nmap12345678910111213Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-26 00:37 ESTWarning: 10.10.11.134 giving up on port because retransmission cap hit (10).Stats: 0:00:38 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth ScanSYN Stealth Scan Timing: About 48.37% done; ETC: 00:38 (0:00:39 remaining)Stats: 0:00:58 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth ScanSYN Stealth Scan Timing: About 71.68% done; ETC: 00:39 (0:00:23 remaining)Nmap scan report for 10.10.1...
nmap1234567891011121314151617181920212223242526272829└─$ sudo nmap -sS 10.10.11.113 -p- --min-rate=2000Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-26 23:54 ESTStats: 0:00:00 elapsed; 0 hosts completed (0 up), 1 undergoing Ping ScanPing Scan Timing: About 50.00% done; ETC: 23:54 (0:00:00 remaining)Nmap scan report for 10.10.11.113Host is up (0.35s latency).Not shown: 65528 closed tcp ports (reset)PORT STATE SERVICE22/tcp open ssh80/tcp open http4566/tcp open kw...
nmap12345678910111213141516171819202122232425262728└─$ sudo nmap -sS 10.10.10.172 -p- --min-rate=2000 [sudo] password for fonllge: Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-24 21:44 ESTNmap scan report for 10.10.10.172Host is up (0.25s latency).Not shown: 65526 filtered tcp ports (no-response)PORT STATE SERVICE53/tcp open domain88/tcp open kerberos-sec135/tcp open msrpc139/tcp open netbios-ssn389/tcp open ldap445/tcp open microsoft-ds5985/tcp ope...
nmap123456789└─$ sudo nmap -sS 10.10.10.203 -p80,3690 -sV --min-rate=2000Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-23 00:14 ESTNmap scan report for 10.10.10.203Host is up (0.26s latency).PORT STATE SERVICE VERSION80/tcp open http Microsoft IIS httpd 10.03690/tcp open svnserve Subversion5985/tcp
to User开放了svn，尝试未授权，可以看到有5个版本变更
1234567891011└─$ svn info svn://10.10.10.203:3690Path: .URL: svn://10.10.10.203Relative URL: ^/Repository Root: svn://10.10.10.203Repository UU...
入门题，考察 x64的字符格式化漏洞 和 Canray
main里一个switch case
12341.add2.naming3.edit4.show
menu()这也有
再看每个函数
add()
naming()
这里很明显的存在fmt漏洞，变量名上其实也给了提示
edit()
这里是一个写入，写入长度是_b所存储的长度。
gdb断点看下b所在的位置
下一个rip地址0x55555555533c+0x2d2c=0x555555558068
其实这个是在bss部分
从反编译也可以看到
show()
思路从反编译的地址可以看出这题开了pie，还有喜闻乐见的canary。
顺便题目还给了个libc
既然考点是format,那存在fmt漏洞的也就只有naming函数，不过他写死了长度0x30，也就只能做fmt漏洞使用，触发点不在这个func里
另一个可以输入但是没有完全写死长度的是edit()
这里他是从bss部分的_b里取长度值的，泄露pie基地址+4068就可以获取_b的地址，用fmt的$n直接写就好
梳理一下
1.现在naming()存在fmt漏洞
...