CSAW CTF Qualification Round 2018 - shell->code

原题

Linked lists are great! They let you chain pieces of data together.

nc pwn.chal.csaw.io 9005

链接：https://ctftime.org/task/6644

附件：（请将文件改名为shellpointcode）

题解

首先看下文件的基本信息：

$ file shellpointcode 
shellpointcode: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=214cfc4f959e86fe8500f593e60ff2a33b3057ee, not stripped

一个64位Linux二进制动态链接文件且未去除符号信息（not stripped）

再看下二进制文件的安全措施：

$ checksec shellpointcode
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    No canary found
    NX:       NX disabled
    PIE:      PIE enabled
    RWX:      Has RWX segments

二进制文件开启了PIE但栈空间未开启canary且可执行