Heres a Libc
Here's a LIBC
Given 3 files : vuln , libc.so.6 , Makefile
Environment set up
Use pwninit to set up the enviroment. We got ld-2.27.so .
Patch vuln with ld-2.27.so .
Analyze vuln
file :
ELF 64-bit LSB executabledynamically linkedinterpreter ./ld-2.27.sonot stripped
checksec :
Arch: amd64-64-littleRELRO: Partial RELROStack: No canary foundNX: NX enabledPIE: No PIE (0x400000)RUNPATH: b'./'
A loop in main :
00400896 b8 00 MOV EAX,0x0 00 00 0000400 ...
Information
Information
Given 1 file : cat.jpg
Analyze cat.jpg
Use exiftool to analyze cat.jpg :
exiftool ./cat.jpg
Found a string cGljb0NURnt0aGVfbTN0YWRhdGFfMXNfbW9kaWZpZWR9 .
Base64 decode and get the Flag
echo "cGljb0NURnt0aGVfbTN0YWRhdGFfMXNfbW9kaWZpZWR9" | base64 -d
python wrangling
Python Wrangling
Given 3 files : ende.py , flag.txt.en , pw.txt
Analyze ende.py :
import sysimport base64from cryptography.fernet import Fernetusage_msg = "Usage: "+ sys.argv[0] +" (-e/-d) [file]"help_msg = usage_msg + "\n" +\ "Examples:\n" +\ " To decrypt a file named 'pole.txt', do: " +\ "'$ python "+ sys.argv[0] +" -d pole.txt'\n"if len(sys.argv) < 2 or len(sys.argv) > 4: ...
Symbolic Execution
Symbolic Execution Note
finding bugs, symbolic execution, EXE
Bugs
Major source of security exploits.
Bugs ~ Exploit
maybe hard, but should assume it is possible
e.g., not buffer overrun is an exploit, but it maybe possible to exploit
Approaches To Finding Bugs
Verification : eliminate classes of bugs
Testing : known bugs
Fuzzing : unknown bugs
Symbolic Execution
可能的情境
Bugs 可能的類型：
Crash
Divide By Zero
Null Pointer Reference
Array Out-Of-Bound
App Specific
Goal : Find Deep Bugs
Ide ...
SROP
SROP Note
SROP Sigreturn-Oriented Programming
Signal 機制
Signal 機制 (軟中斷訊號、軟中斷) 是類 UNIX 系統中 process 之間相互傳遞信息的一種方法。比方說： process 之間可以通過 system 調用 kill 來發送值軟中斷信號。
信號機制常見步驟：
步驟 1 ：
Kernel 向某 process 發送 signal 機制，該 process 會暫時被 hang (掛起) ，進入 kernel 態。
步驟 2 ：
Kernel 會為該 process 保存一些資訊，會把以下資訊壓入 stack 中：
所有 register 值。
Signal 信息。
指向 sigreturn 的系統調用位址。
此部分是在 user process 的 address area 。
之後會跳轉到 Signal Handler 中處理相應的 signal 。
Signal Frame 會因為架構的不同而不同。
步驟 3 ：
當 Signal Handler 執行完之後， Signal Handler 返 ...
Asymmetric Encryption
Asymmetric Encryption
Slide
Crypto Practice 1
Crypto Practice 1
About this slide
Presenter:
Sharkkcode
Location:
CCU
Date:
Oct. 18, 2022
Slide
Binary Exploitation 2
Binary Exploitation 2
About this slide
Presenter:
Sharkkcode
Location:
CCU
Date:
Oct. 7, 2022
Slide
Binary Exploitation 1
Binary Exploitation 1
About this slide
Presenter:
Sharkkcode
Location:
CCU
Date:
Sep. 27, 2022
Slide
Artificial Neural Network
Artificial Neural Network
About this slide
This is the slide I presented on Apr. 25, 2022 , at CCU .
Slide