$ checksec flag [*] '/home/oneshell/PWN/pwnable.kr/flag/flag' Arch: amd64-64-little RELRO: No RELRO Stack: No canary found NX: NX disabled PIE: No PIE (0x400000) RWX: Has RWX segments Packer: Packed with UPX
$ strings flag | grep UPX UPX! $Info: This file is packed with the UPX executable packer http://upx.sf.net $ $Id: UPX 3.08 Copyright (C) 1996-2011 the UPX Team. All Rights Reserved. $ UPX! UPX!
$ ./build/release/upx -d ../flag Ultimate Packer for eXecutables Copyright (C) 1996 - 2023 UPX git-57ad6b Markus Oberhumer, Laszlo Molnar & John Reiser Aug 25th 2023
File size Ratio Format Name -------------------- ------ ----------- ----------- 887219 <- 335288 37.79% linux/amd64 flag
Unpacked 1 file.
WARNING: this is an unstable beta version - use for testing only! Really.
此时可以看到flag已经是not stripped了
1 2
$ file flag flag: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, for GNU/Linux 2.6.24, BuildID[sha1]=96ec4cc272aeb383bd9ed26c0d4ac0eb5db41b16, not stripped
puts("I will malloc() and strcpy the flag there. take it.", argv, envp); dest = (char *)malloc(100LL); strcpy(dest, flag); return0; }
1 2 3
.rodata:0000000000496628 aUpxSoundsLikeA db 'UPX...? sounds like a delivery service :)',0 .rodata:0000000000496628 ; DATA XREF: .data:flag↓o .rodata:0000000000496652 align 8
$ python3 exp.py [+] Opening connection to pwnable.kr on port 9000: Done [*] Switching to interactive mode $ ls bof bof.c flag log super.pl $ cat flag daddy, I just pwned a buFFer :) $
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.20B10_BETA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP requests. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-10835.
# 开始分析qemu虚拟机首次启动的日志 data = open("%s/qemu.initial.serial.log" % targetDir, 'rb').read()
# 寻找开放端口 ports = findPorts(data, endianness)
#find interfaces with non loopback ip addresses ifacesWithIps = findNonLoInterfaces(data, endianness) #find changes of mac addresses for devices # 寻找MAC地址的变化 macChanges = findMacChanges(data, endianness) print('[*] Interfaces: %r' % ifacesWithIps)
echo -e "[*] Waiting web service... from ${IPS[@]}" read IP PING_RESULT WEB_RESULT TIME_PING TIME_WEB < <(check_network "${IPS[@]}" false)
if (${PING_RESULT}); then echo true > ${WORK_DIR}/ping echo ${TIME_PING} > ${WORK_DIR}/time_ping echo ${IP} > ${WORK_DIR}/ip fi if (${WEB_RESULT}); then echo true > ${WORK_DIR}/web echo ${TIME_WEB} > ${WORK_DIR}/time_web fi
START_TIME=$(date +%s | bc) CURRENT_TIME=$(date +%s | bc) t_start=$(date +%s.%N) while [ ${CURRENT_TIME} -le $[${START_TIME} + ${CHECK_TIMEOUT}] ] do for IP in "${IPS[@]}" do if (curl --max-time 2 --output /dev/null --silent http://${IP} || curl --max-time 2 --output /dev/null --silent https://${IP}); then t_end=$(date +%s.%N) if (! ${WEB_RESULT}); then WEB_TIME=$(echo "$t_end - $t_start" | bc) fi if (! ${PING_RESULT}); then PING_TIME=${WEB_TIME} fi PING_RESULT=true WEB_RESULT=true RET_IP=${IP} fi if (ping -c 1 ${IP} > /dev/null); then t_end=$(date +%s.%N) if (! ${PING_RESULT}); then PING_TIME=$(echo "$t_end - $t_start" | bc) fi PING_RESULT=true RET_IP=${IP} fi sleep 1 CURRENT_TIME=$(date +%s | bc) done
// A crash so we can tell the harness is working for lib_echo if(data[0] == 'p') { if(data[1] == 'o') { if(data[2] =='p') { if(data[3] == '!') { assert(0); } } } } }
// fixed size buffer based on assumptions about the maximum size that is likely necessary to exercise all aspects of the target function #define SIZE 50
intmain() { // make sure buffer is initialized to eliminate variable behaviour that isn't dependent on the input. char input[SIZE] = {0};
// fixed size buffer based on assumptions about the maximum size that is likely necessary to exercise all aspects of the target function #define SIZE 100
intmain(int argc, char* argv[]) { if((argc == 2) && strcmp(argv[1], "echo") == 0) { // make sure buffer is initialized to eliminate variable behaviour that isn't dependent on the input. char input[SIZE] = {0};
/** * section: Parsing * synopsis: Parse an XML file to a tree and free it * purpose: Demonstrate the use of xmlReadFile() to read an XML file * into a tree and xmlFreeDoc() to free the resulting tree * usage: parse1 test1.xml * test: parse1 test1.xml * author: Daniel Veillard * copy: see Copyright for the status of this software. */
/** * example1Func: * @filename: a filename or an URL * * Parse the resource and free the resulting tree */ staticvoid example1Func(constchar *filename) { xmlDocPtr doc; /* the resulting document tree */
doc = xmlReadFile(filename, NULL, 0); if (doc == NULL) { fprintf(stderr, "Failed to parse %s\n", filename); return; } xmlFreeDoc(doc); }
intmain(int argc, char **argv) { if (argc != 2) return(1);
/* * this initialize the library and check potential ABI mismatches * between the version it was compiled for and the actual shared * library used. */ LIBXML_TEST_VERSION
example1Func(argv[1]);
/* * Cleanup function for the XML library. */ xmlCleanupParser(); /* * this is to debug memory for regression tests */ xmlMemoryDump(); return(0); }
