pwnable.kr [input]

pwnable.kr [input]

Mom? how can I pass my input to a computer program?
ssh input2@pwnable.kr -p2222 (pw:guest)

input.c 的代码

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <arpa/inet.h>

int main(int argc, char* argv[], char* envp[]){
        printf("Welcome to pwnable.kr\n");
        printf("Let's see if you know how to give input to program\n");
        printf("Just give me correct inputs then you will get the flag :)\n");

        // argv
        if(argc != 100) return 0;
        if(strcmp(argv['A'],"\x00")) return 0;
        if(strcmp(argv['B'],"\x20\x0a\x0d")) return 0;
        printf("Stage 1 clear!\n");

        // stdio
        char buf[4];
        read(0, buf, 4);
        if(memcmp(buf, "\x00\x0a\x00\xff", 4)) return 0;
        read(2, buf, 4);
        if(memcmp(buf, "\x00\x0a\x02\xff", 4)) return 0;
        printf("Stage 2 clear!\n");

        // env
       
	    if(strcmp("\xca\xfe\xba\xbe", getenv("\xde\xad\xbe\xef"))) return 0;
        printf("Stage 3 clear!\n");

        // file
        FILE* fp = fopen("\x0a", "r");
        if(!fp) return 0;
        if( fread(buf, 4, 1, fp)!=1 ) return 0;
        if( memcmp(buf, "\x00\x00\x00\x00", 4) ) return 0;
        fclose(fp);
        printf("Stage 4 clear!\n");

        // network
        int sd, cd;
        struct sockaddr_in saddr, caddr;
        sd = socket(AF_INET, SOCK_STREAM, 0);
        if(sd == -1){
                printf("socket error, tell admin\n");
                return 0;
        }
        saddr.sin_family = AF_INET;
        saddr.sin_addr.s_addr = INADDR_ANY;
        saddr.sin_port = htons( atoi(argv['C']) );
        if(bind(sd, (struct sockaddr*)&saddr, sizeof(saddr)) < 0){
                printf("bind error, use another port\n");
                return 1;
        }
        listen(sd, 1);
        int c = sizeof(struct sockaddr_in);
        cd = accept(sd, (struct sockaddr *)&caddr, (socklen_t*)&c);
        if(cd < 0){
                printf("accept error, tell admin\n");
                return 0;
        }
        if( recv(cd, buf, 4, 0) != 4 ) return 0;
        if(memcmp(buf, "\xde\xad\xbe\xef", 4)) return 0;
        printf("Stage 5 clear!\n");

        // here's your flag
        system("/bin/cat flag");
        return 0;
}

stage1

如代码，要求函数有100个参数，第’A’(65)个为\x00，第’B’(65)个为"\x20\x0a\x0d"，第一个参数为路径
输入即可。

	char *argv[101]={"/home/input/input", [1 ... 99] = "A", NULL};
	argv['A']="\x00";
	argv['B']="\x20\x0a\x0d";

stage2

从标准错误流输入\x00\x0a\x02\xff，从标准输入流输入\x00\x0a\x00\xff。
通过pipe管道输入，先fork一个子进程，父子进程创建管道，子进程输入参数，将父进程的管道输出重定向到标准输出即可。

if ( childpid == 0 ){
    /* Child process */
    close(pipe2stdin[0]); close(pipe2stderr[0]); // Close pipes for reading
    write(pipe2stdin[1],"\x00\x0a\x00\xff",4);
    write(pipe2stderr[1],"\x00\x0a\x02\xff",4);

else {
            /* Parent process */
    close(pipe2stdin[1]); close(pipe2stderr[1]);   // Close pipes for writing
    dup2(pipe2stdin[0],0); dup2(pipe2stderr[0],2); // Map to stdin and stderr
    execve("/home/input2/input",argv,env); 
    exit(1);
}

