒ„ã‚„ã‚Œã°æ¥å¹´ã®1æœˆã«ã¯è¨˜äº‹ãŒå‡ºæ¥ä¸ŠãŒã£ã¦ã‚‹ã‚“ã˜ã‚ƒãªã„ã‹ãªãƒ¼ã¨æ€ã„ã¾ã™ï¼Ž è¿½è¨˜(2019å¹´5æœˆ8æ—¥è¨˜) æ€ã£ãŸä»¥ä¸Šã«é‡ãŒå¤šã„ã®ã§å‰åŠã¨å¾ŒåŠã«åˆ†ã‘ã¾ã™ã€‚å‰åŠã¯7æœˆä¸Šæ—¬ã€å¾ŒåŠã¯æ¥å¹´ã®1æœˆä¸Šæ—¬ã«æŠ•ç¨¿ã™ã‚‹ã¤ã‚‚ã‚Šã§ã™ã€‚ ã»ã¼åˆå¿ƒè€…ã®çŠ¶æ…‹ã‹ã‚‰å§‹ã‚ãŸã®ã§ã€è§£èª¬ãƒŸã‚¹ã¨ã‹ã‚ã‚Œã°æ˜¯éžã‚³ãƒ¡ãƒ³ãƒˆã‹Twitterã§ã”é€£çµ¡ãã ã•ã„m(_ _)m ã¾ãˆ
ionis 2019/07/19
ã‚ã¨ã§èªã‚€

CTF

writeup

ãƒã‚¤ãƒŠãƒª
ãƒªãƒ³ã‚¯
Fridaå…¥é–€ for Windows - æ ªå¼ä¼šç¤¾Ninjastars æŠ€è¡“ç³»ãƒ–ãƒã‚°
æ ªå¼ä¼šç¤¾Ninjastarsã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ä¸€ç€¬ã§ã™ã€‚ ä»Šæ—¥ã¯å‰å›žã®è¨˜äº‹ã§ã‚‚å–ã‚Šä¸Šã’ãŸFridaã«ã¤ã„ã¦Windowsã§ã®åˆ©ç”¨æ–¹æ³•ã‚’è§£èª¬ã•ã›ã¦ã„ãŸã ããŸã„ã¨æ€ã„ã¾ã™ã€‚ Fridaã¨ã¯ä½•ã‹ Fridaã¯JavaScriptã‚’ç”¨ã„ã¦å„ç¨®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’èª¿æŸ»ãƒ»è§£æžã§ãã‚‹å‹•çš„è§£æžãƒ„ãƒ¼ãƒ«ã§ã™ã€‚ å¯¾è±¡OSã¨ã—ã¦Windows,MacOS,GNU/Linux,iOS,Androidç‰ã¨ã„ã£ãŸå¹…åºƒã„ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã§ä½¿ç”¨ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ Androidã‚„iOSç«¯æœ«å†…ã«ã‚µãƒ¼ãƒãƒ¼ã‚’ç«‹ã¦ã¦ãƒ›ã‚¹ãƒˆOSã‹ã‚‰ã‚¢ã‚¿ãƒƒãƒã—ã¦è§£æžã™ã‚‹ãªã©ã‚‚å¯èƒ½ã§ã™ã€‚ Fridaã®ã‚»ãƒƒãƒˆã‚¢ãƒƒãƒ— Fridaã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã¯pip(Pythonã®ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ç”¨ã‚³ãƒžãƒ³ãƒ‰)ã‚’ç”¨ã„ã¦ä»¥ä¸‹ã®ã‚ˆã†ã«ç°¡å˜ã«ã§ãã¾ã™ã€‚ ã€Œpip install fridaã€ ä»Šå›žã‚„ã‚‹ã“ã¨ www.frida.re ã“ã®è¨˜äº‹ã§ã¯Fridaã®ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆ
ionis 2019/05/22
Frida

