摘要:
1.从libc中找到"/bin/sh"的地址(gdb)find__libc_start_main,length,"/bin/sh"2.安排缓冲区'a'*length+addressOfSystem+addressOfExit+addressOfBinSh3.PLT & GOT延迟绑定:PLT第一次调... 阅读全文
摘要:
1.由C代码转为AT & T汇编代码#include int main(int argc, char **argv) { char *name[2]; name[0] = "/bin/bash"; name[1] = NULL; execve(n... 阅读全文