from pwn import * context(os = 'linux',arch = 'amd64') # context(log_level='debug') # context(terminal=['tmux','splitw','-h']) # p = gdb.debug('./babyrev_level21.0','b *interpret_sys + 156\nb *interpret_sys + 491\nb *interpret_sys + 659') # p = process(['strace','./babyrev_level22.0']) # ------------------------------------------------ ### sys:16 | exit:1 ### interpret_imm:4 | opcode[1024]:8 ### sleep:128 ### read_code|read_memory:2/32 opcode[1029]:64 none:4 ### add:2 # ------------------------------------------------ ## test exit ### sys:16, exit:1 # table = [1,2,4,8,16,32,64,0x80] # for i in table: # for j in table: # a = [] # a.append(5) # a.append(j) # a.append(i) # a += [0] * 0x300 # a = b''.join([bytes([i]) for i in a]) # p = process('/challenge/babyrev_level22.0') # p.sendafter(b"This time, YOU'RE in control! Please input your yancode: ",a) # h = p.recv(4096) # print(i) # print(j) ## test interpret_imm, opcode | search : "exit code 5" # table = [1,2,4,8,16,32,64,0x80] # for i in table: # for j in table: # a = [] # a.append(5) # a.append(j) # a.append(i) # a.append(0) # a.append(16) # a.append(1) # a += [0] * 0x250 # a = b''.join([bytes([i]) for i in a]) # p = process('/challenge/babyrev_level22.0') # p.sendafter(b"This time, YOU'RE in control! Please input your yancode: ",a) # h = p.recv(4096) # print(i) # print(j) ## test sleep 128 # table = [1,2,4,8,16,32,64,0x80] # for i in table: # a = [] # a.append(0x10) # a.append(8) # a.append(4) # opcode[1024] = 0 # a.append(0x10) # a.append(i) # a.append(1) # sleep # a.append(0) # a.append(16) # a.append(1) # exit # a = b''.join([bytes([i]) for i in a]) # p = process('/challenge/babyrev_level22.0') # p.sendafter(b"This time, YOU'RE in control! Please input your yancode: ",a) # p.interactive() # # print(h) # print(i) # use exit and add can exploit all the regs ## find add first:2 # import time # table = [1,2,4,8,16,32,64,0x80] # for j in table: # print(j) # a = [] # a.append(3) # a.append(8) # a.append(4) # opcode[1024] = 3 # a.append(8) # a.append(8) # a.append(j) # test add # a.append(0) # a.append(16) # a.append(1) # exit # a_byte = b''.join([bytes([i]) for i in a]) # p = process('/challenge/babyrev_level22.0') # p.sendafter(b"This time, YOU'RE in control! Please input your yancode: ",a_byte) # time.sleep(0.1) # p.kill() ## test ldm # 32 # table = [1,2,4,8,16,32,64,0x80] # for j in table: # print(j) # a = [] # a.append(3) # a.append(8) # a.append(4) # opcode[1024] = 10 # a.append(8) # a.append(8) # a.append(j) # test ldm # a.append(0) # a.append(16) # a.append(1) # exit # a_byte = b''.join([bytes([i]) for i in a]) # p = process('/challenge/babyrev_level22.0') # p.sendafter(b"This time, YOU'RE in control! Please input your yancode: ",a_byte) # time.sleep(0.1) # p.kill() ## test stm # 64 # table = [1,2,4,8,16,32,64,0x80] # for j in table: # print(j) # a = [] # a.append(3) # a.append(8) # a.append(4) # opcode[1024] = 3 # a.append(8) # a.append(1) # a.append(j) # test stm opcode[768] = 3; # a.append(5) # a.append(8) # a.append(4) # opcode[1024] = 5 # failed to write # a.append(1) # a.append(8) # a.append(32) # ldm # a.append(0) # a.append(16) # a.append(1) # exit # a_byte = b''.join([bytes([i]) for i in a]) # p = process('/challenge/babyrev_level22.0') # p.sendafter(b"This time, YOU'RE in control! Please input your yancode: ",a_byte) # time.sleep(0.1) # p.kill() # # # write # # write:4 # table = [1,2,4,8,16,32,64,0x80] # for j in table: # if (j == 16 or j == 128 or j == 2 or j == 32): # continue # print(j) # a = [] # a.append(ord('^')) # a.append(8) # a.append(4) # opcode[1024] = ord('^') # a.append(8) # a.append(1) # a.append(64) # stm opcode[768] = ord('^'); # a.append(1) # a.append(1) # a.append(4) # opcode[[1]] ++ # a.append(8) # a.append(1) # a.append(64) # stm