ctf-pwn

Rust的Pwn工具。

特性

管道

• 将TCP流或进程转换为管道
• 条件读取
• 桥接管道到stdout/stdin
• 有效载荷构建器
• 支持ncurses-like shell的Ansi事件

Shell

• Intel x86
• Amd x64
• Arm
• Risc-V

二进制解析

• Elf
• PE

示例

连接到tcp流

let mut pipe = TcpPipe::connect("127.0.0.1:1337").await?;

启动新进程

let mut pipe = ProcessPipe::from_app("ls").await?;

let mut pipe = ProcessPipe::from_app_args("ls", ["-l", "-a"]).await?;

通用加载

let mut pipe = Pipe::new(stdin(), stdout());

读取示例

let data: Vec<u8> = pipe.recv().await?;
let data: Vec<u8> = pipe.recv_until("Name:", false).await?;
let data: Vec<u8> = pipe.recv_until([0x01, 0x02, 0x03], false).await?;
let data: String = pipe.recv_line_utf8().await?;
let data: AsciiString = pipe.recv_line_ascii().await?;

正则表达式

let data = pipe.recv_until(r"(Ok)|(Error)", true).await?;
let flag = pipe.recv_regex_utf8(r"HTB\{[^\}]+\}").await?;

交互式Shell

pipe.interactive_shell().await?;

Ncurses支持

发送Ansi命令

pipe.write_ansi_command(ansi::Down).await?;
pipe.write_ansi_command(ansi::Right).await?;
pipe.write_ansi_command(ansi::Enter).await?;

基于Ansi事件的交互式Shell

pipe.interactive_ansi().await?;

有效载荷

let payload = Payload::builder()
    .recv_until("> ", false)
    .push("1")
    .push("\n")
    .send()
    .recv_until("Insert card's serial number: ", false)
    .push_line("%4919x%7$hn")
    .send()
    .recv_regex_utf8(r"HTB\{[^\}]+\}")
    .build();

let flag = pipe.payload(payload).await?;
println!("{flag}");

Elf

let elf = Elf::parse("app_path").await?;
let got: &HashMap<String, u64> = elf.got();
let plt: &HashMap<String, u64> = elf.plt();
let symbols: &HashMap<String, Symbol> = elf.symbols();
let dynamic_symbols: &HashMap<String, Symbol> = elf.dynamic_symbols();