从零开始做题：逆向 ret2text level2

原创

已于 2024-02-12 09:00:35 修改 · 1.4k 阅读

23 ·

CC 4.0 BY-SA版权

文章标签：

#python #网络安全 #系统安全 #安全架构 #安全

于 2024-01-20 16:10:44 首次发布

这篇博客介绍了如何解决网络安全挑战中的ret2text level2问题。博主首先分析了ida中使用system函数的情况，然后解决gdb调试问题，并通过cyclic工具获取关键值。接着，通过查看字符串内容并利用ROPgadget找到特定地址。最后，提供了解题脚本，包括本地和远程的执行策略。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

1.题目信息

https://adworld.xctf.org.cn/challenges/list

2.解题分析

2.1 ida发现使用了system函数进行输出

2.2 gdb无法进行调试

root@pwn_test1604:/ctf/work/4# gdb ./level2 
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.5) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
pwndbg: loaded 171 commands. Type pwndbg [filter] for a list.
pwndbg: created $rebase, $ida gdb functions (can be used with print/break)
Reading symbols from ./level2...(no debugging symbols found)...done.
pwndbg> r
Starting program: /ctf/work/4/level2 
[New process 336]
process 336 is executing new program: /bin/dash
Input:
[Inferior 2 (process 336) exited normally]
pwndbg>

2.3 解决gdb无法调试

pwndbg> set follow-fork-mode parent

root@pwn_test1604:/ctf/work/4# gdb ./level2 
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.5) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
pwndbg: loaded 171 commands. Type pwndbg [filter] for a list.
pwndbg: created $rebase, $ida gdb functions (can be used with print/break)
Reading symbols from ./level2...(no debugging symbols found)...done.
pwndbg> set