opcode[769] = ord('^'); # a.append(2) # a.append(1) # a.append(4) # opcode[[1]] ++ # a.append(8) # a.append(1) # a.append(64) # stm opcode[769] = ord('^'); # for i in table: # all register = 1 # if (i == 8 or i == 4 or i == 64): # continue # a.append(1) # a.append(i) # a.append(4) # a.append(1) # a.append(8) # a.append(4) # opcode[1024] = 1 # fd = io # a.append(1) # a.append(j) # a.append(1) # write # a.append(0) # a.append(16) # a.append(1) # exit # a_byte = b''.join([bytes([i]) for i in a]) # p = process('/challenge/babyrev_level22.0') # p.sendafter(b"This time, YOU'RE in control! Please input your yancode: ",a_byte) # time.sleep(0.3) # print(p.recv()) # p.kill() # ## opcode[1025] # # 1 # table = [1,2,4,8,16,32,64,0x80] # tmp_a = [] # tmp_a.append(ord('^')) # tmp_a.append(8) # tmp_a.append(4) # opcode[1024] = ord('^') # tmp_a.append(8) # tmp_a.append(1) # tmp_a.append(64) # stm opcode[768] = ord('^'); # tmp_a.append(1) # tmp_a.append(1) # tmp_a.append(4) # opcode[[1]] ++ # tmp_a.append(8) # tmp_a.append(1) # tmp_a.append(64) # stm opcode[769] = ord('^'); # tmp_a.append(2) # tmp_a.append(1) # tmp_a.append(4) # opcode[[1]] ++ # tmp_a.append(8) # tmp_a.append(1) # tmp_a.append(64) # stm opcode[769] = ord('^'); # for k in table: # test_register = 1 # a = tmp_a.copy() # # print(a) # if (k == 8 or k == 4 or k == 64): # continue # for i in table: # all register = 0 # if (i == 8 or i == 4 or i == 64): # continue # a.append(0) # a.append(i) # a.append(4) # print(k) # a.append(2) # a.append(k) # a.append(4) # one register = 1 # a.append(1) # a.append(8) # a.append(4) # opcode[1024] = 1 # fd = io # a.append(1) # a.append(4) # a.append(1) # write # a.append(0) # a.append(16) # a.append(1) # exit # a_byte = b''.join([bytes([i]) for i in a]) # p = process('/challenge/babyrev_level22.0') # p.sendafter(b"This time, YOU'RE in control! Please input your yancode: ",a_byte) # time.sleep(0.1) # print(p.recv()) # p.kill() ## opcode[1025] # 32 # table = [1,2,4,8,16,32,64,0x80] # tmp_a = [] # tmp_a.append(ord('^')) # tmp_a.append(8) # tmp_a.append(4) # opcode[1024] = ord('^') # tmp_a.append(8) # tmp_a.append(1) # tmp_a.append(64) # stm opcode[768] = ord('^'); # tmp_a.append(1) # tmp_a.append(1) # tmp_a.append(4) # opcode[[1]] ++ # tmp_a.append(ord('@')) # tmp_a.append(8) # tmp_a.append(4) # opcode[1024] = ord('^') # tmp_a.append(8) # tmp_a.append(1) # tmp_a.append(64) # stm opcode[769] = ord('^'); # tmp_a.append(2) # tmp_a.append(1) # tmp_a.append(4) # opcode[[1]] ++ # tmp_a.append(ord('#')) # tmp_a.append(8) # tmp_a.append(4) # opcode[1024] = ord('^') # tmp_a.append(8) # tmp_a.append(1) # tmp_a.append(64) # stm opcode[769] = ord('^'); # for k in table: # test opcode[1025] # if (k == 1 or k == 8 or k == 64 or k == 4): # continue # a = tmp_a.copy() # # print(a) # for i in table: # all register = 0 # if (i == 8 or i == 4 or i == 64 or i == 1): # continue # a.append(0) # a.append(i) # a.append(4) # print(k) # a.append(1) # a.append(k) # a.append(4) # opcode[1025] # offset: 1 # a.append(1) # a.append(1) # a.append(4) # opcode[1026] # len: 1 # a.append(1) # a.append(8) # a.append(4) # opcode[1024] = 1 # fd = io # a.append(1) # a.append(4) # a.append(1) # write # a.append(0) # a.append(16) # a.append(1) # exit # a_byte = b''.join([bytes([i]) for i in a]) # p = process('/challenge/babyrev_level22.0') # p.sendafter(b"This time, YOU'RE in control! Please input your yancode: ",a_byte) # time.sleep(0.1) # print(p.recv()) # p.kill() # # read # 32 # table = [1,2,4,8,16,32,64,0x80] # for k in [2,32]: # test read # a = [] # print(k) # a.append(1) # a.append(32) # a.append(4) # opcode[1025] # offset: 1 # a.append(1) # a.append(1) # a.append(4) # opcode[1026] # len: 1 # a.append(0) # a.append(8) # a.append(4) # opcode[1024] = 0 # fd = io # a.append(2) # a.append(k) # a.append(1) # read # a.append(1) # a.append(8) # a.append(4) # opcode[1024] = 1 # fd = io # a.append(1) # a.append(4) # a.append(1) # write # a.append(0) # a.append(16) # a.append(1) # exit # a_byte = b''.join([bytes([i]) for i in a]) # p = process('/challenge/babyrev_level22.0') # p.sendafter(b"This time, YOU'RE in control! Please input your yancode: ",a_byte) # time.sleep(0.1) # # print(p.recv()) # p.interactive() # p.kill() # ----------------------------------------------------------------------------------------------------------------------------------- # # open -> # ----------------------------------------------------------------------------------------------------------------------------------- # def register(name): if (name == 'opcode[1024]'): return 8 if (name == 'opcode[1025]'): return 32 if (name == 'opcode[1026]'): return 1 if (name == 'opcode[1027]'): return 0 if (name == 'opcode[1028]'): return 0 if (name == 'opcode[1029]'): return 64 print('err register') def interpret_instruction(name): if (name == 'interpret_imm'): return 4 << 16 if (name == 'interpret_add'): return 2 << 16 if (name == 'interpret_stk'): return 0 if (name == 'interpret_stm'): return 64 << 16 if (name == 'interpret_ldm'): return 32 << 16 if (name == 'interpret_cmp'): return 0 if (name == 'interpret_jmp'): return 0 if (name == 'interpret_sys'): return 1 << 16 print('err instruction') def interpret_imm(regs,value): return interpret_instruction('interpret_imm') + (register(regs) << 8) + (value) def interpret_stm(): # opcode[1025] = offset # opcode[1026] = value return interpret_instruction('interpret_stm') + (register('opcode[1025]') << 8) + (register('opcode[1026]')) def interpret_sys(name): if (name == 'open'): return 8 << 8 if (name == 'read_code'): return 2 << 8 if (name == 'read'): return 32 << 8 if (name == 'write'): return 4 << 8 if (name == 'sleep'): return 128 << 8 if (name == 'exit'): return 16 << 8 print('err sys') def open(): # opcode[opcode[1024] + 768] = addr # opcode[1024] = fd # opcode[1026] = len return interpret_sys('open') + interpret_instruction('interpret_sys') + (register('opcode[1024]') ) def read(): # opcode[1024] = fd # opcode[1025] = ret len return interpret_sys('read') + interpret_instruction('interpret_sys') + (register('opcode[1025]') ) def write(): # opcode[1024] = fd return interpret_sys('write') + interpret_instruction('interpret_sys') + (register('opcode[1025]') ) def exitPro(): return interpret_sys('exit') + interpret_instruction('interpret_sys') opcode_func = ''' interpret_imm('opcode[1025]',0) # offset interpret_imm('opcode[1026]',ord('/')) # value interpret_stm() interpret_imm('opcode[1025]',1) # offset interpret_imm('opcode[1026]',ord('f')) # value interpret_stm() interpret_imm('opcode[1025]',2) # offset interpret_imm('opcode[1026]',ord('l')) # value interpret_stm() interpret_imm('opcode[1025]',3) # offset interpret_imm('opcode[1026]',ord('a')) # value interpret_stm() interpret_imm('opcode[1025]',4) # offset interpret_imm('opcode[1026]',ord('g')) # value interpret_stm() interpret_imm('opcode[1024]',0) # addr = opcode[0 + 768] interpret_imm('opcode[1025]',0) interpret_imm('opcode[1026]',0) open() interpret_imm('opcode[1026]',0x50) # len read() interpret_imm('opcode[1024]',1) interpret_imm('opcode[1025]',0) interpret_imm('opcode[1026]',0x50) # len write() exitPro() ''' opcode = [] opcode_func = opcode_func.split('\n') # print(opcode_func) for i in opcode_func: if (i == ''): continue p48 = eval(i) opcode.append(p48 & 0xff) opcode.append((p48 & 0xff00) >> 8) opcode.append((p48 & 0xff0000) >> 16) opcode+=([0] * (0x300 - len(opcode))) a = opcode # print(a) a = b''.join([bytes([i]) for i in a]) p = process('/challenge/babyrev_level22.0') p.sendafter(b"This time, YOU'RE in control! Please input your yancode: ",a) p.interactive() p.kill()

pwnCollege03

随机化opcode的orw