Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 1ccc41f

Browse files
committedFeb 25, 2019
chapter2/format-strings.md: fix two typos, close #14.
Signed-off-by: Tom Li <tomli@tomli.me>
1 parent c37b23f commit 1ccc41f

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed
 

‎chapter2/format-strings.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ objdump -h -j .fini_array fmt
192192

193193
## 0x22 overwrite GOT
194194

195-
思路 2: 类似覆盖.dtors, 利用格式化字符串漏洞把 exit()@plt 覆写为 shellode 的环境变量里面的地址, 程序在原来调用 exit() 地方就会转跳到 shellcode 上执行.
195+
思路 2: 类似覆盖.dtors, 利用格式化字符串漏洞把 `exit@plt` 覆写为 shellcode 的环境变量里面的地址, 程序在原来调用 exit() 地方就会转跳到 shellcode 上执行.
196196

197197
做法, 首先需要把 shellcode 放置到环境变量里面, 后获取其地址,shellcode[下载](../media/attach/shellcode.bin). 这个 shellcode 是 setuid(0) 然后 execve(), 所有要对有 suid 位的程序使用, 如果非 suid 则 setuid(0) 调用失败.
198198

0 commit comments

Comments
 (0)
Please sign in to comment.