CTF - CTF思路相关项目

项目说明

ctf

If you would like a pwn/re ctf course, check out:

This is where I store CTF writeups I've made.

Pwn

#### ROP Chain
+ x64: TokyoWesterns18/pwn/load scan in contents of file to buffer o, used /proc/self/fd/0 as stdin, use ROP Chain to open up STDOUT and the flag file, read contents of the flag file, and print it with puts
+ x64: bkp16/pwn/simple-calc Basic ROP Chain, syscall to execve("/bin/sh", NULL, NULL), Weird method of writing data to memeory
+ x32: defconquals16/pwn/feedme ROP Chain syscall to execve("/bin/sh", NULL, NULL), brute force stack canary, stripped elf
+ x64: insomnihack17/pwn/baby server with child processes, pwntools ROP chain generate, fmt string leak stack canary & libc address, standard buffer o
+ x64: defconquals2019/speedrun/s1 Buffer o, ROP Chain to exec, statically linked no PIE or Stack Canary
#### Stack Pivot
+ x64: defconquals2019/speedrun/s4 Single byte o of saved base pointer,stack pivot into rop chain x64 statically compiled binary
+ x64: Insomnihack18-teaser/onewrite use _fini_arr table entries and qword write to loop function on exit, stack pivot, pie and stack infoleaks, single qword write
#### Format String
+ x64: hackIM19/pwn/babypwn Format String, Signed/Unsigned bug, fmt string libc infoleak with %s, LD_PRELOAD, id remote libc file, get scanf not to write over a value
+ x86: backdoorctf/bbpwn Format String, got o, system imported function
+ x86: tokyowesterns16/pwn/greeting Format String, .fini_array write to cause loop back, o got address with plt system
+ x86: tu19// use fmt string bug to get libc infoleak, then got o
#### Heap
+ x64: defconquals2018/pwn/itsame C++ function pointer o, use after free, libc/heap infoleak, heap o
+ x64: defconquals2018/pwn/racewars Custom Malloc, onegadget, libc + heap infoleak
+ x64: csaw18/pwn/alien Null byte o and arbitrary write to do heap consolidation to leak heap address, then get PIE and libc infoleaks, then write over GOT entry of strtoul with system
+ x86: bkp16/pwn/cookbook Use After Free, House of Power exploit, expand heap into libc, write over free hook with system address, call free with pointer to "/bin/sh", libc and heap address leaks, re structs
+ x64: 0ctf/pwn/babyheap Heap O, Chunk Consolidation and fastbin duplication into libc, oneshot
+ x64: RCTF/pwn/babyheap One Null Byte O, chunk consolidation, double free, libc file
+ x64: asis18quals/pwn/cat Use After Free, creating format string bug, format string. got/plt addresses
+ x64: Hitcon16/pwn/SleepyHolder Double Free, fastin duplication consolidation, unsafe unlink, o got address, infoleak
+ x86: hack.lu14/pwn/oreo House of Spirit, heap o for libc infoleak, allocate heap chunk with malloc to bss
+ x64: csaw17/pwn/auir Fast bin attack, heap consolidation, libc leak, allocate fake chunk in bss
+ x64: hacklu17/pwn/exam Heap Consolidation, Single Byte O
+ x64: hackIM19/pwn/shop Use after free, format string write to GOT table, libc infoleak
+ x64: swampctf19/pwn/heap_golf basic heap grooming
+ x64: 0ctf/pwn/babyaegis address sanitization (ASAN), Use After Free (UAF), libc & pie infoleaks
#### Heap tcache poisoning
+ x64: plaid19/pwn/cpp C++ code, use after free and double free, libc infoleak, use tcache poisioning to write system to free hook
+ x64: defconquals19/pwn/babyheap: Single byte o, fill up tcache to get libc infoleak, use o to o size value with larger, free it then allocate again to get o, o tcache pointer to get write onegadget to malloc hook
