0x01 题目

0x02 解题思路

这个题目比较简单，我就直接贴出来下载和检查过程

root@mypwn:/ctf/work/pwnable.kr# ssh mistake@pwnable.kr -p2222
mistake@pwnable.kr's password: ____  __    __  ____    ____  ____   _        ___      __  _  ____
|    \|  |__|  ||    \  /    ||    \ | |      /  _]    |  |/ ]|    \
|  o  )  |  |  ||  _  ||  o  ||  o  )| |     /  [_     |  ' / |  D  )
|   _/|  |  |  ||  |  ||     ||     || |___ |    _]    |    \ |    /
|  |  |  `  '  ||  |  ||  _  ||  O  ||     ||   [_  __ |     \|    \
|  |   \      / |  |  ||  |  ||     ||     ||     ||  ||  .  ||  .  \
|__|    \_/\_/  |__|__||__|__||_____||_____||_____||__||__|\_||__|\_|- Site admin : daehee87@gatech.edu
- IRC : irc.netgarage.org:6667 / #pwnable.kr
- Simply type "irssi" command to join IRC now
- files under /tmp can be erased anytime. make your directory under /tmp
- to use peda, issue `source /usr/share/peda/peda.py` in gdb terminal
Last login: Wed Jan  1 09:55:46 2020 from 182.96.176.177
mistake@prowl:~$ ls -la
total 44
drwxr-x---   5 root        mistake 4096 Oct 23  2016 .
drwxr-xr-x 116 root        root    4096 Nov 12 21:34 ..
d---------   2 root        root    4096 Jul 29  2014 .bash_history
-r--------   1 mistake_pwn root      51 Jul 29  2014 flag
dr-xr-xr-x   2 root        root    4096 Aug 20  2014 .irssi
-r-sr-x---   1 mistake_pwn mistake 8934 Aug  1  2014 mistake
-rw-r--r--   1 root        root     792 Aug  1  2014 mistake.c
-r--------   1 mistake_pwn root      10 Jul 29  2014 password
drwxr-xr-x   2 root        root    4096 Oct 23  2016 .pwntools-cache
mistake@prowl:~$ exit
logout
Connection to pwnable.kr closed.
root@mypwn:/ctf/work/pwnable.kr# scp -P 2222 mistake@pwnable.kr:/home/mistake/mistake ./
mistake@pwnable.kr's password:
mistake                                                                                100% 8934    32.5KB/s   00:00
root@mypwn:/ctf/work/pwnable.kr# scp -P 2222 mistake@pwnable.kr:/home/mistake/mistake.c ./
mistake@pwnable.kr's password:
mistake.c                                                                              100%  792     2.5KB/s   00:00
root@mypwn:/ctf/work/pwnable.kr# checksec mistake
[*] '/ctf/work/pwnable.kr/mistake'Arch:     amd64-64-littleRELRO:    Partial RELROStack:    Canary foundNX:       NX enabledPIE:      No PIE (0x400000)
root@mypwn:/ctf/work/pwnable.kr# ./mistake
can't open password 1
root@mypwn:/ctf/work/pwnable.kr# echo "test" > password
root@mypwn:/ctf/work/pwnable.kr# ./mistake
can't open password 1
root@mypwn:/ctf/work/pwnable.kr# mkdir -p /home/mistake
root@mypwn:/ctf/work/pwnable.kr# mv password /home/mistake/
root@mypwn:/ctf/work/pwnable.kr# ./mistake
do not bruteforce...
aaaaaaaaaaaaaaa
input password : Wrong Password

看下提供的c代码：

#include <stdio.h>
#include <fcntl.h>#define PW_LEN 10
#define XORKEY 1void xor(char* s, int len){int i;for(i=0; i<len; i++){s[i] ^= XORKEY;}
}int main(int argc, char* argv[]){int fd;if(fd=open("/home/mistake/password",O_RDONLY,0400) < 0){printf("can't open password %d\n", fd);return 0;}printf("do not bruteforce...\n");sleep(time(0)%20);char pw_buf[PW_LEN+1];int len;if(!(len=read(fd,pw_buf,PW_LEN) > 0)){printf("read error\n");close(fd);return 0;       }char pw_buf2[PW_LEN+1];printf("input password : ");scanf("%10s", pw_buf2);// xor your inputxor(pw_buf2, 10);if(!strncmp(pw_buf, pw_buf2, PW_LEN)){printf("Password OK\n");system("/bin/cat flag\n");}else{printf("Wrong Password\n");}close(fd);return 0;
}

我下载了执行程序，用ida反编译了一下

int __cdecl main(int argc, const char **argv, const char **envp)
{int v3; // eaxint result; // eaxint v5; // eaxchar buf; // [rsp+20h] [rbp-30h]char s2; // [rsp+30h] [rbp-20h]unsigned __int64 v8; // [rsp+48h] [rbp-8h]v8 = __readfsqword(0x28u);v3 = open("/home/mistake/password", 0, 256LL, argv);if ( v3 >= 0 ){puts("do not bruteforce...");v5 = time(0LL);sleep(v5 % 20);if ( (signed int)read(0, &buf, 0xAuLL) > 0 ){printf("input password : ", &buf);__isoc99_scanf("%10s", &s2);xor(&s2, 10LL);if ( !strncmp(&buf, &s2, 0xAuLL) ){puts("Password OK");system("/bin/cat flag\n");}else{puts("Wrong Password");}close(0);result = 0;}else{puts("read error");close(0);result = 0;}}else{printf("can't open password %d\n", (unsigned int)v3 >> 31);result = 0;}return result;
}

