信息收集
IP AddressOpening Ports192.168.101.159TCP:
$ nmap -p- 192.168.101.159 --min-rate 1000 -sC -sV
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.7p1 Debian 5deb8u4 (protocol 2.0)
| ssh-hostkey:
| 1024 26:81:c1:f3:5e:01:ef:93:4…
Tcache Attack
tcache让堆利用更加简单:
tcache回顾: 在 tcache 中新增了两个结构体,分别是 tcache_entry 和 tcache_perthread_struct: /* We overlay this structure on the user-data portion of a chunk when the chunk is …