{"version":"1.0","width":"100%","url":"https://hama.hatenadiary.jp/entry/2017/10/19/204700","provider_name":"Hatena Blog","author_url":"https://blog.hatena.ne.jp/hama7230/","published":"2017-10-19 20:47:00","height":"190","categories":["writeup"],"description":"\u306f\u3058\u3081\u306b \u8272\u3005\u3068\u8a66\u3057\u305f\u3089, saved rbp\u3092\u90e8\u5206\u7684\u306b\u66f8\u304d\u63db\u3048\u3066_start\u3092\u623b\u308a\u30a2\u30c9\u30ec\u30b9\u306b\u306a\u308b\u3088\u3046\u306b\u3059\u308b\u3053\u3068\u3067\u518d\u5ea6FSA\u304c\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u3063\u305f. \u3042\u3068\u306f\u9069\u5f53\u306bstack\u4e0a\u306bone gadget RCE\u3092\u6307\u3059\u30a2\u30c9\u30ec\u30b9\u3092\u4f5c\u308a, main\u306e\u623b\u308a\u30a2\u30c9\u30ec\u30b9\u3092\u305d\u3053\u306b\u3057\u305f. exploit\u3067\u306fheap\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u30ea\u30fc\u30af\u3057\u3066\u308b\u304c, \u7d50\u5c40\u4f7f\u308f\u306a\u304b\u3063\u305f. \u6700\u521d\u306fheap\u4e0a\u306bstack pivot\u3092\u72d9\u3063\u3066\u3044\u305f\u304c\u9014\u4e2d\u3067\u65b9\u91dd\u3092\u5909\u66f4\u3057\u305f\u540d\u6b8b\u3067\u3042\u308b. exploit #!/usr/bin/env python from pwn import * context(os='linux', arch='amd64') # co\u2026","type":"rich","author_name":"hama7230","image_url":null,"blog_title":"\u30d6\u30ed\u30b0\u672a\u6e80\u306e\u306a\u306b\u304b","title":"hack.lu CTF 2017 HeapsOfPrint writeup","html":"<iframe src=\"https://hatenablog-parts.com/embed?url=https%3A%2F%2Fhama.hatenadiary.jp%2Fentry%2F2017%2F10%2F19%2F204700\" title=\"hack.lu CTF 2017 HeapsOfPrint writeup - \u30d6\u30ed\u30b0\u672a\u6e80\u306e\u306a\u306b\u304b\" class=\"embed-card embed-blogcard\" scrolling=\"no\" frameborder=\"0\" style=\"display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;\"></iframe>","blog_url":"https://hama.hatenadiary.jp/","provider_url":"https://hatena.blog"}