è§£èª¬

å…¥é–€

ãƒã‚¤ãƒŠãƒª

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

javascript

python
ãƒªãƒ³ã‚¯
ld -z relro ã§ GOT overwrite attack ã‹ã‚‰èº«ã‚’å®ˆã‚‹ - memologue
GOT overwrite? "GOT overwrite" ã¨ã„ã†ã€(ã“ã“ã§ã¯ç‰¹ã«Linuxã®)ãƒ—ãƒã‚°ãƒ©ãƒ ã«å¯¾ã™ã‚‹æ”»æ’ƒæ–¹æ³•ãŒã‚ã‚Šã¾ã™ã€‚æ”»æ’ƒãŒæˆåŠŸã™ã‚‹ã¨ã€ãã®ãƒ—ãƒã‚»ã‚¹ã®æ¨©é™ã§ã®ä»»æ„ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œç‰ã€æ·±åˆ»ãªè¢«å®³ã‚’å—ã‘ã¾ã™ã€‚æœ€è¿‘ã®GNU ld(ãƒªãƒ³ã‚«)ã®ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã‚’ç”¨ã„ã‚‹ã¨ã€ã“ã®æ”»æ’ƒã‹ã‚‰èº«ã‚’å®ˆã‚‹ã“ã¨ãŒã§ãã‚‹ãã†ã§ã™ã®ã§ã€ç´¹ä»‹ã—ã¾ã™ã€‚ æœ€åˆã«ã¾ã¨ã‚ ï¼ˆã“ã¾ã‹ã„ã“ã¨ã¯ã‚ã¨ã§ï¼‰ GOT overwrite ã‹ã‚‰èº«ã‚’å®ˆã‚‹ã«ã¯ã€gccã§ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’ãƒªãƒ³ã‚¯ã™ã‚‹ã¨ãã«ã€ -Wl,-z,now,-z,relro ã‚’ã¤ã‘ã‚‹ã ã‘ã§ã™ã€‚èµ·å‹•æ™‚é–“ãŒé…ããªã‚‹ã¨ã„ã†ãƒˆãƒ¬ãƒ¼ãƒ‰ã‚ªãƒ•ãŒã‚ã‚Šã¾ã™ãŒã€GOTãŒreadonlyã«ãªã‚Šã¾ã™ã€‚GOTãŒreadonlyãªã‚‰ã€GOT overwrite attack ã‚’å—ã‘ãŸã¨ãã«ã€ãƒ—ãƒã‚»ã‚¹ãŒSEGVã—ã¦ãã‚Œã¾ã™ã®ã§ã€å®‰å…¨æ€§ãŒé«˜ã¾ã‚Šã¾ã™ã€‚ãƒ—ãƒã‚»ã‚¹ã®ãƒ¡ãƒ¢ãƒªãƒžãƒƒãƒ—ã‚’ç¢ºèªã™ã‚‹ã¨ã€ãã¡ã‚“ã¨ w ãŒè½ã¡ã¦
ionis 2018/10/30
ãƒã‚¤ãƒŠãƒª

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

RELRO

GOT
ãƒªãƒ³ã‚¯
Return-oriented programmingä»¥å¾Œ | ä¸€ç”Ÿã‚ã¨ã§èªã‚“ã§ã‚
ã¯ã˜ã‚ã«Return-oriented programming(ROP)ãŒæå”±ã•ã‚Œã¦ä¹…ã—ã„ï¼ŽCTFã«ãŠã„ã¦ã‚‚ï¼ŒROPã¯å½“ãŸã‚Šå‰ã®ã‚ˆã†ã«è¦æ±‚ã•ã‚Œã‚‹æŠ€è¡“ã¨ãªã£ã¦ãã¦ã„ã‚‹ï¼Žä¸€æ–¹ã§ï¼ŒROPã«ä»£ã‚ã‚‹æ–°ãŸãªæ”»æ’ƒæ‰‹æ³•ã‚‚æ¨¡ç´¢ã•ã‚Œã¦ã„ã‚‹ï¼Žã“ã“ã§ã¯ï¼Œãã†ã„ã£ãŸROPä»¥å¾Œã®æ”»æ’ƒæ‰‹æ³•ã‚’æ¦‚è¦³ã™ã‚‹ï¼Ž Return-oriented programmingã‚³ãƒ³ã‚»ãƒ—ãƒˆã¾ãšã¯ç°¡å˜ã«ROPã‚’ãŠã•ã‚‰ã„ã™ã‚‹ï¼Ž ROPã¯ä¸»ã«ãƒãƒ¼ãƒ‰ã‚¦ã‚§ã‚¢DEPã¨ã„ã†è„†å¼±æ€§å¯¾ç–æŠ€è¡“ã«å¯¾æŠ—ã™ã‚‹ãŸã‚ã«ç·¨ã¿å‡ºã•ã‚ŒãŸæ”»æ’ƒæ‰‹æ³•ã§ã‚ã‚‹ï¼Žãƒãƒ¼ãƒ‰ã‚¦ã‚§ã‚¢DEPã¯CPUã®NX bitã‚’æœ‰åŠ¹åŒ–ã™ã‚‹ã“ã¨ã§ï¼Œã‚¹ã‚¿ãƒƒã‚¯ä¸Šã§ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã™ã‚‹æ”»æ’ƒã‚’ç„¡åŠ¹åŒ–ã™ã‚‹ï¼Ž ãã“ã§ï¼ŒROPã¯ã‚³ãƒ¼ãƒ‰é ˜åŸŸã®retã§çµ‚ã‚ã‚‹å‘½ä»¤åˆ—(gadget)ã‚’å®Ÿè¡Œã™ã‚‹ã“ã¨ã«ã‚ˆã£ã¦ã“ã‚Œã‚’å›žé¿ã™ã‚‹ï¼Žå˜ä½“ã®gadgetã§ã¯ã‚ãšã‹ãªå‡¦ç†ã—ã‹è¡Œãˆãªã„ãŒï¼Œã‚¹ã‚¿ãƒƒã‚¯ã«æ¬¡ã®gadgetã®ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’ç©ã‚€ã“ã¨ã§ï¼Œgadgetã‚’çµ„ã¿åˆã‚
ionis 2018/06/05
CTF