好像不太一样，拿gdb跟踪了一下程序，比较的位置就是我们输入的两个字符串，其中一个做了xor操作

0x03 题解

题解非常简单：

root@mypwn:/ctf/work/pwnable.kr# ssh mistake@pwnable.kr -p2222
mistake@pwnable.kr's password: ____  __    __  ____    ____  ____   _        ___      __  _  ____
|    \|  |__|  ||    \  /    ||    \ | |      /  _]    |  |/ ]|    \
|  o  )  |  |  ||  _  ||  o  ||  o  )| |     /  [_     |  ' / |  D  )
|   _/|  |  |  ||  |  ||     ||     || |___ |    _]    |    \ |    /
|  |  |  `  '  ||  |  ||  _  ||  O  ||     ||   [_  __ |     \|    \
|  |   \      / |  |  ||  |  ||     ||     ||     ||  ||  .  ||  .  \
|__|    \_/\_/  |__|__||__|__||_____||_____||_____||__||__|\_||__|\_|- Site admin : daehee87@gatech.edu
- IRC : irc.netgarage.org:6667 / #pwnable.kr
- Simply type "irssi" command to join IRC now
- files under /tmp can be erased anytime. make your directory under /tmp
- to use peda, issue `source /usr/share/peda/peda.py` in gdb terminal
Last login: Wed Jan  1 11:43:35 2020 from 120.84.12.64
mistake@prowl:~$ ./mistake
do not bruteforce...
CCCCCCCCCC
input password : BBBBBBBBBB
Password OK
Mommy, the operator priority always confuses me :(
mistake@prowl:~$ Connection to pwnable.kr closed by remote host.
Connection to pwnable.kr closed.
root@mypwn:/ctf/work/pwnable.kr#

PWN mistake [pwnable.kr]CTF writeup题解系列8相关推荐

PWN random [pwnable.kr]CTF writeup题解系列6
目录 0x01 题目 0x02 解题思路 0x03 题解 0x01 题目 0x02 解题思路题目比较简单,直接贴出过程 root@mypwn:/ctf/work/pwnable.kr# ssh ra ...
PWN input [pwnable.kr]CTF writeup题解系列7
目录 0x01题目 0x02解题思路 0x03题解 0x01题目 0x02解题思路先连接到服务器看下情况 root@mypwn:/ctf/work/pwnable.kr# ssh input2@pw ...
PWN lotto [pwnable.kr]CTF writeup题解系列10
目录 0x01题目 0x02解题思路 0x03题解 0x01题目 0x02解题思路下载文件,检查一下情况 root@mypwn:/ctf/work/pwnable.kr# ssh lotto@pwn ...
PWN uaf [pwnable.kr]CTF writeup题解系列13
目录 0x01题目 0x02解题思路 0x03题解 0x01题目 0x02解题思路题目都已经介绍了这是一道Use After Free的题目,那我们就不用多想了,先看看题目主要内容 root@myp ...
PWN passcode [pwnable.kr]CTF writeup题解系列5
直接看题目: 连接服务器看看情况: root@mypwn:/ctf/work/pwnable.kr# ssh passcode@pwnable.kr -p2222 passcode@pwnable.k ...
PWN horcruxes [pwnable.kr]CTF writeup题解系列15
题目内容: 先连接上去看看题目文件,看起来已经说了是一道rop的题目 root@mypwn:/ctf/work/pwnable.kr# ssh horcruxes@pwnable.kr -p2222 ...
pwnable.kr 简单题目详细笔记汇总
文章目录 fd collision bof flag passcode random input leg mistake shellshock coin1 lotto cmd1 cmd2 uaf bl ...
【pwnable.kr】Toddler‘s Bottle-[bof]
目录导航打开题目审题 nc 命令介绍获取服务器文件源代码分析 ELF分析构造payload 解题打开题目审题 Nana told me that buffer overflow is one ...
pwnable.kr lotto题解
ssh lotto@pwnable.kr -p2222 (pw:guest) 题目源码: #include <stdio.h> #include <stdlib.h> #inc ...
[CTF]pwnable.kr fd Wp
pwnable.kr fd Wp 给大家推荐一个优秀的pwn练习平台点我!!!点我!!! 今天分享第一题 fd 首先解决一下我的虚拟机没有网络的问题,没有做任何修改的情况下,我的kali没有网络了, ...

PWN mistake [pwnable.kr]CTF writeup题解系列8

0x01 题目

0x02 解题思路

0x03 题解

PWN mistake [pwnable.kr]CTF writeup题解系列8相关推荐

最新文章

热门文章