pwnable:input
pwnable.kr:input 题目链接
question
Mom? how can I pass my input to a computer program?
ssh input2@pwnable.kr -p2222 (pw:guest)
题目要求我们使用ssh登录到服务器上查看ssh input2@pwnable.kr -p2222
,密码是guest
,有的时候可能有身份的校验,这个时候需要加上参数-o StrictHostKeyChecking=no
进行登录
input.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <arpa/inet.h>
int main(int argc, char* argv[], char* envp[]){
printf("Welcome to pwnable.kr\n");
printf("Let's see if you know how to give input to program\n");
printf("Just give me correct inputs then you will get the flag :)\n");
// argv
if(argc != 100) return 0;
if(strcmp(argv['A'],"\x00")) return 0;
if(strcmp(argv['B'],"\x20\x0a\x0d")) return 0;
printf("Stage 1 clear!\n");
// stdio
char buf[4];
read(0, buf, 4);
if(memcmp(buf, "\x00\x0a\x00\xff", 4)) return 0;
read(2, buf, 4);
if(memcmp(buf, "\x00\x0a\x02\xff", 4)) return 0;
printf("Stage 2 clear!\n");
// env
if(strcmp("\xca\xfe\xba\xbe", getenv("\xde\xad\xbe\xef"))) return 0;
printf("Stage 3 clear!\n");
// file
FILE* fp = fopen("\x0a", "r");
if(!fp) return 0;
if( fread(buf, 4, 1, fp)!=1 ) return 0;
if( memcmp(buf, "\x00\x00\x00\x00", 4) ) return 0;
fclose(fp);
printf("Stage 4 clear!\n");
// network
int sd, cd;
struct sockaddr_in saddr, caddr;
sd = socket(AF_INET, SOCK_STREAM, 0);
if(sd == -1){
printf("socket error, tell admin\n");
return 0;
}
saddr.sin_family = AF_INET;
saddr.sin_addr.s_addr = INADDR_ANY;
saddr.sin_port = htons( atoi(argv['C']) );
if(bind(sd, (struct sockaddr*)&saddr, sizeof(saddr)) < 0){
printf("bind error, use another port\n");
return 1;
}
listen(sd, 1);
int c = sizeof(struct sockaddr_in);
cd = accept(sd, (struct sockaddr *)&caddr, (socklen_t*)&c);
if(cd < 0){
printf("accept error, tell admin\n");
return 0;
}
if( recv(cd, buf, 4, 0) != 4 ) return 0;
if(memcmp(buf, "\xde\xad\xbe\xef", 4)) return 0;
printf("Stage 5 clear!\n");
// here's your flag
system("/bin/cat flag");
return 0;
}
analyse
step 1:
if(argc != 100) return 0;
if(strcmp(argv['A'],"\x00")) return 0;
if(strcmp(argv['B'],"\x20\x0a\x0d")) return 0;
printf("Stage 1 clear!\n");
也就是说在执行时传入的参数时,需要有100个参数(包含./input
),并且其中的argv['A']
要等于\x00
,argv['B']
要等于\x20\x0a\x0d
。
step 2:
// stdio
char buf[4];
read(0, buf, 4);
if(memcmp(buf, "\x00\x0a\x00\xff", 4)) return 0;
read(2, buf, 4);
if(memcmp(buf, "\x00\x0a\x02\xff", 4)) return 0;
printf("Stage 2 clear!\n");
标准输入输出,从标准输入读取4字节\x00\x0a\x00\xff
,从标准错误读取四字节\x00\x0a\x02\xff
step 3:
// env
if(strcmp("\xca\xfe\xba\xbe", getenv("\xde\xad\xbe\xef"))) return 0;
printf("Stage 3 clear!\n");
设置环境变量\xde\xad\xbe\xef
的值为\xca\xfe\xba\xbe
step 4:
FILE* fp = fopen("\x0a", "r");
if(!fp) return 0;
if( fread(buf, 4, 1, fp)!=1 ) return 0;
if( memcmp(buf, "\x00\x00\x00\x00", 4) ) return 0;
fclose(fp);
printf("Stage 4 clear!\n");
文件操作,从\x0a
文件读取四字节,看是否为\x00\x00\x00\x00
step 5:
int sd, cd;
struct sockaddr_in saddr, caddr;
sd = socket(AF_INET, SOCK_STREAM, 0);
if(sd == -1){
printf("socket error, tell admin\n");
return 0;
}
saddr.sin_family = AF_INET;
saddr.sin_addr.s_addr = INADDR_ANY;
saddr.sin_port = htons( atoi(argv['C']) );
if(bind(sd, (struct sockaddr*)&saddr, sizeof(saddr)) < 0){
printf("bind error, use another port\n");
return 1;
}
listen(sd, 1);
int c = sizeof(struct sockaddr_in);
cd = accept(sd, (struct sockaddr *)&caddr, (socklen_t*)&c);
if(cd < 0){
printf("accept error, tell admin\n");
return 0;
}
if( recv(cd, buf, 4, 0) != 4 ) return 0;
if(memcmp(buf, "\xde\xad\xbe\xef", 4)) return 0;
printf("Stage 5 clear!\n");
socket 编程,打开端口argv['C']
,监听直到接收到数值,判断是否为\xde\xad\xbe\xef
get flag
这里给出大佬写的代码,真的漂亮
# input.py
import os
import socket
import time
import subprocess
stdinr, stdinw = os.pipe()
stderrr, stderrw = os.pipe()
args = list("A"*99)
args[ord('A') - 1] = ""
args[ord('B') - 1] = "\x20\x0a\x0d"
args[ord("C") - 1] = "8888"
os.write(stdinw, "\x00\x0a\x00\xff")
os.write(stderrw, "\x00\x0a\x02\xff")
environ = {"\xde\xad\xbe\xef" : "\xca\xfe\xba\xbe"}
f = open("\x0a" , "wb")
f.write("\x00"*4)
f.close()
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
pro = subprocess.Popen(["/home/input2/input"]+args, stdin=stdinr,stderr=stderrr,env=environ)
time.sleep(2)
s.connect(("127.0.0.1", 8888))
s.send("\xde\xad\xbe\xef")
s.close()
但是并没有这么简单,由于文件夹读写权限问题,我们首先需要将脚本scp到/tmp
目录下,然后新建一个自己的目录,接着分别建立input.py
和flag
文件的软链接到自己的目录下,然后执行脚本。
input2@ubuntu:/tmp$ mkdir ycd
input2@ubuntu:/tmp$ cd ycd
input2@ubuntu:/tmp/ycd$ mv ../input.py .
input2@ubuntu:/tmp/ycd$ ls
input.py
input2@ubuntu:/tmp/ycd$ ln -s /home/input2/flag flag
input2@ubuntu:/tmp/ycd$ python input.py
Welcome to pwnable.kr
Let's see if you know how to give input to program
Just give me correct inputs then you will get the flag :)
Stage 1 clear!
Stage 2 clear!
Stage 3 clear!
Stage 4 clear!
Stage 5 clear!
Mommy! I learned how to pass various input in Linux :)
flag
:Mommy! I learned how to pass various input in Linux :)