#### Return 2 System
+ x86: TUCTF/guestbook Infoleak, PIE, strcpy
+ x64: AsisFinals2017/Mary_Morton fmt_string Stack Canary Infoleak, "cat flag" string at static address
+ x86: hxp2018/poor_canary Arm buffer o, call system, arm debugging and disassembly
##### Return 2 libc
+ x64: AsisFinals2017/Mrs._Hudson Call Scanf, scan in shellcode into memory, call shellcode
+ x64: defconquals2019/speedrun/s2/ buffer o no PIE, call plt puts for libc infoleak, return before vuln to reuse it, oneshot gadget
+ x64: fbct19/o buffer o, puts libc infoleak into rop gadget, float input
+ x64: ctf/hs19/storytime write infoleak, return to onegadget
#### Custom malloc / memory allocation
+ x86: Csaw17/pwn/minesweeper custom malloc, abuse o to get write what where with delinking function, also get stack and heap infoleak
+ x64: Csaw17/pwn/zone allocates memory with mmap, handles it with custom functions to handle allocating / freeing memory from memory obtained through mmap
#### Faking Heap Ptrs
+ x64: bkp16/pwn/complex-calc pass false pointer to free and not crash, pointer is to bss
#### Bad Checks
+ x86: csaw18/pwn/doubletrouble bad check allows you to o index size, sorting algorithm mo into return address, get to deal with floats (we all float down here)
#### Stack Pivot / single gadget stack challenges
+ x64: csaw18/pwn/plc custom firmware, online interface, buffer o into libc infoleak and single gadget, pi into ROP Chain
+ x64: csaw18/pwn/turtles objective C, pop registers to move rop chain into stack, ROP calls to printf for infoleak, and libc system
#### Stack
+ x64: googlequals17/pwn/wiki , PIE, buffer o, no output
+ x64: Csaw18/pwn/get_it simple buffer o with gets to call a different function
+ x64: Csaw18/pwn/get_it simple buffer o hidword on the stack
+ x86: TokyoWesterns/just_do_it simple buffer o of puts pointer
+ x86: Csaw13/pwn/exploit1 o on stack
+ x86: tu19/thefirst simple buffer o with gets to call a different function
#### Crafting Shellcode
+ x86: defconQuals18/pwn/nop write shellcode with limited instructions, popa instruction call
+ x64: hackIM19/pwn/easyshell craft alphanumeric shellocde self-modifying shellcode that also gets around seccomp rules, pie breakpoints
+ x64: hackIM19/pwn/peasy-shell craft self-modifying shellcode to bypass character and seccomp restrictions, sequel to easyshell
+ x64: Csaw18/pwn/shellpointcode write custom shellcode to fit in disconnected blocks, buffer o to get return address, get free stack leak
+ x64: ctf/defconquals2019/speedrun/s3/ Modify shellcode to meet length / xor requirments
+ x64: ctf/defconquals2019/speedrun/s6/ Write shellcode to scan in additional shellcode and meet length, no null byte, all registers cleared (except rip), extra opcdes inserted restrictions, use secondary shellcode to get shell
#### Sigreturn
+ x64: backdoorctf/pwn/funsignals Use Sigreturn syscall to run a write syscall to print flag
#### Index Check
+ swampctf19/pwn/dream_heaps: Abuse index checks and pointer array o for got table o
#### File Struct
+ swampctf19/pwn/bad_file: Oerwrite file struct to get code execution, Use After Free
#### Timing Attack
+ defconquals2019/speedrun/s11/: Craft shellcode to leak flag one bit at a time using timing attack, autoomate the process
#### misc
+ x86: tu19/runme run the binary
#### Windows
+ csaw14/greenhornd: Buffer o into rop chain into shellcode

