i 春秋月刊第六期：Linux pwn 零基础入门 (it-ebooks)（Z-Library）

【One-Line Pitch】 A hands-on, CTF-driven introduction to Linux pwn exploitation, walking beginners from environment setup and stack overflows through shellcode, ROP, format strings, and advanced bypass techniques. Ideal for CTF newcomers and security students who want a practical, example-based path into binary exploitation. 【Book Arc】 - **Opening (~0%–9%)**: Sets up the learning environment using Docker containers, IDA for remote debugging, and pwntools for scripting. Explains the basics of function prologues/epilogues and demonstrates a first stack overflow that hijacks EIP to call a hidden backdoor function. - **Early (~9%–26%)**: Moves from simple backdoors to writing and using shellcode, including encoding tricks to bypass character filters. Introduces ROP as a way to bypass NX by chaining gadgets, covering calls to system, int 0x80/syscall, and leveraging provided libc for address calculations. - **Early–Middle (~26%–35%)**: Explores advanced ROP techniques, including "universal gadgets" for x64 argument setup and one-gadget RCE for a single-address getshell. Introduces stack pivoting to control the stack pointer when direct control is limited, a key skill for later topics. - **Middle (~35%–48%)**: Covers information disclosure and bypassing ASLR. Teaches how to leak memory addresses using write/puts, handle partial leaks, and use tools or other challenges' libc to resolve symbols. Introduces format string vulnerabilities as a powerful leak and write primitive. - **Middle–Late (~48%–52%)**: Focuses on bypassing PIE (Position Independent Executable) protections. Discusses partial overwrite techniques to brute-force or redirect execution, and using vsyscall pages as a stable address source for NOP-sled-like ret chains when no other leak is available. - **Late (~52%–end)**: Introduces SROP (Sigreturn-Oriented Programming), a technique that uses the sigreturn syscall to set all registers from a forged frame on the stack, simplifying exploitation when traditional ROP gadgets are scarce. The book concludes with practical examples and exercises. 【Key Takeaways】 - **Environment setup is the first hurdle** (Early): The book provides Docker images and IDA/pwntools integration to create a reproducible lab, solving the common problem of scattered tools and hard-to-find practice binaries. - **Understanding the stack frame is fundamental** (Early): By tracing EIP, EBP, and ESP through function calls, you learn that overwriting the saved return address on the stack is the core of stack overflow exploitation. - **Shellcode is not always ready to use** (Early): Real-world constraints like bad characters (e.g., \x00, \x0A) or encoding filters (e.g., base64) require transforming shellcode, either with tools or by hand, to fit the input restrictions. - **ROP is the primary NX bypass** (Early): Since NX prevents executing code on the stack, ROP chains existing instructions (gadgets) ending in `ret` to call functions like system, using the stack to control arguments and control flow. - **Leaking addresses is key to defeating ASLR** (Middle): Techniques like using `puts` or `write` to print GOT entries, and then calculating offsets from a known libc, turn a single leak into full control over function calls. - **Format strings are a dual leak/write primitive** (Middle): By controlling the format string, you can read arbitrary stack data (`%x`, `%s`) and, with Partial RELRO, overwrite GOT entries to redirect function calls to system. - **PIE can be bypassed with partial overwrites** (Middle): Because PIE randomizes only the base address, the lower 12 bits of instruction addresses remain fixed; overwriting just the last bytes of a saved return address can redirect execution with brute force. - **SROP simplifies register control** (Late): By invoking the `sigreturn` syscall, you can place a fake signal frame on the stack to set all registers at once, making exploitation possible even with very few gadgets. 【Reading Tips】 - **Skim the Docker setup if you already have a lab** (Opening): The first chunk is mostly environment configuration; if you have a working Linux VM with Docker, IDA, and pwntools, you can jump straight to the stack overflow section. - **Deep-read the stack overflow and ROP chapters** (Early): These are the foundation of everything else. Trace the examples in a debugger yourself—modify EIP, build the ROP chain, and watch each step in IDA to internalize the mechanics. - **Pay close attention to the exploit scripts** (Throughout): The provided Python scripts with pwntools are the most valuable part. Don't just read them—run them against the provided binaries, change addresses, and see what breaks. - **Treat stack pivot and SROP as advanced topics** (Middle–Late): These are conceptually trickier. If you're a beginner, first master basic ROP and leaks, then return to these chapters for a deeper understanding of stack control. - **Use the exercises to test yourself** (End of chapters): Each section ends with practice problems from real CTFs. Attempt them without looking at the solutions first, then compare your approach with the book's scripts. 【Coverage Limits】 This guide covers the core topics from the excerpts: stack overflows, shellcode, ROP, ASLR/PIE bypasses, format strings, and SROP. It does not cover heap exploitation, integer overflows, or race conditions in detail, as those are mentioned but not elaborated in the sampled chunks.