我已阅读并完成了逆向：逆向工程的秘密和黑客：利用的艺术。他们都以自己的方式进行了阐述，但我仍然觉得其中提出的许多技术和信息在某种程度上已经过时了。
当臭名昭著的 Phrack 文章 为了乐趣和利润而粉碎堆栈 于 1996 年撰写时，就在 1996 年之前我认为计算机安全的“黄金时代”。
在接下来的几年里，编写漏洞利用程序相对容易。执行缓冲区溢出并在受害者机器上执行一些任意 shell 代码只需要一些 C 和汇编方面的基本知识。
简单地说，事情变得变得更加复杂。现在，安全工程师必须应对诸如地址空间布局随机化 (ASLR)、数据执行保护 (DEP)、堆栈 Cookie、堆 Cookie 等等。编写漏洞利用的复杂性至少上升了一个数量级。
如果不使用一堆标志进行编译以关闭现代保护，您将无法运行今天教程中的大多数缓冲区溢出漏洞。
现在，如果你想编写一个漏洞利用程序，你必须设计出关闭 DEP 的方法，用你的 shell 代码喷射堆数百次，并尝试猜测你的 shell 代码附近的随机内存位置。更不用说当今使用的托管语言的普遍性，当涉及到这些漏洞时，它们的安全性要高得多。
我希望将我的安全知识扩展到为十年前的系统编写玩具漏洞之外。面对我上面概述的所有保护措施，我无法找到有助于解决编写漏洞利用问题的资源。
有哪些更先进和流行的论文、书籍或其他资源致力于应对现代系统编写漏洞的挑战？
I've read and finished both Reversing: Secrets of Reverse Engineering and Hacking: The Art of Exploitation. They both were illuminating in their own way but I still feel like a lot of the techniques and information presented within them is outdated to some degree.
When the infamous Phrack Article, Smashing the Stack for Fun and Profit, was written 1996 it was just before what I sort of consider the Computer Security "golden age".
Writing exploits in the years that followed was relatively easy. Some basic knowledge in C and Assembly was all that was required to perform buffer overflows and execute some arbitrary shell code on a victims machine.
To put it lightly, things have gotten a lot more complicated. Now security engineers have to contend with things like Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP), Stack Cookies, Heap Cookies, and much more. The complexity of writing exploits went up at least an order of magnitude.
You can't event run most of the buffer overrun exploits in the tutorials you'll find today without compiling with a bunch of flags to turn off modern protections.
Now if you want to write an exploit you have to devise ways to turn off DEP, spray the heap with your shell-code hundreds of times and attempt to guess a random memory location near your shellcode. Not to mention the pervasiveness of managed languages in use today that are much more secure when it comes to these vulnerabilities.
I'm looking to extend my security knowledge beyond writing toy-exploits for a decade old system. I'm having trouble locating resources that help address the issues of writing exploits in the face of all the protections I outlined above.
What are the more advanced and prevalent papers, books or other resources devoted to contending with the challenges of writing exploits for modern systems?
发布评论
评论（4）
你提到了“粉碎堆栈”。从研究角度来看，这篇文章在发表之前就已经过时了。 80 年代末的 Morris 蠕虫病毒就使用了它（以利用 Fingerd IIRC）。当时引起了巨大的轰动，因为当时每个服务器都是用乐观的 C 语言编写的。
这花了几年（十年左右）的时间，但逐渐每个人都更加意识到与面向公众的服务器相关的安全问题。
用 C 语言编写的服务器经过了大量的安全分析，同时服务器端处理扩展到其他语言和运行时。
今天情况看起来有点不同。服务器不被认为是一个大目标。如今，客户才是大鱼。劫持客户端，服务器将允许您在该客户端的凭据下进行操作。
风景已经改变。
就我个人而言，我偶尔喜欢玩组装游戏。我对它们没有实际用途，但如果您想了解这一点，我建议您查看 Metasploit 源代码并阅读他们的邮件列表。他们做了很多疯狂的事情，而且都是公开的。
You mentioned 'Smashing the stack'. Research-wise this article was out-dated before it was even published. The late 80s Morris worm used it (to exploit fingerd IIRC). At the time it caused a huge stir because back then every server was written in optimistic C.
It took a few (10 or so) years, but gradually everyone became more conscious of security concerns related to public-facing servers.
The servers written in C were subjected to lots of security analysis and at the same time server-side processing branched out into other languages and runtimes.
Today things look a bit different. Servers are not considered a big target. These days it's clients that are the big fish. Hijack a client and the server will allow you to operate under that client's credentials.
The landscape has changed.
Personally I'm a sporadic fan of playing assembly games. I have no practical use for them, but if you want to get in on this I'd recommend checking out the Metasploit source and reading their mailing lists. They do a lot of crazy stuff and it's all out there in the open.
我印象深刻，你是一个 leet 黑客像我一样。您需要转向网络应用程序。过去几年发布的大多数 CVE 编号都是在 Web 应用程序中。
阅读这两篇论文：
http://www.securereality.com.au/studyinscarlet.txt
http://www.ngssoftware.com/papers/HackproofingMySQL.pdf
获取LAMP 堆栈并安装这三个应用程序：
http://sourceforge.net/projects/dvwa/ (php)
http://sourceforge.net/projects/gsblogger/ (php)
http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project (j2ee ）
您应该下载 w3af 并掌握它。为它编写插件。 w3af 是一个很棒的攻击平台，但它有 bug，并且存在 DVWA 问题，它会破坏灰度。 Acunetix 是一款很好的商业扫描仪，但价格昂贵。
I'm impressed, you are a leet hacker Like me. You need to move to web applications. The majority of CVE numbers issued in the past few years have been in web applications.
