Analysis of SCTF PWN test questions

Re1

is a simple string encryption. The program uses multiple threads and then synchronizes. The authentication thread is not started until the encryption thread is encrypted. The problem is that IDA F5 out of the wrong, do not know is not the confusion mechanism.

Just started to see the F5 after the pseudo-code, a face confused force. Then I looked at the assembly to see what was going on.

Decryption directly hit the table can be, can also write inverse algorithm.

Pwn1

Using checksec to look at the protection mechanism, there is canary+nx protection. The vulnerability is a simple stack overflow, but there is no way to hijack a program's flow.

Since flag has been read in memory, it is thought to leak out. Later know that there is an SSP leak play, is deliberately triggered Canary protection,

And this protection mechanism will output argv[] in the program name, because the stack argv[] is the system calls the main function parameters, the stack frame must be at the current high address, so in the stack can be overwritten.

So you can go and cover it. Exp the structure is Exp=junk+flag the pointer.

Pwn2

This problem started with a bit of a crazy, because the format string vulnerability before the contact is the format of strings stored in the stack. The format string for this problem is stored in the BSS section. format string vulnerability is to write to any address, and the format of the string is not in the stack address can not be specified, so it is awkward.

Later thought can write to the stack to write an address, equivalent to construct a springboard. But the premise is that the stack must have a pointer to the stack, debugging up a look, there is really such a pointer.

So it can be constructed.

Because fflush () is called immediately after reading it, I write the got table directly. the system function has been provided, even the parameters have been push . Just cover the address directly.

Two format strings are

"%134525283x%4$n"

"%134520973x%12$n"

Analysis of SCTF PWN test questions