ROP

ãƒã‚¤ãƒŠãƒª

ã¾ã¨ã‚
ãƒªãƒ³ã‚¯
GitHub - jjyg/metasm: This is the main repository for metasm, a free assembler / disassembler / compiler written in ruby
ionis 2018/06/04
IDAã¿ãŸã„ãªã‚„ã¤ã‹ãªã€‚

tool

Metasm

ãƒã‚¤ãƒŠãƒª
ãƒªãƒ³ã‚¯
ãƒã‚¤ãƒŠãƒªã‚¨ãƒ‡ã‚£ã‚¿ã‚’ä½œã‚Šã¾ã—ãŸï¼ - ãƒ—ãƒã‚°ãƒ©ãƒ ãƒ¢ã‚°ãƒ¢ã‚°
ãƒã‚¤ãƒŠãƒªã‚¨ãƒ‡ã‚£ã‚¿ã‚’ä½œã‚Šã¾ã—ãŸã€‚ ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã¯Homebrew brew install itchyny/tap/bed ã¾ãŸã¯ä»¥ä¸‹ã®ã‚³ãƒžãƒ³ãƒ‰ã§ã§ãã¾ã™ã€‚ go get github.com/itchyny/bed/cmd/bed ãªãœä½œã£ãŸã®ã‹ ç§ã¯æ˜”ã‹ã‚‰ãƒ•ã‚¡ã‚¤ãƒ«ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã«èˆˆå‘³ãŒã‚ã‚Šã€ç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã‚„PDFãƒ•ã‚¡ã‚¤ãƒ«ã®ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã‚’èª¿ã¹ã‚‹ã®ãŒå¥½ãã§ã—ãŸã€‚ æœ€è¿‘ã‚‚åœ§ç¸®ãƒ•ã‚¡ã‚¤ãƒ«ã®ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã‚’è¶£å‘³ã§èª¿ã¹ãŸã‚Šã—ã¦ã„ã¾ã™ã€‚ ã‚³ãƒ³ãƒ‘ã‚¤ãƒ©æŠ€è¡“ã«ã‚‚èˆˆå‘³ãŒã‚ã‚Šã€ã‚†ãã‚†ãã¯å®Ÿè¡Œãƒ•ã‚¡ã‚¤ãƒ«ã‚’ç”Ÿæˆã—ãŸã‚Šã—ãŸã„ãªã¨ã„ã†æ€ã„ã‚‚ã‚ã‚Šã¾ã™ã€‚ ãƒã‚¤ãƒŠãƒªãƒ•ã‚¡ã‚¤ãƒ«ã‚’ã‚¨ãƒ‡ã‚£ãƒƒãƒˆã™ã‚‹ã«ã¯ãƒã‚¤ãƒŠãƒªã‚¨ãƒ‡ã‚£ã‚¿ãŒå¿…è¦ã¨ãªã‚‹ã‚ã‘ã§ã™ãŒã€è‡ªåˆ†ã®æ‰‹ã«é¦´æŸ“ã‚€UIã‚’æŒã¤ã‚¨ãƒ‡ã‚£ã‚¿ãŒã‚ã‚Šã¾ã›ã‚“ã§ã—ãŸã€‚ ç§ã¯å®Ÿã¯Vimã¨ã„ã†ã‚¨ãƒ‡ã‚£ã‚¿ãŒå¥½ããªã®ã§ã€Vimã®ã‚ˆã†ãªã‚¤ãƒ³ã‚¿ãƒ¼ãƒ•ã‚§ãƒ¼ã‚¹ã‚’æŒã¡ã€ã‚¿ãƒ¼ãƒŸãƒŠãƒ«ã®ä¸ã§å‹•ãã‚¨ãƒ‡ã‚£ã‚¿ã‚’æŽ¢ã—ãŸã®ã§ã™ãŒã€ãªã‹ãªã‹ã‚ã‚Šã¾ã›ã‚“ã€‚ b
ionis 2018/04/10
ãƒã‚¤ãƒŠãƒª

