forked from hardenedlinux/linux-exploit-development-tutorial
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathchapter_stack.tex
More file actions
31 lines (28 loc) · 1.12 KB
/
Copy pathchapter_stack.tex
File metadata and controls
31 lines (28 loc) · 1.12 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
\chapter{stack}
\par 这个阶段可能要花点时间了,需要学习主流的bypass安全机制的部分手段(base
stack).
\par ret2any: 返回到任何可以执行的地方, 已知的地方
\begin{list}{\textbullet}{%
\setlength\topsep{0pt} \setlength\partopsep{0pt}
\setlength\parsep{0pt} \setlength\itemsep{0pt}
}
\item stack
\item data/heap
\item text
\item library (libc)
\item code chunk (ROP)
\end{list}
\section{CANARY}
\subsection{overwriting TLS}
\section{NX}
\subsection{return-to-libc}
\footnote{\url{https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-return-to-libc/}}.\newline
\subsection{chained return-to-libc}
\footnote{\url{https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-chained-return-to-libc/}}.\newline
\section{ASLR}
\subsection{return-to-plt}
\footnote{\url{https://sploitfun.wordpress.com/2015/05/08/bypassing-aslr-part-i/}}.\newline
\subsection{brute-force}
\footnote{\url{https://sploitfun.wordpress.com/2015/05/08/bypassing-aslr-part-ii/}}.\newline
\subsection{overwriting GOT}
\footnote{\url{https://sploitfun.wordpress.com/2015/05/08/bypassing-aslr-part-iii/}}.\newline