- 简单拓扑结构:国内-(ocserv)-国内中转服务器-(shadowvpn)-国外服务器
- 实验环境:用户终端为iPhone,中转服务器及国外服务器均为Ubuntu 14.04
- 搭建Ocserv
- 打开
ftp://ftp.infradead.org/pub/ocserv/找到最新版本并下载、解压 - 安装依赖:
- 打开
| use std::cell::RefCell; | |
| use std::pin::Pin; | |
| use std::task::Context; | |
| use std::task::Poll; | |
| use std::task::ready; | |
| use futures::Stream; | |
| use futures::TryFuture; | |
| use futures::stream::FuturesUnordered; | |
| use futures::stream::StreamExt; |
At first glance, I thought there are 3 ways to exploit this problem, since it gives me 3 choices: BOF, FSB, UAF, however, the last two are not available.
In echo1, it calls get_input to input 128 input, but the buffer equals to bp-20h, so it can only save data with max length of 32.
Above the return address is the old rbp, so we can write 32 + 8 trash and an address to jump to to overflow it.
After searching with jmpcall si in peda, we found no result.
To help users in China mainland access telegram api stably and conveniently with low cost, this script maybe the one you need.
The server-less means you don't have to run a server to proxy the requests, just pay as you go.
Edit key_prefix, set it to the prefix of you bot address(like /bot563441998:) can avoid abusing.
| #!/usr/bin/python | |
| # -*- coding: utf-8 -*- | |
| # __author__ = 'ihciah' | |
| # cid_hash_file function from https://github.com/binux/lixian.xunlei/blob/master/libs/tools.py | |
| # Gist: https://gist.github.com/ihciah/30eda05ca36ee9f9f190067538b0ae04 | |
| import hashlib | |
| import inotify.adapters | |
| import os | |
| import sys |
(Too lazy to review lessons before exam... Load with IDA and found:
_BOOL4 __cdecl auth(int a1)
{
char v2; // [sp+14h] [bp-14h]@1
char *s2; // [sp+1Ch] [bp-Ch]@1| .editor-group-watermark > .letterpress{ | |
| background-image: url("https://raw.githubusercontent.com/Aikoyori/ProgrammingVTuberLogos/main/VSCode/VSCode.png") !important; | |
| opacity: .75; | |
| } |