-
-
[原创]CTF2019_Q1_拯救单身狗
-
发表于:
2019-3-10 15:12
2896
-
一血，happy
比较显然的两个点：
两个edit函数只判断指针是否存在，没有判断输入的int范围：
（为了符合理解，我把one和two rename交换了一下）
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 | unsigned __int64 edit_singledog()
{
int v1;
unsigned __int64 v2;
v2 = __readfsqword(0x28u);
puts("which?");
v1 = read_int();
if ( one[v1] )
{
puts("Oh,singledog,changing your name can bring you good luck.");
read(0, (void *)one[v1], 0x20uLL);
printf("new name: %s", one[v1]);
}
else
{
puts("nothing here");
}
return __readfsqword(0x28u) ^ v2;
}
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 | unsigned __int64 edit_singledog()
{
int v1;
unsigned __int64 v2;
v2 = __readfsqword(0x28u);
puts("which?");
v1 = read_int();
if ( one[v1] )
{
puts("Oh,singledog,changing your name can bring you good luck.");
read(0, (void *)one[v1], 0x20uLL);
printf("new name: %s", one[v1]);
}
else
{
puts("nothing here");
}
return __readfsqword(0x28u) ^ v2;
}
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | unsigned __int64 edit_luckydog()
{
int v1;
unsigned __int64 v2;
v2 = __readfsqword(0x28u);
puts("which?");
v1 = read_int();
if ( two[v1] )
{
puts("Oh,luckydog,What is your new name?");
read(0, (void *)(two[v1] + 8LL), 0x18uLL);
puts("your partner's new name");
read(0, *(void **)two[v1], 0x20uLL);
}
else
{
puts("nothing here");
}
return __readfsqword(0x28u) ^ v2;
}
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | unsigned __int64 edit_luckydog()
{
int v1;
unsigned __int64 v2;
v2 = __readfsqword(0x28u);
puts("which?");
v1 = read_int();
if ( two[v1] )
{
puts("Oh,luckydog,What is your new name?");
read(0, (void *)(two[v1] + 8LL), 0x18uLL);
puts("your partner's new name");
read(0, *(void **)two[v1], 0x20uLL);
}
else
{
puts("nothing here");
}
return __readfsqword(0x28u) ^ v2;
}
|
edit_singledog()不存在\x00截断，导致很容易leak
1 2 3 | puts("Oh,singledog,changing your name can bring you good luck.");
read(0, (void *)one[v1], 0x20uLL);
printf("new name: %s", one[v1]);
|
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
最后于 2019-3-16 20:25
被梅零落编辑
，原因：