Read these two papers:
http://www.securereality.com.au/studyinscarlet.txt
http://www.ngssoftware.com/papers/HackproofingMySQL.pdf
Get a LAMP stack and install these three applications:
http://sourceforge.net/projects/dvwa/ (php)
http://sourceforge.net/projects/gsblogger/ (php)
http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project (j2ee)
You should download w3af and master it. Write plugins for it. w3af is an awesome attack platform, but it is buggy and has problems with DVWA, it will rip up greyscale. Acunetix is a good commercial scanner, but it is expensive.
我强烈推荐《The Shellcoder's Handbook》。在编写漏洞利用方面，这无疑是我读过的最好的参考资料。
如果您有兴趣编写漏洞利用程序，您可能需要学习如何进行逆向工程。对于世界上 99% 的人来说，这意味着 IDA Pro。根据我的经验，没有比 Chris Eagle 的《IDA Pro Book》更好的 IDA Pro 书籍了。他详细介绍了您在 IDA Pro 中需要做的几乎所有事情。
OpenRCE.org 上有一个非常棒的逆向工程社区。那里有大量的论文和各种有用的应用程序。我是在一个名为 RECon 的两年一度的逆向工程会议上了解到这个网站的。下一次活动将于 2010 年举行。
目前大多数研究都将是“容易实现的成果”。我最近参加的安全会议上的大部分讨论都是关于移动平台（iPhone、Android 等）上的漏洞，在这些平台上，现代操作系统几乎没有可用的保护措施。
一般来说，不会有任何参考文献可以解释如何编写现代漏洞利用程序，因为操作系统中内置了大量保护措施。例如，假设您发现了一个堆漏洞，但 Windows 中令人讨厌的新安全取消链接功能使您无法获得执行。您必须知道，有两个天才研究了此功能，并且 发现了一个缺陷。
祝你学习顺利。漏洞利用写作非常令人沮丧，但又非常有益！
呸!垃圾邮件使我无法发布所有链接。对不起！
I highly recommend "The Shellcoder's Handbook". It's easily the best reference I've ever read when it comes to writing exploits.
If you're interested writing exploits, you're likely going to have to learn how to reverse engineer. For 99% of the world, this means IDA Pro. In my experience, there's no better IDA Pro book than Chris Eagle's "The IDA Pro Book". He details pretty much everything you'll ever need to do in IDA Pro.
There's a pretty great reverse engineering community at OpenRCE.org. Tons of papers and various helpful apps are available there. I learned about this website at an excellent bi-annual reverse engineering conference called RECon. The next event will be in 2010.
Most research these days will be "low-hanging fruit". The majority of talks at recent security conferences I've been to have been about vulnerabilities on mobile platforms (iPhone, Android, etc) where there are few to none of the protections available on modern OSes.
In general, there won't be a single reference out there that will explain how to write a modern exploit, because there's a whole host of protections built into OSes. For example, say you've found a heap vulnerability, but that pesky new Safe Unlinking feature in Windows is keeping you from gaining execution. You'd have to know that two geniuses researched this feature and found a flaw.
Good luck in your studies. Exploit writing is extremely frustrating, and EXTREMELY rewarding!
Bah! The spam thingy is keeping me from posting all of my links. Sorry!
通过使用其他漏洞利用技术（例如 Ret2Lib 或 Ret2Esp），可以轻松绕过 DEP（数据执行保护）、NX（不执行）和其他明确禁止执行的安全增强功能。编译应用程序时，通常是与其他库 (Linux) 或 DLL (Windows) 一起编译。这些 Ret2* 技术只是调用驻留在内存中的现有 function()。
例如，在正常的攻击中，您可能会溢出堆栈，然后使用 NOP Sled、您的 Shellcode 或包含您的 shellcode 的环境变量的地址来控制返回地址 (EIP)。当在不允许堆栈可执行的系统上尝试此漏洞时，您的代码将无法运行。相反，当您溢出返回地址 (EIP) 时，您可以将其指向内存中的现有函数，例如 system() 或 execv()。您使用该函数所需的参数预先填充所需的寄存器，现在您可以调用 /bin/sh 而无需执行堆栈中的任何内容。
有关更多信息，请参见此处：
http://web.textfiles.com/hacking/smackthestack.txt< /a>
DEP (Data Execution Prevention), NX (No-Execute) and other security enhancements that specifically disallow execution are easily by-passed by using another exploit techniques such as Ret2Lib or Ret2Esp. When an application is compiled it usually is done so with other libraries (Linux) or DLLs (Windows). These Ret2* techniques simply call an existing function() that resides in memory.
For example, in a normal exploit you may overflow the stack and then take control of the return address (EIP) with the address of a NOP Sled, your Shellcode or an Environmental Variable that contains your shellcode. When attempting this exploit on a system that does not allow the stack to be executable your code will not run. Instead, when you overflow the return address (EIP) you can point it to an existing function within memory such as system() or execv(). You pre populate the required registers with the parameters this function expects and now you can call /bin/sh without having to execute anything from the stack.
For more information look here:
http://web.textfiles.com/hacking/smackthestack.txt