Introduction
It is not me that solve the challenge during the competition. Just take it as a warm-up for coming CTF.Read More »
Hacking Blind
Introduction
This paper was published in Oakland 2014. In this paper, the author presents a generic way to exploit proprietary server even if the source code and the binary code is not available but a crash is found through remote fuzzing test.
Read More »
Virtual Function
Introduction
The virtual table is the key factor that achieves polymorphism in C++. This post will talk about the virtual table and its structure in C++. More particularly, I will introduce the virtual functions under Linux and Windows. All tests are done on 64-bit platform. 32-bit platform is a little bit different but the basic idea is similar.
Read More »
Counterfeit Object-oriented Programming
Introduction
This paper was published in Oakland 2015. In this paper, the author introduced COOP (Conterfeit Object Oriented Programming) to bypass the virtual table integrity check and coarse-grained CFI. In COOP, it takes a whole virtual function in C++ code as a gadget to launch the attack. Since the state-of-art CFI does not have a deep knowledge of the semantics of the binary code in C++ and the state-of-art vtable enforcement does not take vtable reuse attack into consideration, COOP attack is hard to be distinguished from benign execution of the program.
Read More »
VTable Reuse Attack
Introduction
VTable reuse attack is a novel exploitation technique in recent academic work. I think it is time to give a short series of posts on VTable reuse attacks including academic papers, more details on VTable and VTable reuse attacks based on existing CVE.Read More »
BCTF 2015 PWN Zhongguancun Write-up
Introduction
This challenge implements a simplified version of VTint in the binary file. Therefore, this is a good example to introduce vtable reuse attack.
Read More »
VTint: Protecting Virutal Function Tables’ Integrity
Introduction
This paper was published on NDSS2015. Virtual table hijacking is an attack to overwrite the virtual table pointer(vfptr) by utilizing the use-after-free or heap-overflow vulnerability, which finally hijacks the control flow of the program. In this paper, the author proposed an protection on the binary by instrumentation.
Read More »
PHP Object Serialization
Introduction
This post will give a basic explanation of PHP (de)serialization and how such mechanism will be exploited in PHP Object Injection (POI).
Read More »
Protected: CrossCTF 2018决赛回顾－－我一个做binary的怎么就去做web了
CrossCTF 2018 Final RE Write-up Collection
Introduction
This post will contain the 2 RE challenges in CrossCTF 2018 final: perfect and Rochefort_6.
Read More »
氷 菓 