Angelboy PWN-6
這個月社團請到frozenkp講課,最近就一直在練PWN。 這題是Angelboy之前在台大計安上課用的題目。有錄影片在youtube上。 主要是32 bit ROP ,不曉得現在比賽還見不見得到? 攻擊步驟: 1.找塊rw的記憶體寫入 "/bin/sh\x00" 2.設好register值,去做execve的syscall
TOTOLINK N200RE_v5 Telnet Backdoor
Wenyi Li @UCCU Hacker Description The telnet service on the router, though disabled by default, can be enabled by an unauthenticated attacker with a single POST request. The attacker can then login as root with hardcoded credentials. Affected versions Tested on firmware version V9.3.5u.6139, other versions may also be vulnerable. Cause Analysis The web interface issues a SESSION_ID cookie upon a successful login. However, the request endpoints do not check for it, resulting in broken access control. POC demo
留言
張貼留言