此处通过父进程调用程序然后关闭，子进程继续进行接下来服务器工作。

stage3

程序检查固定的环境变量
输入时确定环境变量即可。

char *env[2] = {"\xde\xad\xbe\xef=\xca\xfe\xba\xbe", NULL};
    execve("/home/input2/input",argv,env); 

stage4

文件读写操作，从文件读入四个字符，与常量比较。
调用之前先写好文件即可

FILE* fp = fopen("\x0a", "r");
        if(!fp) return 0;
        if( fread(buf, 4, 1, fp)!=1 ) return 0;
        if( memcmp(buf, "\x00\x00\x00\x00", 4) ) return 0;
        fclose(fp);

stage5

网络编程，注意程序中使用了输出参数argv['C']作为服务器的端口号。
创建客户端服务器传输数据即可

	 sleep(5);
        int sockfd;
        struct sockaddr_in server;
        sockfd = socket(AF_INET,SOCK_STREAM,0);
        if ( sockfd < 0){
            perror("Cannot create the socket");
            exit(1);
        }
        server.sin_family = AF_INET;
        server.sin_addr.s_addr = inet_addr("127.0.0.1");
        server.sin_port = htons(55555);
        if ( connect(sockfd, (struct sockaddr*) &server, sizeof(server)) < 0 ){
            perror("Problem connecting");
            exit(1);
        }
        printf("Connected\n");
        char buf[4] = "\xde\xad\xbe\xef";
        write(sockfd,buf,4);
        close(sockfd);

总代码

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <stdlib.h>
#include <sys/wait.h>
#include <arpa/inet.h>
#include <sys/socket.h>
#include <netinet/in.h>
int main()
{
	char *argv[101]={"/home/input/input", [1 ... 99] = "A", NULL};
	argv['A']="\x00";
	argv['B']="\x20\x0a\x0d";
	argv['C']="55555";
	int pipe2stdin[2]={-1,-1};
	int pipe2stderr[2]={-1,-1};
	pid_t childpid;
	pipe(pipe2stdin);
	pipe(pipe2stderr);
	FILE* fp = fopen("\x0a","w");
	fwrite("\x00\x00\x00\x00",4,1,fp);
	fclose(fp);
	
if ( childpid == 0 ){
    /* Child process */
    close(pipe2stdin[0]); close(pipe2stderr[0]); // Close pipes for reading
    write(pipe2stdin[1],"\x00\x0a\x00\xff",4);
    write(pipe2stderr[1],"\x00\x0a\x02\xff",4);

else {
            /* Parent process */
    close(pipe2stdin[1]); close(pipe2stderr[1]);   // Close pipes for writing
    dup2(pipe2stdin[0],0); dup2(pipe2stderr[0],2); // Map to stdin and stderr
    char *env[2] = {"\xde\xad\xbe\xef=\xca\xfe\xba\xbe", NULL};
    execve("/home/input2/input",argv,env); 
    exit(1);
}
	 sleep(5);
        int sockfd;
        struct sockaddr_in server;
        sockfd = socket(AF_INET,SOCK_STREAM,0);
        if ( sockfd < 0){
            perror("Cannot create the socket");
            exit(1);
        }
        server.sin_family = AF_INET;
        server.sin_addr.s_addr = inet_addr("127.0.0.1");
        server.sin_port = htons(55555);
        if ( connect(sockfd, (struct sockaddr*) &server, sizeof(server)) < 0 ){
            perror("Problem connecting");
            exit(1);
        }
        printf("Connected\n");
        char buf[4] = "\xde\xad\xbe\xef";
        write(sockfd,buf,4);
        close(sockfd);
	return 0;
} 

Tips

• 文件上传至/tmp文件夹,在目录下新建一个文件夹，把编译好的程序放进去，运行。
• 建立软连接ln -s /home/input2/flag /tmp/input/flag
• 原因：tmp文件夹无读权限，目录下新建文件夹才有读权限。

总结

• 不会，源码抄的，只能看懂
• 管道编程看这里链接
• 网络编程看这里link
• 数组输入小技巧char *argv[101]={"/home/input/input", [1 ... 99] = "A", NULL};学习了