ã‚¨ãƒ‡ã‚£ã‚¿

tool
ãƒªãƒ³ã‚¯
Unpacking Executables - The ESP Trick
ionis 2018/04/05
ã‚¢ãƒ³ãƒ‘ãƒƒã‚¯ã®ãƒ†ã‚¯ãƒ‹ãƒƒã‚¯

tips

ESP Trick

ãƒã‚¤ãƒŠãƒª

UnPack
ãƒªãƒ³ã‚¯
GitHub - Billy-Ellis/Exploit-Challenges: A collection of vulnerable ARM binaries for practicing exploit development
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
ionis 2017/06/01
[ARM]

binary

exploit

å…¥é–€

CTF

ãƒã‚¤ãƒŠãƒª
ãƒªãƒ³ã‚¯
GitHub - DhavalKapil/heap-exploitation: This book on heap exploitation is a guide to understanding the internals of glibc's heap and various attacks possible on the heap structure.
This short book is written for people who want to understand the internals of 'heap memory', particularly the implementation of glibc's 'malloc' and 'free' procedures, and also for security researchers who want to get started in the field of heap exploitation. The first section of the book covers an in-depth, yet concise, description about heap internals. The second section covers some of the most
ionis 2017/05/30
è§£èª¬

ãƒ¡ãƒ¢ãƒª

ãƒ’ãƒ¼ãƒ—ãƒ¡ãƒ¢ãƒª

ãƒã‚¤ãƒŠãƒª

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
https://pastebin.com/raw/mrFNd19w
ionis 2017/04/05
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

CTF

ãƒã‚¤ãƒŠãƒª

ã¾ã¨ã‚

è§£èª¬
ãƒªãƒ³ã‚¯
é«˜æ©Ÿèƒ½ãƒã‚¤ãƒŠãƒªãƒˆãƒ¬ãƒ¼ã‚µqiraã¯ã©ã®ã‚ˆã†ã«å®Ÿè£…ã•ã‚Œã¦ã„ã‚‹ã®ã‹ - ã‚‹ãã™ã®æ—¥è¨˜ ~ Out_Of_Range ~
1. qiraã¨ã¯ qiraã¨ã¯ä¸–ç•Œçš„ãªãƒãƒƒã‚«ãƒ¼ã€George Hotzæ° (ã‚¸ãƒ§ãƒ¼ã‚¸ãƒ»ãƒ›ãƒƒãƒ„ - Wikipedia) ã«ã‚ˆã£ã¦é–‹ç™ºã•ã‚ŒãŸé«˜æ©Ÿèƒ½ãƒã‚¤ãƒŠãƒªãƒˆãƒ¬ãƒ¼ã‚µãƒ¼ã§ã‚ã‚Šã€qiraã¨ã„ã†åã¯ï¼ˆQEMU Interactive Runtime Analyserï¼‰ã®ç•¥ã§ã‚ã‚‹ã€‚ GitHub - BinaryAnalysisPlatform/qira: QEMU Interactive Runtime Analyser ç•¥èªžã‚’è¦‹ã‚Œã°åˆ†ã‹ã‚‹ãŒuser mode QEMUã‚’ä½¿ç”¨ã—ãŸãƒã‚¤ãƒŠãƒªè§£æžãƒ„ãƒ¼ãƒ«ã§ã‚ã‚Šã€ELFãªã©ã®å®Ÿè¡Œå½¢å¼ãƒã‚¤ãƒŠãƒªã‚’å®Ÿéš›ã«å‹•ä½œã•ã›ã¦å„å‘½ä»¤ã®ãƒ¬ã‚¸ã‚¹ã‚¿ã€ãƒ¡ãƒ¢ãƒªã¸ã®æ“ä½œã‚’é€æ¬¡è¨˜éŒ²ã™ã‚‹ã€‚ ã“ã‚Œã‚‰ã®è¨˜éŒ²ã¯web UIã‚’é€šã—ã¦å¥½ããªå‘½ä»¤ä½ç½®ã«ã‚«ãƒ¼ã‚½ãƒ«ã‚’ç§»å‹•ã•ã›ã‚‹ã ã‘ã§è¦‹ã‚‹ã“ã¨ãŒã§ãã€ãã®æ™‚ã®ãƒ¬ã‚¸ã‚¹ã‚¿ã€ãƒ¡ãƒ¢ãƒªã®è¨˜éŒ²ãŒå†ç¾ã•ã‚Œã‚‹ä»•çµ„ã¿ã«ãªã£ã¦ã„ã‚‹ã€‚ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã®ãƒ‡ãƒãƒƒã‚°ã‚„CTFã«ãŠã‘ã‚‹ãƒã‚¤ãƒŠãƒªè§£
ionis 2017/02/13
QEMU

