題目連結

https://learn.cylabacademy.org/library/727

題目解法

使用 nc 連線後開始回答問題。

  1. 第 1 - 3 題： 使用 file 指令查看執行檔詳細資料

    webshell:~$ file vuln
vuln: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=19251d430d5dd4b44a3e8489a8c76f1894676f7d, for GNU/Linux 3.2.0, not stripped

    [*] Question number 0x1:

Is this a '32-bit' or '64-bit' ELF? (e.g. 100-bit)

💡 Hint: Check if the system is x86_64 or x86. No compilation flag specified means default.

>> 64-bit

    [*] Question number 0x2:

What's the linking of the binary? (e.g. static, dynamic)

💡 Hint: The program uses standard library functions like fprintf, fgets, and system.

>> dynamic

    [*] Question number 0x3:

Is the binary 'stripped' or 'not stripped'?

💡 Hint: By default, binaries compiled without the -s flag contain debugging symbols.

>> not stripped

  2. 第 4 - 10 題 查看並分析原始碼

    [*] Question number 0x4:

Looking at the vuln() function, what is the size of the buffer in bytes? (e.g. 0x10)

💡 Hint: Check the declaration in the function and answer in either hex or decimal

>> 0x15

    [*] Question number 0x5:

How many bytes are read into the buffer? (e.g. 0x10)

💡 Hint: Check the fgets

>> 0x90

    [*] Question number 0x6:

Is there a buffer overflow vulnerability? (yes/no)

💡 Hint: Compare buffer size and input size

>> yes

    [*] Question number 0x7:

Name a standard C function that could cause a buffer overflow in the provided C code.

💡 Hint: (e.g. fprintf)

>> fgets

    [*] Question number 0x8:

What is the name of function which is not called any where in the program?

💡 Hint: Analyze the source

>> win()

    [*] Question number 0x9:

What type of attack could exploit this vulnerability? (e.g. format string, buffer overflow, etc.)

💡 Hint: Try interpreting the information gathered so far

>>  buffer overflow

    [*] Question number 0xa:

How many bytes of overflow are possible? (e.g. 0x10)

💡 Hint: Subtract values

>> 0x7b

  3. 第 11 - 12 題 使用 checksec

    webshell:~$ checksec --file=vuln    
[*] Checking for new versions of pwntools
    To disable this functionality, set the contents of /home/PinJimWu-picoctf/.cache/.pwntools-cache-3.10/update to 'never' (old way).
    Or add the following lines to ~/.pwn.conf or ~/.config/pwn.conf (or /etc/pwn.conf system-wide):
        [update]
        interval=never
[*] You have the latest version of Pwntools (4.15.0)
[*] '/home/PinJimWu-picoctf/vuln'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No

    [*] Question number 0xb:

What protection is enabled in this binary?

💡 Hint: Learn to use checksec

>> NX

    [*] Question number 0xc:

What exploitation technique could bypass NX? (e.g. shellcode, ROP, format string)

💡 Hint: Choose from the options

>> ROP

  4. 第 13 題 使用 objdump

    objdump -d vuln

    0000000000401176 <win>:
401176:       f3 0f 1e fa             endbr64 
40117a:       55                      push   %rbp
40117b:       48 89 e5                mov    %rsp,%rbp
40117e:       bf 04 20 40 00          mov    $0x402004,%edi
401183:       e8 d8 fe ff ff          call   401060 <system@plt>
401188:       90                      nop
401189:       5d                      pop    %rbp
40118a:       c3                      ret

    [*] Question number 0xd:

What is the address of 'win()' in hex? (e.g. 0x4011eb)

💡 Hint: Use gdb/objdump to find the address

>> 0x401176

  5. 通過

    =========================================================================================================
QUIZ COMPLETE!
=========================================================================================================

🎉 PERFECT SCORE! 🎉
You got 13/13 questions correct!

Flag: picoCTF{my_-------------------------333}

=========================================================================================================