Pwn~

Pwn Collections

Date from 2016-07-11
Difficult rank: $ -> $$... easy -> hard

CISCN 2016

---

pwn-1 $$

From this challenge I find it better to learn about ELF file type & C program's construction
You'd better learn how to use pwntool or zio fluently
To find the strings you can use strings pwn1 | grep 'sh'

the program just accept 1 byte number (as char)

pwn-2

pwn-3

ISCC 2016

---

pwn-1 \$\$

pwn-2 \$\$\$

TJCTF 2016

---

pwn-1 $

pwn-2 $

Other CTFs

---

pwn1

Appendix

---

Pwn Summary

basic ideas

• stack overflow
• heap overflow
• format-string vulnerability

basic methods

• ret2stack (most basics)
• ret2libc
• ret2reg
• ret2plt
• rop

basic tools

• IDA Pro
• GDB (with peda)
• Linux tools: file; strings; objdump; grep; cat; ...
• radare2 (I didn't use it)
• pwntool
• zio
• nc (the basic communication tool)

basic steps

• file pwnfile to determine the filetype
• if you can run, run it; if can't, try to create environment to run it
• IDA-Pro to decompile
• GDB-peda to dynamically debug
• objdump -D pwnfile > text to analyse the whole code
• strings pwnfile | grep 'sh' to search for specific strings
• after analysing, you can use zio or pwntool to exploit

basic problems

• little endian or big endian?
• the data type you input? %d or %c or %u?

Resources

• ELF file Type
• linkers & loaders
• gdb user manual
• pwntools user manual
• zio user manual
• CSAPP
• IDA Pro manual
• 《程序员的自我修养》

Websites