qira

ãƒ‡ãƒãƒƒã‚°

ãƒã‚¤ãƒŠãƒª
ãƒªãƒ³ã‚¯
katagaitai CTFå‹‰å¼·ä¼šã®å®¿é¡Œ - Qiita
ãƒãƒ¼ãƒ katagaitaiä¸»å‚¬ã®å‹‰å¼·ä¼šã«å‚åŠ ã—ãŸã€‚ https://atnd.org/events/67035 bataã•ã‚“ã®pwnablesã®è¬›ç¾©ã®é¡ŒæãŒPlaid CTF 2013ã®ropasaurusrexã§ã€å‹‰å¼·ä¼šä¸ã«æœ€ã‚‚ç°¡å˜ãªç‰ˆã®è§£ãæ–¹ãŒç´¹ä»‹ã•ã‚Œã¦ã€é›£ã—ãæ”¹é€ ã—ãŸã‚‚ã®ã‚’å¾Œã§è§£ã„ã¦ã¿ã¦ãã ã•ã„ã¨ã„ã†æ„Ÿã˜ã ã£ãŸã€‚è„†å¼±æ€§ã¯ã‚¹ã‚¿ãƒƒã‚¯ãƒãƒƒãƒ•ã‚¡ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ã§ã€ASLRãªã©ã‚’ã©ã†å›žé¿ã™ã‚‹ã‹ã¨ã„ã†è©±ã€‚ å‚åŠ ã™ã‚‹å‰ã®ç§ã€Œã‚Šã€€ã‚Šã‚ã‚“ã¯ã—ã£ã¦ã‚‹ã€ 1å•ç›®ã‚’è§£ã„ãŸç§ã€Œã€Žã“ã“ã«â—‹â—‹ã®ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’æ›¸ãã€ã¨ã‹ã®èª˜å°Žç„¡ã—ã§ã¯ç„¡ç†ã ãªã€ 5å•ç›®ã‚’è§£ã„ãŸç§ã€Œ1å•ç›®ã€system("/bin/sh")ã‚’å‘¼ã¶ã ã‘ã ã—ã€libcã‚‚æ›¸ãè¾¼ã¿å¯èƒ½ãªé ˜åŸŸã‚‚ã‚ã‚‹ã—ã€ç°¡å˜ã™ãŽï¾œï¾›ï¾€ã€ 1å•ç›® system("/bin/sh")ã‚’å‘¼ã³å‡ºã™ã€‚å•é¡Œã®ãƒã‚¤ãƒŠãƒªä¸ã«ã¯systemã®ã‚¢ãƒ‰ãƒ¬ã‚¹ãŒç„¡ãã€ASLRã«ã‚ˆã£ã¦libcã®ã‚¢ãƒ‰ãƒ¬ã‚¹ãŒåˆ†ã‹ã‚‰ãª
ionis 2015/12/25
CTF

