6.1.30 pwn HITCONCTF2017 Ghost_in_the_heap

• 题目复现
• 题目解析
• 漏洞利用
• 参考资料

下载文件

题目复现

$ file ghost_in_the_heap
ghost_in_the_heap: ELF 64-bit LSB pie executable x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=e862c2118fbad287f5947b95b6f5a5a532fa4a6f, stripped
$ checksec -f ghost_in_the_heap
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FORTIFY Fortified Fortifiable  FILE
Full RELRO      Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   Yes     1               2       ghost_in_the_heap
$ strings libc-2.24.so | grep "GNU C"
GNU C Library (Ubuntu GLIBC 2.24-9ubuntu2.2) stable release version 2.24, by Roland McGrath et al.
Compiled by GNU CC version 6.3.0 20170406.

64 位程序，保护全开。

题目解析

漏洞利用

参考资料

• https://ctftime.org/task/4847