Reverse Engineering (RE)

#### Dynamic Analysis
+ x64: csaw17/re/bananascript reverse custom interpreter/programming language, gdb init, brute force solution with itertools
+ x64: bkp16/re/jit Use gdb to reverse obfuscated program, read breakpoints on input
+ x86: other/re/mo Side Channel Attack on Mo program, obfuscation where elf only uses mo
+ 16 bit: csaw17/re/realism Reverse 16 bit i8086 Master Boot Record. Get to deal with registers like xmm0 and instructions like psadbw (compute sum of absolute differences) Use z3 to solve.
+ x64: swampctf19/re/future Mo, use Demo, sol side channel attack with Perf
+ x64: plaid19/re/plaid_party_planning_III jump past code giving issues to get flag (unintended solution)
#### Static Analysis
+ x64: bkp16/re/unholy ruby, python, x64 shared library, xtea encryption/decryption/identification z3
+ x86: defcon-quals-2018/elf-crumble x86, opcodes, patching, common x86 knowledge
+ x64: RCTF/re/sign strings
+ x86: csaw2018/re basic x86 reading, well commented walkthrough
+ x86: csaw2018/re basic x86 patching, run binary with qemu
#### Static and Dynamic Analysis
+ x86: RCTF/re/babyre figure out what's important/what's not, one to one function for each character
+ x86: Asis18Quals/re/babyc Mo, Demo, program obfuscation
+ x64: Csaw17/re Simple lookup table
+ x86: TokyoWesterns/re/re Z3 problem, takes in input, runs it through an algorithm, compares against predefined output
+ x64: insomnihack18-teaser/re: written in rust, figuring out which checks we need to pass, standard take in input check one character at a time
+ x64: bkp16/re/frogger gmp library, factoring math
+ x86: csaw13/re/crackme typical crackme, not solved with angr / z3
#### Angr
+ x86: plaid19/re/icancount Use Angr to sol, e input one byte at a time, 19 bytes between 0x30 - 0x39, input
+ x64: securityfest/fairlight Use Angr to sol crackme
#### Cryptoish
+ x64: insomnihack18-teaser/junkyard AES Crypto encryption, reverse binary to find Ciphertext and IV, and find key format, brute force key
#### Code Review
+ asis18quals/re/warmup: Cleaning up code, editing source code
#### Super Simple RE
+ x86: csaw13/re Run challenge with debugger, or sol encryption
+ x86: csaw13/re Simple xoring challenge
#### .NET
+ x86: Decompile with jetbrains, simple xoring challenge to find input
+ x86: Decompile with jetbrains, slightly more complex xoring chall to find correct input

Non-Challenges Pwn

#### Heap
+ shellphish_how2heap/first_fit: Block reuse after free
+ shellphish_how2heap/fastbin_dup: Double Free to return same pointer twice
+ shellphish_how2heap/fastbin_dup_into_stack: Double Free to return same ptr twice, use that to return return stack ptr from malloc
+ shellphish_how2heap/fastbin_dup_consolidate: Double free to same ptr twice, allocate large chunk in between to move ptr out of fastbin list to pass malloc() check
+ shellphish_how2heap/unsafe_unlink: Alter metadata of a chunk, into chunk before that one create a fake chunk, get an arbitrary write over an address that you know
+ shellphish_how2heap/house-of-spirit: O a pointer, and write to integers to region you conttrol to create fake chunk, free o pointer, ha return pointer to the region you wrote integers to
+ shellphish_how2heap/single_null_byte_o: Allocate a heap chunk that o with another heap chunk, by causing a heap consolidation using a single null byte o.
+ shellphish_how2heap/house-of-spirit: Get malloc to return a pointer to the stack, by creating fake chunks on the stack, and o freed heap small bin bk pointer to second fake stackc chunk.
+ shellphish_how2heap/o: Get malloc to return a freed chunk (unsorted bin) that o with another chunk, by o the size value of the freed chunk
+ shellphish_how2heap/o: Get malloc to return a freed chunk that encompases another chunk, by o the size value of an allocated chunk
+ shellphish_how2heap/house-of-power: Get malloc to allocate space outside of the heap by editing the Wilderness Value, after that edit memory outside of the heap.
+ shellphish_how2heap/unsorted_bin_into_stack: Only works if compiled with glibc option tcache-option disabled. Get malloc to return pointer to stack by o data for unsorted bin.
+ shellphish_how2heap/unsorted_bin_attack: Only works if compiled with glibc option tcache-option disabled. Get write to stack value by allocating unsorted bin with o bk pointer.
+ shellphis_how2heap/house-of-einherjar: Only works if compiled with glibc option tcache-option disabled. Get malloc to return pointer to fake chunk (must know address of fake chunk) anywhere in memory, with a null byte o.

项目信息

开发语言：Python

Star 数：112

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕CTF思路相关项目展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。