ãƒã‚¤ãƒŠãƒª

*ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
format string attackã«ã‚ˆã‚‹GOT overwriteã‚’ã‚„ã£ã¦ã¿ã‚‹ - ã‚‚ã‚‚ã„ã‚ãƒ†ã‚¯ãƒŽãƒã‚¸ãƒ¼
ä¸€ã¤å‰ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯format string attackã«ã‚ˆã‚‹ãƒ¡ãƒ¢ãƒªèªã¿å‡ºã—ã‚’ã‚„ã£ã¦ã¿ãŸãŒã€format string attackã§ã¯ä»»æ„ã®ä½ç½®ã®ãƒ¡ãƒ¢ãƒªå†…å®¹ã‚’æ›¸ãæ›ãˆã‚‹ã“ã¨ã‚‚ã§ãã‚‹ã€‚ ã“ã“ã§ã¯ã€å®Ÿéš›ã«GOT (Global Offset Table) ã¨å‘¼ã°ã‚Œã‚‹ã‚»ã‚¯ã‚·ãƒ§ãƒ³ã«ç½®ã‹ã‚Œã‚‹ãƒ©ã‚¤ãƒ–ãƒ©ãƒªé–¢æ•°ã®ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’ã‚·ã‚§ãƒ«ã‚³ãƒ¼ãƒ‰ã®ã‚¢ãƒ‰ãƒ¬ã‚¹ã«ç½®ãæ›ãˆã€ã‚·ã‚§ãƒ«ã‚’èµ·å‹•ã•ã›ã¦ã¿ã‚‹ã€‚ ç’°å¢ƒ Ubuntu 12.04 LTS 32bitç‰ˆ $ uname -a Linux vm-ubuntu32 3.11.0-15-generic #25~precise1-Ubuntu SMP Thu Jan 30 17:42:40 UTC 2014 i686 i686 i386 GNU/Linux $ lsb_release -a No LSB modules are available. Distributor ID
ionis 2015/12/25
GOT

exploit

ãƒã‚¤ãƒŠãƒª

*ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
ROP stagerã«ã‚ˆã‚‹ã‚·ã‚§ãƒ«ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã‚’ã‚„ã£ã¦ã¿ã‚‹ - ã‚‚ã‚‚ã„ã‚ãƒ†ã‚¯ãƒŽãƒã‚¸ãƒ¼
DEPãŒæœ‰åŠ¹ãªçŠ¶æ³ã§ã¯ã€ã‚¹ã‚¿ãƒƒã‚¯ãƒãƒƒãƒ•ã‚¡ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ãªã©ã‹ã‚‰å‘½ä»¤ã‚’å®Ÿè¡Œã•ã›ã‚‹ãŸã‚ã«ROPã¨å‘¼ã°ã‚Œã‚‹æ‰‹æ³•ãŒä½¿ã‚ã‚Œã‚‹ã€‚ ã•ã‚‰ã«ã€ROPã‚’ä½¿ã£ã¦ä»»æ„ã®å‡¦ç†ã‚’å®Ÿè¡Œã•ã›ã‚‹æ–¹æ³•ã¨ã—ã¦ã€å®Ÿè¡Œå¯èƒ½ãªãƒ¡ãƒ¢ãƒªé ˜åŸŸï¼ˆstageï¼‰ã‚’å‹•çš„ã«ç¢ºä¿ã—ã€ãã“ã«é€šå¸¸ã®ã‚·ã‚§ãƒ«ã‚³ãƒ¼ãƒ‰ã‚’ã‚³ãƒ”ãƒ¼ã—å®Ÿè¡Œã•ã›ã‚‹ã¨ã„ã†æ–¹æ³•ãŒçŸ¥ã‚‰ã‚Œã¦ã„ã‚‹ã€‚ ã“ã®éš›ä½¿ã‚ã‚Œã‚‹ROPã‚·ãƒ¼ã‚±ãƒ³ã‚¹ã¯ROP stagerã¨å‘¼ã°ã‚Œã‚‹ã€‚ ã“ã“ã§ã¯ã€DEPãŒæœ‰åŠ¹ãªçŠ¶æ³ä¸‹ã§ã€mmapã‚’ä½¿ã£ãŸROP stagerã«ã‚ˆã‚‹ã‚·ã‚§ãƒ«ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã‚’ã‚„ã£ã¦ã¿ã‚‹ã€‚ ç’°å¢ƒ Ubuntu 12.04 LTS 32bitç‰ˆ $ uname -a Linux vm-ubuntu32 3.11.0-15-generic #25~precise1-Ubuntu SMP Thu Jan 30 17:42:40 UTC 2014 i686 i686 i386 GNU/Linux $ lsb_release
ionis 2015/12/25
ROP

exploit

*ã‚ã¨ã§èªã‚€

ãƒã‚¤ãƒŠãƒª
ãƒªãƒ³ã‚¯
Windows Exploit Development - Part 1: The Basics - Security Sift
Sifting through the world of Information Security, one bit at a time Sift: to examine (something) thoroughly so as to isolate that which is most important -- Oxford Dictionary Overview Welcome to Part 1 of a series of posts on Windows Exploit Development. In this first installment Iâ€™ll cover just the basics necessary to understand the content of future posts, including some Assem bly syntax, Window
ionis 2015/08/24
windows

memory

ãƒã‚¤ãƒŠãƒª

å…¥é–€

exploit

*ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
ç›®grepå…¥é–€ +è§£èª¬
2. ã„ã„ã‚ã‘ 1 â€¢ ãªãœã‹ã‚ˆãã‚ã‹ã‚‰ãªã„ã‘ã©å¥½è©•ã ã£ãŸã‚‰ã—ã„ â€¢ ã§ã‚‚ â€“ ã„ã¿ã‚ã‹ã‚“ãï½—ï½—ï½— â€“ å¾ŒåŠãŒæ„å‘³ä¸æ˜Ž â€“ ã¤ãƒ¼ã‹ãã‚Œç›®grepè¨€ã‚ãªã„ã§ã—ã‚‡ â€¢ ã¨ã„ã†ãƒ„ãƒƒã‚³ãƒŸãŒâ€¦ â€¢ é ãŠã‹ã—ã„ã¨ã„ã†ã®ãŒã†ã‘ãŸã‚‰ã—ã„? â€“ å…¨ç„¶ãŠã‹ã—ããªã„ã‚ˆ! â€¢ ãŒã€äººã«ã‚ˆã£ã¦ã¯ã€ŒãŸã‚ã«ãªã‚‹è³‡æ–™ã§ã™ï¼ï¼ã€ã¨ã„ã†ã‚³ ãƒ¡ãƒ³ãƒˆã‚‚ã‚ã£ãŸã‚Š 2 / 83
ionis 2015/08/20
å…¥é–€

ãƒã‚¤ãƒŠãƒª

ç›®grep
ãƒªãƒ³ã‚¯
Private Presentation
Private content!This content has been marked as private by the uploader.
ionis 2015/02/02
*ã‚ã¨ã§èªã‚€

slideshare

ãƒã‚¤ãƒŠãƒª

å…¥é–€
ãƒªãƒ³ã‚¯
å˜ç´”ãªã‚¹ã‚¿ãƒƒã‚¯ãƒãƒƒãƒ•ã‚¡ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼æ”»æ’ƒã‚’ã‚„ã£ã¦ã¿ã‚‹ - ã‚‚ã‚‚ã„ã‚ãƒ†ã‚¯ãƒŽãƒã‚¸ãƒ¼
ä¸€ã¤å‰ã®ã‚¨ãƒ³ãƒˆãƒªã§ä½œã£ãŸã‚·ã‚§ãƒ«ã‚³ãƒ¼ãƒ‰ã‚’ä½¿ã£ã¦ã€ã‚¹ã‚¿ãƒƒã‚¯ãƒãƒƒãƒ•ã‚¡ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ã‚’åˆ©ç”¨ã—ãŸã‚·ã‚§ãƒ«èµ·å‹•ã‚’ã‚„ã£ã¦ã¿ã‚‹ã€‚ ç’°å¢ƒ Ubuntu 12.04 LTS 32bitç‰ˆ $ uname -a Linux vm-ubuntu32 3.11.0-15-generic #25~precise1-Ubuntu SMP Thu Jan 30 17:42:40 UTC 2014 i686 i686 i386 GNU/Linux $ lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 12.04.4 LTS Release: 12.04 Codename: precise $ gcc --version gcc (Ubuntu/Linaro 4.6.3-1ubuntu5) 4.6.3
ionis 2015/01/20
ãƒã‚¤ãƒŠãƒª

å…¥é–€

StackOverFlow
ãƒªãƒ³ã‚¯
????????
ionis 2014/06/24
CTF

ãƒã‚¤ãƒŠãƒª
ãƒªãƒ³ã‚¯
https://microcorruption.com/login
ionis 2014/06/21
ãƒã‚¤ãƒŠãƒª

CTF
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